Android/packages_apps_Settings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace ECM AppOps call with service

Browse Source 
A new ECM service was introcuded in changeId
I831391e4437b51b3312b5273a2360bd029a3d8ee.

We begin calling it, and update/cleanup method signatures to match.

Note: There are two feature flags:

1. enhancedConfirmationModeApisEnabled - read only, protects the
   mainline API.

2. extendEcmToAllSettings - runtime - gates calls to the above APIs.

We use both so we can ramp up in teamfood as needed.

Bug: 297372999
Test: Tested on device
Test: atest SpaPrivilegedLibTests
Test: atest com.android.settings.applications.specialaccess.notificationaccess
Test: atest com.android.settings.datausage
Test: atest PremiumSmsAccessTest
Test: atest RestrictedPreferenceHelperTest
Change-Id: I945ec51df5cd63de548a8ffdd1acc4f09f2301e5
This commit is contained in:
Hani Kazmi
2024-01-29 14:59:22 +00:00
parent 96ab2b9e25
commit 206300962f
23 changed files with 215 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/com/android/settings/ActionDisabledByAppOpsDialog.java
View File

@@ -21,7 +21,6 @@ import android.app.AppOpsManager;
import android.content.DialogInterface;
import android.content.Intent;
import android.os.Bundle;
import android.util.Log;
public class ActionDisabledByAppOpsDialog extends Activity
implements DialogInterface.OnDismissListener {

14
src/com/android/settings/accessibility/AccessibilityDetailsSettingsFragment.java
View File

@@ -43,6 +43,7 @@ import com.android.settings.R;
import com.android.settings.core.InstrumentedFragment;
import com.android.settings.core.SubSettingLauncher;
import com.android.settings.overlay.FeatureFactory;
import com.android.settingslib.RestrictedLockUtilsInternal;
import com.android.settingslib.accessibility.AccessibilityUtils;
import java.util.List;
@@ -164,16 +165,9 @@ public class AccessibilityDetailsSettingsFragment extends InstrumentedFragment {
if (permittedServices != null && !permittedServices.contains(packageName)) {
return false;
}
try {
final int mode = mAppOps.noteOpNoThrow(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid, packageName);
final boolean ecmEnabled = getContext().getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
return !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return true;
}
return !RestrictedLockUtilsInternal.isEnhancedConfirmationRestricted(getContext(),
packageName, AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE);
}
private AccessibilityServiceInfo getAccessibilityServiceInfo(ComponentName componentName) {

68
src/com/android/settings/accessibility/RestrictedPreferenceHelper.java
View File

@@ -235,10 +235,11 @@ public class RestrictedPreferenceHelper {
boolean serviceAllowed = permittedServices == null || permittedServices.contains(
preference.getPackageName());
if (android.security.Flags.extendEcmToAllSettings()) {
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
preference.checkEcmRestrictionAndSetDisabled(
AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE,
preference.getPackageName(), preference.getUid());
preference.getPackageName());
if (preference.isDisabledByEcm()) {
serviceAllowed = false;
}
@@ -257,40 +258,39 @@ public class RestrictedPreferenceHelper {
preference.setEnabled(false);
}
}
return;
}
boolean appOpsAllowed;
if (serviceAllowed) {
try {
final int mode = mAppOps.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
preference.getUid(), preference.getPackageName());
final boolean ecmEnabled = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
appOpsAllowed = !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
serviceAllowed = appOpsAllowed;
} catch (Exception e) {
// Allow service in case if app ops is not available in testing.
appOpsAllowed = true;
}
} else {
appOpsAllowed = false;
}
if (serviceAllowed || serviceEnabled) {
preference.setEnabled(true);
} else {
// Disable accessibility service that are not permitted.
final RestrictedLockUtils.EnforcedAdmin admin =
RestrictedLockUtilsInternal.checkIfAccessibilityServiceDisallowed(
mContext, preference.getPackageName(), UserHandle.myUserId());
if (admin != null) {
preference.setDisabledByAdmin(admin);
} else if (!appOpsAllowed) {
preference.setDisabledByAppOps(true);
boolean appOpsAllowed;
if (serviceAllowed) {
try {
final int mode = mAppOps.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
preference.getUid(), preference.getPackageName());
final boolean ecmEnabled = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
appOpsAllowed = !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
serviceAllowed = appOpsAllowed;
} catch (Exception e) {
// Allow service in case if app ops is not available in testing.
appOpsAllowed = true;
}
} else {
preference.setEnabled(false);
appOpsAllowed = false;
}
if (serviceAllowed || serviceEnabled) {
preference.setEnabled(true);
} else {
// Disable accessibility service that are not permitted.
final RestrictedLockUtils.EnforcedAdmin admin =
RestrictedLockUtilsInternal.checkIfAccessibilityServiceDisallowed(
mContext, preference.getPackageName(), UserHandle.myUserId());
if (admin != null) {
preference.setDisabledByAdmin(admin);
} else if (!appOpsAllowed) {
preference.setDisabledByAppOps(true);
} else {
preference.setEnabled(false);
}
}
}
}

