Merge changes from topics "ecm-manager", "ecm-tests" into main

* changes:
  Replace ECM AppOps call with service
  Wired remaining SpecialAppAccess for ECM.
This commit is contained in:
Hani Kazmi
2024-02-21 19:29:04 +00:00
committed by Android (Google) Code Review
23 changed files with 510 additions and 95 deletions

View File

@@ -21,7 +21,6 @@ import android.app.AppOpsManager;
import android.content.DialogInterface;
import android.content.Intent;
import android.os.Bundle;
import android.util.Log;
public class ActionDisabledByAppOpsDialog extends Activity
implements DialogInterface.OnDismissListener {

View File

@@ -43,6 +43,7 @@ import com.android.settings.R;
import com.android.settings.core.InstrumentedFragment;
import com.android.settings.core.SubSettingLauncher;
import com.android.settings.overlay.FeatureFactory;
import com.android.settingslib.RestrictedLockUtilsInternal;
import com.android.settingslib.accessibility.AccessibilityUtils;
import java.util.List;
@@ -164,16 +165,9 @@ public class AccessibilityDetailsSettingsFragment extends InstrumentedFragment {
if (permittedServices != null && !permittedServices.contains(packageName)) {
return false;
}
try {
final int mode = mAppOps.noteOpNoThrow(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid, packageName);
final boolean ecmEnabled = getContext().getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
return !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return true;
}
return !RestrictedLockUtilsInternal.isEnhancedConfirmationRestricted(getContext(),
packageName, AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE);
}
private AccessibilityServiceInfo getAccessibilityServiceInfo(ComponentName componentName) {

View File

@@ -235,10 +235,11 @@ public class RestrictedPreferenceHelper {
boolean serviceAllowed = permittedServices == null || permittedServices.contains(
preference.getPackageName());
if (android.security.Flags.extendEcmToAllSettings()) {
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
preference.checkEcmRestrictionAndSetDisabled(
AppOpsManager.OPSTR_BIND_ACCESSIBILITY_SERVICE,
preference.getPackageName(), preference.getUid());
preference.getPackageName());
if (preference.isDisabledByEcm()) {
serviceAllowed = false;
}
@@ -257,40 +258,39 @@ public class RestrictedPreferenceHelper {
preference.setEnabled(false);
}
}
return;
}
boolean appOpsAllowed;
if (serviceAllowed) {
try {
final int mode = mAppOps.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
preference.getUid(), preference.getPackageName());
final boolean ecmEnabled = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
appOpsAllowed = !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
serviceAllowed = appOpsAllowed;
} catch (Exception e) {
// Allow service in case if app ops is not available in testing.
appOpsAllowed = true;
}
} else {
appOpsAllowed = false;
}
if (serviceAllowed || serviceEnabled) {
preference.setEnabled(true);
} else {
// Disable accessibility service that are not permitted.
final RestrictedLockUtils.EnforcedAdmin admin =
RestrictedLockUtilsInternal.checkIfAccessibilityServiceDisallowed(
mContext, preference.getPackageName(), UserHandle.myUserId());
if (admin != null) {
preference.setDisabledByAdmin(admin);
} else if (!appOpsAllowed) {
preference.setDisabledByAppOps(true);
boolean appOpsAllowed;
if (serviceAllowed) {
try {
final int mode = mAppOps.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
preference.getUid(), preference.getPackageName());
final boolean ecmEnabled = mContext.getResources().getBoolean(
com.android.internal.R.bool.config_enhancedConfirmationModeEnabled);
appOpsAllowed = !ecmEnabled || mode == AppOpsManager.MODE_ALLOWED;
serviceAllowed = appOpsAllowed;
} catch (Exception e) {
// Allow service in case if app ops is not available in testing.
appOpsAllowed = true;
}
} else {
preference.setEnabled(false);
appOpsAllowed = false;
}
if (serviceAllowed || serviceEnabled) {
preference.setEnabled(true);
} else {
// Disable accessibility service that are not permitted.
final RestrictedLockUtils.EnforcedAdmin admin =
RestrictedLockUtilsInternal.checkIfAccessibilityServiceDisallowed(
mContext, preference.getPackageName(), UserHandle.myUserId());
if (admin != null) {
preference.setDisabledByAdmin(admin);
} else if (!appOpsAllowed) {
preference.setDisabledByAppOps(true);
} else {
preference.setEnabled(false);
}
}
}
}

