Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Migrate setPermittedInputMethods to policy engine" into udc-dev

Browse Source
This commit is contained in:
Kholoud Mohamed
2023-04-26 08:38:56 +00:00
committed by Android (Google) Code Review
parent 4dd6a96568 60281025fe
commit 1e9f13da34
6 changed files with 115 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/api/test-current.txt
View File

@@ -536,6 +536,12 @@ package android.app.admin {
field @NonNull public static final android.app.admin.DeviceAdminAuthority DEVICE_ADMIN_AUTHORITY;
}
public final class DevicePolicyIdentifiers {
field public static final String PERMITTED_INPUT_METHODS_POLICY = "permittedInputMethods";
field public static final String PERSONAL_APPS_SUSPENDED_POLICY = "personalAppsSuspended";
field public static final String SCREEN_CAPTURE_DISABLED_POLICY = "screenCaptureDisabled";
}
public class DevicePolicyManager {
method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.INTERACT_ACROSS_USERS}) public void acknowledgeNewUserDisclaimer();
method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void calculateHasIncompatibleAccounts();

4
core/java/android/app/admin/DevicePolicyIdentifiers.java
View File

@@ -17,6 +17,7 @@
package android.app.admin;
import android.annotation.NonNull;
import android.annotation.TestApi;
import android.os.UserManager;
import java.util.Objects;
@@ -118,6 +119,7 @@ public final class DevicePolicyIdentifiers {
*
* @hide
*/
@TestApi
public static final String PERMITTED_INPUT_METHODS_POLICY = "permittedInputMethods";
/**
@@ -125,6 +127,7 @@ public final class DevicePolicyIdentifiers {
*
* @hide
*/
@TestApi
public static final String PERSONAL_APPS_SUSPENDED_POLICY = "personalAppsSuspended";
/**
@@ -132,6 +135,7 @@ public final class DevicePolicyIdentifiers {
*
* @hide
*/
@TestApi
public static final String SCREEN_CAPTURE_DISABLED_POLICY = "screenCaptureDisabled";
/**

3
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java
View File

@@ -130,12 +130,11 @@ final class DevicePolicyEngine {
<V> void setLocalPolicy(
@NonNull PolicyDefinition<V> policyDefinition,
@NonNull EnforcingAdmin enforcingAdmin,
@NonNull PolicyValue<V> value,
@Nullable PolicyValue<V> value,
int userId,
boolean skipEnforcePolicy) {
Objects.requireNonNull(policyDefinition);
Objects.requireNonNull(enforcingAdmin);
Objects.requireNonNull(value);
synchronized (mLock) {
PolicyState<V> localPolicyState = getLocalPolicyStateLocked(policyDefinition, userId);

