diff --git a/api/current.txt b/api/current.txt index bf7e762b4bb8d..85a30875a6998 100644 --- a/api/current.txt +++ b/api/current.txt @@ -6493,7 +6493,7 @@ package android.app.admin { field public static final java.lang.String EXTRA_PROVISIONING_WIFI_PROXY_PORT = "android.app.extra.PROVISIONING_WIFI_PROXY_PORT"; field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SECURITY_TYPE = "android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE"; field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SSID = "android.app.extra.PROVISIONING_WIFI_SSID"; - field public static final int FLAG_EVICT_CE_KEY = 1; // 0x1 + field public static final int FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY = 1; // 0x1 field public static final int FLAG_MANAGED_CAN_ACCESS_PARENT = 2; // 0x2 field public static final int FLAG_PARENT_CAN_ACCESS_MANAGED = 1; // 0x1 field public static final int KEYGUARD_DISABLE_FEATURES_ALL = 2147483647; // 0x7fffffff diff --git a/api/removed.txt b/api/removed.txt index ba48e32663875..ed849d58ee13c 100644 --- a/api/removed.txt +++ b/api/removed.txt @@ -18,6 +18,7 @@ package android.app.admin { method public deprecated java.lang.String getDeviceInitializerApp(); method public deprecated android.content.ComponentName getDeviceInitializerComponent(); method public void setAffiliationIds(android.content.ComponentName, java.util.List); + field public static final deprecated int FLAG_EVICT_CE_KEY = 1; // 0x1 } } diff --git a/api/system-current.txt b/api/system-current.txt index d609fc1c1775a..0deec2d6ed51b 100644 --- a/api/system-current.txt +++ b/api/system-current.txt @@ -6737,7 +6737,7 @@ package android.app.admin { field public static final java.lang.String EXTRA_PROVISIONING_WIFI_PROXY_PORT = "android.app.extra.PROVISIONING_WIFI_PROXY_PORT"; field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SECURITY_TYPE = "android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE"; field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SSID = "android.app.extra.PROVISIONING_WIFI_SSID"; - field public static final int FLAG_EVICT_CE_KEY = 1; // 0x1 + field public static final int FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY = 1; // 0x1 field public static final int FLAG_MANAGED_CAN_ACCESS_PARENT = 2; // 0x2 field public static final int FLAG_PARENT_CAN_ACCESS_MANAGED = 1; // 0x1 field public static final int KEYGUARD_DISABLE_FEATURES_ALL = 2147483647; // 0x7fffffff diff --git a/api/system-removed.txt b/api/system-removed.txt index 4b3d3ead6acac..c7debc4b9847d 100644 --- a/api/system-removed.txt +++ b/api/system-removed.txt @@ -16,6 +16,7 @@ package android.app.admin { method public deprecated android.os.UserHandle createAndInitializeUser(android.content.ComponentName, java.lang.String, java.lang.String, android.content.ComponentName, android.os.Bundle); method public deprecated android.os.UserHandle createUser(android.content.ComponentName, java.lang.String); method public void setAffiliationIds(android.content.ComponentName, java.util.List); + field public static final deprecated int FLAG_EVICT_CE_KEY = 1; // 0x1 } } diff --git a/api/test-current.txt b/api/test-current.txt index e8b5afaa5e71f..08cfba9e50609 100644 --- a/api/test-current.txt +++ b/api/test-current.txt @@ -6523,7 +6523,7 @@ package android.app.admin { field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SECURITY_TYPE = "android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE"; field public static final java.lang.String EXTRA_PROVISIONING_WIFI_SSID = "android.app.extra.PROVISIONING_WIFI_SSID"; field public static final java.lang.String EXTRA_RESTRICTION = "android.app.extra.RESTRICTION"; - field public static final int FLAG_EVICT_CE_KEY = 1; // 0x1 + field public static final int FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY = 1; // 0x1 field public static final int FLAG_MANAGED_CAN_ACCESS_PARENT = 2; // 0x2 field public static final int FLAG_PARENT_CAN_ACCESS_MANAGED = 1; // 0x1 field public static final int KEYGUARD_DISABLE_FEATURES_ALL = 2147483647; // 0x7fffffff diff --git a/api/test-removed.txt b/api/test-removed.txt index ba48e32663875..ed849d58ee13c 100644 --- a/api/test-removed.txt +++ b/api/test-removed.txt @@ -18,6 +18,7 @@ package android.app.admin { method public deprecated java.lang.String getDeviceInitializerApp(); method public deprecated android.content.ComponentName getDeviceInitializerComponent(); method public void setAffiliationIds(android.content.ComponentName, java.util.List); + field public static final deprecated int FLAG_EVICT_CE_KEY = 1; // 0x1 } } diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index f5df67b6035cf..8fcabce61825b 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -3030,17 +3030,24 @@ public class DevicePolicyManager { * keyring. The user's credential will need to be entered again in order to derive the * credential encryption key that will be stored back in the keyring for future use. *

