Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f37b4591 authored by Rubin Xu's avatar Rubin Xu
Browse files

Add devic policy API to query theft detection state 

Device Management Role Holder will be able to query
the state to feed into its zero trust signals.

Bug: 325073410
Test: TheftDetectionTest
Change-Id: I503fd097af514e645e2d312f1ee22af817f5a0dc
parent 9027446c

core/api/system-current.txt

+2 −0
Original line number Diff line number Diff line
@@ -194,6 +194,7 @@ package android { 
    field public static final String MANAGE_DEFAULT_APPLICATIONS = "android.permission.MANAGE_DEFAULT_APPLICATIONS";

    field public static final String MANAGE_DEVICE_ADMINS = "android.permission.MANAGE_DEVICE_ADMINS";

    field public static final String MANAGE_DEVICE_POLICY_APP_EXEMPTIONS = "android.permission.MANAGE_DEVICE_POLICY_APP_EXEMPTIONS";

    field @FlaggedApi("android.app.admin.flags.device_theft_api_enabled") public static final String MANAGE_DEVICE_POLICY_THEFT_DETECTION = "android.permission.MANAGE_DEVICE_POLICY_THEFT_DETECTION";

    field @FlaggedApi("android.permission.flags.enhanced_confirmation_mode_apis_enabled") public static final String MANAGE_ENHANCED_CONFIRMATION_STATES = "android.permission.MANAGE_ENHANCED_CONFIRMATION_STATES";

    field public static final String MANAGE_ETHERNET_NETWORKS = "android.permission.MANAGE_ETHERNET_NETWORKS";

    field public static final String MANAGE_FACTORY_RESET_PROTECTION = "android.permission.MANAGE_FACTORY_RESET_PROTECTION";
@@ -1315,6 +1316,7 @@ package android.app.admin { 
    method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public boolean isDpcDownloaded();

    method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS}) public boolean isManagedKiosk();

    method public boolean isSecondaryLockscreenEnabled(@NonNull android.os.UserHandle);

    method @FlaggedApi("android.app.admin.flags.device_theft_api_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_DEVICE_POLICY_THEFT_DETECTION) public boolean isTheftDetectionTriggered();

    method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS}) public boolean isUnattendedManagedKiosk();

    method @RequiresPermission("android.permission.NOTIFY_PENDING_SYSTEM_UPDATE") public void notifyPendingSystemUpdate(long);

    method @RequiresPermission("android.permission.NOTIFY_PENDING_SYSTEM_UPDATE") public void notifyPendingSystemUpdate(long, boolean);

core/java/android/app/admin/DevicePolicyManager.java

+21 −0
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SECURITY_LOGGING; 
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_STATUS_BAR;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SYSTEM_UPDATES;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_THEFT_DETECTION;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_USB_DATA_SIGNALLING;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_WIFI;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_WIPE_DATA;
@@ -17010,6 +17011,26 @@ public class DevicePolicyManager { 
        }

    }













    /**













     *













     * Returns whether the device considers itself to be potentially stolen.













     * @hide













     */













    @SystemApi













    @RequiresPermission(value = MANAGE_DEVICE_POLICY_THEFT_DETECTION)













    @FlaggedApi(Flags.FLAG_DEVICE_THEFT_API_ENABLED)













    public boolean isTheftDetectionTriggered() {













        throwIfParentInstance("isTheftDetectionTriggered");













        if (mService == null) {













            return false;













        }













        try {













            return mService.isTheftDetectionTriggered(mContext.getPackageName());













        } catch (RemoteException e) {













            throw e.rethrowFromSystemServer();













        }













    }



























    /**















     * Returns a {@link DevicePolicyResourcesManager} containing the required APIs to set, reset,















     * and get device policy related resources.

























core/java/android/app/admin/IDevicePolicyManager.aidl



+2
−0




























Original line number
Diff line number
Diff line








@@ -576,6 +576,8 @@ interface IDevicePolicyManager {













    void setWifiSsidPolicy(String callerPackageName, in WifiSsidPolicy policy);















    WifiSsidPolicy getWifiSsidPolicy(String callerPackageName);





























    boolean isTheftDetectionTriggered(String callerPackageName);





























    List<UserHandle> listForegroundAffiliatedUsers();















    void setDrawables(in List<DevicePolicyDrawableResource> drawables);















    void resetDrawables(in List<String> drawableIds);

































core/res/AndroidManifest.xml



+8
−0




























Original line number
Diff line number
Diff line








@@ -3782,6 +3782,14 @@













    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_LOCK"















                android:protectionLevel="internal|role" />





























    <!-- Allows an application to manage policy related to theft detection.













        @FlaggedApi("android.app.admin.flags.device_theft_api_enabled")













        @hide













        @SystemApi













    -->













    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_THEFT_DETECTION"













                android:protectionLevel="internal|role" />





























    <!-- Allows an application to manage policy related to system apps.















        <p>{@link Manifest.permission#MANAGE_DEVICE_POLICY_ACROSS_USERS_FULL} is required to call















        APIs protected by this permission on users different to the calling user.

































services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java



+15
−0




























Original line number
Diff line number
Diff line








@@ -73,6 +73,7 @@ import static android.Manifest.permission.MANAGE_DEVICE_POLICY_STATUS_BAR;













import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE;















import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SYSTEM_DIALOGS;















import static android.Manifest.permission.MANAGE_DEVICE_POLICY_SYSTEM_UPDATES;













import static android.Manifest.permission.MANAGE_DEVICE_POLICY_THEFT_DETECTION;















import static android.Manifest.permission.MANAGE_DEVICE_POLICY_THREAD_NETWORK;















import static android.Manifest.permission.MANAGE_DEVICE_POLICY_TIME;















import static android.Manifest.permission.MANAGE_DEVICE_POLICY_USB_DATA_SIGNALLING;










@@ -21852,6 +21853,20 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {













        }















    }



























    @Override













    public boolean isTheftDetectionTriggered(String callerPackageName) {













        final CallerIdentity caller = getCallerIdentity(callerPackageName);













        if (!android.app.admin.flags.Flags.deviceTheftImplEnabled()) {













            return false;













        }













        enforcePermission(MANAGE_DEVICE_POLICY_THEFT_DETECTION, caller.getPackageName(),













                caller.getUserId());

























        //STOPSHIP: replace 1<<9 with













        // LockPatternUtils.SOME_AUTH_REQUIRED_AFTER_ADAPTIVE_AUTH_REQUEST once ag/26042068 lands













        return 0 != (mLockPatternUtils.getStrongAuthForUser(caller.getUserId()) & (1 << 9));













    }



























    @Override















    public void setWifiSsidPolicy(String callerPackageName, WifiSsidPolicy policy) {















        CallerIdentity caller;