From 0e3bda210625c7d5fa591a0ab1cdb622da4315e0 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Tue, 10 May 2022 04:16:41 +0000 Subject: [PATCH] DPM: remove FDE-specific password validity persistence On FDE devices, DevicePolicyManagerService persistently stored a flag indicating whether the user's password is sufficient for the policy. Since FDE is no longer supported, this code is no longer needed. Test: atest FrameworksServicesTests:DevicePolicyManagerTest Bug: 208476087 Change-Id: I1e2a97a354382dbee6a92b166e91ae8130f1e48c --- .../server/devicepolicy/DevicePolicyData.java | 20 ++----------------- .../DevicePolicyManagerService.java | 11 +--------- .../PolicyUpgraderDataProvider.java | 5 ----- .../devicepolicy/PolicyVersionUpgrader.java | 6 +----- .../PolicyVersionUpgraderTest.java | 6 ------ 5 files changed, 4 insertions(+), 44 deletions(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyData.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyData.java index fd97db23f01aa..054181dfa7285 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyData.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyData.java @@ -67,7 +67,6 @@ class DevicePolicyData { private static final String TAG_CURRENT_INPUT_METHOD_SET = "current-ime-set"; private static final String TAG_OWNER_INSTALLED_CA_CERT = "owner-installed-ca-cert"; private static final String TAG_INITIALIZATION_BUNDLE = "initialization-bundle"; - private static final String TAG_PASSWORD_VALIDITY = "password-validity"; private static final String TAG_PASSWORD_TOKEN_HANDLE = "password-token"; private static final String TAG_PROTECTED_PACKAGES = "protected-packages"; private static final String TAG_BYPASS_ROLE_QUALIFICATIONS = "bypass-role-qualifications"; @@ -184,7 +183,7 @@ class DevicePolicyData { /** * Serializes DevicePolicyData object as XML. */ - static boolean store(DevicePolicyData policyData, JournaledFile file, boolean isFdeDevice) { + static boolean store(DevicePolicyData policyData, JournaledFile file) { FileOutputStream stream = null; File chooseForWrite = null; try { @@ -269,15 +268,6 @@ class DevicePolicyData { out.endTag(null, "failed-password-attempts"); } - // For FDE devices only, we save this flag so we can report on password sufficiency - // before the user enters their password for the first time after a reboot. For - // security reasons, we don't want to store the full set of active password metrics. - if (isFdeDevice) { - out.startTag(null, TAG_PASSWORD_VALIDITY); - out.attributeBoolean(null, ATTR_VALUE, policyData.mPasswordValidAtLastCheckpoint); - out.endTag(null, TAG_PASSWORD_VALIDITY); - } - for (int i = 0; i < policyData.mAcceptedCaCertificates.size(); i++) { out.startTag(null, TAG_ACCEPTED_CA_CERTIFICATES); out.attribute(null, ATTR_NAME, policyData.mAcceptedCaCertificates.valueAt(i)); @@ -405,7 +395,7 @@ class DevicePolicyData { * @param adminInfoSupplier function that queries DeviceAdminInfo from PackageManager * @param ownerComponent device or profile owner component if any. */ - static void load(DevicePolicyData policy, boolean isFdeDevice, JournaledFile journaledFile, + static void load(DevicePolicyData policy, JournaledFile journaledFile, Function adminInfoSupplier, ComponentName ownerComponent) { FileInputStream stream = null; @@ -545,12 +535,6 @@ class DevicePolicyData { policy.mAdminBroadcastPending = Boolean.toString(true).equals(pending); } else if (TAG_INITIALIZATION_BUNDLE.equals(tag)) { policy.mInitBundle = PersistableBundle.restoreFromXml(parser); - } else if (TAG_PASSWORD_VALIDITY.equals(tag)) { - if (isFdeDevice) { - // This flag is only used for FDE devices - policy.mPasswordValidAtLastCheckpoint = - parser.getAttributeBoolean(null, ATTR_VALUE, false); - } } else if (TAG_PASSWORD_TOKEN_HANDLE.equals(tag)) { policy.mPasswordTokenHandle = parser.getAttributeLong(null, ATTR_VALUE); } else if (TAG_CURRENT_INPUT_METHOD_SET.equals(tag)) { diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 19a8f09f94a6e..1855b55803d06 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -2877,10 +2877,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } private