From 03e3789af9bb6c27d1849cbcf9ffa5c24cdd0158 Mon Sep 17 00:00:00 2001 From: Sooraj Sasindran Date: Mon, 9 May 2022 01:36:18 -0700 Subject: [PATCH] Let managed profile owner retrieve enterprise apn Let managed profile owner retrieve enterprise apn All override apn functionality should restricted to device owner or managed profile owner only and not any profile owner Bug: 231360296 Test: system test with test dpc to confirm insertion, query and delete from managed profile works fine Change-Id: I06cdaa43ef015a5432956cbf2c62fd6c8f3a4353 --- .../app/admin/DevicePolicyManager.java | 38 +++++++++++------ .../DevicePolicyManagerService.java | 41 ++++++++++++++++--- 2 files changed, 61 insertions(+), 18 deletions(-) diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index 0a2b421215450..c4a5eea169807 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -11210,7 +11210,9 @@ public class DevicePolicyManager { * for enterprise use. * * An example of a supported preferential network service is the Enterprise - * slice on 5G networks. + * slice on 5G networks. For devices on 4G networks, the profile owner needs to additionally + * configure enterprise APN to set up data call for the preferential network service. + * These APNs can be added using {@link #addOverrideApn}. * * By default, preferential network service is disabled on the work profile and * fully managed devices, on supported carriers and devices. @@ -11260,7 +11262,9 @@ public class DevicePolicyManager { * {@see PreferentialNetworkServiceConfig} * * An example of a supported preferential network service is the Enterprise - * slice on 5G networks. + * slice on 5G networks. For devices on 4G networks, the profile owner needs to additionally + * configure enterprise APN to set up data call for the preferential network service. + * These APNs can be added using {@link #addOverrideApn}. * * By default, preferential network service is disabled on the work profile and fully managed * devices, on supported carriers and devices. Admins can explicitly enable it with this API. @@ -13782,18 +13786,13 @@ public class DevicePolicyManager { } /** - * Called by device owner or profile owner to add an override APN. + * Called by device owner or managed profile owner to add an override APN. * *

This method may returns {@code -1} if {@code apnSetting} conflicts with an existing * override APN. Update the existing conflicted APN with * {@link #updateOverrideApn(ComponentName, int, ApnSetting)} instead of adding a new entry. *

Two override APNs are considered to conflict when all the following APIs return * the same values on both override APNs: - *

Before Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: - * Only device owners can add APNs. - *

Starting from Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: - * Device and profile owners can add enterprise APNs - * ({@link ApnSetting#TYPE_ENTERPRISE}), while only device owners can add other type of APNs. *

* + *

Before Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: + * Only device owners can add APNs. + *

Starting from Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: + * Both device owners and managed profile owners can add enterprise APNs + * ({@link ApnSetting#TYPE_ENTERPRISE}), while only device owners can add other type of APNs. + * Enterprise APNs are specific to the managed profile and do not override any user-configured + * VPNs. They are prerequisites for enabling preferential network service on the managed + * profile on 4G networks ({@link #setPreferentialNetworkServiceConfigs}). + * * @param admin which {@link DeviceAdminReceiver} this request is associated with * @param apnSetting the override APN to insert * @return The {@code id} of inserted override APN. Or {@code -1} when failed to insert into @@ -13830,7 +13838,7 @@ public class DevicePolicyManager { } /** - * Called by device owner or profile owner to update an override APN. + * Called by device owner or managed profile owner to update an override APN. * *

This method may returns {@code false} if there is no override APN with the given * {@code apnId}. @@ -13840,7 +13848,7 @@ public class DevicePolicyManager { *

Before Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: * Only device owners can update APNs. *

Starting from Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: - * Device and profile owners can update enterprise APNs + * Both device owners and managed profile owners can update enterprise APNs * ({@link ApnSetting#TYPE_ENTERPRISE}), while only device owners can update other type of APNs. * * @param admin which {@link DeviceAdminReceiver} this request is associated with @@ -13867,14 +13875,14 @@ public class DevicePolicyManager { } /** - * Called by device owner or profile owner to remove an override APN. + * Called by device owner or managed profile owner to remove an override APN. * *

This method may returns {@code false} if there is no override APN with the given * {@code apnId}. *

