This change addresses a security gap where users with the "DISALLOW_GRANT_ADMIN" restriction could still grant admin privileges to others, potentially undermining supervised user models. We've extended the existing logic to ensure that restricted users cannot grant or receive admin privileges when the DISALLOW_GRANT_ADMIN restriction is in place. This prevents scenarios where supervised users could create new admins to bypass restrictions and factory reset the device.
In addition to the core functionality improvement, significant code refactoring has been done to untangle complex multiple if conditions. The logic for determining when admin status changes are allowed is now clearer and more readable, taking into account both the "current user" (initiating the change) and the "target user" (whose privileges are being modified).
Bug: 357056776
Test: atest UserDetailsSettingsTest and manually verified the user having DISALLOW_GRANT_ADMIN restriction is not allowed to change admin status of any other user.
Flag: android.multiuser.unicorn_mode_refactoring_for_hsum_read_only
Change-Id: If02c9355ee7ce285b5b7bcddae630d716d5bf333
The name "Allow multiple users" is too ambiguous. It sounds like by toggling it off, the feature is completely disabled. In fact, it only hides user switcher. In conjunction with hiding other users from the list, it makes it appear as all the users get deleted when the toggle is off. On the contrary, users might be running in background when the toggle is off.
After this change, the new name better represents the intention behind this toggle, as well as makes the UI more intuitive. The users are not being hidden anymore. But switching preference gets disabled.
Since the toggle can only be enabled or disabled by owner (after this refactoring), it means that Owner has full control over multiuser settings and is able to perform actions on users without having to enable the toggle.
Bug: 336762423
Test: atest UserSettingsTest && atest UserDetailsSettingsTest
Flag: android.multiuser.new_multiuser_settings_ux
Change-Id: Id9d507039b58d3df66fe78710409716fd4816890
Before this change, Delete action was disabled for all uninitialized secondary users.
Bug: 341840847
Test: atest UserDetailsSettingsTest
Change-Id: Icd43836f577dd061d267f6fb75658c35a0c47589
Currently, if Settings applies CALLS or SMS restrictions to a user, that
restriction doesn't propogate to its child profiles. It should.
This is actually a no-op right now, since it's not possible to have a
profile on a user that isn't the Admin user anyway. But one day such a
thing may be allowed, so this implementation is more future-proof and
safer.
Test: Manual verification that applying the restriction continues to
work properly a full user
Test: UserDetailsSettingsTest
Bug: 261469887
Change-Id: Ib19cecbd37b6efc90f9655565295e7856427f049
SwitchPreference and SwitchPreferenceCompat are both TwoStatePreference.
Using TwoStatePreference in Java will helps migration in the future.
Bug: 306771414
Test: manual - check Settings pages
Change-Id: I84e1d7b09451106797c2b23d127855c6976678ca
Admins should not be able to disable phone calls and SMS from the device owner.
Bug: 294846327
Test: atest UserDetailsSettingsTest
Change-Id: Ibb8532379c6e1e22fe45f2acb5191f8f6c7f3b0a
Bug: 287265141
Test: on device with multiple admins enabled (default for HSUM) create a new
user and open User details view. Toggle Make this user an admin on/off.
Observe increased padding.
Change-Id: I216a91c4685eb12986cc4c61ae7be439358f55b2
In a series of CLs under topic add_ui_for_hsum_admins UI and functionality for allowing multiple admins on HSUM build is added. In User settings and User switcher when creating a new user there is a new dialog prompting to choose admin status of the user to be created. In User details view there is a toggle that is visible to admin users that allows to modify admin status of existing users. This toggle is only applicable to full users that are not supervised, guests or a main device user.
Bug: 252790451
Test: croot && make RunSettingsRoboTests -j40 ROBOTEST_FILTER="com.android.settings.users.UserDetailsSettingsTest"
Change-Id: I447dc168be30aa614aeb3f8b71ad14a7223fd7c1
Added isMain() user check in UserDetailsSettings.initialize and
UserDetailsSettings.canDeleteUser to hide and restrict
delete user option for main user in multi user settings.
