Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Log to SecurityLog if camera is disabled by admin

Browse Source 
This is part of the NIAP audit logging requirement.

Bug: 137937540
Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithSingleUser
Change-Id: I4fe1e856337787dcd4fbe1b25ff2e9e5a18c2ce9
This commit is contained in:
Rubin Xu
2020-01-03 11:59:21 +00:00
parent d56dcd2f71
commit 3ea0f6f3ef
4 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
api/current.txt
View File

@@ -7121,6 +7121,7 @@ package android.app.admin {
field public static final int TAG_ADB_SHELL_CMD = 210002; // 0x33452
field public static final int TAG_ADB_SHELL_INTERACTIVE = 210001; // 0x33451
field public static final int TAG_APP_PROCESS_START = 210005; // 0x33455
field public static final int TAG_CAMERA_POLICY_SET = 210034; // 0x33472
field public static final int TAG_CERT_AUTHORITY_INSTALLED = 210029; // 0x3346d
field public static final int TAG_CERT_AUTHORITY_REMOVED = 210030; // 0x3346e
field public static final int TAG_CERT_VALIDATION_FAILURE = 210033; // 0x33471

15
core/java/android/app/admin/SecurityLog.java
View File

@@ -81,6 +81,7 @@ public class SecurityLog {
TAG_CRYPTO_SELF_TEST_COMPLETED,
TAG_KEY_INTEGRITY_VIOLATION,
TAG_CERT_VALIDATION_FAILURE,
TAG_CAMERA_POLICY_SET
})
public @interface SecurityLogTag {}
@@ -432,6 +433,19 @@ public class SecurityLog {
public static final int TAG_CERT_VALIDATION_FAILURE =
SecurityLogTags.SECURITY_CERT_VALIDATION_FAILURE;
/**
* Indicates that the admin has set policy to disable camera.
* The log entry contains the following information about the event, encapsulated in an
* {@link Object} array and accessible via {@link SecurityEvent#getData()}:
* <li> [0] admin package name ({@code String})
* <li> [1] admin user ID ({@code Integer})
* <li> [2] target user ID ({@code Integer})
* <li> [3] whether the camera is disabled or not ({@code Integer}, 1 if it's disabled,
* 0 if enabled)
*/
public static final int TAG_CAMERA_POLICY_SET =
SecurityLogTags.SECURITY_CAMERA_POLICY_SET;
/**
* Event severity level indicating that the event corresponds to normal workflow.
*/
@@ -561,6 +575,7 @@ public class SecurityLog {
case TAG_MAX_PASSWORD_ATTEMPTS_SET:
case TAG_USER_RESTRICTION_ADDED:
case TAG_USER_RESTRICTION_REMOVED:
case TAG_CAMERA_POLICY_SET:
return LEVEL_INFO;
case TAG_CERT_AUTHORITY_REMOVED:
case TAG_CRYPTO_SELF_TEST_COMPLETED:

1
core/java/android/app/admin/SecurityLogTags.logtags
View File

@@ -38,3 +38,4 @@ option java_package android.app.admin
210031 security_crypto_self_test_completed (success|1)
210032 security_key_integrity_violation (key_id|3),(uid|1)
210033 security_cert_validation_failure (reason|3)
210034 security_camera_policy_set (package|3),(admin_user|1),(target_user|1),(disabled|1)

8
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -7710,7 +7710,13 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
}
}
// Tell the user manager that the restrictions have changed.
pushUserRestrictions(parent ? getProfileParentId(userHandle) : userHandle);
final int affectedUserId = parent ? getProfileParentId(userHandle) : userHandle;
pushUserRestrictions(affectedUserId);
if (SecurityLog.isLoggingEnabled()) {
SecurityLog.writeEvent(SecurityLog.TAG_CAMERA_POLICY_SET,
who.getPackageName(), userHandle, affectedUserId, disabled ? 1 : 0);
}
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.SET_CAMERA_DISABLED)
.setAdmin(who)