136
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -12214,17 +12214,22 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
}
synchronized (getLockObject()) {
ActiveAdmin admin;
if (isPermissionCheckFlagEnabled()) {
admin = enforcePermissionAndGetEnforcingAdmin(
who, MANAGE_DEVICE_POLICY_INPUT_METHODS,
caller.getPackageName(), userId).getActiveAdmin();
if (isPolicyEngineForFinanceFlagEnabled()) {
EnforcingAdmin admin = getEnforcingAdminForCaller(who, callerPackageName);
mDevicePolicyEngine.setLocalPolicy(
PolicyDefinition.PERMITTED_INPUT_METHODS,
admin,
packageList == null
? null
: new StringSetPolicyValue(new HashSet<>(packageList)),
userId);
} else {
admin = getParentOfAdminIfRequired(
getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()), calledOnParentInstance);
ActiveAdmin admin = getParentOfAdminIfRequired(
getProfileOwnerOrDeviceOwnerLocked(caller.getUserId()),
calledOnParentInstance);
admin.permittedInputMethods = packageList;
saveSettingsLocked(caller.getUserId());
}
admin.permittedInputMethods = packageList;
saveSettingsLocked(caller.getUserId());
}
DevicePolicyEventLogger
@@ -12272,19 +12277,18 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
}
synchronized (getLockObject()) {
ActiveAdmin admin;
if (isPermissionCheckFlagEnabled()) {
if (isPolicyEngineForFinanceFlagEnabled()) {
int affectedUser = calledOnParentInstance ? getProfileParentId(
caller.getUserId()) : caller.getUserId();
admin = enforcePermissionAndGetEnforcingAdmin(
who, MANAGE_DEVICE_POLICY_INPUT_METHODS, caller.getPackageName(),
affectedUser).getActiveAdmin();
Set<String> policy = mDevicePolicyEngine.getResolvedPolicy(
PolicyDefinition.PERMITTED_INPUT_METHODS, affectedUser);
return policy == null ? null : new ArrayList<>(policy);
} else {
admin = getParentOfAdminIfRequired(
ActiveAdmin admin = getParentOfAdminIfRequired(
getProfileOwnerOrDeviceOwnerLocked(
caller.getUserId()), calledOnParentInstance);
return admin.permittedInputMethods;
}
return admin.permittedInputMethods;
}
}
@@ -12302,37 +12306,45 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
}
private @Nullable List<String> getPermittedInputMethodsUnchecked(@UserIdInt int userId) {
synchronized (getLockObject()) {
List<String> result = null;
// Only device or profile owners can have permitted lists set.
List<ActiveAdmin> admins = getActiveAdminsForAffectedUserInclPermissionBasedAdminLocked(userId);
for (ActiveAdmin admin: admins) {
List<String> fromAdmin = admin.permittedInputMethods;
if (fromAdmin != null) {
if (result == null) {
result = new ArrayList<String>(fromAdmin);
} else {
result.retainAll(fromAdmin);
}
}
}
// If we have a permitted list add all system input methods.
if (result != null) {
List<InputMethodInfo> imes = InputMethodManagerInternal
.get().getInputMethodListAsUser(userId);
if (imes != null) {
for (InputMethodInfo ime : imes) {
ServiceInfo serviceInfo = ime.getServiceInfo();
ApplicationInfo applicationInfo = serviceInfo.applicationInfo;
if ((applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
result.add(serviceInfo.packageName);
List<String> result = null;
if (isPolicyEngineForFinanceFlagEnabled()) {
Set<String> policy = mDevicePolicyEngine.getResolvedPolicy(
PolicyDefinition.PERMITTED_INPUT_METHODS, userId);
result = policy == null ? null : new ArrayList<>(policy);
} else {
synchronized (getLockObject()) {
// Only device or profile owners can have permitted lists set.
List<ActiveAdmin> admins =
getActiveAdminsForAffectedUserInclPermissionBasedAdminLocked(
userId);
for (ActiveAdmin admin : admins) {
List<String> fromAdmin = admin.permittedInputMethods;
if (fromAdmin != null) {
if (result == null) {
result = new ArrayList<String>(fromAdmin);
} else {
result.retainAll(fromAdmin);
}
}
}
}
return result;
}
// If we have a permitted list add all system input methods.
if (result != null) {
List<InputMethodInfo> imes = InputMethodManagerInternal
.get().getInputMethodListAsUser(userId);
if (imes != null) {
for (InputMethodInfo ime : imes) {
ServiceInfo serviceInfo = ime.getServiceInfo();
ApplicationInfo applicationInfo = serviceInfo.applicationInfo;
if ((applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
result.add(serviceInfo.packageName);
}
}
}
}
return result;
}
@Override
@@ -12347,17 +12359,38 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
String.format(NOT_SYSTEM_CALLER_MSG,
"query if an input method is disabled by admin"));
synchronized (getLockObject()) {
ActiveAdmin admin = getParentOfAdminIfRequired(
getActiveAdminUncheckedLocked(who, userHandle), calledOnParentInstance);
if (admin == null) {
return false;
if (isPolicyEngineForFinanceFlagEnabled()) {
int affectedUser = calledOnParentInstance ? getProfileParentId(userHandle) : userHandle;
Map<EnforcingAdmin, PolicyValue<Set<String>>> policies =
mDevicePolicyEngine.getLocalPoliciesSetByAdmins(
PolicyDefinition.PERMITTED_INPUT_METHODS, affectedUser);
EnforcingAdmin admin = null;
for (EnforcingAdmin a : policies.keySet()) {
if (a.getPackageName().equals(who.getPackageName())) {
if (policies.get(a).getValue() == null) {
return true;
} else {
return checkPackagesInPermittedListOrSystem(
Collections.singletonList(packageName),
new ArrayList<>(policies.get(a).getValue()), affectedUser);
}
}
}
if (admin.permittedInputMethods == null) {
return true;
// Admin didn't set a policy
return false;
} else {
synchronized (getLockObject()) {
ActiveAdmin admin = getParentOfAdminIfRequired(
getActiveAdminUncheckedLocked(who, userHandle), calledOnParentInstance);
if (admin == null) {
return false;
}
if (admin.permittedInputMethods == null) {
return true;
}
return checkPackagesInPermittedListOrSystem(Collections.singletonList(packageName),
admin.permittedInputMethods, userHandle);
}
return checkPackagesInPermittedListOrSystem(Collections.singletonList(packageName),
admin.permittedInputMethods, userHandle);
}
}
@@ -23793,6 +23826,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
public DevicePolicyState getDevicePolicyState() {
Preconditions.checkCallAuthorization(
hasCallingOrSelfPermission(MANAGE_PROFILE_AND_DEVICE_OWNERS));
return mInjector.binderWithCleanCallingIdentity(mDevicePolicyEngine::getDevicePolicyState);
}

9
services/devicepolicy/java/com/android/server/devicepolicy/PolicyDefinition.java
View File

@@ -308,6 +308,13 @@ final class PolicyDefinition<V> {
DevicePolicyIdentifiers.ACCOUNT_MANAGEMENT_DISABLED_POLICY, accountType));
}
static PolicyDefinition<Set<String>> PERMITTED_INPUT_METHODS = new PolicyDefinition<>(
new NoArgsPolicyKey(DevicePolicyIdentifiers.PERMITTED_INPUT_METHODS_POLICY),
new MostRecent<>(),
POLICY_FLAG_LOCAL_ONLY_POLICY,
(Set<String> value, Context context, Integer userId, PolicyKey policyKey) -> true,
new StringSetPolicySerializer());
private static final Map<String, PolicyDefinition<?>> POLICY_DEFINITIONS = new HashMap<>();
private static Map<String, Integer> USER_RESTRICTION_FLAGS = new HashMap<>();
@@ -333,6 +340,8 @@ final class PolicyDefinition<V> {
GENERIC_APPLICATION_HIDDEN);
POLICY_DEFINITIONS.put(DevicePolicyIdentifiers.ACCOUNT_MANAGEMENT_DISABLED_POLICY,
GENERIC_ACCOUNT_MANAGEMENT_DISABLED);
POLICY_DEFINITIONS.put(DevicePolicyIdentifiers.PERMITTED_INPUT_METHODS_POLICY,
PERMITTED_INPUT_METHODS);
// User Restriction Policies
USER_RESTRICTION_FLAGS.put(UserManager.DISALLOW_MODIFY_ACCOUNTS, /* flags= */ 0);

19
services/devicepolicy/java/com/android/server/devicepolicy/PolicyState.java
View File

@@ -67,9 +67,8 @@ final class PolicyState<V> {
/**
* Returns {@code true} if the resolved policy has changed, {@code false} otherwise.
*/
boolean addPolicy(@NonNull EnforcingAdmin admin, @NonNull PolicyValue<V> policy) {
boolean addPolicy(@NonNull EnforcingAdmin admin, @Nullable PolicyValue<V> policy) {
Objects.requireNonNull(admin);
Objects.requireNonNull(policy);
//LinkedHashMap doesn't update the insertion order of existing keys, removing the existing
// key will cause it to update.
@@ -89,9 +88,9 @@ final class PolicyState<V> {
* Returns {@code true} if the resolved policy has changed, {@code false} otherwise.
*/
boolean addPolicy(
@NonNull EnforcingAdmin admin, @NonNull PolicyValue<V> policy,
@NonNull EnforcingAdmin admin, @Nullable PolicyValue<V> policy,
LinkedHashMap<EnforcingAdmin, PolicyValue<V>> globalPoliciesSetByAdmins) {
mPoliciesSetByAdmins.put(Objects.requireNonNull(admin), Objects.requireNonNull(policy));
mPoliciesSetByAdmins.put(Objects.requireNonNull(admin), policy);
return resolvePolicy(globalPoliciesSetByAdmins);
}
@@ -210,10 +209,12 @@ final class PolicyState<V> {
for (EnforcingAdmin admin : mPoliciesSetByAdmins.keySet()) {
serializer.startTag(/* namespace= */ null, TAG_ADMIN_POLICY_ENTRY);
serializer.startTag(/* namespace= */ null, TAG_POLICY_VALUE_ENTRY);
mPolicyDefinition.savePolicyValueToXml(
serializer, mPoliciesSetByAdmins.get(admin).getValue());
serializer.endTag(/* namespace= */ null, TAG_POLICY_VALUE_ENTRY);
if (mPoliciesSetByAdmins.get(admin) != null) {
serializer.startTag(/* namespace= */ null, TAG_POLICY_VALUE_ENTRY);
mPolicyDefinition.savePolicyValueToXml(
serializer, mPoliciesSetByAdmins.get(admin).getValue());
serializer.endTag(/* namespace= */ null, TAG_POLICY_VALUE_ENTRY);
}
serializer.startTag(/* namespace= */ null, TAG_ENFORCING_ADMIN_ENTRY);
admin.saveToXml(serializer);
@@ -250,7 +251,7 @@ final class PolicyState<V> {
break;
}
}
if (admin != null && value != null) {
if (admin != null) {
policiesSetByAdmins.put(admin, value);
} else {
Log.e(TAG, "Error Parsing TAG_ADMIN_POLICY_ENTRY");