Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bdc2da02 authored by Jim Miller's avatar Jim Miller Committed by Android Git Automerger
Browse files

am b0400d12: am 771ad8b7: Merge "Limit grantTrust() duration to... 

am b0400d12: am 771ad8b7: Merge "Limit grantTrust() duration to DevicePolicy-imposed limit." into lmp-dev

* commit 'b0400d12f8f2dd4ad8088fef9c13dcf37bcb9837':
  Limit grantTrust() duration to DevicePolicy-imposed limit.
parents b35b6271 c047a951

core/java/android/app/admin/DevicePolicyManager.java

+1 −1
Original line number Diff line number Diff line
@@ -1374,7 +1374,7 @@ public class DevicePolicyManager { 
     * @param admin The name of the admin component to check, or null to aggregate

     * all admins.

     * @return time in milliseconds for the given admin or the minimum value (strictest) of

     * all admins if admin is null.

     * all admins if admin is null. Returns 0 if there are no restrictions.

     */

    public long getMaximumTimeToLock(ComponentName admin) {

        return getMaximumTimeToLock(admin, UserHandle.myUserId());

services/core/java/com/android/server/trust/TrustAgentWrapper.java

+34 −5
Original line number Diff line number Diff line
@@ -51,7 +51,7 @@ import java.util.List; 
public class TrustAgentWrapper {

    private static final String EXTRA_COMPONENT_NAME = "componentName";

    private static final String TRUST_EXPIRED_ACTION = "android.server.trust.TRUST_EXPIRED_ACTION";

    private static final String PERMISSION = "android.permission.PROVIDE_TRUST_AGENT";

    private static final String PERMISSION = android.Manifest.permission.PROVIDE_TRUST_AGENT;

    private static final boolean DEBUG = false;

    private static final String TAG = "TrustAgentWrapper";
@@ -81,6 +81,7 @@ public class TrustAgentWrapper { 
    private ITrustAgentService mTrustAgentService;

    private boolean mBound;

    private long mScheduledRestartUptimeMillis;

    private long mMaximumTimeToLock; // from DevicePolicyManager



    // Trust state

    private boolean mTrusted;
@@ -90,6 +91,7 @@ public class TrustAgentWrapper { 
    private IBinder mSetTrustAgentFeaturesToken;

    private AlarmManager mAlarmManager;

    private final Intent mAlarmIntent;

    private PendingIntent mAlarmPendingIntent;



    private final BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() {

        @Override
@@ -118,10 +120,25 @@ public class TrustAgentWrapper { 
                    boolean initiatedByUser = msg.arg1 != 0;

                    long durationMs = msg.getData().getLong(DATA_DURATION);

                    if (durationMs > 0) {

                        long expiration = SystemClock.elapsedRealtime() + durationMs;

                        PendingIntent op = PendingIntent.getBroadcast(mContext, 0, mAlarmIntent,

                        final long duration;

                        if (mMaximumTimeToLock != 0) {

                            // Enforce DevicePolicyManager timeout.  This is here as a safeguard to

                            // ensure trust agents are evaluating trust state at least as often as

                            // the policy dictates. Admins that want more guarantees should be using

                            // DevicePolicyManager#KEYGUARD_DISABLE_TRUST_AGENTS.

                            duration = Math.min(durationMs, mMaximumTimeToLock);

                            if (DEBUG) {

                                Log.v(TAG, "DPM lock timeout in effect. Timeout adjusted from "

                                    + durationMs + " to " + duration);

                            }

                        } else {

                            duration = durationMs;

                        }

                        long expiration = SystemClock.elapsedRealtime() + duration;

                        mAlarmPendingIntent = PendingIntent.getBroadcast(mContext, 0, mAlarmIntent,

                                PendingIntent.FLAG_CANCEL_CURRENT);

                        mAlarmManager.set(AlarmManager.ELAPSED_REALTIME_WAKEUP, expiration, op);

                        mAlarmManager.set(AlarmManager.ELAPSED_REALTIME_WAKEUP, expiration,

                                mAlarmPendingIntent);

                    }

                    mTrustManagerService.mArchive.logGrantTrust(mUserId, mName,

                            (mMessage != null ? mMessage.toString() : null),
@@ -244,12 +261,13 @@ public class TrustAgentWrapper { 


        mAlarmIntent = new Intent(TRUST_EXPIRED_ACTION).putExtra(EXTRA_COMPONENT_NAME, mName);

        mAlarmIntent.setData(Uri.parse(mAlarmIntent.toUri(Intent.URI_INTENT_SCHEME)));

        mAlarmIntent.setPackage(context.getPackageName());



        final IntentFilter alarmFilter = new IntentFilter(TRUST_EXPIRED_ACTION);

        alarmFilter.addDataScheme(mAlarmIntent.getScheme());

        final String pathUri = mAlarmIntent.toUri(Intent.URI_INTENT_SCHEME);

        alarmFilter.addDataPath(pathUri, PatternMatcher.PATTERN_LITERAL);

        mContext.registerReceiver(mBroadcastReceiver, alarmFilter);

        mContext.registerReceiver(mBroadcastReceiver, alarmFilter, PERMISSION, null);



        // Schedules a restart for when connecting times out. If the connection succeeds,

        // the restart is canceled in mCallback's onConnected.
@@ -319,6 +337,17 @@ public class TrustAgentWrapper { 
                                mSetTrustAgentFeaturesToken);

                    }

                }

                final long maxTimeToLock = dpm.getMaximumTimeToLock(null);

                if (maxTimeToLock != mMaximumTimeToLock) {

                    // If the timeout changes, cancel the alarm and send a timeout event to have

                    // the agent re-evaluate trust.

                    mMaximumTimeToLock = maxTimeToLock;

                    if (mAlarmPendingIntent != null) {

                        mAlarmManager.cancel(mAlarmPendingIntent);

                        mAlarmPendingIntent = null;

                        mHandler.sendEmptyMessage(MSG_TRUST_TIMEOUT);

                    }

                }

            }

        } catch (RemoteException e) {

            onError(e);