From e19237983326d5348442c1f677eed236279a4d07 Mon Sep 17 00:00:00 2001 From: Eran Messeri Date: Tue, 20 Apr 2021 18:46:56 +0100 Subject: [PATCH] Document access to device identifiers on managed devices Document when, on a managed device or profile, the DPC can read hardware identifiers, and when it must use the new enrollment-specific ID. Bug: 172636282 Test: m docs Change-Id: I783725853d0654d49518a38d8d8d04b3ca7e3ab0 --- .../app/admin/DevicePolicyManager.java | 12 ++- core/java/android/os/Build.java | 8 +- .../android/telephony/TelephonyManager.java | 80 +++++++------------ 3 files changed, 44 insertions(+), 56 deletions(-) diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index c93a88f9f312c..81d125c8f7be6 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -1840,6 +1840,8 @@ public class DevicePolicyManager { * Delegation of certificate installation and management. This scope grants access to the * {@link #getInstalledCaCerts}, {@link #hasCaCertInstalled}, {@link #installCaCert}, * {@link #uninstallCaCert}, {@link #uninstallAllUserCaCerts} and {@link #installKeyPair} APIs. + * This scope also grants the ability to read identifiers that the delegating device owner or + * profile owner can obtain. See {@link #getEnrollmentSpecificId()}. */ public static final String DELEGATION_CERT_INSTALL = "delegation-cert-install"; @@ -13601,12 +13603,20 @@ public class DevicePolicyManager { * It is available both in a work profile and on a fully-managed device. * The identifier would be consistent even if the work profile is removed and enrolled again * (to the same organization), or the device is factory reset and re-enrolled. - + * * Can only be called by the Profile Owner or Device Owner, if the * {@link #setOrganizationId(String)} was previously called. * If {@link #setOrganizationId(String)} was not called, then the returned value will be an * empty string. * + *

Note about access to device identifiers: a device owner, a profile owner of an + * organization-owned device or the delegated certificate installer (holding the + * {@link #DELEGATION_CERT_INSTALL} delegation) on such a device can still obtain hardware + * identifiers by calling e.g. {@link android.os.Build#getSerial()}, in addition to using + * this method. However, a profile owner on a personal (non organization-owned) device, or the + * delegated certificate installer on such a device, cannot obtain hardware identifiers anymore + * and must switch to using this method. + * * @return A stable, enrollment-specific identifier. * @throws SecurityException if the caller is not a profile owner or device owner. */ diff --git a/core/java/android/os/Build.java b/core/java/android/os/Build.java index 7b8fdd77a250c..5b3bc267e2b67 100755 --- a/core/java/android/os/Build.java +++ b/core/java/android/os/Build.java @@ -174,15 +174,13 @@ public class Build { *

* *

If the calling app does not meet one of these requirements then this method will behave diff --git a/telephony/java/android/telephony/TelephonyManager.java b/telephony/java/android/telephony/TelephonyManager.java index 05f5d291ca6f4..d9001bd488f40 100644 --- a/telephony/java/android/telephony/TelephonyManager.java +++ b/telephony/java/android/telephony/TelephonyManager.java @@ -1936,11 +1936,9 @@ public class TelephonyManager { *