Added unit tests for the same.
Bug: 260200162
Test: Manual test on headless to check remove user option
is not visible for the main user.
Test: Run robo tests with this command:
make -j64 RunSettingsRoboTests ROBOTEST_FILTER="com.android.settings.users.UserDetailsSettingsTest"
Change-Id: Ia455611a3d0b1e0945f61f00658425b7bf6c2dae
Move "Turn on phone calls" from guest detail user screen to user screen.
Optimisation: Applying restrictions to default guest user has been moved
to UserManagerService -> setDefaultGuestRestrictions.
Following UX there is no need for confirmation dialog.
Bug: 191483069
Test: make RunSettingsRoboTests -j128 ROBOTEST_FILTER="com.android.settings.users.GuestTelephonyPreferenceControllerTest"
make RunSettingsRoboTests -j128 ROBOTEST_FILTER="com.android.settings.users.UserSettingsTest"
Change-Id: Id7391d3f85954ea7f9c94791f24174105ec8073e
- Add option in user settings to enable/disable ephemeral
mode for guest user
- Update user settings to show exit guest and reset guest preferences
- Update user settings to show guest related preferences grouped together
Bug: 214031645, 175795666
Screenshots: go/ephemeral-guest-b-214031645-ux
Test: Manual test on sunfish, atest SystemUITests, atest SettingsRoboTests
Relands ag/16544951 after fixing post submit issues
Revert "Revert "Guest mode UX flow updates to user settings""
This reverts commit ed45e8c56a.
Change-Id: I54583f9021171ae523ff40d4f63835f1cb486e35
If the guest user was not auto created, removing the user from settings message was wrongly worded. Small refactor to reuse the same wording in different modules has been done.
Bug: 225314166
Test: manual
Change-Id: Ia1871efc6aeeb2d3604c2fc4fd98a2a3a500953b
Many multi-user strings were duplicated between SettingsLib, Settings,
System UI and Car projects. This CL removes those duplicates.
List of singularized strings: "Guest", "Remove guest", "Add user",
"Remove guest?", "Too many incorrect attempts...."
Bug: 191386817
Test: NA
Change-Id: I8d9629a1a9628cab9f049df84f706bd04ee75cc2
This CL reverts the changes made in ag/14282598 since the issue is
solved from the source and removes 'String name' parameter from
UM.createGuest() calls.
Bug: 185309160
Test: atest UserDetailsSettingsTest
Change-Id: I92acad938d79e21b45af99cc76ff411022b61f1b
Merged-In: I92acad938d79e21b45af99cc76ff411022b61f1b
(cherry picked from commit ae871ba823)
Add tracepoints in Settings for user switches and creation, for the
primary purpose of performance metrics in trace_processor.
Bug: 192001071
Test: manual
Change-Id: I1ecaccdaba3b14c42a45fefeb9b5568f7c7d6bf6
Allows an admin user to selectively install packages into a Guest user
by displaying a list of available packages that are installed in the
admin, but not in the Guest, and letting the admin choose to copy those
apps to the Guest.
Test: atest SettingsLibTests:com.android.settingslib.users.AppCopyingHelperTest
Test: Manual: install some apps in user 0, create a guest, uninstall
some system apps from it. Now, open this panel. Request some of those
apps be installed in the Guest and verify it worked.
