diff --git a/api/current.txt b/api/current.txt index 15c9e89a60929..ea69453eb7a28 100644 --- a/api/current.txt +++ b/api/current.txt @@ -5967,7 +5967,7 @@ package android.app.admin { method public java.util.List retrievePreRebootSecurityLogs(android.content.ComponentName); method public java.util.List retrieveSecurityLogs(android.content.ComponentName); method public void setAccountManagementDisabled(android.content.ComponentName, java.lang.String, boolean); - method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; + method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String, boolean) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; method public boolean setApplicationHidden(android.content.ComponentName, java.lang.String, boolean); method public void setApplicationRestrictions(android.content.ComponentName, java.lang.String, android.os.Bundle); method public void setApplicationRestrictionsManagingPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException; diff --git a/api/system-current.txt b/api/system-current.txt index a78cb994036e9..e3b258895d89a 100644 --- a/api/system-current.txt +++ b/api/system-current.txt @@ -6128,7 +6128,7 @@ package android.app.admin { method public java.util.List retrieveSecurityLogs(android.content.ComponentName); method public void setAccountManagementDisabled(android.content.ComponentName, java.lang.String, boolean); method public deprecated boolean setActiveProfileOwner(android.content.ComponentName, java.lang.String) throws java.lang.IllegalArgumentException; - method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; + method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String, boolean) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; method public boolean setApplicationHidden(android.content.ComponentName, java.lang.String, boolean); method public void setApplicationRestrictions(android.content.ComponentName, java.lang.String, android.os.Bundle); method public void setApplicationRestrictionsManagingPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException; diff --git a/api/test-current.txt b/api/test-current.txt index b5c7103e9337a..d4aa3fc5b9ea3 100644 --- a/api/test-current.txt +++ b/api/test-current.txt @@ -5971,7 +5971,7 @@ package android.app.admin { method public java.util.List retrievePreRebootSecurityLogs(android.content.ComponentName); method public java.util.List retrieveSecurityLogs(android.content.ComponentName); method public void setAccountManagementDisabled(android.content.ComponentName, java.lang.String, boolean); - method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; + method public void setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String, boolean) throws android.content.pm.PackageManager.NameNotFoundException, java.lang.UnsupportedOperationException; method public boolean setApplicationHidden(android.content.ComponentName, java.lang.String, boolean); method public void setApplicationRestrictions(android.content.ComponentName, java.lang.String, android.os.Bundle); method public void setApplicationRestrictionsManagingPackage(android.content.ComponentName, java.lang.String) throws android.content.pm.PackageManager.NameNotFoundException; diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index 0ca2e14ade470..b0e86f41a7e87 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -2996,6 +2996,19 @@ public class DevicePolicyManager { return null; } + /** + * Called by a device or profile owner to configure an always-on VPN connection through a + * specific application for the current user. + * + * @deprecated this version only exists for compability with previous developer preview builds. + * TODO: delete once there are no longer any live references. + * @hide + */ + public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage) + throws NameNotFoundException, UnsupportedOperationException { + setAlwaysOnVpnPackage(admin, vpnPackage, /* lockdownEnabled */ true); + } + /** * Called by a device or profile owner to configure an always-on VPN connection through a * specific application for the current user. This connection is automatically granted and @@ -3006,7 +3019,10 @@ public class DevicePolicyManager { * fail. * * @param vpnPackage The package name for an installed VPN app on the device, or {@code null} to - * remove an existing always-on VPN configuration. + * remove an existing always-on VPN configuration. + * @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or + * {@code false} otherwise. This carries the risk that any failure of the VPN provider + * could break networking for all apps. This has no effect when clearing. * @return {@code true} if the package is set as always-on VPN controller; {@code false} * otherwise. * @throws SecurityException if {@code admin} is not a device or a profile owner. @@ -3014,12 +3030,13 @@ public class DevicePolicyManager { * @throws