We now have javadoc based docs generated from these comments now. Ensure
the links can be resolved.
Bug: 144927670
Test: Test: m -j offline-sdk-docs
Change-Id: Ie9827ad02ad91ab7f01226a3a741c94fa46de730
Make isOrganizationOwnedDeviceWithManagedProfile a public method, as
there is no reason to keep this information hidden from apps.
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedProfileOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedDeviceOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
Bug: 143518237
Bug: 144978467
Bug: 147340575
Bug: 146123237
Change-Id: Iab45f20c9150a6b8bd48eea610484f36f199d3d7
Restrict adding a managed profile when the device has a device owner.
This mode is no longer supported, in favour of Corporate Owned,
Personally Enabled mode (Organization-Owned device with Managed Profile).
The restriction on adding managed profiles is now added by default when
a device owner is set, and is removed when the device owner is removed,
to avoid other system copoments from creating a managed profile when
there's a device owner.
Additionally, the method for checking whether pre-provisioning
conditions are met has been modified to return an error if the
restriction is set.
Bug: 145271440
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Change-Id: Ife25f4e2faffe84d85ab7786407c14997b4cf069
Historically, FRP behaviour was built on top of the application restrictions
infrastructure. This CL introduces new behaviour, as the profile owner of an
organization-owned device needs to be able to control FRP behaviour and
cannot set application restrictions on user 0.
- Introduced a new FactoryResetProtectionPolicy object
- Added it as a field to ActiveAdmin
- Created a default value
- Added setFactoryResetProtectionPolicy to DPM which is used to set a
factory reset protection policy. If the policy is null, the current
policy is cleared and set back to the default value.
- Added getFactoryResetProtectionPolicy to DPM to retrieve the current
factory reset protection policy. If this is the default value, then
no policy is set.
- Both these APIs are callable by the device owner or profile owner of
an organization-owned device.
Bug: 143517230
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
atest com.android.server.devicepolicy.FactoryResetProtectionPolicyTest
atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testFactoryResetProtectionPolicy
atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testFactoryResetProtectionPolicy
Change-Id: I72c4d06ec8a27741a1956d082969573077937726
Add CrossProfileApps#canRequestInteractAcrossProfiles,
and CrossProfileApps#canInteractAcrossProfiles public APIs.
This provides apps the ability to check if they can interact across profiles,
or can they request that from the user if not.
BUG: 136249261
Test: in progress
Change-Id: Ifd561d5d5efcd167e24a5f05c22496d1fe9c81fc
Add a method to the DevicePolicyManager for finding out if the device is
an organization-owned device with a work profile (i.e. it has a work
profile but the work profile was created during the provisioning flow).
This method is currently available for privileged callers (system API),
since other methods (e.g. isDeviceManaged) are also restricted.
NOTE: Addition of GTS tests is pending final decision on whether this
will be public API or not.
Bug: 143518237
Bug: 144978467
Bug: 147340575
Test: atest FrameworksServicesTests:DevicePolicyManagerTest#testIsOrganizationOwnedDevice
Test: CTS tests that are on hold for now.
Change-Id: I26ce1de10844dc297924427a6d46df9208931ab0
Fixing a bug in ag/9885696.
Changed to get the active admin for the current user rather
than the calling user.
BUG: 136249261
Test: atest CrossProfileAppsPermissionHostSideTest
Change-Id: I847056b4dbca215438a9856c456d6042ea4fa891
Rename canProfileOwnerAccessDeviceIds to
isProfileOwnerOfOrganizationOwnedDevice, for consistency with other
methods that check whether a profile is of an organization-owned device.
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Change-Id: I7327494ef74f0efb6fe9c3caf4fa89e63e2df3a2
Add cross_profile_apps.xml and
DevicePolicyManager#getAllCrossProfilePackages. This sets the list of default package names set by the OEM for the user to approve/disapprove for
cross profile communication during managed provisioning setup.
