* Handling of device owners without component names.
* Migration of user restriction from UserManager to DPMS.
* Handling legacy owners format.
* Legacy tag TAG_DEVICE_INITIALIZER in owners.
This code can only be invoked on a device that is upgrading from
M or below straight into T+, so the device should have a lifespan
of 8 dessert releases. This is more than twice than any device
officially supports.
This change is needed to make further changes for the issue
simpler.
Bug: 218639412
Test: atest com.android.server.devicepolicy.OwnersTest
Test: atest com.android.server.devicepolicy.DevicePolicyManagerServiceMigrationTest
Change-Id: I142ac7f690ebb5fb7a94cc32306aeb4a6321e541
Bug: 227653108
This adds a helper class that can reduce much of the boilerplate in
code that uses IpcDataCache (or the internal-only variant,
PropertyInvalidatedCache). See the changes to DevicePolicyManager for
example usage.
Two PropertyInvalidatedCaches APIs are exposed for testing. The
method createPropertyName() is changed so that apis like "Foo" are
converted to "foo", not "_foo".
Unit tests for the new behavior are added to IpcDataCacheTest.
This was manually tested by dumping the cache info from builds with
and without this change. Special attention is paid to the
DevicePolicyManager caches. The same caches were found (as identified
by their key and api) and the caches were enabled/disabled the same.
In the course of testing, multiple instances of DevicePolicyManager
caches were observed. Cache performance is better if the caches are
static; making them static will be addressed in b/228452829.
Test:
* atest FrameworksCoreTests:IpcDataCacheTest
* atest FrameworksCoreTests:PropertyInvalidatedCacheTests
* atest FrameworksServicesTests:DevicePolicyConstantsTest
* atest FrameworksServicesTests:DevicePolicyEventLoggerTest
* atest FrameworksServicesTests:DevicePolicyManagerServiceMigrationTest
* atest FrameworksServicesTests:DevicePolicyManagerTest
* atest FrameworksServicesTests:EnterpriseSpecificIdCalculatorTest
* atest FrameworksServicesTests:OverlayPackagesProviderTest
* atest FrameworksServicesTests:OwnersTest
* atest FrameworksServicesTests:PolicyVersionUpgraderTest
* atest FrameworksServicesTests:SecurityEventTest
* atest FrameworksServicesTests:SystemUpdatePolicyTest
* atest FrameworksServicesTests:TransferOwnershipMetadataManagerTest
* atest MixedDeviceOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
* atest MixedDeviceOwnerTest#testSetKeyguardDisabledFeatures
* atest MixedManagedProfileOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
* atest MixedManagedProfileOwnerTest#testNetworkLoggingDelegate
* atest MixedManagedProfileOwnerTest#testSetKeyguardDisabledFeatures
* atest OrgOwnedProfileOwnerTest#testIsDeviceOrganizationOwnedWithManagedProfile
* atest OrgOwnedProfileOwnerTest#testNetworkLoggingDelegate
* atest OrgOwnedProfileOwnerTest#testSetKeyguardDisabledFeatures
* atest android.devicepolicy.cts.DevicePolicyManagerTest
* atest android.devicepolicy.cts.NetworkLoggingTest
* atest com.android.cts.devicepolicy.DeviceOwnerTest#testAdminActionBookkeeping
Change-Id: I2f4fe4ed25db5fb3100334b9d2ce748ee928c10d
Since FDE (Full Disk Encryption) is no longer supported, there is no
need for DevicePolicyManagerService.getEncryptionStatus() to check for
FDE-specific encryption statuses.
There is more that needs to be cleaned up here, but this gets rid of the
dependency on some obsolete StorageManager methods.
Bug: 208476087
Test: atest DevicePolicyManagerTest
Change-Id: I26c3fafc1b134177324de929d3600fb2dd7f4d1d
Bug: 190489030
Put a binder cache in front of IDevicePolicyManager APIs. The
following APIs are cached:
* getKeyguardDisabledFeatures()
* hasDeviceOwner()
* getProfileOwnerOrDeviceOwnerSupervisionComponent()
* isOrganizationOwnedDeviceWithManagedProfile()
* getDeviceOwnerOrganizationName()
* getOrganizationNameForUser()
* isNetworkLoggingEnabled()
The caches use a shared key which means that all are invalidated at
the same time. This is slightly less efficient than API-specific
invalidation but it greatly simplifies the invalidation logic in the
server. The cost of invalidating all caches at the same time is small
if invalidation happens infrequently (less than one an hour, on
average).
The test classes are modified to disable caches in the local process.
Test:
* atest FrameworksServicesTests:DevicePolicyConstantsTest
* atest FrameworksServicesTests:DevicePolicyEventLoggerTest
* atest FrameworksServicesTests:DevicePolicyManagerServiceMigrationTest
* atest FrameworksServicesTests:DevicePolicyManagerTest
* atest FrameworksServicesTests:EnterpriseSpecificIdCalculatorTest
* atest FrameworksServicesTests:OverlayPackagesProviderTest
* atest FrameworksServicesTests:OwnersTest
* atest FrameworksServicesTests:PolicyVersionUpgraderTest
* atest FrameworksServicesTests:SecurityEventTest
* atest FrameworksServicesTests:SystemUpdatePolicyTest
* atest FrameworksServicesTests:TransferOwnershipMetadataManagerTest
Change-Id: Iead8644cb413b45f3b6f3da81ff00a61788941a2
* Send location from the fused, network and gps providers (in order)
* Do not loop though all location providers
Bug: 223148704
Test: atest android.devicepolicy.cts.LostModeLocationTest
atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: I2d73130c304e01e9342c40f4589791f34747f4a5
FDE (Full Disk Encryption) is no longer supported, so
StorageManager.inCryptKeeperBounce() is now hard-coded to return false.
