docs: Migrating Direct Boot preview docs into DAC
For Android N release, migrating and updating Direct Boot docs into regular DAC docs. Updated TOC and added redirect. Removed preview/features doc. Bug: 30256895 Change-Id: I5c6d457dc69c911199f86f0e0ed93ec7d6244779
This commit is contained in:
@@ -1212,3 +1212,5 @@ redirects:
|
|||||||
to: /training/tv/playback/picture-in-picture.html
|
to: /training/tv/playback/picture-in-picture.html
|
||||||
- from: /preview/features/tv-recording-api.html
|
- from: /preview/features/tv-recording-api.html
|
||||||
to: /training/tv/tif/content-recording.html
|
to: /training/tv/tif/content-recording.html
|
||||||
|
- from: /preview/features/direct-boot.html
|
||||||
|
to: /training/articles/direct-boot.html
|
||||||
|
|||||||
@@ -1392,6 +1392,11 @@ toc:
|
|||||||
path_attributes:
|
path_attributes:
|
||||||
- name: description
|
- name: description
|
||||||
value: How to create an application that enforces security policies on devices.
|
value: How to create an application that enforces security policies on devices.
|
||||||
|
- title: Supporting Direct Boot
|
||||||
|
path: /training/articles/direct-boot.html
|
||||||
|
path_attributes:
|
||||||
|
- name: description
|
||||||
|
value: How use device encrypted storage during Direct Boot mode.
|
||||||
|
|
||||||
- title: Best Practices for Permissions & Identifiers
|
- title: Best Practices for Permissions & Identifiers
|
||||||
path: /training/best-permissions-ids.html
|
path: /training/best-permissions-ids.html
|
||||||
|
|||||||
@@ -1,12 +1,10 @@
|
|||||||
page.title=Direct Boot
|
page.title=Supporting Direct Boot
|
||||||
page.keywords=preview,sdk,direct boot
|
page.keywords=direct boot
|
||||||
page.tags=androidn
|
|
||||||
page.image=images/cards/card-nyc_2x.jpg
|
|
||||||
|
|
||||||
@jd:body
|
@jd:body
|
||||||
|
|
||||||
<div id="qv-wrapper">
|
<div id="tb-wrapper">
|
||||||
<div id="qv">
|
<div id="tb">
|
||||||
<h2>In this document</h2>
|
<h2>In this document</h2>
|
||||||
<ol>
|
<ol>
|
||||||
<li><a href="#run">Requesting Access to Run During Direct Boot</a></li>
|
<li><a href="#run">Requesting Access to Run During Direct Boot</a></li>
|
||||||
@@ -19,7 +17,7 @@ page.image=images/cards/card-nyc_2x.jpg
|
|||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<p>Android N runs in a secure, <i>Direct Boot</i> mode
|
<p>Android 7.0 runs in a secure, <i>Direct Boot</i> mode
|
||||||
when the device has been powered on but the user has not unlocked the
|
when the device has been powered on but the user has not unlocked the
|
||||||
device. To support this, the system provides two storage locations for data:</p>
|
device. To support this, the system provides two storage locations for data:</p>
|
||||||
|
|
||||||
@@ -63,21 +61,23 @@ storage. Apps register with the system by marking components as
|
|||||||
<code>android:directBootAware</code> attribute to true in your manifest.<p>
|
<code>android:directBootAware</code> attribute to true in your manifest.<p>
|
||||||
|
|
||||||
<p>Encryption aware components can register to receive a
|
<p>Encryption aware components can register to receive a
|
||||||
<code>LOCKED_BOOT_COMPLETED</code> broadcast message from the
|
{@link android.content.Intent#ACTION_LOCKED_BOOT_COMPLETED
|
||||||
|
ACTION_LOCKED_BOOT_COMPLETED} broadcast message from the
|
||||||
system when the device has been restarted. At this point device encrypted
|
system when the device has been restarted. At this point device encrypted
|
||||||
storage is available, and your component can execute tasks that need to be
|
storage is available, and your component can execute tasks that need to be
|
||||||
run during Direct Boot mode, such as triggering a scheduled alarm.</p>
|
run during Direct Boot mode, such as triggering a scheduled alarm.</p>
|
||||||
|
|
||||||
<p>The following code snippet is an example of how to register a
|
<p>The following code snippet is an example of how to register a
|
||||||
{@link android.content.BroadcastReceiver} as encryption aware, and add an
|
{@link android.content.BroadcastReceiver} as encryption aware, and add an
|
||||||
intent filter for <code>LOCKED_BOOT_COMPLETED</code>, in the app manifest:</p>
|
intent filter for {@link android.content.Intent#ACTION_LOCKED_BOOT_COMPLETED
|
||||||
|
ACTION_LOCKED_BOOT_COMPLETED}, in the app manifest:</p>
|
||||||
|
|
||||||
<pre>
|
<pre>
|
||||||
<receiver
|
<receiver
|
||||||
android:directBootAware="true" >
|
android:directBootAware="true" >
|
||||||
...