void saveSettingsLocked(int userHandle) { - if (DevicePolicyData.store( - getUserData(userHandle), - makeJournaledFile(userHandle), - !mInjector.storageManagerIsFileBasedEncryptionEnabled())) { + if (DevicePolicyData.store(getUserData(userHandle), makeJournaledFile(userHandle))) { sendChangedNotification(userHandle); } invalidateBinderCaches(); @@ -2895,7 +2892,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { private void loadSettingsLocked(DevicePolicyData policy, int userHandle) { DevicePolicyData.load(policy, - !mInjector.storageManagerIsFileBasedEncryptionEnabled(), makeJournaledFile(userHandle), component -> findAdmin( component, userHandle, /* throwForMissingPermission= */ false), @@ -3060,11 +3056,6 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { // TODO(b/230841522) Make it static. private class DpmsUpgradeDataProvider implements PolicyUpgraderDataProvider { - @Override - public boolean storageManagerIsFileBasedEncryptionEnabled() { - return mInjector.storageManagerIsFileBasedEncryptionEnabled(); - } - @Override public JournaledFile makeDevicePoliciesJournaledFile(int userId) { return DevicePolicyManagerService.this.makeJournaledFile(userId, DEVICE_POLICIES_XML); diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/PolicyUpgraderDataProvider.java b/services/devicepolicy/java/com/android/server/devicepolicy/PolicyUpgraderDataProvider.java index 7b7a454fc9454..147474907f295 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/PolicyUpgraderDataProvider.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/PolicyUpgraderDataProvider.java @@ -28,11 +28,6 @@ import java.util.function.Function; * to go through the upgrade process. */ public interface PolicyUpgraderDataProvider { - /** - * Returns true if the storage manager indicates file-based encryption is enabled. - */ - boolean storageManagerIsFileBasedEncryptionEnabled(); - /** * Returns the journaled policies file for a given user. */ diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/PolicyVersionUpgrader.java b/services/devicepolicy/java/com/android/server/devicepolicy/PolicyVersionUpgrader.java index 253851cdbf68e..808133164cd1c 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/PolicyVersionUpgrader.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/PolicyVersionUpgrader.java @@ -222,7 +222,6 @@ public class PolicyVersionUpgrader { int userId, int loadVersion, ComponentName ownerComponent) { DevicePolicyData policy = new DevicePolicyData(userId); DevicePolicyData.load(policy, - !mProvider.storageManagerIsFileBasedEncryptionEnabled(), mProvider.makeDevicePoliciesJournaledFile(userId), mProvider.getAdminInfoSupplier(userId), ownerComponent); @@ -230,10 +229,7 @@ public class PolicyVersionUpgrader { } private boolean writeDataForUser(int userId, DevicePolicyData policy) { - return DevicePolicyData.store( - policy, - mProvider.makeDevicePoliciesJournaledFile(userId), - !mProvider.storageManagerIsFileBasedEncryptionEnabled()); + return DevicePolicyData.store(policy, mProvider.makeDevicePoliciesJournaledFile(userId)); } private JournaledFile getVersionFile() { diff --git a/services/tests/servicestests/src/com/android/server/devicepolicy/PolicyVersionUpgraderTest.java b/services/tests/servicestests/src/com/android/server/devicepolicy/PolicyVersionUpgraderTest.java index 412722d68f436..72fac55d7c99a 100644 --- a/services/tests/servicestests/src/com/android/server/devicepolicy/PolicyVersionUpgraderTest.java +++ b/services/tests/servicestests/src/com/android/server/devicepolicy/PolicyVersionUpgraderTest.java @@ -69,15 +69,9 @@ public class PolicyVersionUpgraderTest extends DpmTestBase { private ComponentName mFakeAdmin; private class FakePolicyUpgraderDataProvider implements PolicyUpgraderDataProvider { - boolean mIsFileBasedEncryptionEnabled; Map mComponentToDeviceAdminInfo = new HashMap<>(); int[] mUsers; - @Override - public boolean storageManagerIsFileBasedEncryptionEnabled() { - return mIsFileBasedEncryptionEnabled; - } - private JournaledFile makeJournaledFile(int userId, String fileName) { File parentDir = getServices().environment.getUserSystemDirectory(userId);