Bug: 193281439
Change-Id: I4e6874a4ee93cd7bba96e1f6c8d04ed95873c1a2
If frameworks config config_guestUserAutoCreated=true, then Settings
will:
- Create a new guest user any time the current guest user is removed
- Show "Guest" instead of "Add guest"
- Show "Reset guest" instead of "Remove guest"
Bug: 188542158
Test: With config_guestUserAutoCreated=true, delete current guest user
using adb (`adb shell cmd user list -v --all` to find the user
ids, then remove each guest user with `adb shell pm remove-user
<id>`), then as owner, open multi-users settings page. Check that
there is a item for "Guest" instead of "Add guest". Select
"Guest", then confirm there is an item for "Reset guest" (it
should be disabled). Select "Switch to guest", then switch back to
owner. Open the multi-users settings page again. Check that "Reset
guest" is now enabled. Tap "Reset guest", and press confirmation
button, named "Reset". You should be take back to the main
multi-user settings page and still see "Guest". Wait a few
seconds, then use adb to confirm there is a guest user present.
Test: With config_guestUserAutoCreated=true, switch to guest user, open
multi-users settings page, check that there is an option to "Reset
guest". Select "Reset guest", and press confirmation button, named
"Reset". Phone should switch back to last active user, and QS tile
should now show "Guest" instead of "Add guest". Run `adb shell cmd
user list -v --all` to confirm guest has a new user id.
Test: With config_guestUserAutoCreated=false, confirm that "Add guest"
and "Remove guest" features remain unchanged
Change-Id: I7d5b81bd2e5c6b999ae18cd6b1280ae0496db94b
The UserDetailsSettings panel, and its title, show the user's UserInfo.name.
This is correct for a regular user (and for the Owner). But for a Guest user,
this is incorrect, and the user_guest string should be used instead.
The difference occurs if the system language is changed after the guest is created;
the word 'guest' should update to the current language, not be frozen to the
language at the time of the guest's creation.
Bug: 185309160
Test: atest UserDetailsSettingsTest
Change-Id: I545aa3e6cc5d00c0bcc49960f37dddd9334b153b
Revert submission 13278947-new-guest-user-strings
Reason for revert: Use same strings and text as Android R
Reverted Changes:
I8e9b7992d:Update icons and text for guest user
I42c0b46fd:Update icons and text for guest user
Bug: 169783558
Change-Id: Id038ec708e9098c856c4d24ae55a3b7e2bad391d
Test: As Guest, open Settings > System > Multiple users
Test: As Owner, open Settings > System > Multiple users
Bug: 169783558
Change-Id: I42c0b46fd895267b7556f3f308957b6dd17d92c4
Revert "Snap for 6793014 from 3157b4ee4325286f0c2ab0f26528460c8b..."
Revert "Snap for 6793014 from a43295d1825da62af038d345a7a861ed7a..."
Revert "Snap for 6793014 from 2076be4d27078d6ebc0a6b5e5ceb386109..."
Revert "Snap for 6793014 from d0e31526c62b2aeb35c293ac96feb180fc..."
Revert "Snap for 6793014 from 7a3a8c6351d5167a6ae0b33bc376efabd2..."
Revert "Snap for 6793014 from 41471cb21bb16b5c3bcc92f84293b79684..."
Revert "Snap for 6793014 from 42e5cca3cfb829690c9d8c6aca57a8e7d5..."
Revert "Snap for 6793014 from 4f81304963d19f4511b1e8e7d0aad87a67..."
Revert "Snap for 6793014 from 07602cdacf5bcc835db41f7eaa24af9964..."
Revert "Snap for 6793014 from 14cb57e107a3abce8b14937b1f92c28d18..."
Revert "Snap for 6793014 from ab1e4a81d09a540a5f927059e5bc03a606..."
Revert "Snap for 6793014 from 8c65adad0bcdfb3acc561063b4048dca24..."
Revert "Snap for 6793014 from b3061942700265e2bf04af9997775dcbbb..."
Revert "Snap for 6793014 from 551c5953fc62e339e4ee884ec2cd0ac3be..."
Revert "Snap for 6793014 from 4919273b2ac5c6347a18e17c5ec70d8da6..."
Revert "Snap for 6793014 from 988d4244914e0c749655e8cb6db18ba44f..."