View File

@@ -174,7 +174,7 @@ public class UsageAccessDetails extends AppInfoWithHeader implements OnPreferenc
if (shouldEnable && !hasAccess) {
mSwitchPref.checkEcmRestrictionAndSetDisabled(AppOpsManager.OPSTR_GET_USAGE_STATS,
mPackageName, mPackageInfo.applicationInfo.uid);
mPackageName);
shouldEnable = !mSwitchPref.isDisabledByEcm();
}

View File

@@ -24,6 +24,7 @@ import android.app.Activity;
import android.app.AppOpsManager;
import android.app.KeyguardManager;
import android.app.admin.DevicePolicyManager;
import android.app.ecm.EnhancedConfirmationManager;
import android.app.settings.SettingsEnums;
import android.content.BroadcastReceiver;
import android.content.Context;
@@ -490,12 +491,23 @@ public class AppInfoDashboardFragment extends DashboardFragment
return true;
case ACCESS_RESTRICTED_SETTINGS:
showLockScreen(getContext(), () -> {
final AppOpsManager appOpsManager = getContext().getSystemService(
AppOpsManager.class);
appOpsManager.setMode(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
getUid(),
getPackageName(),
AppOpsManager.MODE_ALLOWED);
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
EnhancedConfirmationManager manager = getContext().getSystemService(
EnhancedConfirmationManager.class);
try {
manager.clearRestriction(getPackageName());
} catch (NameNotFoundException e) {
Log.e(TAG, "Exception when retrieving package:" + getPackageName(), e);
}
} else {
final AppOpsManager appOpsManager = getContext().getSystemService(
AppOpsManager.class);
appOpsManager.setMode(AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
getUid(),
getPackageName(),
AppOpsManager.MODE_ALLOWED);
}
getActivity().invalidateOptionsMenu();
final String toastString = getContext().getString(
R.string.toast_allows_restricted_settings_successfully,
@@ -527,14 +539,25 @@ public class AppInfoDashboardFragment extends DashboardFragment
}
private boolean shouldShowAccessRestrictedSettings() {
try {
final int mode = getSystemService(AppOpsManager.class).noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, getUid(),
getPackageName());
return mode == AppOpsManager.MODE_IGNORED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return false;
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
try {
return getSystemService(EnhancedConfirmationManager.class)
.isClearRestrictionAllowed(getPackageName());
} catch (NameNotFoundException e) {
Log.e(TAG, "Exception when retrieving package:" + getPackageName(), e);
return false;
}
} else {
try {
final int mode = getSystemService(AppOpsManager.class).noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, getUid(),
getPackageName());
return mode == AppOpsManager.MODE_IGNORED;
} catch (Exception e) {
// Fallback in case if app ops is not available in testing.
return false;
}
}
}

View File

@@ -222,7 +222,7 @@ public class DeviceAdminListPreferenceController extends BasePreferenceControlle
pref.setOnPreferenceChangeListener((preference, newValue) -> false);
pref.setSingleLineTitle(true);
pref.checkEcmRestrictionAndSetDisabled(Manifest.permission.BIND_DEVICE_ADMIN,
item.getPackageName(), item.getUid());
item.getPackageName());
}
/**

View File

@@ -24,6 +24,7 @@ import android.content.pm.PackageInfo;
import android.content.pm.PackageManager;
import android.os.AsyncTask;
import androidx.annotation.NonNull;
import androidx.annotation.VisibleForTesting;
import androidx.preference.Preference;
import androidx.preference.PreferenceFragmentCompat;
@@ -42,7 +43,7 @@ public class ApprovalPreferenceController extends BasePreferenceController {
private NotificationManager mNm;
private PackageManager mPm;
// The appOp representing this preference
private String mAppOpStr;
private String mSettingIdentifier;
public ApprovalPreferenceController(Context context, String key) {
super(context, key);
@@ -76,8 +77,9 @@ public class ApprovalPreferenceController extends BasePreferenceController {
/**
* Set the associated appOp for the Setting
*/
public ApprovalPreferenceController setAppOpStr(String appOpStr) {
mAppOpStr = appOpStr;
@NonNull
public ApprovalPreferenceController setSettingIdentifier(@NonNull String settingIdentifier) {
mSettingIdentifier = settingIdentifier;
return this;
}
@@ -118,14 +120,15 @@ public class ApprovalPreferenceController extends BasePreferenceController {
}
});
if (android.security.Flags.extendEcmToAllSettings()) {
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
if (!isAllowedCn && !isEnabled) {
preference.setEnabled(false);
} else if (isEnabled) {
preference.setEnabled(true);
} else {
preference.checkEcmRestrictionAndSetDisabled(mAppOpStr,
mCn.getPackageName(), mPkgInfo.applicationInfo.uid);
preference.checkEcmRestrictionAndSetDisabled(mSettingIdentifier,
mCn.getPackageName());
}
} else {
preference.updateState(

