Merge "Stop managed profile owner granting READ_SMS" into sc-dev am: 28e4c5d57a am: 0b3d3a0b6c

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/15371691

Change-Id: Ib3146566cd7be21a0dedb54b6cdbf7bbef00a76d

core/java/android/app/admin/DevicePolicyManager.java

@@ -11022,6 +11022,16 @@ public class DevicePolicyManager {
      * {@link #EXTRA_PROVISIONING_SENSORS_PERMISSION_GRANT_OPT_OUT} in the provisioning parameters.
      * In that case the device owner's control will be limited do denying these permissions.
      * <p>
+     * NOTE: On devices running {@link android.os.Build.VERSION_CODES#S} and above, control over
+     * the following permissions are restricted for managed profile owners:
+     * <ul>
+     *    <li>Manifest.permission.READ_SMS</li>
+     * </ul>
+     * <p>
+     * A managed profile owner may not grant these permissions (i.e. call this method with any of
+     * the permissions listed above and {@code grantState} of
+     * {@code #PERMISSION_GRANT_STATE_GRANTED}), but may deny them.
+     * <p>
      * Attempts by the admin to grant these permissions, when the admin is restricted from doing
      * so, will be silently ignored (no exception will be thrown).
      *