2
src/com/android/settings/applications/UsageAccessDetails.java
View File

@@ -174,7 +174,7 @@ public class UsageAccessDetails extends AppInfoWithHeader implements OnPreferenc
if (shouldEnable && !hasAccess) {
mSwitchPref.checkEcmRestrictionAndSetDisabled(AppOpsManager.OPSTR_GET_USAGE_STATS,
mPackageName, mPackageInfo.applicationInfo.uid);
mPackageName);
shouldEnable = !mSwitchPref.isDisabledByEcm();
}

51
src/com/android/settings/applications/appinfo/AppInfoDashboardFragment.java
View File

@@ -24,6 +24,7 @@ import android.app.Activity;
import android.app.AppOpsManager;
import android.app.KeyguardManager;
import android.app.admin.DevicePolicyManager;
import android.app.ecm.EnhancedConfirmationManager;
import android.app.settings.SettingsEnums;
import android.content.BroadcastReceiver;
import android.content.Context;
@@ -490,12 +491,23 @@ public class AppInfoDashboardFragment extends DashboardFragment
return true;
case ACCESS_RESTRICTED_SETTINGS:
showLockScreen(getContext(), () -> {
final AppOpsManager appOpsManager = getContext().getSystemService(
AppOpsManager.class);
appOpsManager.setMode(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
getUid(),
getPackageName(),
AppOpsManager.MODE_ALLOWED);
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
EnhancedConfirmationManager manager = getContext().getSystemService(
EnhancedConfirmationManager.class);
try {
manager.clearRestriction(getPackageName());
} catch (NameNotFoundException e) {
Log.e(TAG, "Exception when retrieving package:" + getPackageName(), e);
}
} else {
final AppOpsManager appOpsManager = getContext().getSystemService(
AppOpsManager.class);
appOpsManager.setMode(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
getUid(),
getPackageName(),
AppOpsManager.MODE_ALLOWED);
}
getActivity().invalidateOptionsMenu();
final String toastString = getContext().getString(
R.string.toast_allows_restricted_settings_successfully,
@@ -527,14 +539,25 @@ public class AppInfoDashboardFragment extends DashboardFragment
}
private boolean shouldShowAccessRestrictedSettings() {
try {
final int mode = getSystemService(AppOpsManager.class).noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, getUid(),
getPackageName());
return mode == AppOpsManager.MODE_IGNORED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return false;
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
try {
return getSystemService(EnhancedConfirmationManager.class)
.isClearRestrictionAllowed(getPackageName());
} catch (NameNotFoundException e) {
Log.e(TAG, "Exception when retrieving package:" + getPackageName(), e);
return false;
}
} else {
try {
final int mode = getSystemService(AppOpsManager.class).noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, getUid(),
getPackageName());
return mode == AppOpsManager.MODE_IGNORED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return false;
}
}
}

2
src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminListPreferenceController.java
View File

@@ -210,7 +210,7 @@ public class DeviceAdminListPreferenceController extends BasePreferenceControlle
pref.setOnPreferenceChangeListener((preference, newValue) -> false);
pref.setSingleLineTitle(true);
pref.checkEcmRestrictionAndSetDisabled(Manifest.permission.BIND_DEVICE_ADMIN,
item.getPackageName(), item.getUid());
item.getPackageName());
}
/**

15
src/com/android/settings/applications/specialaccess/notificationaccess/ApprovalPreferenceController.java
View File

@@ -24,6 +24,7 @@ import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.os.AsyncTask;
import androidx.annotation.NonNull;
import androidx.annotation.VisibleForTesting;
import androidx.preference.Preference;
import androidx.preference.PreferenceFragmentCompat;
@@ -42,7 +43,7 @@ public class ApprovalPreferenceController extends BasePreferenceController {
private NotificationManager mNm;
private PackageManager mPm;
// The appOp representing this preference
private String mAppOpStr;
private String mSettingIdentifier;
public ApprovalPreferenceController(Context context, String key) {
super(context, key);
@@ -76,8 +77,9 @@ public class ApprovalPreferenceController extends BasePreferenceController {
/**
* Set the associated appOp for the Setting
*/
public ApprovalPreferenceController setAppOpStr(String appOpStr) {
mAppOpStr = appOpStr;
@NonNull
public ApprovalPreferenceController setSettingIdentifier(@NonNull String settingIdentifier) {
mSettingIdentifier = settingIdentifier;
return this;
}
@@ -118,14 +120,15 @@ public class ApprovalPreferenceController extends BasePreferenceController {
}
});
if (android.security.Flags.extendEcmToAllSettings()) {
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
if (!isAllowedCn && !isEnabled) {
preference.setEnabled(false);
} else if (isEnabled) {
preference.setEnabled(true);
} else {
preference.checkEcmRestrictionAndSetDisabled(mAppOpStr,
mCn.getPackageName(), mPkgInfo.applicationInfo.uid);
preference.checkEcmRestrictionAndSetDisabled(mSettingIdentifier,
mCn.getPackageName());
}
} else {
preference.updateState(