UnsupportedOperationException if {@code vpnPackage} exists but does not support being * set as always-on, or if always-on VPN is not available. */ - public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage) + public void setAlwaysOnVpnPackage(@NonNull ComponentName admin, @Nullable String vpnPackage, + boolean lockdownEnabled) throws NameNotFoundException, UnsupportedOperationException { throwIfParentInstance("setAlwaysOnVpnPackage"); if (mService != null) { try { - if (!mService.setAlwaysOnVpnPackage(admin, vpnPackage)) { + if (!mService.setAlwaysOnVpnPackage(admin, vpnPackage, lockdownEnabled)) { throw new NameNotFoundException(vpnPackage); } } catch (RemoteException e) { diff --git a/core/java/android/app/admin/IDevicePolicyManager.aidl b/core/java/android/app/admin/IDevicePolicyManager.aidl index 989e613413636..447ee29bd967e 100644 --- a/core/java/android/app/admin/IDevicePolicyManager.aidl +++ b/core/java/android/app/admin/IDevicePolicyManager.aidl @@ -157,7 +157,7 @@ interface IDevicePolicyManager { void setCertInstallerPackage(in ComponentName who, String installerPackage); String getCertInstallerPackage(in ComponentName who); - boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage); + boolean setAlwaysOnVpnPackage(in ComponentName who, String vpnPackage, boolean lockdown); String getAlwaysOnVpnPackage(in ComponentName who); void addPersistentPreferredActivity(in ComponentName admin, in IntentFilter filter, in ComponentName activity); diff --git a/core/java/android/net/ConnectivityManager.java b/core/java/android/net/ConnectivityManager.java index 933dddf4a9480..43d9bf327a335 100644 --- a/core/java/android/net/ConnectivityManager.java +++ b/core/java/android/net/ConnectivityManager.java @@ -797,14 +797,16 @@ public class ConnectivityManager { * @param userId The identifier of the user to set an always-on VPN for. * @param vpnPackage The package name for an installed VPN app on the device, or {@code null} * to remove an existing always-on VPN configuration. - + * @param lockdownEnabled {@code true} to disallow networking when the VPN is not connected or + * {@code false} otherwise. * @return {@code true} if the package is set as always-on VPN controller; * {@code false} otherwise. * @hide */ - public boolean setAlwaysOnVpnPackageForUser(int userId, @Nullable String vpnPackage) { + public boolean setAlwaysOnVpnPackageForUser(int userId, @Nullable String vpnPackage, + boolean lockdownEnabled) { try { - return mService.setAlwaysOnVpnPackage(userId, vpnPackage); + return mService.setAlwaysOnVpnPackage(userId, vpnPackage, lockdownEnabled); } catch (RemoteException e) { throw e.rethrowFromSystemServer(); } diff --git a/core/java/android/net/IConnectivityManager.aidl b/core/java/android/net/IConnectivityManager.aidl index aec6b3ec23fef..0d518cc14049a 100644 --- a/core/java/android/net/IConnectivityManager.aidl +++ b/core/java/android/net/IConnectivityManager.aidl @@ -122,7 +122,7 @@ interface IConnectivityManager VpnInfo[] getAllVpnInfo(); boolean updateLockdownVpn(); - boolean setAlwaysOnVpnPackage(int userId, String packageName); + boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown); String getAlwaysOnVpnPackage(int userId); int checkMobileProvisioning(int suggestedTimeOutMs); diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java index 16234b3801cf9..06255a29f98bc 100644 --- a/services/core/java/com/android/server/ConnectivityService.java +++ b/services/core/java/com/android/server/ConnectivityService.java @@ -3347,7 +3347,7 @@ public class ConnectivityService extends IConnectivityManager.Stub } @Override - public boolean setAlwaysOnVpnPackage(int userId, String packageName) { + public boolean setAlwaysOnVpnPackage(int userId, String packageName, boolean lockdown) { enforceConnectivityInternalPermission(); enforceCrossUserPermission(userId); diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 93fbe5cd7e7a6..cbec270c5e9b8 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -4459,7 +4459,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { * @throws UnsupportedException if the package does not support being set as always-on. */ @Override - public boolean setAlwaysOnVpnPackage(ComponentName admin, String vpnPackage) + public boolean setAlwaysOnVpnPackage(ComponentName admin, String vpnPackage, boolean lockdown) throws SecurityException { synchronized (this) { getActiveAdminForCallerLocked(admin, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER); @@ -4473,7 +4473,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { } ConnectivityManager connectivityManager = (ConnectivityManager) mContext.getSystemService(Context.CONNECTIVITY_SERVICE); - if (!connectivityManager.setAlwaysOnVpnPackageForUser(userId, vpnPackage)) { + if (!connectivityManager.setAlwaysOnVpnPackageForUser(userId, vpnPackage, lockdown)) { throw new UnsupportedOperationException(); } } finally {