View File

@@ -103,7 +103,7 @@ public class NotificationAccessDetails extends DashboardFragment {
.setCn(mComponentName)
.setNm(context.getSystemService(NotificationManager.class))
.setPm(mPm)
.setAppOpStr(AppOpsManager.OPSTR_ACCESS_NOTIFICATIONS)
.setSettingIdentifier(AppOpsManager.OPSTR_ACCESS_NOTIFICATIONS)
.setParent(this);
use(HeaderPreferenceController.class)
.setFragment(this)

View File

@@ -25,7 +25,6 @@ import android.view.View;
import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;
import androidx.preference.DropDownPreference;
import androidx.preference.Preference;
import androidx.preference.Preference.OnPreferenceChangeListener;
import androidx.preference.PreferenceScreen;
@@ -38,6 +37,7 @@ import com.android.settings.applications.AppStateSmsPremBridge.SmsState;
import com.android.settings.overlay.FeatureFactory;
import com.android.settings.search.BaseSearchIndexProvider;
import com.android.settings.widget.EmptyTextSettings;
import com.android.settingslib.RestrictedDropDownPreference;
import com.android.settingslib.applications.ApplicationsState;
import com.android.settingslib.applications.ApplicationsState.AppEntry;
import com.android.settingslib.applications.ApplicationsState.Callbacks;
@@ -52,6 +52,8 @@ import java.util.ArrayList;
public class PremiumSmsAccess extends EmptyTextSettings
implements Callback, Callbacks, OnPreferenceChangeListener {
private static final String ECM_RESTRICTION_KEY = "android:premium_sms_access";
private ApplicationsState mApplicationsState;
private AppStateSmsPremBridge mSmsBackend;
private Session mSession;
@@ -205,7 +207,7 @@ public class PremiumSmsAccess extends EmptyTextSettings
}
private class PremiumSmsPreference extends DropDownPreference {
private class PremiumSmsPreference extends RestrictedDropDownPreference {
private final AppEntry mAppEntry;
public PremiumSmsPreference(AppEntry appEntry, Context context) {
@@ -224,6 +226,7 @@ public class PremiumSmsAccess extends EmptyTextSettings
});
setValue(String.valueOf(getCurrentValue()));
setSummary("%s");
this.checkEcmRestrictionAndSetDisabled(ECM_RESTRICTION_KEY, appEntry.info.packageName);
}
private int getCurrentValue() {

View File

@@ -20,7 +20,9 @@ import android.graphics.drawable.Drawable;
import android.os.UserHandle;
import android.view.View;
import androidx.annotation.NonNull;
import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;
import androidx.preference.PreferenceViewHolder;
import com.android.settings.R;
@@ -36,6 +38,7 @@ import com.android.settingslib.widget.AppSwitchPreference;
public class UnrestrictedDataAccessPreference extends AppSwitchPreference implements
DataSaverBackend.Listener {
private static final String ECM_SETTING_IDENTIFIER = "android:unrestricted_data_access";
private final ApplicationsState mApplicationsState;
private final AppEntry mEntry;
@@ -58,6 +61,7 @@ public class UnrestrictedDataAccessPreference extends AppSwitchPreference implem
mParentFragment = parentFragment;
setDisabledByAdmin(checkIfMeteredDataUsageUserControlDisabled(
context, entry.info.packageName, UserHandle.getUserId(entry.info.uid)));
mHelper.checkEcmRestrictionAndSetDisabled(ECM_SETTING_IDENTIFIER, entry.info.packageName);
updateState();
setKey(generateKey(mEntry));
@@ -166,10 +170,24 @@ public class UnrestrictedDataAccessPreference extends AppSwitchPreference implem
return mHelper.isDisabledByAdmin();
}
@VisibleForTesting
boolean isDisabledByEcm() {
return mHelper.isDisabledByEcm();
}
public void setDisabledByAdmin(EnforcedAdmin admin) {
mHelper.setDisabledByAdmin(admin);
}
/**
* Checks if the given setting is subject to Enhanced Confirmation Mode restrictions for this
* package. Marks the preference as disabled if so.
* @param packageName the package to check the restriction for
*/
public void checkEcmRestrictionAndSetDisabled(@NonNull String packageName) {
mHelper.checkEcmRestrictionAndSetDisabled(ECM_SETTING_IDENTIFIER, packageName);
}
// Sets UI state based on allowlist/denylist status.
public void updateState() {
setTitle(mEntry.label);
@@ -179,7 +197,8 @@ public class UnrestrictedDataAccessPreference extends AppSwitchPreference implem
setSummary(com.android.settingslib.widget.restricted.R.string.disabled_by_admin);
} else if (mDataUsageState.isDataSaverDenylisted) {
setSummary(R.string.restrict_background_blocklisted);
} else {
// If disabled by ECM, the summary is set directly by the switch.
} else if (!isDisabledByEcm()) {
setSummary("");
}
}