2
src/com/android/settings/applications/specialaccess/notificationaccess/NotificationAccessDetails.java
View File

@@ -103,7 +103,7 @@ public class NotificationAccessDetails extends DashboardFragment {
.setCn(mComponentName)
.setNm(context.getSystemService(NotificationManager.class))
.setPm(mPm)
.setAppOpStr(AppOpsManager.OPSTR_ACCESS_NOTIFICATIONS)
.setSettingIdentifier(AppOpsManager.OPSTR_ACCESS_NOTIFICATIONS)
.setParent(this);
use(HeaderPreferenceController.class)
.setFragment(this)

3
src/com/android/settings/applications/specialaccess/premiumsms/PremiumSmsAccess.java
View File

@@ -226,8 +226,7 @@ public class PremiumSmsAccess extends EmptyTextSettings
});
setValue(String.valueOf(getCurrentValue()));
setSummary("%s");
this.checkEcmRestrictionAndSetDisabled(ECM_RESTRICTION_KEY, appEntry.info.packageName,
appEntry.info.uid);
this.checkEcmRestrictionAndSetDisabled(ECM_RESTRICTION_KEY, appEntry.info.packageName);
}
private int getCurrentValue() {

11
src/com/android/settings/datausage/UnrestrictedDataAccessPreference.java
View File

@@ -20,6 +20,7 @@ import android.graphics.drawable.Drawable;
import android.os.UserHandle;
import android.view.View;
import androidx.annotation.NonNull;
import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;
import androidx.preference.PreferenceViewHolder;
@@ -37,7 +38,7 @@ import com.android.settingslib.widget.AppSwitchPreference;
public class UnrestrictedDataAccessPreference extends AppSwitchPreference implements
DataSaverBackend.Listener {
private static final String ECM_RESTRICTION_KEY = "android:unrestricted_data_access";
private static final String ECM_SETTING_IDENTIFIER = "android:unrestricted_data_access";
private final ApplicationsState mApplicationsState;
private final AppEntry mEntry;
@@ -60,8 +61,7 @@ public class UnrestrictedDataAccessPreference extends AppSwitchPreference implem
mParentFragment = parentFragment;
setDisabledByAdmin(checkIfMeteredDataUsageUserControlDisabled(
context, entry.info.packageName, UserHandle.getUserId(entry.info.uid)));
mHelper.checkEcmRestrictionAndSetDisabled(ECM_RESTRICTION_KEY, entry.info.packageName,
entry.info.uid);
mHelper.checkEcmRestrictionAndSetDisabled(ECM_SETTING_IDENTIFIER, entry.info.packageName);
updateState();
setKey(generateKey(mEntry));
@@ -183,10 +183,9 @@ public class UnrestrictedDataAccessPreference extends AppSwitchPreference implem
* Checks if the given setting is subject to Enhanced Confirmation Mode restrictions for this
* package. Marks the preference as disabled if so.
* @param packageName the package to check the restriction for
* @param uid the uid of the package
*/
public void checkEcmRestrictionAndSetDisabled(@Nullable String packageName, int uid) {
mHelper.checkEcmRestrictionAndSetDisabled(ECM_RESTRICTION_KEY, packageName, uid);
public void checkEcmRestrictionAndSetDisabled(@NonNull String packageName) {
mHelper.checkEcmRestrictionAndSetDisabled(ECM_SETTING_IDENTIFIER, packageName);
}
// Sets UI state based on allowlist/denylist status.