|
...
|
||||||
<intent-filter>
|
<intent-filter>
|
||||||
<action android:name="android.intent.action.LOCKED_BOOT_COMPLETED" />
|
<action android:name="android.intent.action.ACTION_LOCKED_BOOT_COMPLETED" />
|
||||||
</intent-filter>
|
</intent-filter>
|
||||||
</receiver>
|
</receiver>
|
||||||
</pre>
|
</pre>
|
||||||
@@ -89,7 +89,8 @@ device encrypted storage as well as credential encrypted storage.</p>
|
|||||||
|
|
||||||
<p>To access device encrypted storage, create a second
|
<p>To access device encrypted storage, create a second
|
||||||
{@link android.content.Context} instance by calling
|
{@link android.content.Context} instance by calling
|
||||||
<code>Context.createDeviceProtectedStorageContext()</code>. All storage API
|
{@link android.content.Context#createDeviceProtectedStorageContext
|
||||||
|
Context.createDeviceProtectedStorageContext()}. All storage API
|
||||||
calls made using this context access the device encrypted storage. The
|
calls made using this context access the device encrypted storage. The
|
||||||
following example accesses the device encrypted storage and opens an existing
|
following example accesses the device encrypted storage and opens an existing
|
||||||
app data file:</p>
|
app data file:</p>
|
||||||
@@ -120,7 +121,8 @@ after boot:
|
|||||||
</p>
|
</p>
|
||||||
<ul>
|
<ul>
|
||||||
<li>If your app has foreground processes that need immediate notification,
|
<li>If your app has foreground processes that need immediate notification,
|
||||||
listen for the {@code ACTION_USER_UNLOCKED} message.</li>
|
listen for the {@link android.content.Intent#ACTION_USER_UNLOCKED
|
||||||
|
ACTION_USER_UNLOCKED} message.</li>
|
||||||
<li>If your app only uses background processes that can act on a delayed
|
<li>If your app only uses background processes that can act on a delayed
|
||||||
notification, listen for the
|
notification, listen for the
|
||||||
{@link android.content.Intent#ACTION_BOOT_COMPLETED ACTION_BOOT_COMPLETED}
|
{@link android.content.Intent#ACTION_BOOT_COMPLETED ACTION_BOOT_COMPLETED}
|
||||||
@@ -128,14 +130,17 @@ message.</li>
|
|||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<p>If the user has unlocked the device, you can find out by calling
|
<p>If the user has unlocked the device, you can find out by calling
|
||||||
<code>UserManager.isUserUnlocked()</code>.</p>
|
{@link android.os.UserManager#isUserUnlocked UserManager.isUserUnlocked()}.
