Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit caa07ff5 authored by Adam Bookatz's avatar Adam Bookatz
Browse files

Factory Reset Protection via MainUser 

Instead of using the SYSTEM user for Factory Reset Protection, use the
Main User (if it exists) instead.

This means that, even in Headless System User Mode (HSUM), the MainUser can set the FRP.

Part of this involves migrating SECURE_FRP_MODE from a per-user setting
to a Global setting. It should always have been a Global setting, since
it is a device-wide property. It should only ever have been set or read
on user 0 prior to this cl anyway.

Bug: 249097735
Bug: 256624031
Bug: 159629501
Test: manual: In HSUM, user 10 has account+PIN; factory reset; SUW demands credentials post reboot
Test: atest FrameworksServicesTests:SyntheticPasswordTests FrameworksServicesTests:WeaverBasedSyntheticPasswordTests
Test: atest CtsPackageInstallTestCases:android.packageinstaller.install.cts
Change-Id: Ic84cb9c3b74317813d7ae11cdae2eba729d8fa88
parent 8f733bee

core/api/current.txt

+1 −1
Original line number Diff line number Diff line
@@ -36214,7 +36214,7 @@ package android.provider { 
    field public static final String PARENTAL_CONTROL_LAST_UPDATE = "parental_control_last_update";

    field public static final String PARENTAL_CONTROL_REDIRECT_URL = "parental_control_redirect_url";

    field public static final String RTT_CALLING_MODE = "rtt_calling_mode";

    field public static final String SECURE_FRP_MODE = "secure_frp_mode";

    field @Deprecated public static final String SECURE_FRP_MODE = "secure_frp_mode";

    field public static final String SELECTED_INPUT_METHOD_SUBTYPE = "selected_input_method_subtype";

    field public static final String SETTINGS_CLASSNAME = "settings_classname";

    field public static final String SKIP_FIRST_USE_HINTS = "skip_first_use_hints";

core/api/system-current.txt

+1 −0
Original line number Diff line number Diff line
@@ -10991,6 +10991,7 @@ package android.provider { 
    field public static final String INSTALL_CARRIER_APP_NOTIFICATION_SLEEP_MILLIS = "install_carrier_app_notification_sleep_millis";

    field public static final String OTA_DISABLE_AUTOMATIC_UPDATE = "ota_disable_automatic_update";

    field public static final String REQUIRE_PASSWORD_TO_DECRYPT = "require_password_to_decrypt";

    field public static final String SECURE_FRP_MODE = "secure_frp_mode";

    field public static final String TETHER_OFFLOAD_DISABLED = "tether_offload_disabled";

    field public static final String TETHER_SUPPORTED = "tether_supported";

    field public static final String THEATER_MODE_ON = "theater_mode_on";

core/java/android/provider/Settings.java

+19 −1
Original line number Diff line number Diff line
@@ -6227,6 +6227,7 @@ public final class Settings { 
            MOVED_TO_GLOBAL.add(Settings.Global.DEFAULT_DNS_SERVER);

            MOVED_TO_GLOBAL.add(Settings.Global.PREFERRED_NETWORK_MODE);

            MOVED_TO_GLOBAL.add(Settings.Global.WEBVIEW_DATA_REDUCTION_PROXY_KEY);

            MOVED_TO_GLOBAL.add(Settings.Global.SECURE_FRP_MODE);

        }















        /** @hide */










@@ -7089,7 +7090,10 @@ public final class Settings {













         * device is removed from this mode.















         * <p>















         * Type: int (0 for false, 1 for true)













         *













         * @deprecated Use Global.SECURE_FRP_MODE















         */













        @Deprecated















        @Readable















        public static final String SECURE_FRP_MODE = "secure_frp_mode";
























@@ -11914,7 +11918,21 @@ public final class Settings {













        public static final String DEVICE_PROVISIONED = "device_provisioned";





























        /**













         * Whether bypassing the device policy management role holder qualifcation is allowed,













         * Indicates whether the device is under restricted secure FRP mode.













         * Secure FRP mode is enabled when the device is under FRP. On solving of FRP challenge,













         * device is removed from this mode.













         * <p>













         * Type: int (0 for false, 1 for true)













         *













         * @hide













         */













        @SystemApi













        @Readable













        @SuppressLint("NoSettingsProvider")













        public static final String SECURE_FRP_MODE = "secure_frp_mode";

























        /**













         * Whether bypassing the device policy management role holder qualification is allowed,















         * (0 = false, 1 = true).















         *















         * @hide

































core/java/com/android/internal/widget/LockPatternUtils.java



+1
−1




























Original line number
Diff line number
Diff line








@@ -1742,7 +1742,7 @@ public class LockPatternUtils {













    }































    public static boolean userOwnsFrpCredential(Context context, UserInfo info) {













        return info != null && info.isPrimary() && info.isAdmin() && frpCredentialEnabled(context);













        return info != null && info.isMain() && info.isAdmin() && frpCredentialEnabled(context);















    }































    public static boolean frpCredentialEnabled(Context context) {

































packages/SettingsProvider/test/src/android/provider/SettingsBackupTest.java



+1
−0




























Original line number
Diff line number
Diff line








@@ -427,6 +427,7 @@ public class SettingsBackupTest {













                    Settings.Global.RESTRICTED_NETWORKING_MODE,















                    Settings.Global.REQUIRE_PASSWORD_TO_DECRYPT,















                    Settings.Global.SAFE_BOOT_DISALLOWED,













                    Settings.Global.SECURE_FRP_MODE,















                    Settings.Global.SELINUX_STATUS,















                    Settings.Global.SELINUX_UPDATE_CONTENT_URL,















                    Settings.Global.SELINUX_UPDATE_METADATA_URL,