Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f3dc1219 authored by Rubin Xu's avatar Rubin Xu
Browse files

New permissions for various device policy APIs 

These are needed to allow the DMRH to restrict certain
policies on dedicated devices:

MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL
MANAGE_DEVICE_POLICY_CAMERA_TOGGLE
MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE

Bug: 281964214
Test: TBD
Change-Id: I9b49372856dde2b0c762e206c816d610c0b194d4
parent 9027446c

core/api/current.txt

+3 −0
Original line number Diff line number Diff line
@@ -144,10 +144,12 @@ package android { 
    field public static final String MANAGE_DEVICE_POLICY_AUDIO_OUTPUT = "android.permission.MANAGE_DEVICE_POLICY_AUDIO_OUTPUT";

    field public static final String MANAGE_DEVICE_POLICY_AUTOFILL = "android.permission.MANAGE_DEVICE_POLICY_AUTOFILL";

    field public static final String MANAGE_DEVICE_POLICY_BACKUP_SERVICE = "android.permission.MANAGE_DEVICE_POLICY_BACKUP_SERVICE";

    field @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled") public static final String MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL = "android.permission.MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL";

    field public static final String MANAGE_DEVICE_POLICY_BLUETOOTH = "android.permission.MANAGE_DEVICE_POLICY_BLUETOOTH";

    field public static final String MANAGE_DEVICE_POLICY_BUGREPORT = "android.permission.MANAGE_DEVICE_POLICY_BUGREPORT";

    field public static final String MANAGE_DEVICE_POLICY_CALLS = "android.permission.MANAGE_DEVICE_POLICY_CALLS";

    field public static final String MANAGE_DEVICE_POLICY_CAMERA = "android.permission.MANAGE_DEVICE_POLICY_CAMERA";

    field @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled") public static final String MANAGE_DEVICE_POLICY_CAMERA_TOGGLE = "android.permission.MANAGE_DEVICE_POLICY_CAMERA_TOGGLE";

    field public static final String MANAGE_DEVICE_POLICY_CERTIFICATES = "android.permission.MANAGE_DEVICE_POLICY_CERTIFICATES";

    field public static final String MANAGE_DEVICE_POLICY_COMMON_CRITERIA_MODE = "android.permission.MANAGE_DEVICE_POLICY_COMMON_CRITERIA_MODE";

    field @FlaggedApi("android.view.contentprotection.flags.manage_device_policy_enabled") public static final String MANAGE_DEVICE_POLICY_CONTENT_PROTECTION = "android.permission.MANAGE_DEVICE_POLICY_CONTENT_PROTECTION";
@@ -169,6 +171,7 @@ package android { 
    field @FlaggedApi("android.app.admin.flags.esim_management_enabled") public static final String MANAGE_DEVICE_POLICY_MANAGED_SUBSCRIPTIONS = "android.permission.MANAGE_DEVICE_POLICY_MANAGED_SUBSCRIPTIONS";

    field public static final String MANAGE_DEVICE_POLICY_METERED_DATA = "android.permission.MANAGE_DEVICE_POLICY_METERED_DATA";

    field public static final String MANAGE_DEVICE_POLICY_MICROPHONE = "android.permission.MANAGE_DEVICE_POLICY_MICROPHONE";

    field @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled") public static final String MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE = "android.permission.MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE";

    field public static final String MANAGE_DEVICE_POLICY_MOBILE_NETWORK = "android.permission.MANAGE_DEVICE_POLICY_MOBILE_NETWORK";

    field public static final String MANAGE_DEVICE_POLICY_MODIFY_USERS = "android.permission.MANAGE_DEVICE_POLICY_MODIFY_USERS";

    field public static final String MANAGE_DEVICE_POLICY_MTE = "android.permission.MANAGE_DEVICE_POLICY_MTE";

core/res/AndroidManifest.xml

+18 −0
Original line number Diff line number Diff line
@@ -3819,6 +3819,24 @@ 
    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_MANAGED_SUBSCRIPTIONS"

        android:protectionLevel="internal|role" />



    <!-- Allows an application to manage policy related to block package uninstallation.

        @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled")

    -->

    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL"

        android:protectionLevel="internal|role" />



    <!-- Allows an application to manage policy related to camera toggle.

        @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled")

    -->

    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_CAMERA_TOGGLE"

        android:protectionLevel="internal|role" />



    <!-- Allows an application to manage policy related to microphone toggle.

        @FlaggedApi("android.app.admin.flags.dedicated_device_control_api_enabled")

    -->

    <permission android:name="android.permission.MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE"

        android:protectionLevel="internal|role" />



    <!-- Allows an application to set device policies outside the current user

        that are critical for securing data within the current user.

        <p>Holding this permission allows the use of other held MANAGE_DEVICE_POLICY_*

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+3 −8
Original line number Diff line number Diff line
@@ -29,9 +29,11 @@ import static android.Manifest.permission.MANAGE_DEVICE_POLICY_APPS_CONTROL; 
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_APP_RESTRICTIONS;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_AUDIO_OUTPUT;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_AUTOFILL;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_BLUETOOTH;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_CALLS;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_CAMERA;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_CAMERA_TOGGLE;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_CERTIFICATES;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_COMMON_CRITERIA_MODE;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_CONTENT_PROTECTION;
@@ -50,6 +52,7 @@ import static android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK_CREDENTIALS; 
import static android.Manifest.permission.MANAGE_DEVICE_POLICY_LOCK_TASK;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MANAGED_SUBSCRIPTIONS;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MICROPHONE;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MOBILE_NETWORK;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MODIFY_USERS;

import static android.Manifest.permission.MANAGE_DEVICE_POLICY_MTE;
@@ -22293,14 +22296,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { 
        });

    }













    // Permission that will need to be created in V.













    private static final String MANAGE_DEVICE_POLICY_BLOCK_UNINSTALL =













            "manage_device_policy_block_uninstall";













    private static final String MANAGE_DEVICE_POLICY_CAMERA_TOGGLE =













            "manage_device_policy_camera_toggle";













    private static final String MANAGE_DEVICE_POLICY_MICROPHONE_TOGGLE =













            "manage_device_policy_microphone_toggle";



























    // DPC types















    private static final int NOT_A_DPC = -1;















    private static final int DEFAULT_DEVICE_OWNER = 0;