Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reaaply policies on reboot

Browse Source 
And add missing policy engine gating checks

Bug: 273494642
Test: btest android.devicepolicy.cts.LockTaskTest
Change-Id: Ie1e610f01a22321f8b82a8731f4346d7b3c4029d
This commit is contained in:
Kholoud Mohamed
2023-04-16 19:43:37 +00:00
parent ac607f95bc
commit 13a402b079
2 changed files with 44 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java
View File

@@ -1017,8 +1017,12 @@ final class DevicePolicyEngine {
int userId = user.id;
// Apply local policies present on parent to newly created child profile.
UserInfo parentInfo = mUserManager.getProfileParent(userId);
if (parentInfo == null || parentInfo.getUserHandle().getIdentifier() == userId) return;
if (parentInfo == null || parentInfo.getUserHandle().getIdentifier() == userId) {
return;
}
if (!mLocalPolicies.contains(parentInfo.getUserHandle().getIdentifier())) {
return;
}
for (Map.Entry<PolicyKey, PolicyState<?>> entry : mLocalPolicies.get(
parentInfo.getUserHandle().getIdentifier()).entrySet()) {
enforcePolicyOnUser(userId, entry.getValue());
@@ -1242,6 +1246,31 @@ final class DevicePolicyEngine {
synchronized (mLock) {
clear();
new DevicePoliciesReaderWriter().readFromFileLocked();
reapplyAllPolicies();
}
}
private <V> void reapplyAllPolicies() {
for (PolicyKey policy : mGlobalPolicies.keySet()) {
PolicyState<?> policyState = mGlobalPolicies.get(policy);
// Policy definition and value will always be of the same type
PolicyDefinition<V> policyDefinition =
(PolicyDefinition<V>) policyState.getPolicyDefinition();
PolicyValue<V> policyValue = (PolicyValue<V>) policyState.getCurrentResolvedPolicy();
enforcePolicy(policyDefinition, policyValue, UserHandle.USER_ALL);
}
for (int i = 0; i < mLocalPolicies.size(); i++) {
int userId = mLocalPolicies.keyAt(i);
for (PolicyKey policy : mLocalPolicies.get(userId).keySet()) {
PolicyState<?> policyState = mLocalPolicies.get(userId).get(policy);
// Policy definition and value will always be of the same type
PolicyDefinition<V> policyDefinition =
(PolicyDefinition<V>) policyState.getPolicyDefinition();
PolicyValue<V> policyValue =
(PolicyValue<V>) policyState.getCurrentResolvedPolicy();
enforcePolicy(policyDefinition, policyValue, userId);
}
}
}

21
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -2131,7 +2131,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
mUserManagerInternal.addUserLifecycleListener(new UserLifecycleListener());
mDeviceManagementResourcesProvider.load();
if (isPermissionCheckFlagEnabled()) {
if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) {
mDevicePolicyEngine.load();
}
@@ -3280,8 +3280,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
policy.validatePasswordOwner();
updateMaximumTimeToLockLocked(userHandle);
updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userHandle);
updateLockTaskFeaturesLocked(policy.mLockTaskFeatures, userHandle);
if (!isPolicyEngineForFinanceFlagEnabled()) {
updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userHandle);
updateLockTaskFeaturesLocked(policy.mLockTaskFeatures, userHandle);
}
if (policy.mStatusBarDisabled) {
setStatusBarDisabledInternal(policy.mStatusBarDisabled, userHandle);
}
@@ -3593,7 +3595,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
}
startOwnerService(userId, "start-user");
if (isPermissionCheckFlagEnabled()) {
if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) {
mDevicePolicyEngine.handleStartUser(userId);
}
}
@@ -3620,7 +3622,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
void handleUnlockUser(int userId) {
startOwnerService(userId, "unlock-user");
if (isPermissionCheckFlagEnabled()) {
if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) {
mDevicePolicyEngine.handleUnlockUser(userId);
}
}
@@ -3632,7 +3634,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
void handleStopUser(int userId) {
updateNetworkPreferenceForUser(userId, List.of(PreferentialNetworkServiceConfig.DEFAULT));
mDeviceAdminServiceController.stopServicesForUser(userId, /* actionForLog= */ "stop-user");
if (isPermissionCheckFlagEnabled()) {
if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) {
mDevicePolicyEngine.handleStopUser(userId);
}
}
@@ -10205,7 +10207,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
policy.mUserProvisioningState = DevicePolicyManager.STATE_USER_UNMANAGED;
policy.mAffiliationIds.clear();
policy.mLockTaskPackages.clear();
updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userId);
if (!isPolicyEngineForFinanceFlagEnabled()) {
updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userId);
}
policy.mLockTaskFeatures = DevicePolicyManager.LOCK_TASK_FEATURE_NONE;
saveSettingsLocked(userId);
@@ -10995,7 +10999,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
return false;
}
if (!isPermissionCheckFlagEnabled()) {
if (!isPermissionCheckFlagEnabled() && !isPolicyEngineForFinanceFlagEnabled()) {
// TODO: Figure out if something like this needs to be restored for policy engine
final ComponentName profileOwner = getProfileOwnerAsUser(userId);
if (profileOwner == null) {
@@ -14878,6 +14882,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
}
final List<String> lockTaskPackages = getUserData(userId).mLockTaskPackages;
// TODO(b/278438525): handle in the policy engine
if (!lockTaskPackages.isEmpty()) {
Slogf.d(LOG_TAG,
"User id " + userId + " not affiliated. Clearing lock task packages");