Update OverlayPackagesProvider to never remove the role holder

The role holder must always be in the work profile, regardless of
whether it has a launcher icon or not.

Fixes: 216622058
Test: atest OverlayPackagesProviderTest
Change-Id: Iadb63e057ada0089cb38274298b47a192e4e128c

services/devicepolicy/java/com/android/server/devicepolicy/OverlayPackagesProvider.java

@@ -34,6 +34,7 @@ import android.annotation.NonNull;
 import android.annotation.UserIdInt;
 import android.app.admin.DeviceAdminReceiver;
 import android.app.admin.DevicePolicyManager;
+import android.app.role.RoleManager;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
@@ -41,6 +42,7 @@ import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
+import android.os.Binder;
 import android.util.ArraySet;
 import android.util.IndentingPrintWriter;
 import android.view.inputmethod.InputMethodInfo;
@@ -91,6 +93,8 @@ public class OverlayPackagesProvider {
         List<InputMethodInfo> getInputMethodListAsUser(@UserIdInt int userId);
 
         String getActiveApexPackageNameContainingPackage(String packageName);
+
+        String getDeviceManagerRoleHolderPackageName(Context context);
     }
 
     private static final class DefaultInjector implements Injector {
@@ -104,6 +108,19 @@ public class OverlayPackagesProvider {
         public String getActiveApexPackageNameContainingPackage(String packageName) {
             return ApexManager.getInstance().getActiveApexPackageNameContainingPackage(packageName);
         }
+
+        @Override
+        public String getDeviceManagerRoleHolderPackageName(Context context) {
+            return Binder.withCleanCallingIdentity(() -> {
+                RoleManager roleManager = context.getSystemService(RoleManager.class);
+                List<String> roleHolders =
+                        roleManager.getRoleHolders(RoleManager.ROLE_DEVICE_MANAGER);
+                if (roleHolders.isEmpty()) {
+                    return null;
+                }
+                return roleHolders.get(0);
+            });
+        }
     }
 
     @VisibleForTesting
@@ -142,9 +159,20 @@ public class OverlayPackagesProvider {
         nonRequiredApps.addAll(getDisallowedApps(provisioningAction));
         nonRequiredApps.removeAll(
                 getRequiredAppsMainlineModules(nonRequiredApps, provisioningAction));
+        nonRequiredApps.removeAll(getDeviceManagerRoleHolders());
         return nonRequiredApps;
     }
 
+    private Set<String> getDeviceManagerRoleHolders() {
+        HashSet<String> result = new HashSet<>();
+        String deviceManagerRoleHolderPackageName =
+                mInjector.getDeviceManagerRoleHolderPackageName(mContext);
+        if (deviceManagerRoleHolderPackageName != null) {
+            result.add(deviceManagerRoleHolderPackageName);
+        }
+        return result;
+    }
+
     /**
      * Returns a subset of {@code packageNames} whose packages are mainline modules declared as
      * required apps via their app metadata.

services/tests/servicestests/src/com/android/server/devicepolicy/OverlayPackagesProviderTest.java

@@ -26,6 +26,7 @@ import static android.app.admin.DevicePolicyManager.REQUIRED_APP_MANAGED_USER;
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.when;
 
@@ -76,6 +77,7 @@ public class OverlayPackagesProviderTest {
     private static final ComponentName TEST_MDM_COMPONENT_NAME = new ComponentName(
             TEST_DPC_PACKAGE_NAME, "pc.package.name.DeviceAdmin");
     private static final int TEST_USER_ID = 123;
+    private static final String ROLE_HOLDER_PACKAGE_NAME = "test.role.holder.package.name";
 
     private @Mock Resources mResources;
 
@@ -305,6 +307,26 @@ public class OverlayPackagesProviderTest {
                 ACTION_PROVISION_MANAGED_PROFILE, "package1", "package2", "package3");
     }
 
+    @Test
+    public void testGetNonRequiredApps_managedProfile_roleHolder_works() {
+        when(mInjector.getDeviceManagerRoleHolderPackageName(any()))
+                .thenReturn(ROLE_HOLDER_PACKAGE_NAME);
+        setSystemAppsWithLauncher("package1", "package2", ROLE_HOLDER_PACKAGE_NAME);
+
+        verifyAppsAreNonRequired(
+                ACTION_PROVISION_MANAGED_PROFILE, "package1", "package2");
+    }
+
+    @Test
+    public void testGetNonRequiredApps_managedDevice_roleHolder_works() {
+        when(mInjector.getDeviceManagerRoleHolderPackageName(any()))
+                .thenReturn(ROLE_HOLDER_PACKAGE_NAME);
+        setSystemAppsWithLauncher("package1", "package2", ROLE_HOLDER_PACKAGE_NAME);
+
+        verifyAppsAreNonRequired(
+                ACTION_PROVISION_MANAGED_DEVICE, "package1", "package2");
+    }
+
     private void setupRegularModulesWithManagedUser(String... regularModules) {
         setupRegularModulesWithMetadata(regularModules, REQUIRED_APP_MANAGED_USER);
     }