3
src/com/android/settings/datausage/UnrestrictedDataAccessPreferenceController.java
View File

@@ -151,8 +151,7 @@ public class UnrestrictedDataAccessPreferenceController extends BasePreferenceCo
} else {
preference.setDisabledByAdmin(checkIfMeteredDataUsageUserControlDisabled(mContext,
entry.info.packageName, UserHandle.getUserId(entry.info.uid)));
preference.checkEcmRestrictionAndSetDisabled(entry.info.packageName,
entry.info.uid);
preference.checkEcmRestrictionAndSetDisabled(entry.info.packageName);
preference.updateState();
}
preference.setOrder(i);

2
src/com/android/settings/notification/zen/ZenAccessSettings.java
View File

@@ -134,7 +134,7 @@ public class ZenAccessSettings extends EmptyTextSettings implements
// Not auto approved, update summary according to notification backend.
pref.setSummary(getPreferenceSummary(pkg));
pref.checkEcmRestrictionAndSetDisabled(
android.Manifest.permission.MANAGE_NOTIFICATIONS, app.packageName, app.uid);
android.Manifest.permission.MANAGE_NOTIFICATIONS, app.packageName);
}
pref.setOnPreferenceClickListener(preference -> {
AppInfoBase.startAppInfoFragment(

36
src/com/android/settings/spa/app/appinfo/AppInfoSettingsMoreOptions.kt
View File

@@ -17,6 +17,7 @@
package com.android.settings.spa.app.appinfo
import android.app.AppOpsManager
import android.app.ecm.EnhancedConfirmationManager
import android.content.Context
import android.content.pm.ApplicationInfo
import android.os.UserManager
@@ -90,12 +91,18 @@ fun AppInfoSettingsMoreOptions(
private fun ApplicationInfo.allowRestrictedSettings(context: Context, onSuccess: () -> Unit) {
AppInfoDashboardFragment.showLockScreen(context) {
context.appOpsManager.setMode(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid,
packageName,
AppOpsManager.MODE_ALLOWED,
)
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
val manager = context.getSystemService(EnhancedConfirmationManager::class.java)!!
manager.clearRestriction(packageName)
} else {
context.appOpsManager.setMode(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid,
packageName,
AppOpsManager.MODE_ALLOWED,
)
}
onSuccess()
val toastString = context.getString(
R.string.toast_allows_restricted_settings_successfully,
@@ -137,7 +144,7 @@ private suspend fun ApplicationInfo.getMoreOptionsState(
)
}
val shouldShowAccessRestrictedSettingsDeferred = async {
shouldShowAccessRestrictedSettings(context.appOpsManager)
shouldShowAccessRestrictedSettings(context)
}
val isProfileOrDeviceOwner =
Utils.isProfileOrDeviceOwner(context.userManager, context.devicePolicyManager, packageName)
@@ -169,7 +176,14 @@ private fun ApplicationInfo.isOtherUserHasInstallPackage(
.filter { it.id != userId }
.any { packageManagers.isPackageInstalledAsUser(packageName, it.id) }
private fun ApplicationInfo.shouldShowAccessRestrictedSettings(appOpsManager: AppOpsManager) =
appOpsManager.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, uid, packageName, null, null
) == AppOpsManager.MODE_IGNORED
private fun ApplicationInfo.shouldShowAccessRestrictedSettings(context: Context): Boolean {
return if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
val manager = context.getSystemService(EnhancedConfirmationManager::class.java)!!
manager.isClearRestrictionAllowed(packageName)
} else {
context.appOpsManager.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, uid, packageName, null, null
) == AppOpsManager.MODE_IGNORED
}
}

3
src/com/android/settings/utils/ManagedServiceSettings.java
View File

@@ -153,8 +153,7 @@ public abstract class ManagedServiceSettings extends EmptyTextSettings {
});
pref.setKey(cn.flattenToString());
if (!pref.isChecked()) {
pref.checkEcmRestrictionAndSetDisabled(mConfig.permission, service.packageName,
service.applicationInfo.uid);
pref.checkEcmRestrictionAndSetDisabled(mConfig.permission, service.packageName);
}
screen.addPreference(pref);
}

11
src/com/android/settings/widget/RestrictedAppPreference.java
View File

@@ -21,6 +21,7 @@ import android.os.UserHandle;
import android.text.TextUtils;
import android.util.AttributeSet;
import androidx.annotation.NonNull;
import androidx.preference.PreferenceManager;
import androidx.preference.PreferenceViewHolder;
@@ -128,11 +129,11 @@ public class RestrictedAppPreference extends AppPreference {
/**
* Checks if the given setting is subject to Enhanced Confirmation Mode restrictions for this
* package. Marks the preference as disabled if so.
* @param restriction The key identifying the setting
* @param packageName the package to check the restriction for
* @param uid the uid of the package
* @param settingIdentifier The key identifying the setting
* @param packageName the package to check the settingIdentifier for
*/
public void checkEcmRestrictionAndSetDisabled(String restriction, String packageName, int uid) {
mHelper.checkEcmRestrictionAndSetDisabled(restriction, packageName, uid);
public void checkEcmRestrictionAndSetDisabled(@NonNull String settingIdentifier,
@NonNull String packageName) {
mHelper.checkEcmRestrictionAndSetDisabled(settingIdentifier, packageName);
}
}