From 13a402b079371c1d5820d7cbe37619d631a0811f Mon Sep 17 00:00:00 2001 From: Kholoud Mohamed Date: Sun, 16 Apr 2023 19:43:37 +0000 Subject: [PATCH] Reaaply policies on reboot And add missing policy engine gating checks Bug: 273494642 Test: btest android.devicepolicy.cts.LockTaskTest Change-Id: Ie1e610f01a22321f8b82a8731f4346d7b3c4029d --- .../devicepolicy/DevicePolicyEngine.java | 33 +++++++++++++++++-- .../DevicePolicyManagerService.java | 21 +++++++----- 2 files changed, 44 insertions(+), 10 deletions(-) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java index 1027b31b1879a..415440b1f46dc 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java @@ -1017,8 +1017,12 @@ final class DevicePolicyEngine { int userId = user.id; // Apply local policies present on parent to newly created child profile. UserInfo parentInfo = mUserManager.getProfileParent(userId); - if (parentInfo == null || parentInfo.getUserHandle().getIdentifier() == userId) return; - + if (parentInfo == null || parentInfo.getUserHandle().getIdentifier() == userId) { + return; + } + if (!mLocalPolicies.contains(parentInfo.getUserHandle().getIdentifier())) { + return; + } for (Map.Entry> entry : mLocalPolicies.get( parentInfo.getUserHandle().getIdentifier()).entrySet()) { enforcePolicyOnUser(userId, entry.getValue()); @@ -1242,6 +1246,31 @@ final class DevicePolicyEngine { synchronized (mLock) { clear(); new DevicePoliciesReaderWriter().readFromFileLocked(); + reapplyAllPolicies(); + } + } + + private void reapplyAllPolicies() { + for (PolicyKey policy : mGlobalPolicies.keySet()) { + PolicyState policyState = mGlobalPolicies.get(policy); + // Policy definition and value will always be of the same type + PolicyDefinition policyDefinition = + (PolicyDefinition) policyState.getPolicyDefinition(); + PolicyValue policyValue = (PolicyValue) policyState.getCurrentResolvedPolicy(); + enforcePolicy(policyDefinition, policyValue, UserHandle.USER_ALL); + } + for (int i = 0; i < mLocalPolicies.size(); i++) { + int userId = mLocalPolicies.keyAt(i); + for (PolicyKey policy : mLocalPolicies.get(userId).keySet()) { + PolicyState policyState = mLocalPolicies.get(userId).get(policy); + // Policy definition and value will always be of the same type + PolicyDefinition policyDefinition = + (PolicyDefinition) policyState.getPolicyDefinition(); + PolicyValue policyValue = + (PolicyValue) policyState.getCurrentResolvedPolicy(); + enforcePolicy(policyDefinition, policyValue, userId); + + } } } diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 1e58e2dcc6e6f..20774174cee10 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -2131,7 +2131,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { mUserManagerInternal.addUserLifecycleListener(new UserLifecycleListener()); mDeviceManagementResourcesProvider.load(); - if (isPermissionCheckFlagEnabled()) { + if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) { mDevicePolicyEngine.load(); } @@ -3280,8 +3280,10 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { policy.validatePasswordOwner(); updateMaximumTimeToLockLocked(userHandle); - updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userHandle); - updateLockTaskFeaturesLocked(policy.mLockTaskFeatures, userHandle); + if (!isPolicyEngineForFinanceFlagEnabled()) { + updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userHandle); + updateLockTaskFeaturesLocked(policy.mLockTaskFeatures, userHandle); + } if (policy.mStatusBarDisabled) { setStatusBarDisabledInternal(policy.mStatusBarDisabled, userHandle); } @@ -3593,7 +3595,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { } startOwnerService(userId, "start-user"); - if (isPermissionCheckFlagEnabled()) { + if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) { mDevicePolicyEngine.handleStartUser(userId); } } @@ -3620,7 +3622,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { void handleUnlockUser(int userId) { startOwnerService(userId, "unlock-user"); - if (isPermissionCheckFlagEnabled()) { + if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) { mDevicePolicyEngine.handleUnlockUser(userId); } } @@ -3632,7 +3634,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { void handleStopUser(int userId) { updateNetworkPreferenceForUser(userId, List.of(PreferentialNetworkServiceConfig.DEFAULT)); mDeviceAdminServiceController.stopServicesForUser(userId, /* actionForLog= */ "stop-user"); - if (isPermissionCheckFlagEnabled()) { + if (isPermissionCheckFlagEnabled() || isPolicyEngineForFinanceFlagEnabled()) { mDevicePolicyEngine.handleStopUser(userId); } } @@ -10205,7 +10207,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { policy.mUserProvisioningState = DevicePolicyManager.STATE_USER_UNMANAGED; policy.mAffiliationIds.clear(); policy.mLockTaskPackages.clear(); - updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userId); + if (!isPolicyEngineForFinanceFlagEnabled()) { + updateLockTaskPackagesLocked(mContext, policy.mLockTaskPackages, userId); + } policy.mLockTaskFeatures = DevicePolicyManager.LOCK_TASK_FEATURE_NONE; saveSettingsLocked(userId); @@ -10995,7 +10999,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { return false; } - if (!isPermissionCheckFlagEnabled()) { + if (!isPermissionCheckFlagEnabled() && !isPolicyEngineForFinanceFlagEnabled()) { // TODO: Figure out if something like this needs to be restored for policy engine final ComponentName profileOwner = getProfileOwnerAsUser(userId); if (profileOwner == null) { @@ -14878,6 +14882,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { } final List lockTaskPackages = getUserData(userId).mLockTaskPackages; + // TODO(b/278438525): handle in the policy engine if (!lockTaskPackages.isEmpty()) { Slogf.d(LOG_TAG, "User id " + userId + " not affiliated. Clearing lock task packages");