Some Javadoc can be improved once all CLs are in, since different APIs
should refer to each other.
BUG: 136249261
BUG: 144577776
BUG: 145970297
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: I214b521ffc7fb0179bff1ca65d6bc2a9f8decea3
Modified setTime and setTimeZone to be callable by a a profile owner
of an organization-owned device as well as a device owner.
Bug: 138709470
Test: Manual testing with testdpc and the set auto time zone toggle
atest com.android.server.devicepolicy.DevicePolicyManagerTest
atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSetTime
atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSetTimeZone
atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testSetTime
atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testSetTimeZone
atest com.android.cts.devicepolicy.DeviceOwnerTest#testSetTime
Change-Id: I2de94035c20fc53cdd629860c84f237f3e7eaa1f
Create new APIs in TelephonyManager for DevicePolicyManager to add
override APNs, and use them in DevicePolicyManagerService instead of
directly accessing the APN database.
Bug: 146834818
Test: cts-tradefed run cts --module DevicePolicyManager --test
com.android.cts.devicepolicy.DeviceOwnerTest#testOverrideApn
Test: atest TelephonyManagerTest
Change-Id: I6c6214424169c05fd452db71a8c6593f8473b9d4
This is part of the NIAP audit logging requirement.
Bug: 137937540
Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testSecurityLoggingWithSingleUser
Change-Id: I4fe1e856337787dcd4fbe1b25ff2e9e5a18c2ce9
Setting a package as protected prevents user from clearing app data and
force stopping apps from Settings and Launcher. Added two apis
* setProtectedPackages()
* getProtectedPackages()
Bug: 135486391
Test: atest DevicePolicyManagerTest
Change-Id: I28858aca89a52ba06af033a24da43f394ed79a0e
Temporarily restore access to device identifiers for a profile owner on
a personal (non corporate-owned) device.
This is a partial revert of ag/9845617.
As this change breaks some Corp use cases, we will be working with the
affected parties on a timeline to re-introduce it.
Bug: 130844684
Bug:110099294
Test: atest com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testProfileOwnerCanGetDeviceIdentifiers
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.ManagedProfileTest
Change-Id: I4444658680f18969b8bd6537b5f69ffb46692dbe
Throw if a caller requests the individual device attestation certificate
to be used for key attestation, but the feature is unavailable in the
device's StrongBox implementation.
Bug: 140194470
Bug: 136494773
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedDeviceOwnerTest#testKeyManagement
Change-Id: Ie289dae2949400443efd14832cb847761b2b92e7
Introduce a helper method for executing a runnable that returns a value
with the binder caller's identity cleared.
Replace multiple call sites which employed the pattern of saving the
caller identity, clearing it and restoring it in the 'finally' block.
This would make the code safer as there'd be no chance of forgetting to
restore the caller's identity or restoring the wrong caller's identity.
This refactoring introduces no functional changes.
Bug: 146552069
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedDeviceOwnerTest
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Change-Id: I7eb84b00009778580560fa5f0bdd0a584f1d454b
As part of the work to deprecate Corporate-Owned Managed Profile (COMP)
mode, remove the restrictions that are set by default when a Device
Owner is set on the device.
The Device Owner used to be able to add/remove the restrictions for
adding/removing a managed profile.
In the new mode, this restriction will be set by default, by the system,
and not removeable by the device owner.
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.DeviceOwnerPlusProfileOwnerTest
Bug: 143517714
Bug: 138709492
Change-Id: Ice5f8b678327b2c901623cc8f4dd6d60271b361b
In the new COPE mode, some user restrictions should be applied globally
when called by the Work Profile PO.
Previously, the APIs addUserRestriction, clearUserRestriction and
getUserRestrictions did not support explicitly querying the parent
profile. This CL allows the WP DPC to now call these methods,
allowing the WP DPC to apply some restrictions globally.