|
||||||
|
</p>
|
||||||
|
|
||||||
<h2 id="migrating">Migrating Existing Data</h2>
|
<h2 id="migrating">Migrating Existing Data</h2>
|
||||||
|
|
||||||
<p>If a user updates their device to use Direct Boot mode, you might have
|
<p>If a user updates their device to use Direct Boot mode, you might have
|
||||||
existing data that needs to get migrated to device encrypted storage. Use
|
existing data that needs to get migrated to device encrypted storage. Use
|
||||||
<code>Context.moveSharedPreferencesFrom()</code> and
|
{@link android.content.Context#moveSharedPreferencesFrom
|
||||||
<code>Context.moveDatabaseFrom()</code> to migrate preference and database
|
Context.moveSharedPreferencesFrom()} and
|
||||||
|
{@link android.content.Context#moveDatabaseFrom
|
||||||
|
Context.moveDatabaseFrom()} to migrate preference and database
|
||||||
data between credential encrypted storage and device encrypted storage.</p>
|
data between credential encrypted storage and device encrypted storage.</p>
|
||||||
|
|
||||||
<p>Use your best judgment when deciding what data to migrate from credential
|
<p>Use your best judgment when deciding what data to migrate from credential
|
||||||
@@ -146,13 +151,13 @@ separate sets of data in the two encrypted stores.</p>
|
|||||||
|
|
||||||
<h2 id="testing">Testing Your Encryption Aware App</h2>
|
<h2 id="testing">Testing Your Encryption Aware App</h2>
|
||||||
|
|
||||||
<p>Test your encryption aware app using the new Direct Boot mode. There are
|
<p>Test your encryption aware app with Direct Boot mode enabled. There are
|
||||||
two ways to enable Direct Boot.</p>
|
two ways to enable Direct Boot.</p>
|
||||||
|
|
||||||
<p class="caution"><strong>Caution:</strong> Enabling Direct Boot
|
<p class="caution"><strong>Caution:</strong> Enabling Direct Boot
|
||||||
wipes all user data on the device.</p>
|
wipes all user data on the device.</p>
|
||||||
|
|
||||||
<p>On supported devices with Android N installed, enable
|
<p>On supported devices with Android 7.0 installed, enable
|
||||||
Direct Boot by doing one of the following:</p>
|
Direct Boot by doing one of the following:</p>
|
||||||
|
|
||||||
<ul>
|
<ul>
|
||||||
@@ -194,14 +199,14 @@ $ adb shell sm set-emulate-fbe false
|
|||||||
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
||||||
DevicePolicyManager.getStorageEncryptionStatus()} to check the current
|
DevicePolicyManager.getStorageEncryptionStatus()} to check the current
|
||||||
encryption status of the device. If your app is targeting an API level
|
encryption status of the device. If your app is targeting an API level
|
||||||
lower than Android N,
|
lower than 24.0 (Android 7.0),
|
||||||
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
||||||
getStorageEncryptionStatus()} will return
|
getStorageEncryptionStatus()} will return
|
||||||
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
||||||
ENCRYPTION_STATUS_ACTIVE} if the device is either using full-disk encryption,
|
ENCRYPTION_STATUS_ACTIVE} if the device is either using full-disk encryption,
|
||||||
or file-based encryption with Direct Boot. In both of these cases, data is
|
or file-based encryption with Direct Boot. In both of these cases, data is
|
||||||
always stored encrypted at rest. If your app is targeting an API level of
|
always stored encrypted at rest. If your app is targeting an API level of
|
||||||
Android N or higher,
|
24.0 or higher,
|
||||||
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
{@link android.app.admin.DevicePolicyManager#getStorageEncryptionStatus
|
||||||
getStorageEncryptionStatus()} will return
|
getStorageEncryptionStatus()} will return
|
||||||
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
||||||
@@ -212,7 +217,7 @@ ENCRYPTION_STATUS_ACTIVE_PER_USER} if the device is using file-based encryption
|
|||||||
with Direct Boot.</p>
|
with Direct Boot.</p>
|
||||||
|
|
||||||
<p>If you build a device administration app
|
<p>If you build a device administration app
|
||||||
that targets Android N, make sure to check for both
|
that targets Android 7.0, make sure to check for both
|
||||||
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE
|
||||||
ENCRYPTION_STATUS_ACTIVE} and
|
ENCRYPTION_STATUS_ACTIVE} and
|
||||||
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE_PER_USER
|
{@link android.app.admin.DevicePolicyManager#ENCRYPTION_STATUS_ACTIVE_PER_USER
|
||||||
Reference in New Issue
Block a user