Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security logging broadcast work profile

Browse Source 
Changes
On an org-owned device with a managed
profile, the security logs available broadcast
should be sent to the work profile user

Manual testing steps
* Set up org-owned device
  with a managed profile
* Enable security logging in
  the work profile
* Force logs using adb
  adb shell dpm force-security-logs
* Verify DeviceAdminReceiver
  receives broadcast

Bug: 170293810
Test: manual testing
      atest com.android.server.devicepolicy.DevicePolicyManagerTest
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSecurityLoggingWithSingleUser
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSecurityLoggingEnabledLogged
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSecurityLoggingWithTwoUsers
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSecurityLoggingDelegate
      atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testSecurityLogging
      atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testSecurityLoggingDelegate
Change-Id: Ia955d6ef6b983fb1ff05dff9e68f8cb8e9b6e9f9
This commit is contained in:
Alex Johnston
2021-05-14 13:50:56 +01:00
parent 81bd9d9b30
commit 25b2533630
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
services/devicepolicy/java/com/android/server/devicepolicy/SecurityLogMonitor.java
View File

@@ -226,7 +226,7 @@ class SecurityLogMonitor implements Runnable {
Slog.i(TAG, "Resumed.");
try {
notifyDeviceOwnerIfNeeded(false /* force */);
notifyDeviceOwnerOrProfileOwnerIfNeeded(false /* force */);
} catch (InterruptedException e) {
Log.w(TAG, "Thread interrupted.", e);
}
@@ -439,7 +439,7 @@ class SecurityLogMonitor implements Runnable {
saveLastEvents(newLogs);
newLogs.clear();
notifyDeviceOwnerIfNeeded(force);
notifyDeviceOwnerOrProfileOwnerIfNeeded(force);
} catch (IOException e) {
Log.e(TAG, "Failed to read security log", e);
} catch (InterruptedException e) {
@@ -460,8 +460,9 @@ class SecurityLogMonitor implements Runnable {
Slog.i(TAG, "MonitorThread exit.");
}
private void notifyDeviceOwnerIfNeeded(boolean force) throws InterruptedException {
boolean allowRetrievalAndNotifyDO = false;
private void notifyDeviceOwnerOrProfileOwnerIfNeeded(boolean force)
throws InterruptedException {
boolean allowRetrievalAndNotifyDOOrPO = false;
mLock.lockInterruptibly();
try {
if (mPaused) {
@@ -471,16 +472,16 @@ class SecurityLogMonitor implements Runnable {
if (logSize >= BUFFER_ENTRIES_NOTIFICATION_LEVEL || (force && logSize > 0)) {
// Allow DO to retrieve logs if too many pending logs or if forced.
if (!mAllowedToRetrieve) {
allowRetrievalAndNotifyDO = true;
allowRetrievalAndNotifyDOOrPO = true;
}
if (DEBUG) Slog.d(TAG, "Number of log entries over threshold: " + logSize);
}
if (logSize > 0 && SystemClock.elapsedRealtime() >= mNextAllowedRetrievalTimeMillis) {
// Rate limit reset
allowRetrievalAndNotifyDO = true;
allowRetrievalAndNotifyDOOrPO = true;
if (DEBUG) Slog.d(TAG, "Timeout reached");
}
if (allowRetrievalAndNotifyDO) {
if (allowRetrievalAndNotifyDOOrPO) {
mAllowedToRetrieve = true;
// Set the timeout to retry the notification if the DO misses it.
mNextAllowedRetrievalTimeMillis = SystemClock.elapsedRealtime()
@@ -489,10 +490,10 @@ class SecurityLogMonitor implements Runnable {
} finally {
mLock.unlock();
}
if (allowRetrievalAndNotifyDO) {
Slog.i(TAG, "notify DO");
mService.sendDeviceOwnerCommand(DeviceAdminReceiver.ACTION_SECURITY_LOGS_AVAILABLE,
null);
if (allowRetrievalAndNotifyDOOrPO) {
Slog.i(TAG, "notify DO or PO");
mService.sendDeviceOwnerOrProfileOwnerCommand(
DeviceAdminReceiver.ACTION_SECURITY_LOGS_AVAILABLE, null, mEnabledUser);
}
}