This CL also introduces the enforcingUserId parameter to
setDevicePolicyUserRestriction. This new paramter is used as the
key of mDevicePolicyGlobalUserRestrictions and
mDevicePolicyLocalUserRestrictions.
Bug: 138709470
Test: Manual testing with testdpc
atest com.android.server.devicepolicy.DevicePolicyManagerTest
atest com.android.cts.devicepolicy.UserRestrictionsTest
atest com.android.server.pm.UserRestrictionsUtilsTest
atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testUserRestrictionsSetOnParentAreNotPersisted
atest com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testDevicePolicyManagerParentSupport
Change-Id: Idfafd100bfcb250998a8628aba4cc378f1fc2c84
* Added new API methods setAutoTimeZone and getAutoTimeZone.
* DPCs are recommended to combine these new APIs together with the DISALLOW_CONFIG_DATE_TIME
restriction to prevent the user from changing auto time zone settings.
* The new methods can also be called by the WP PO (COPE mode).
Bug: 138709470
Test: Manual testing with testdpc and the set auto time zone toggle
atest com.android.server.devicepolicy.DevicePolicyManagerTest
atest com.android.cts.devicepolicy.MixedProfileOwnerTest#testSetAutoTimeZone
atest com.android.cts.devicepolicy.ManagedProfileTest#testParentProfileApiDisabled
Change-Id: I841d31f76a848e9679d2d9087426e1d5bb7efd1d
Add DevicePolicyManager#setCrossProfilePackages and
DevicePolicyManager#getCrossProfilePackages. This provides admin consent
for apps that can ask for user consent to communicate cross-profile.
Some Javadoc can be improved once all CLs are in, since different APIs
should refer to each other.
BUG: 136249261
BUG: 144577776
BUG: 141690885
BUG: 145970297
TEST: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: I3f931bb7c1d5e490d04e5450f3010465ed6a5dc6
Previously, these APIs did not support explicitly querying the parent profile.
This CL allows the WP DPC to now call these methods, which means the WP DPC
can disable the camera device-wide and not just for the WP.
Bug: 138709470
Test: manual testing using Personal and WP TestDPC and Camera
atest com.android.cts.devicepolicy.ManagedProfileTest
atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: I7e7ce7be766850c6e2f58c72a0a44990817e9b73
Time has come that we can finally ditch untrusted password reset i.e.
changing lockscreen password without providing the existing password or
an activiated password reset token. In this change, we are:
1. Preventing any DPC / legacy device admin from invoking
DPM.resetPassword(), the primary route to invoke untrusted password
reset. Depending on their target SDK level, resetPassword() will either
throw SecurityException, or fail silently.
2. Still allowing privilleged app holding RESET_PASSWORD permission to
call this API, but it's limited to setting a new passowrd on an
unsecured device.
3. Removing synthetic password caching mechanism in LockSettingsService,
whose sole purpose was to support untrusted password reset.
Bug: 137939224
Test: atest com.android.server.locksettings
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: Ie3e5e277984b6fc2f1d378880363028752bad775
Add TimeZoneDetector.suggestManualTimeZone() to set the time zone
"manually" and switch the device policy manager code over to using
it.
Add RequiredPermission annotations to TimeZoneDetector while there.
Bug: 140712361
Test: treehugger only
Test: atest services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java
Change-Id: Id247fddfdd793732dd88294ee215eda37cd0be4c
Allow the profile owner on an organization-owned device to call
getWifiMacAddress.
Part of this change is introducing a new DeviceAdminInfo policy,
USES_POLICY_ORGANIZATION_OWNED_PROFILE_OWNER, which can be used
to find out if the admin is either device owner or profile owner
on organization-owned device.
Bug: 138709470
Bug: 145308393
Bug: 145336515
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedDeviceOwnerTest#testWifi
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedManagedProfileOwnerTest#testWifiMacAddress
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testWifi
Change-Id: Id790408a07b9dd19530563bd2aa9216a7333e863