- * This flag can only be used by a profile owner when locking a managed profile on an FBE - * device. + * This flag can only be used by a profile owner when locking a managed profile when + * {@link #getStorageEncryptionStatus} returns {@link #ENCRYPTION_STATUS_ACTIVE_PER_USER}. *

* In order to secure user data, the user will be stopped and restarted so apps should wait * until they are next run to perform further actions. */ + public static final int FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY = 1; + + /** + * Instead use {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY}. + * @removed + */ + @Deprecated public static final int FLAG_EVICT_CE_KEY = 1; /** @hide */ @Retention(RetentionPolicy.SOURCE) - @IntDef(flag=true, value={FLAG_EVICT_CE_KEY}) + @IntDef(flag=true, value={FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY}) public @interface LockNowFlag {} /** @@ -3072,15 +3079,17 @@ public class DevicePolicyManager { * This method can be called on the {@link DevicePolicyManager} instance returned by * {@link #getParentProfileInstance(ComponentName)} in order to lock the parent profile. * - * @param flags May be 0 or {@link #FLAG_EVICT_CE_KEY}. + * @param flags May be 0 or {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY}. * @throws SecurityException if the calling application does not own an active administrator * that uses {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK} or the - * {@link #FLAG_EVICT_CE_KEY} flag is passed by an application that is not a profile + * {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is passed by an application + * that is not a profile * owner of a managed profile. - * @throws IllegalArgumentException if the {@link #FLAG_EVICT_CE_KEY} flag is passed when - * locking the parent profile. - * @throws UnsupportedOperationException if the {@link #FLAG_EVICT_CE_KEY} flag is passed on a - * non-FBE device. + * @throws IllegalArgumentException if the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} flag is + * passed when locking the parent profile. + * @throws UnsupportedOperationException if the {@link #FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY} + * flag is passed when {@link #getStorageEncryptionStatus} does not return + * {@link #ENCRYPTION_STATUS_ACTIVE_PER_USER}. */ public void lockNow(@LockNowFlag int flags) { if (mService != null) { diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 2ddce1652b612..6584672c09481 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -4651,19 +4651,20 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { final long ident = mInjector.binderClearCallingIdentity(); try { // Evict key - if ((flags & DevicePolicyManager.FLAG_EVICT_CE_KEY) != 0) { - enforceManagedProfile(callingUserId, "set FLAG_EVICT_CE_KEY"); + if ((flags & DevicePolicyManager.FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY) != 0) { + enforceManagedProfile( + callingUserId, "set FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY"); if (!isProfileOwner(admin.info.getComponent(), callingUserId)) { - throw new SecurityException( - "Only profile owner admins can set FLAG_EVICT_CE_KEY"); + throw new SecurityException("Only profile owner admins can set " + + "FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY"); } if (parent) { throw new IllegalArgumentException( - "Cannot set FLAG_EVICT_CE_KEY for the parent"); + "Cannot set FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY for the parent"); } if (!mInjector.storageManagerIsFileBasedEncryptionEnabled()) { throw new UnsupportedOperationException( - "FLAG_EVICT_CE_KEY only applies to FBE devices"); + "FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY only applies to FBE devices"); } mUserManager.evictCredentialEncryptionKey(callingUserId); }