View File

@@ -151,6 +151,7 @@ public class UnrestrictedDataAccessPreferenceController extends BasePreferenceCo
} else {
preference.setDisabledByAdmin(checkIfMeteredDataUsageUserControlDisabled(mContext,
entry.info.packageName, UserHandle.getUserId(entry.info.uid)));
preference.checkEcmRestrictionAndSetDisabled(entry.info.packageName);
preference.updateState();
}
preference.setOrder(i);

View File

@@ -39,8 +39,8 @@ import com.android.settings.applications.specialaccess.zenaccess.ZenAccessDetail
import com.android.settings.applications.specialaccess.zenaccess.ZenAccessSettingObserverMixin;
import com.android.settings.search.BaseSearchIndexProvider;
import com.android.settings.widget.EmptyTextSettings;
import com.android.settings.widget.RestrictedAppPreference;
import com.android.settingslib.search.SearchIndexable;
import com.android.settingslib.widget.AppPreference;
import java.util.ArrayList;
import java.util.Collections;
@@ -122,7 +122,7 @@ public class ZenAccessSettings extends EmptyTextSettings implements
for (ApplicationInfo app : apps) {
final String pkg = app.packageName;
final CharSequence label = app.loadLabel(mPkgMan);
final AppPreference pref = new AppPreference(getPrefContext());
final RestrictedAppPreference pref = new RestrictedAppPreference(getPrefContext());
pref.setKey(pkg);
pref.setIcon(app.loadIcon(mPkgMan));
pref.setTitle(label);
@@ -133,6 +133,8 @@ public class ZenAccessSettings extends EmptyTextSettings implements
} else {
// Not auto approved, update summary according to notification backend.
pref.setSummary(getPreferenceSummary(pkg));
pref.checkEcmRestrictionAndSetDisabled(
android.Manifest.permission.MANAGE_NOTIFICATIONS, app.packageName);
}
pref.setOnPreferenceClickListener(preference -> {
AppInfoBase.startAppInfoFragment(

View File

@@ -17,6 +17,7 @@
package com.android.settings.spa.app.appinfo
import android.app.AppOpsManager
import android.app.ecm.EnhancedConfirmationManager
import android.content.Context
import android.content.pm.ApplicationInfo
import android.os.UserManager
@@ -90,12 +91,18 @@ fun AppInfoSettingsMoreOptions(
private fun ApplicationInfo.allowRestrictedSettings(context: Context, onSuccess: () -> Unit) {
AppInfoDashboardFragment.showLockScreen(context) {
context.appOpsManager.setMode(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid,
packageName,
AppOpsManager.MODE_ALLOWED,
)
if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
val manager = context.getSystemService(EnhancedConfirmationManager::class.java)!!
manager.clearRestriction(packageName)
} else {
context.appOpsManager.setMode(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS,
uid,
packageName,
AppOpsManager.MODE_ALLOWED,
)
}
onSuccess()
val toastString = context.getString(
R.string.toast_allows_restricted_settings_successfully,
@@ -137,7 +144,7 @@ private suspend fun ApplicationInfo.getMoreOptionsState(
)
}
val shouldShowAccessRestrictedSettingsDeferred = async {
shouldShowAccessRestrictedSettings(context.appOpsManager)
shouldShowAccessRestrictedSettings(context)
}
val isProfileOrDeviceOwner =
Utils.isProfileOrDeviceOwner(context.userManager, context.devicePolicyManager, packageName)
@@ -169,7 +176,14 @@ private fun ApplicationInfo.isOtherUserHasInstallPackage(
.filter { it.id != userId }
.any { packageManagers.isPackageInstalledAsUser(packageName, it.id) }
private fun ApplicationInfo.shouldShowAccessRestrictedSettings(appOpsManager: AppOpsManager) =
appOpsManager.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, uid, packageName, null, null
) == AppOpsManager.MODE_IGNORED
private fun ApplicationInfo.shouldShowAccessRestrictedSettings(context: Context): Boolean {
return if (android.permission.flags.Flags.enhancedConfirmationModeApisEnabled()
&& android.security.Flags.extendEcmToAllSettings()) {
val manager = context.getSystemService(EnhancedConfirmationManager::class.java)!!
manager.isClearRestrictionAllowed(packageName)
} else {
context.appOpsManager.noteOpNoThrow(
AppOpsManager.OP_ACCESS_RESTRICTED_SETTINGS, uid, packageName, null, null
) == AppOpsManager.MODE_IGNORED
}
}

View File

@@ -37,14 +37,14 @@ import androidx.annotation.Nullable;
import androidx.appcompat.app.AlertDialog;
import androidx.fragment.app.Fragment;
import androidx.preference.PreferenceScreen;
import androidx.preference.TwoStatePreference;
import com.android.settings.R;
import com.android.settings.Utils;
import com.android.settings.core.instrumentation.InstrumentedDialogFragment;
import com.android.settings.widget.EmptyTextSettings;
import com.android.settingslib.RestrictedSwitchPreference;
import com.android.settingslib.applications.ServiceListing;
import com.android.settingslib.widget.AppSwitchPreference;
import com.android.settingslib.widget.TwoTargetPreference;
import java.util.List;
@@ -121,10 +121,12 @@ public abstract class ManagedServiceSettings extends EmptyTextSettings {
}
final CharSequence finalTitle = title;
final String summary = service.loadLabel(mPm).toString();
final TwoStatePreference pref = new AppSwitchPreference(getPrefContext());
final RestrictedSwitchPreference pref =
new RestrictedSwitchPreference(getPrefContext());
pref.setPersistent(false);
pref.setIcon(mIconDrawableFactory.getBadgedIcon(service, service.applicationInfo,
UserHandle.getUserId(service.applicationInfo.uid)));
pref.setIconSize(TwoTargetPreference.ICON_SIZE_MEDIUM);
if (title != null && !title.equals(summary)) {
pref.setTitle(title);
pref.setSummary(summary);
@@ -150,6 +152,9 @@ public abstract class ManagedServiceSettings extends EmptyTextSettings {
}
});
pref.setKey(cn.flattenToString());
if (!pref.isChecked()) {
pref.checkEcmRestrictionAndSetDisabled(mConfig.permission, service.packageName);
}
screen.addPreference(pref);
}
highlightPreferenceIfNeeded();

View File

@@ -21,6 +21,7 @@ import android.os.UserHandle;
import android.text.TextUtils;
import android.util.AttributeSet;
import androidx.annotation.NonNull;
import androidx.preference.PreferenceManager;
import androidx.preference.PreferenceViewHolder;
@@ -72,10 +73,18 @@ public class RestrictedAppPreference extends AppPreference {
@Override
public void setEnabled(boolean enabled) {
if (isDisabledByAdmin() && enabled) {
return;
boolean changed = false;
if (enabled && isDisabledByAdmin()) {
mHelper.setDisabledByAdmin(null);
changed = true;
}
if (enabled && isDisabledByEcm()) {
mHelper.setDisabledByEcm(null);
changed = true;
}
if (!changed) {
super.setEnabled(enabled);
}
super.setEnabled(enabled);
}
public void setDisabledByAdmin(RestrictedLockUtils.EnforcedAdmin admin) {
@@ -88,6 +97,10 @@ public class RestrictedAppPreference extends AppPreference {
return mHelper.isDisabledByAdmin();
}
public boolean isDisabledByEcm() {
return mHelper.isDisabledByEcm();
}
public void useAdminDisabledSummary(boolean useSummary) {
mHelper.useAdminDisabledSummary(useSummary);
}
@@ -112,4 +125,15 @@ public class RestrictedAppPreference extends AppPreference {
public void checkRestrictionAndSetDisabled(String userRestriction, int userId) {
mHelper.checkRestrictionAndSetDisabled(userRestriction, userId);
}
/**
* Checks if the given setting is subject to Enhanced Confirmation Mode restrictions for this
* package. Marks the preference as disabled if so.
* @param settingIdentifier The key identifying the setting
* @param packageName the package to check the settingIdentifier for
*/
public void checkEcmRestrictionAndSetDisabled(@NonNull String settingIdentifier,
@NonNull String packageName) {
mHelper.checkEcmRestrictionAndSetDisabled(settingIdentifier, packageName);
}
}