Before Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: * Only device owners can remove APNs. *

Starting from Android version {@link android.os.Build.VERSION_CODES#TIRAMISU}: - * Device and profile owners can remove enterprise APNs + * Both device owners and managed profile owners can remove enterprise APNs * ({@link ApnSetting#TYPE_ENTERPRISE}), while only device owners can remove other type of APNs. * * @param admin which {@link DeviceAdminReceiver} this request is associated with @@ -13899,7 +13907,8 @@ public class DevicePolicyManager { } /** - * Called by device owner to get all override APNs inserted by device owner. + * Called by device owner or managed profile owner to get all override APNs inserted by + * device owner or managed profile owner previously using {@link #addOverrideApn}. * * @param admin which {@link DeviceAdminReceiver} this request is associated with * @return A list of override APNs inserted by device owner. @@ -13924,6 +13933,9 @@ public class DevicePolicyManager { *

Override APNs are separated from other APNs on the device, and can only be inserted or * modified by the device owner. When enabled, only override APNs are in use, any other APNs * are ignored. + *

Note: Enterprise APNs added by managed profile owners do not need to be enabled by + * this API. They are part of the preferential network service config and is controlled by + * {@link #setPreferentialNetworkServiceConfigs}. * * @param admin which {@link DeviceAdminReceiver} this request is associated with * @param enabled {@code true} if override APNs should be enabled, {@code false} otherwise diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index ceac1023dfb02..8d36d929595fc 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -1937,6 +1937,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { updatePasswordQualityCacheForUserGroup(userHandle); mPolicyCache.onUserRemoved(userHandle); + if (isManagedProfile(userHandle)) { + clearManagedProfileApnUnchecked(); + } isOrgOwned = mOwners.isProfileOwnerOfOrganizationOwnedDevice(userHandle); mOwners.removeProfileOwner(userHandle); @@ -8755,6 +8758,18 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } + private void clearManagedProfileApnUnchecked() { + if (!mHasTelephonyFeature) { + return; + } + final List apns = getOverrideApnsUnchecked(); + for (ApnSetting apn : apns) { + if (apn.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE) { + removeOverrideApnUnchecked(apn.getId()); + } + } + } + private void clearDeviceOwnerLocked(ActiveAdmin admin, int userId) { mDeviceAdminServiceController.stopServiceForOwner(userId, "clear-device-owner"); @@ -12095,6 +12110,10 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } + private boolean isManagedProfileOwner(CallerIdentity caller) { + return isProfileOwner(caller) && isManagedProfile(caller.getUserId()); + } + private boolean isDefaultSupervisor(CallerIdentity caller) { final String supervisor = mContext.getResources().getString( com.android.internal.R.string.config_defaultSupervisionProfileOwnerComponent); @@ -16295,7 +16314,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { final CallerIdentity caller = getCallerIdentity(who); if (apnSetting.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE) { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller) - || isProfileOwner(caller)); + || isManagedProfileOwner(caller)); } else { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller)); } @@ -16323,7 +16342,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { if (apn != null && apn.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE && apnSetting.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE) { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller) - || isProfileOwner(caller)); + || isManagedProfileOwner(caller)); } else { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller)); } @@ -16351,7 +16370,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { ApnSetting apn = getApnSetting(apnId); if (apn != null && apn.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE) { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller) - || isProfileOwner(caller)); + || isManagedProfileOwner(caller)); } else { Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller)); } @@ -16396,8 +16415,20 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } Objects.requireNonNull(who, "ComponentName is null"); final CallerIdentity caller = getCallerIdentity(who); - Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller)); - return getOverrideApnsUnchecked(); + Preconditions.checkCallAuthorization(isDefaultDeviceOwner(caller) + || isManagedProfileOwner(caller)); + List apnSettings = getOverrideApnsUnchecked(); + if (isProfileOwner(caller)) { + List apnSettingList = new ArrayList<>(); + for (ApnSetting apnSetting : apnSettings) { + if (apnSetting.getApnTypeBitmask() == ApnSetting.TYPE_ENTERPRISE) { + apnSettingList.add(apnSetting); + } + } + return apnSettingList; + } else { + return apnSettings; + } } private List getOverrideApnsUnchecked() {