In preparation for removing this method, stop calling it from the device
policy manager.
Bug: 208476087
Change-Id: I17ab54dd622aaf749e8c2df925b71f042f440ef8
1. Fail early when token handle is invalid
2. Dump out token handle in DPMS
Bug: 203411634
Test: dumpsys device_policy
Change-Id: I4d87b07113f746ea7e7457fada865f39a22a629e
WifiSsidPolicy is parcelable, so there is no need to marshall it
explicitly as a deny- or allow-list using separate getters and
setters.
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
test: atest WifiSsidRestrictionTest
Bug: 218495535
Change-Id: Iee06acb6b136766fb16cef2d60a46bd7373b5c56
When setting a permission grant on a non-existent permission,
implementation currently throws RemoteException but that's not
propagated across binder causing the client cide to stuck until
the timeout. Replace this with an immediate fail.
Bug: 197200931
Test: manual with TestDPC
Change-Id: I9a0ea42e52d68259eb0464194a5a1d9fbfc2a216
In remote bugreport collection, Shell sends REMOTE_BUGREPORT_DISPATCH to
DevicePolicyManagerService which in turn notifies Device Owners that a
bug report is ready for collection. There existed a threat where a
malicous user could spoof the REMOTE_BUGREPORT_DISPATCH broadcast via
ADB to send a crafted bugreport to the Device Owner. Securing
REMOTE_BUGREPORT_DISPATCH is not as easy as it appears: putting a
permission on REMOTE_BUGREPORT_DISPATCH does not work since both the
legitimate sender and the malicious user are UID_SHELL. Instead, we
introduces a nonce which was sent from DPMS to Shell when bugreport is
triggered, and DPM will only accept REMOTE_BUGREPORT_DISPATCH when
a matching nonce is seen.
Ignore-AOSP-First: security fix
Bug: 171495100
Test: atest DeviceOwnerTest#testRemoteBugreportWithTwoUsers
Test: atest DeviceOwnerTest#testAdminActionBookkeeping
Test: atest BugreportManagerTest
Change-Id: I7649b4f22b74647d152d76bb46d5ca70bfa3617d
Merged-In: I7649b4f22b74647d152d76bb46d5ca70bfa3617d
(cherry picked from commit a4131c50d0)
Changes:
* Use TRIGGER_LOST_MODE permission to gate the
DevicePolicyManager API sendLostModeLocationUpdate
Bug: 223148704
Test: atest android.devicepolicy.cts.LostModeLocationTest
Change-Id: If15388a377c75b7581c9c2a35b3d9828f78e13fc
Merged-In: If15388a377c75b7581c9c2a35b3d9828f78e13fc
Get device owner app admin when prefentialNetworkService is
configured by device owner
Bug: 219651203
Test: cts
Change-Id: Ic748227e8d12896361216f6ea67776660b752e4e
In remote bugreport collection, Shell sends REMOTE_BUGREPORT_DISPATCH to
DevicePolicyManagerService which in turn notifies Device Owners that a
bug report is ready for collection. There existed a threat where a
malicous user could spoof the REMOTE_BUGREPORT_DISPATCH broadcast via
ADB to send a crafted bugreport to the Device Owner. Securing
REMOTE_BUGREPORT_DISPATCH is not as easy as it appears: putting a
permission on REMOTE_BUGREPORT_DISPATCH does not work since both the
legitimate sender and the malicious user are UID_SHELL. Instead, we
introduces a nonce which was sent from DPMS to Shell when bugreport is
triggered, and DPM will only accept REMOTE_BUGREPORT_DISPATCH when
a matching nonce is seen.
Ignore-AOSP-First: security fix
Bug: 171495100
Test: atest DeviceOwnerTest#testRemoteBugreportWithTwoUsers
Test: atest DeviceOwnerTest#testAdminActionBookkeeping
Test: atest BugreportManagerTest
Change-Id: I7649b4f22b74647d152d76bb46d5ca70bfa3617d
Dont hold lock while calling in to NetworkPolicyManagerService in
removeAdminArtifacts
Bug: 223382458
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest#testForceRemoveActiveAdmin_nonShellCallerWithPermission
atest com.android.server.devicepolicy.DevicePolicyManagerTest#testForceRemoveActiveAdmin_ShellCaller
Change-Id: I1e83201211678df203908a52759858fa7dd44e5b
* changes:
RESTRICT AUTOMERGE Refactor device policy resource APIs to a separate class
RESTRICT AUTOMERGE move device policy resource APIs to a separate class
RESTRICT AUTOMERGE hide device policy resources constants
That way the logic to get a managed profile can be
customizable by OEMs.
Fixes: 214473624
Test: manual
Test: CTS tests to be added in a follow-up CL
Change-Id: Id183e987d2cb04040db028b9913188267d1a9a84
