From 0733c37462e5b93c88251cc0dca5e22accefd8c8 Mon Sep 17 00:00:00 2001 From: Florian Mayer Date: Tue, 24 Jan 2023 16:24:29 -0800 Subject: [PATCH] [MTE] Allow devices to disable MTE DPM API Test: atest MtePolicyTest Change-Id: I13c216d4f62a44563b9f3fdcf6b5c958cd17cbbb --- core/java/android/app/admin/DevicePolicyManager.java | 1 + .../devicepolicy/DevicePolicyManagerService.java | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index 239111ebaab72..0465962e89e3f 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -3959,6 +3959,7 @@ public class DevicePolicyManager { * * @throws SecurityException if caller is not device owner or profile owner of org-owned device * or if called on a parent instance + * @throws UnsupportedOperationException if the device does not support MTE * @param policy the MTE policy to be set */ public void setMtePolicy(@MtePolicy int policy) { diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 7d1b5ca4867ef..616b4b783ffd7 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -20166,6 +20166,17 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { DevicePolicyManager.MTE_ENABLED); Preconditions.checkArgument( allowedModes.contains(flags), "Provided mode is not one of the allowed values."); + // In general, this API should be available when "bootctl_settings_toggle" is set, which + // signals that there is a control for MTE in the user settings and this API fundamentally + // is a way for the device admin to override that setting. + // Allow bootctl_device_policy_manager as an override, e.g. to offer the + // DevicePolicyManager only without a visible user setting. + if (!mInjector.systemPropertiesGetBoolean( + "ro.arm64.memtag.bootctl_device_policy_manager", + mInjector.systemPropertiesGetBoolean( + "ro.arm64.memtag.bootctl_settings_toggle", false))) { + throw new UnsupportedOperationException("device does not support MTE"); + } final CallerIdentity caller = getCallerIdentity(); if (flags == DevicePolicyManager.MTE_DISABLED) { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller));