Part3 - Don't add padlock if the restriction is not set by admin.

Bug: 26687435
Change-Id: Ibfea6d7d5bd32e7a05dcc2cc32b121c9e50b6a34

res/xml/privacy_settings.xml

@@ -55,6 +55,7 @@
         android:key="network_reset"
         android:title="@string/reset_network_title"
         settings:keywords="@string/keywords_network_reset"
+        settings:userRestriction="no_network_reset"
         settings:useAdminDisabledSummary="true"
         android:fragment="com.android.settings.ResetNetwork" />
 

res/xml/user_details_settings.xml

@@ -23,6 +23,7 @@
     <com.android.settingslib.RestrictedPreference
             android:key="remove_user"
             android:title="@string/user_remove_user"
+            settings:userRestriction="no_remove_user"
             settings:useAdminDisabledSummary="true" />
 
 </PreferenceScreen>

src/com/android/settings/DeviceInfoSettings.java

@@ -81,7 +81,9 @@ public class DeviceInfoSettings extends SettingsPreferenceFragment implements In
     private UserManager mUm;
 
     private EnforcedAdmin mFunDisallowedAdmin;
+    private boolean mFunDisallowedBySystem;
     private EnforcedAdmin mDebuggingFeaturesDisallowedAdmin;
+    private boolean mDebuggingFeaturesDisallowedBySystem;
 
     @Override
     protected int getMetricsCategory() {
@@ -192,8 +194,12 @@ public class DeviceInfoSettings extends SettingsPreferenceFragment implements In
         mDevHitToast = null;
         mFunDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(
                 getActivity(), UserManager.DISALLOW_FUN, UserHandle.myUserId());
+        mFunDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(
+                getActivity(), UserManager.DISALLOW_FUN, UserHandle.myUserId());
         mDebuggingFeaturesDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(
                 getActivity(), UserManager.DISALLOW_DEBUGGING_FEATURES, UserHandle.myUserId());
+        mDebuggingFeaturesDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(
+                getActivity(), UserManager.DISALLOW_DEBUGGING_FEATURES, UserHandle.myUserId());
     }
 
     @Override
@@ -202,9 +208,11 @@ public class DeviceInfoSettings extends SettingsPreferenceFragment implements In
             System.arraycopy(mHits, 1, mHits, 0, mHits.length-1);
             mHits[mHits.length-1] = SystemClock.uptimeMillis();
             if (mHits[0] >= (SystemClock.uptimeMillis()-500)) {
-                if (mFunDisallowedAdmin != null) {
+                if (mUm.hasUserRestriction(UserManager.DISALLOW_FUN)) {
+                    if (mFunDisallowedAdmin != null && !mFunDisallowedBySystem) {
                         RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
                                 mFunDisallowedAdmin);
+                    }
                     Log.d(LOG_TAG, "Sorry, no fun for you!");
                     return false;
                 }
@@ -228,9 +236,12 @@ public class DeviceInfoSettings extends SettingsPreferenceFragment implements In
                 return true;
             }
 
-            if (mDebuggingFeaturesDisallowedAdmin != null) {
+            if (mUm.hasUserRestriction(UserManager.DISALLOW_DEBUGGING_FEATURES)) {
+                if (mDebuggingFeaturesDisallowedAdmin != null &&
+                        !mDebuggingFeaturesDisallowedBySystem) {
                     RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(),
                             mDebuggingFeaturesDisallowedAdmin);
+                }
                 return true;
             }
 

src/com/android/settings/PrivacySettings.java

@@ -38,6 +38,7 @@ import com.android.internal.logging.MetricsProto.MetricsEvent;
 import com.android.settings.dashboard.SummaryLoader;
 import com.android.settings.search.BaseSearchIndexProvider;
 import com.android.settings.search.Indexable;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.RestrictedPreference;
 
 import java.util.ArrayList;
@@ -186,12 +187,6 @@ public class PrivacySettings extends SettingsPreferenceFragment implements Index
             // Hide the item if data management intent is not supported by transport.
             getPreferenceScreen().removePreference(mManageData);
         }
-
-        RestrictedPreference networkResetPref = (RestrictedPreference) findPreference(
-                NETWORK_RESET);
-        if (networkResetPref != null) {
-            networkResetPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_NETWORK_RESET);
-        }
     }
 
     private void setConfigureSummary(String summary) {
@@ -315,5 +310,13 @@ public class PrivacySettings extends SettingsPreferenceFragment implements Index
             nonVisibleKeys.add(AUTO_RESTORE);
             nonVisibleKeys.add(CONFIGURE_ACCOUNT);
         }
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_FACTORY_RESET, UserHandle.myUserId())) {
+            nonVisibleKeys.add(FACTORY_RESET);
+        }
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_NETWORK_RESET, UserHandle.myUserId())) {
+            nonVisibleKeys.add(NETWORK_RESET);
+        }
     }
 }

src/com/android/settings/RestrictedSettingsFragment.java

@@ -251,7 +251,7 @@ public abstract class RestrictedSettingsFragment extends SettingsPreferenceFragm
     @Override
     protected void onDataSetChanged() {
         highlightPreferenceIfNeeded();
-        if (mAdminSupportDetails != null && isUiRestricted()) {
+        if (mAdminSupportDetails != null && isUiRestrictedByOnlyAdmin()) {
             updateAdminSupportDetailsView();
             setEmptyView(mAdminSupportDetails);
         } else if (mEmptyTextView != null) {
@@ -266,4 +266,9 @@ public abstract class RestrictedSettingsFragment extends SettingsPreferenceFragm
     protected boolean isUiRestricted() {
         return isRestrictedAndNotProviderProtected() || !hasChallengeSucceeded();
     }
+
+    protected boolean isUiRestrictedByOnlyAdmin() {
+        return isUiRestricted() && !mUserManager.hasBaseUserRestriction(mRestrictionKey,
+                UserHandle.of(UserHandle.myUserId()));
+    }
 }

src/com/android/settings/SecuritySettings.java

@@ -276,19 +276,30 @@ public class SecuritySettings extends SettingsPreferenceFragment
         final UserManager um = (UserManager) getActivity().getSystemService(Context.USER_SERVICE);
         mKeyStore = KeyStore.getInstance(); // needs to be initialized for onResume()
 
+        if (!RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_CONFIG_CREDENTIALS, MY_USER_ID)) {
             RestrictedPreference credentialStorageType = (RestrictedPreference) root.findPreference(
                     KEY_CREDENTIAL_STORAGE_TYPE);
             credentialStorageType.checkRestrictionAndSetDisabled(
                     UserManager.DISALLOW_CONFIG_CREDENTIALS);
             RestrictedPreference installCredentials = (RestrictedPreference) root.findPreference(
                     KEY_CREDENTIALS_INSTALL);
-        installCredentials.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_CREDENTIALS);
+            installCredentials.checkRestrictionAndSetDisabled(
-        mResetCredentials.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_CREDENTIALS);
+                    UserManager.DISALLOW_CONFIG_CREDENTIALS);
+            mResetCredentials.checkRestrictionAndSetDisabled(
+                    UserManager.DISALLOW_CONFIG_CREDENTIALS);
 
             final int storageSummaryRes =
                     mKeyStore.isHardwareBacked() ? R.string.credential_storage_type_hardware
                             : R.string.credential_storage_type_software;
             credentialStorageType.setSummary(storageSummaryRes);
+        } else {
+            PreferenceGroup credentialsManager = (PreferenceGroup)
+                    root.findPreference(KEY_CREDENTIALS_MANAGER);
+            credentialsManager.removePreference(root.findPreference(KEY_RESET_CREDENTIALS));
+            credentialsManager.removePreference(root.findPreference(KEY_CREDENTIALS_INSTALL));
+            credentialsManager.removePreference(root.findPreference(KEY_CREDENTIAL_STORAGE_TYPE));
+        }
 
 
         // Application install
@@ -300,6 +311,12 @@ public class SecuritySettings extends SettingsPreferenceFragment
         // Side loading of apps.
         // Disable for restricted profiles. For others, check if policy disallows it.
         mToggleAppInstallation.setEnabled(!um.getUserInfo(MY_USER_ID).isRestricted());
+        if (RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES, MY_USER_ID)
+                || RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                        UserManager.DISALLOW_INSTALL_APPS, MY_USER_ID)) {
+            mToggleAppInstallation.setEnabled(false);
+        }
         if (mToggleAppInstallation.isEnabled()) {
             mToggleAppInstallation.checkRestrictionAndSetDisabled(
                     UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES);

src/com/android/settings/WirelessSettings.java

@@ -34,6 +34,7 @@ import android.nfc.NfcAdapter;
 import android.nfc.NfcManager;
 import android.os.Bundle;
 import android.os.SystemProperties;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.provider.SearchIndexableResource;
 import android.provider.Settings;
@@ -242,7 +243,8 @@ public class WirelessSettings extends SettingsPreferenceFragment implements Inde
         //enable/disable wimax depending on the value in config.xml
         final boolean isWimaxEnabled = isAdmin && this.getResources().getBoolean(
                 com.android.internal.R.bool.config_wimaxEnabled);
-        if (!isWimaxEnabled) {
+        if (!isWimaxEnabled || RestrictedLockUtils.hasBaseUserRestriction(activity,
+                UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS, UserHandle.myUserId())) {
             PreferenceScreen root = getPreferenceScreen();
             Preference ps = findPreference(KEY_WIMAX_SETTINGS);
             if (ps != null) root.removePreference(ps);
@@ -260,7 +262,8 @@ public class WirelessSettings extends SettingsPreferenceFragment implements Inde
         }
         // Disable VPN.
         // TODO: http://b/23693383
-        if (!isAdmin) {
+        if (!isAdmin || RestrictedLockUtils.hasBaseUserRestriction(activity,
+                UserManager.DISALLOW_CONFIG_VPN, UserHandle.myUserId())) {
             removePreference(KEY_VPN_SETTINGS);
         }
 
@@ -285,7 +288,9 @@ public class WirelessSettings extends SettingsPreferenceFragment implements Inde
 
         // Remove Mobile Network Settings and Manage Mobile Plan for secondary users,
         // if it's a wifi-only device.
-        if (!isAdmin || Utils.isWifiOnly(getActivity())) {
+        if (!isAdmin || Utils.isWifiOnly(getActivity()) ||
+                RestrictedLockUtils.hasBaseUserRestriction(activity,
+                        UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS, UserHandle.myUserId())) {
             removePreference(KEY_MOBILE_NETWORK_SETTINGS);
             removePreference(KEY_MANAGE_MOBILE_PLAN);
         }
@@ -317,9 +322,11 @@ public class WirelessSettings extends SettingsPreferenceFragment implements Inde
         final ConnectivityManager cm =
                 (ConnectivityManager) activity.getSystemService(Context.CONNECTIVITY_SERVICE);
 
-        final boolean adminDisallowedTetherConfig = mUm.hasUserRestriction(
+        final boolean adminDisallowedTetherConfig = RestrictedLockUtils.checkIfRestrictionEnforced(
-                UserManager.DISALLOW_CONFIG_TETHERING);
+                activity, UserManager.DISALLOW_CONFIG_TETHERING, UserHandle.myUserId()) != null;
-        if (!cm.isTetheringSupported() && !adminDisallowedTetherConfig) {
+        if ((!cm.isTetheringSupported() && !adminDisallowedTetherConfig) ||
+                RestrictedLockUtils.hasBaseUserRestriction(activity,
+                        UserManager.DISALLOW_CONFIG_TETHERING, UserHandle.myUserId())) {
             getPreferenceScreen().removePreference(findPreference(KEY_TETHER_SETTINGS));
         } else if (!adminDisallowedTetherConfig) {
             Preference p = findPreference(KEY_TETHER_SETTINGS);

src/com/android/settings/accounts/AccountSettings.java

@@ -62,6 +62,7 @@ import com.android.settings.search.Index;
 import com.android.settings.search.Indexable;
 import com.android.settings.search.SearchIndexableRaw;
 import com.android.settings.users.UserDialogs;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.accounts.AuthenticatorHelper;
 
 import java.util.ArrayList;
@@ -325,10 +326,13 @@ public class AccountSettings extends SettingsPreferenceFragment
         if (userInfo.isEnabled()) {
             profileData.authenticatorHelper = new AuthenticatorHelper(context,
                     userInfo.getUserHandle(), this);
+            if (!RestrictedLockUtils.hasBaseUserRestriction(context,
+                    UserManager.DISALLOW_MODIFY_ACCOUNTS, userInfo.id)) {
                 profileData.addAccountPreference = newAddAccountPreference(context);
                 profileData.addAccountPreference.checkRestrictionAndSetDisabled(
                         DISALLOW_MODIFY_ACCOUNTS, userInfo.id);
             }
+        }
         mProfiles.put(userInfo.id, profileData);
         Index.getInstance(getActivity()).updateFromClassNameResource(
                 AccountSettings.class.getName(), true, true);
@@ -715,13 +719,16 @@ public class AccountSettings extends SettingsPreferenceFragment
             for (int i = 0; i < profilesCount; i++) {
                 UserInfo userInfo = profiles.get(i);
                 if (userInfo.isEnabled()) {
+                    if (!RestrictedLockUtils.hasBaseUserRestriction(context,
+                            DISALLOW_MODIFY_ACCOUNTS, userInfo.id)) {
                         SearchIndexableRaw data = new SearchIndexableRaw(context);
                         data = new SearchIndexableRaw(context);
                         data.title = res.getString(R.string.add_account_label);
                         data.screenTitle = screenTitle;
                         result.add(data);
+                    }
                     if (userInfo.isManagedProfile()) {
-                        data = new SearchIndexableRaw(context);
+                        SearchIndexableRaw data = new SearchIndexableRaw(context);
                         data = new SearchIndexableRaw(context);
                         data.title = res.getString(R.string.remove_managed_profile_label);
                         data.screenTitle = screenTitle;

src/com/android/settings/accounts/AccountSyncSettings.java

@@ -262,6 +262,8 @@ public class AccountSyncSettings extends AccountPreferenceBase {
         MenuItem syncCancel = menu.add(0, MENU_SYNC_CANCEL_ID, 0,
                 getString(R.string.sync_menu_sync_cancel))
                 .setIcon(com.android.internal.R.drawable.ic_menu_close_clear_cancel);
+        if (!RestrictedLockUtils.hasBaseUserRestriction(getPrefContext(),
+                UserManager.DISALLOW_MODIFY_ACCOUNTS, mUserHandle.getIdentifier())) {
             MenuItem removeAccount = menu.add(0, MENU_REMOVE_ACCOUNT_ID, 0,
                     getString(R.string.remove_account_label))
                     .setIcon(R.drawable.ic_menu_delete);
@@ -276,6 +278,7 @@ public class AccountSyncSettings extends AccountPreferenceBase {
             }
             RestrictedLockUtils.setMenuItemAsDisabledByAdmin(getPrefContext(),
                     removeAccount, admin);
+        }
         syncNow.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |
                 MenuItem.SHOW_AS_ACTION_WITH_TEXT);
         syncCancel.setShowAsAction(MenuItem.SHOW_AS_ACTION_NEVER |

src/com/android/settings/applications/AppInfoBase.java

@@ -56,6 +56,7 @@ public abstract class AppInfoBase extends SettingsPreferenceFragment
     protected static final boolean localLOGV = false;
 
     protected EnforcedAdmin mAppsControlDisallowedAdmin;
+    protected boolean mAppsControlDisallowedBySystem;
 
     protected ApplicationsState mState;
     protected ApplicationsState.Session mSession;
@@ -97,6 +98,8 @@ public abstract class AppInfoBase extends SettingsPreferenceFragment
         mSession.resume();
         mAppsControlDisallowedAdmin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_APPS_CONTROL, mUserId);
+        mAppsControlDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_APPS_CONTROL, mUserId);
 
         if (!refreshUi()) {
             setIntentAndFinish(true, true);

src/com/android/settings/applications/AppStorageSettings.java

@@ -194,7 +194,7 @@ public class AppStorageSettings extends AppInfoWithHeader
     @Override
     public void onClick(View v) {
         if (v == mClearCacheButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
                 return;
@@ -203,7 +203,7 @@ public class AppStorageSettings extends AppInfoWithHeader
             }
             mPm.deleteApplicationCacheFiles(mPackageName, mClearCacheObserver);
         } else if (v == mClearDataButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else if (mAppEntry.info.manageSpaceActivityName != null) {
@@ -219,7 +219,7 @@ public class AppStorageSettings extends AppInfoWithHeader
         } else if (v == mChangeStorageButton && mDialogBuilder != null && !isMoveInProgress()) {
             mDialogBuilder.show();
         } else if (v == mClearUriButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else {
@@ -323,6 +323,10 @@ public class AppStorageSettings extends AppInfoWithHeader
                 mClearCacheButton.setOnClickListener(this);
             }
         }
+        if (mAppsControlDisallowedBySystem) {
+            mClearCacheButton.setEnabled(false);
+            mClearDataButton.setEnabled(false);
+        }
     }
 
     @Override
@@ -369,6 +373,10 @@ public class AppStorageSettings extends AppInfoWithHeader
             }
             mClearDataButton.setOnClickListener(this);
         }
+
+        if (mAppsControlDisallowedBySystem) {
+            mClearDataButton.setEnabled(false);
+        }
     }
 
     private void initMoveDialog() {
@@ -488,6 +496,10 @@ public class AppStorageSettings extends AppInfoWithHeader
             mUri.addPreference(pref);
         }
 
+        if (mAppsControlDisallowedBySystem) {
+            mClearUriButton.setEnabled(false);
+        }
+
         mClearUri.setOrder(order);
         mClearUriButton.setVisibility(View.VISIBLE);
 

src/com/android/settings/applications/InstalledAppDetails.java

@@ -242,6 +242,10 @@ public class InstalledAppDetails extends AppInfoBase
             }
         }
 
+        if (mAppsControlDisallowedBySystem) {
+            enabled = false;
+        }
+
         mUninstallButton.setEnabled(enabled);
         if (enabled) {
             // Register listener
@@ -405,7 +409,7 @@ public class InstalledAppDetails extends AppInfoBase
         menu.findItem(UNINSTALL_ALL_USERS_MENU).setVisible(showIt);
         mUpdatedSysApp = (mAppEntry.info.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0;
         MenuItem uninstallUpdatesItem = menu.findItem(UNINSTALL_UPDATES);
-        uninstallUpdatesItem.setVisible(mUpdatedSysApp);
+        uninstallUpdatesItem.setVisible(mUpdatedSysApp && !mAppsControlDisallowedBySystem);
         if (uninstallUpdatesItem.isVisible()) {
             RestrictedLockUtils.setMenuItemAsDisabledByAdmin(getActivity(),
                     uninstallUpdatesItem, mAppsControlDisallowedAdmin);
@@ -660,9 +664,13 @@ public class InstalledAppDetails extends AppInfoBase
     }
 
     private void updateForceStopButton(boolean enabled) {
+        if (mAppsControlDisallowedBySystem) {
+            mForceStopButton.setEnabled(false);
+        } else {
             mForceStopButton.setEnabled(enabled);
             mForceStopButton.setOnClickListener(InstalledAppDetails.this);
         }
+    }
 
     private void checkForceStop() {
         if (mDpm.packageHasActiveAdmins(mPackageInfo.packageName)) {
@@ -719,7 +727,9 @@ public class InstalledAppDetails extends AppInfoBase
         if(v == mUninstallButton) {
             EnforcedAdmin admin = RestrictedLockUtils.checkIfUninstallBlocked(getActivity(),
                     packageName, mUserId);
-            if (admin != null) {
+            boolean uninstallBlockedBySystem = mAppsControlDisallowedBySystem ||
+                    RestrictedLockUtils.hasBaseUserRestriction(getActivity(), packageName, mUserId);
+            if (admin != null && !uninstallBlockedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(), admin);
             } else if ((mAppEntry.info.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
                 if (mAppEntry.info.enabled && !isDisabledUntilUsed()) {
@@ -739,7 +749,7 @@ public class InstalledAppDetails extends AppInfoBase
                 uninstallPkg(packageName, false, false);
             }
         } else if (v == mForceStopButton) {
-            if (mAppsControlDisallowedAdmin != null) {
+            if (mAppsControlDisallowedAdmin != null && !mAppsControlDisallowedBySystem) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         getActivity(), mAppsControlDisallowedAdmin);
             } else {

src/com/android/settings/bluetooth/BluetoothSettings.java

@@ -171,6 +171,9 @@ public final class BluetoothSettings extends DeviceListPreferenceFragment implem
 
         if (isUiRestricted()) {
             setDeviceListGroup(getPreferenceScreen());
+            if (!isUiRestrictedByOnlyAdmin()) {
+                getEmptyTextView().setText(R.string.bluetooth_empty_list_user_restricted);
+            }
             removeAllDevices();
             return;
         }
@@ -294,6 +297,7 @@ public final class BluetoothSettings extends DeviceListPreferenceFragment implem
                 mDevicePreferenceMap.clear();
 
                 if (isUiRestricted()) {
+                    messageId = R.string.bluetooth_empty_list_user_restricted;
                     break;
                 }
 
@@ -355,7 +359,7 @@ public final class BluetoothSettings extends DeviceListPreferenceFragment implem
             case BluetoothAdapter.STATE_OFF:
                 setOffMessage();
                 if (isUiRestricted()) {
-                    messageId = 0;
+                    messageId = R.string.bluetooth_empty_list_user_restricted;
                 }
                 break;
 

src/com/android/settings/deviceinfo/StorageSettings.java

@@ -395,7 +395,10 @@ public class StorageSettings extends SettingsPreferenceFragment implements Index
                     EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(
                             getActivity(), UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
                             UserHandle.myUserId());
-                    if (admin != null) {
+                    boolean hasBaseUserRestriction = RestrictedLockUtils.hasBaseUserRestriction(
+                            getActivity(), UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
+                            UserHandle.myUserId());
+                    if (admin != null && !hasBaseUserRestriction) {
                         RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getActivity(), admin);
                         return;
                     }

src/com/android/settings/deviceinfo/UsbBackend.java

@@ -22,6 +22,7 @@ import android.content.pm.PackageManager;
 import android.hardware.usb.UsbManager;
 import android.hardware.usb.UsbPort;
 import android.hardware.usb.UsbPortStatus;
+import android.os.UserHandle;
 import android.os.UserManager;
 
 public class UsbBackend {
@@ -37,6 +38,7 @@ public class UsbBackend {
     public static final int MODE_DATA_MIDI   = 0x03 << 1;
 
     private final boolean mRestricted;
+    private final boolean mRestrictedBySystem;
     private final boolean mMidi;
 
     private UserManager mUserManager;
@@ -56,6 +58,8 @@ public class UsbBackend {
         mUsbManager = context.getSystemService(UsbManager.class);
 
         mRestricted = mUserManager.hasUserRestriction(UserManager.DISALLOW_USB_FILE_TRANSFER);
+        mRestrictedBySystem = mUserManager.hasBaseUserRestriction(
+                UserManager.DISALLOW_USB_FILE_TRANSFER, UserHandle.of(UserHandle.myUserId()));
         mMidi = context.getPackageManager().hasSystemFeature(PackageManager.FEATURE_MIDI);
 
         UsbPort[] ports = mUsbManager.getPorts();
@@ -134,7 +138,7 @@ public class UsbBackend {
                     ? UsbPort.POWER_ROLE_SOURCE : UsbPort.POWER_ROLE_SINK;
     }
 
-    public boolean isModeDisallowedByAdmin(int mode) {
+    public boolean isModeDisallowed(int mode) {
         if (mRestricted && (mode & MODE_DATA_MASK) != MODE_DATA_NONE
                 && (mode & MODE_DATA_MASK) != MODE_DATA_MIDI) {
             // No USB data modes are supported.
@@ -143,6 +147,15 @@ public class UsbBackend {
         return false;
     }
 
+    public boolean isModeDisallowedBySystem(int mode) {
+        if (mRestrictedBySystem && (mode & MODE_DATA_MASK) != MODE_DATA_NONE
+                && (mode & MODE_DATA_MASK) != MODE_DATA_MIDI) {
+            // No USB data modes are supported.
+            return true;
+        }
+        return false;
+    }
+
     public boolean isModeSupported(int mode) {
         if (!mMidi && (mode & MODE_DATA_MASK) == MODE_DATA_MIDI) {
             return false;

src/com/android/settings/deviceinfo/UsbModeChooserActivity.java

@@ -106,9 +106,10 @@ public class UsbModeChooserActivity extends Activity {
         mBackend = new UsbBackend(this);
         int current = mBackend.getCurrentMode();
         for (int i = 0; i < DEFAULT_MODES.length; i++) {
-            if (mBackend.isModeSupported(DEFAULT_MODES[i])) {
+            if (mBackend.isModeSupported(DEFAULT_MODES[i])
+                    && !mBackend.isModeDisallowedBySystem(DEFAULT_MODES[i])) {
                 inflateOption(DEFAULT_MODES[i], current == DEFAULT_MODES[i], container,
-                        mBackend.isModeDisallowedByAdmin(DEFAULT_MODES[i]));
+                        mBackend.isModeDisallowed(DEFAULT_MODES[i]));
             }
         }
     }

src/com/android/settings/location/LocationSettings.java

@@ -266,8 +266,8 @@ public class LocationSettings extends LocationSettingsBase
         mManagedProfileSwitch.setOnPreferenceClickListener(null);
         final EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_SHARE_LOCATION, mManagedProfile.getIdentifier());
-        if (mUm.hasUserRestriction(UserManager.DISALLOW_SHARE_LOCATION, mManagedProfile)
+        final boolean isRestrictedByBase = isManagedProfileRestrictedByBase();
-                && admin != null) {
+        if (!isRestrictedByBase && admin != null) {
             mManagedProfileSwitch.setDisabledByAdmin(admin);
             mManagedProfileSwitch.setChecked(false);
         } else {
@@ -278,9 +278,8 @@ public class LocationSettings extends LocationSettingsBase
             if (!enabled) {
                 mManagedProfileSwitch.setChecked(false);
             } else {
-                final boolean isRestricted = isManagedProfileRestrictedByBase();
+                mManagedProfileSwitch.setChecked(!isRestrictedByBase);
-                mManagedProfileSwitch.setChecked(!isRestricted);
+                summaryResId = (isRestrictedByBase ?
-                summaryResId = (isRestricted ?
                         R.string.switch_off_text : R.string.switch_on_text);
                 mManagedProfileSwitch.setOnPreferenceClickListener(
                         mManagedProfileSwitchClickListener);
@@ -382,9 +381,11 @@ public class LocationSettings extends LocationSettingsBase
         final boolean enabled = (mode != android.provider.Settings.Secure.LOCATION_MODE_OFF);
         EnforcedAdmin admin = RestrictedLockUtils.checkIfRestrictionEnforced(getActivity(),
                 UserManager.DISALLOW_SHARE_LOCATION, UserHandle.myUserId());
+        boolean hasBaseUserRestriction = RestrictedLockUtils.hasBaseUserRestriction(getActivity(),
+                UserManager.DISALLOW_SHARE_LOCATION, UserHandle.myUserId());
         // Disable the whole switch bar instead of the switch itself. If we disabled the switch
         // only, it would be re-enabled again if the switch bar is not disabled.
-        if (admin != null) {
+        if (!hasBaseUserRestriction && admin != null) {
             mSwitchBar.setDisabledByAdmin(admin);
         } else {
             mSwitchBar.setEnabled(!restricted);

src/com/android/settings/nfc/NfcEnabler.java

@@ -21,12 +21,14 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.nfc.NfcAdapter;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.support.v14.preference.SwitchPreference;
 import android.support.v7.preference.Preference;
 import android.support.v7.preference.PreferenceScreen;
 
 import com.android.settings.R;
+import com.android.settingslib.RestrictedLockUtils;
 import com.android.settingslib.RestrictedPreference;
 
 /**
@@ -40,6 +42,7 @@ public class NfcEnabler implements Preference.OnPreferenceChangeListener {
     private final RestrictedPreference mAndroidBeam;
     private final NfcAdapter mNfcAdapter;
     private final IntentFilter mIntentFilter;
+    private boolean mBeamDisallowedBySystem;
 
     private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
         @Override
@@ -58,6 +61,8 @@ public class NfcEnabler implements Preference.OnPreferenceChangeListener {
         mSwitch = switchPreference;
         mAndroidBeam = androidBeam;
         mNfcAdapter = NfcAdapter.getDefaultAdapter(context);
+        mBeamDisallowedBySystem = RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_OUTGOING_BEAM, UserHandle.myUserId());
 
         if (mNfcAdapter == null) {
             // NFC is not supported
@@ -66,6 +71,9 @@ public class NfcEnabler implements Preference.OnPreferenceChangeListener {
             mIntentFilter = null;
             return;
         }
+        if (mBeamDisallowedBySystem) {
+            mAndroidBeam.setEnabled(false);
+        }
         mIntentFilter = new IntentFilter(NfcAdapter.ACTION_ADAPTER_STATE_CHANGED);
     }
 
@@ -112,7 +120,12 @@ public class NfcEnabler implements Preference.OnPreferenceChangeListener {
         case NfcAdapter.STATE_ON:
             mSwitch.setChecked(true);
             mSwitch.setEnabled(true);
+            if (mBeamDisallowedBySystem) {
+                mAndroidBeam.setDisabledByAdmin(null);
+                mAndroidBeam.setEnabled(false);
+            } else {
                 mAndroidBeam.checkRestrictionAndSetDisabled(UserManager.DISALLOW_OUTGOING_BEAM);
+            }
             if (mNfcAdapter.isNdefPushEnabled() && mAndroidBeam.isEnabled()) {
                 mAndroidBeam.setSummary(R.string.android_beam_on_summary);
             } else {

src/com/android/settings/notification/ZenModeSettingsBase.java

@@ -69,8 +69,12 @@ abstract public class ZenModeSettingsBase extends RestrictedSettingsFragment {
         maybeRefreshRules(true, true /*fireChanged*/);
         mSettingsObserver.register();
         if (isUiRestricted()) {
+            if (isUiRestrictedByOnlyAdmin()) {
                 getPreferenceScreen().removeAll();
                 return;
+            } else {
+                finish();
+            }
         }
     }
 

src/com/android/settings/users/UserDetailsSettings.java

@@ -29,7 +29,7 @@ import android.support.v7.preference.Preference;
 import com.android.internal.logging.MetricsProto.MetricsEvent;
 import com.android.settings.R;
 import com.android.settings.SettingsPreferenceFragment;
-import com.android.settingslib.RestrictedPreference;
+import com.android.settingslib.RestrictedLockUtils;
 
 import java.util.List;
 
@@ -60,7 +60,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
 
     private UserManager mUserManager;
     private SwitchPreference mPhonePref;
-    private RestrictedPreference mRemoveUserPref;
+    private Preference mRemoveUserPref;
 
     private UserInfo mUserInfo;
     private boolean mGuestUser;
@@ -80,7 +80,7 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
 
         addPreferencesFromResource(R.xml.user_details_settings);
         mPhonePref = (SwitchPreference) findPreference(KEY_ENABLE_TELEPHONY);
-        mRemoveUserPref = (RestrictedPreference) findPreference(KEY_REMOVE_USER);
+        mRemoveUserPref = findPreference(KEY_REMOVE_USER);
 
         mGuestUser = getArguments().getBoolean(EXTRA_USER_GUEST, false);
 
@@ -103,13 +103,11 @@ public class UserDetailsSettings extends SettingsPreferenceFragment
             mPhonePref.setChecked(
                     !mDefaultGuestRestrictions.getBoolean(UserManager.DISALLOW_OUTGOING_CALLS));
         }
-        mPhonePref.setOnPreferenceChangeListener(this);
+        if (RestrictedLockUtils.hasBaseUserRestriction(context,
+                UserManager.DISALLOW_REMOVE_USER, UserHandle.myUserId())) {
+            removePreference(KEY_REMOVE_USER);
         }
-
+        mPhonePref.setOnPreferenceChangeListener(this);
-    @Override
-    public void onResume() {
-        super.onResume();
-        mRemoveUserPref.checkRestrictionAndSetDisabled(UserManager.DISALLOW_REMOVE_USER);
     }
 
     @Override

src/com/android/settings/wifi/WifiSettings.java

@@ -633,6 +633,9 @@ public class WifiSettings extends RestrictedSettingsFragment
         // Safeguard from some delayed event handling
         if (getActivity() == null) return;
         if (isUiRestricted()) {
+            if (!isUiRestrictedByOnlyAdmin()) {
+                addMessagePreference(R.string.wifi_empty_list_user_restricted);
+            }
             getPreferenceScreen().removeAll();
             return;
         }
@@ -732,6 +735,9 @@ public class WifiSettings extends RestrictedSettingsFragment
 
     private void setOffMessage() {
         if (isUiRestricted()) {
+            if (!isUiRestrictedByOnlyAdmin()) {
+                addMessagePreference(R.string.wifi_empty_list_user_restricted);
+            }
             getPreferenceScreen().removeAll();
             return;
         }