Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "DPM Check for unaffiliated secondary users" into sc-dev am: 345ff0cc74

Browse Source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/14325409

Change-Id: I344f07a727a3697d3fee9f8fcd8f1f626f5f4de3
This commit is contained in:
Alex Johnston
2021-05-04 10:30:02 +00:00
committed by Automerger Merge Worker
parent 2c8a242c4e 345ff0cc74
commit 4c60a03778
3 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
core/java/android/app/admin/DevicePolicyManager.java
View File

@@ -5513,6 +5513,10 @@ public class DevicePolicyManager {
* This method requires the caller to be the device owner.
* <p>
* This proxy is only a recommendation and it is possible that some apps will ignore it.
* <p>
* Note: The device owner won't be able to set a global HTTP proxy if there are unaffiliated
* secondary users or profiles on the device. It's recommended that affiliation ids are set for
* new users as soon as possible after provisioning via {@link #setAffiliationIds}.
*
* @see ProxyInfo
* @param admin Which {@link DeviceAdminReceiver} this request is associated with.
@@ -12791,6 +12795,11 @@ public class DevicePolicyManager {
* <p>In this mode, the DNS subsystem will attempt a TLS handshake to the network-supplied
* resolver prior to attempting name resolution in cleartext.
*
* <p>Note: The device owner won't be able to set the global private DNS mode if there are
* unaffiliated secondary users or profiles on the device. It's recommended that affiliation
* ids are set for new users as soon as possible after provisioning via
* {@link #setAffiliationIds}.
*
* @param admin which {@link DeviceAdminReceiver} this request is associated with.
*
* @return {@code PRIVATE_DNS_SET_NO_ERROR} if the mode was set successfully, or
@@ -12826,6 +12835,11 @@ public class DevicePolicyManager {
* the ability to resolve hostnames as system traffic to the resolver may not go through the
* VPN.
*
* <p>Note: The device owner won't be able to set the global private DNS mode if there are
* unaffiliated secondary users or profiles on the device. It's recommended that affiliation
* ids are set for new users as soon as possible after provisioning via
* {@link #setAffiliationIds}.
*
* @param admin which {@link DeviceAdminReceiver} this request is associated with.
* @param privateDnsHost The hostname of a server that implements DNS over TLS (RFC7858).
*

2
services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
View File

@@ -7244,6 +7244,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
Objects.requireNonNull(who, "ComponentName is null");
final CallerIdentity caller = getCallerIdentity(who);
Preconditions.checkCallAuthorization(isDeviceOwner(caller));
checkAllUsersAreAffiliatedWithDevice();
mInjector.binderWithCleanCallingIdentity(
() -> mInjector.getConnectivityManager().setGlobalProxy(proxyInfo));
}
@@ -15736,6 +15737,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
Objects.requireNonNull(who, "ComponentName is null");
final CallerIdentity caller = getCallerIdentity(who);
Preconditions.checkCallAuthorization(isDeviceOwner(caller));
checkAllUsersAreAffiliatedWithDevice();
checkCanExecuteOrThrowUnsafe(DevicePolicyManager.OPERATION_SET_GLOBAL_PRIVATE_DNS);
switch (mode) {

43
services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
View File

@@ -30,6 +30,7 @@ import static android.app.admin.DevicePolicyManager.PASSWORD_COMPLEXITY_HIGH;
import static android.app.admin.DevicePolicyManager.PASSWORD_COMPLEXITY_LOW;
import static android.app.admin.DevicePolicyManager.PASSWORD_COMPLEXITY_MEDIUM;
import static android.app.admin.DevicePolicyManager.PASSWORD_COMPLEXITY_NONE;
import static android.app.admin.DevicePolicyManager.PRIVATE_DNS_SET_NO_ERROR;
import static android.app.admin.DevicePolicyManager.WIPE_EUICC;
import static android.app.admin.PasswordMetrics.computeForPasswordOrPin;
import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_DIRECT_BOOT_AWARE;
@@ -7333,6 +7334,48 @@ public class DevicePolicyManagerTest extends DpmTestBase {
assertThat(dpm.getPolicyExemptApps()).containsExactly("4", "8", "15", "16", "23", "42");
}
@Test
public void testSetGlobalPrivateDnsModeOpportunistic_asDeviceOwner() throws Exception {
setDeviceOwner();
// setUp() adds a secondary user for CALLER_USER_HANDLE. Remove it as otherwise the
// feature is disabled because there are non-affiliated secondary users.
getServices().removeUser(CALLER_USER_HANDLE);
clearInvocations(getServices().settings);
int result = dpm.setGlobalPrivateDnsModeOpportunistic(admin1);
assertThat(result).isEqualTo(PRIVATE_DNS_SET_NO_ERROR);
}
@Test
public void testSetGlobalPrivateDnsModeOpportunistic_hasUnaffiliatedUsers() throws Exception {
setDeviceOwner();
setAsProfileOwner(admin2);
assertThrows(SecurityException.class,
() -> dpm.setGlobalPrivateDnsModeOpportunistic(admin1));
}
@Test
public void testSetRecommendedGlobalProxy_asDeviceOwner() throws Exception {
setDeviceOwner();
// setUp() adds a secondary user for CALLER_USER_HANDLE. Remove it as otherwise the
// feature is disabled because there are non-affiliated secondary users.
getServices().removeUser(CALLER_USER_HANDLE);
dpm.setRecommendedGlobalProxy(admin1, null);
verify(getServices().connectivityManager).setGlobalProxy(null);
}
@Test
public void testSetRecommendedGlobalProxy_hasUnaffiliatedUsers() throws Exception {
setDeviceOwner();
setAsProfileOwner(admin2);
assertThrows(SecurityException.class, () -> dpm.setRecommendedGlobalProxy(admin1, null));
}
private void setUserUnlocked(int userHandle, boolean unlocked) {
when(getServices().userManager.isUserUnlocked(eq(userHandle))).thenReturn(unlocked);
}