Revert submission 12465146-release-request-6b259cbc-1f45-4b05-bc7e-c9b893b79d68-for-git_main-busytown-release-6793014
Reason for revert: b/166531456
Reverted Changes:
I5ff7a6c0d:Snap for 6793014 from f2989f9c65556d5155dbd57f82f0...
I77bdff943:Snap for 6793014 from a43295d1825da62af038d345a7a8...
I2ac5c520a:Snap for 6793014 from c3f124cca05579acf0a6cb589ebd...
I023b9702f:Snap for 6793014 from 98756d6d3e2bb0ba28eb125caa7a...
Ibc7893d72:Snap for 6793014 from fd1ad6750ef332d3f50f218f4d5d...
Ic27847bee:Snap for 6793014 from 8c65adad0bcdfb3acc561063b404...
If20bc9352:Snap for 6793014 from 7a3a8c6351d5167a6ae0b33bc376...
I6542d17e8:Snap for 6793014 from 3777d883a3857b1a1589181c436d...
I66e6bb8a9:Snap for 6793014 from 8b8bf0a07b0521bbe8483fbbab12...
I3cd190b6b:Snap for 6793014 from 424180bdc4aa18249e678daebfd0...
If92db7402:Snap for 6793014 from ab1e4a81d09a540a5f927059e5bc...
Iaced03c87:Snap for 6793014 from d0e31526c62b2aeb35c293ac96fe...
I5d28c6b4b:Snap for 6793014 from 4f81304963d19f4511b1e8e7d0aa...
I30d07bea3:Snap for 6793014 from 7594ec6384c4da320726def34f47...
I473205f48:Snap for 6793014 from 551c5953fc62e339e4ee884ec2cd...
I0656b41af:Snap for 6793014 from 44725f06b7f7d6407b5ee82d989b...
I0f9796067:Snap for 6793014 from 4919273b2ac5c6347a18e17c5ec7...
I9a38cda8f:Snap for 6793014 from 2076be4d27078d6ebc0a6b5e5ceb...
I876a82f51:Snap for 6793014 from 11467102abddb6026aaa164c1361...
I749d7d023:Snap for 6793014 from 41471cb21bb16b5c3bcc92f84293...
I038daea41:Snap for 6793014 from 07602cdacf5bcc835db41f7eaa24...
I47aa3131c:Snap for 6793014 from 14cb57e107a3abce8b14937b1f92...
I32dba8a95:Snap for 6793014 from 3157b4ee4325286f0c2ab0f26528...
I2ebc9f9db:Snap for 6793014 from 988d4244914e0c749655e8cb6db1...
Iae7c3370f:Snap for 6793014 from 9ffb8852294e06e2d387dc1fb868...
I6467a7f1b:Snap for 6793014 from 42e5cca3cfb829690c9d8c6aca57...
I8c6375203:Snap for 6793014 from b3061942700265e2bf04af999777...
I843b2e1f3:Snap for 6793014 from 265280bf5cb4bc14e132c3a35ae5...
Ie254f7079:Snap for 6793014 from f22ad3164937a8f2e309965c102b...
I01e0974ed:Snap for 6793014 from bbbccc3c2b7fc7c5780f6c415c42...
Change-Id: Ie8b2b332f7ebaaee7cd39c6f94d280c047426bc9
- Extract user setup prompt dialog creation logic
- Move user setup prompt dialog showing to UserDetailsSettings
- Rename user click and creation related methods to improve readability
- Set "disabled by admin" for switch pref when switch is disabled
- Cleanup UserSettings and UserDetailsSettings onPreferenceClick
- After a guest is created the details page opens instead of switching
Test: Manual test and robo tests with this command:
make -j64 RunSettingsRoboTests
Demo: http://shortn/_ACYsnbIKO9
Bug: 156867277
Change-Id: Ifa0cdefcd49d5b865e940a7cc332136ed26ecf57
- Restricted users can change their name
- Improved App&Content access screen
- Remove "Turn on phone calls" from restricted user detail page
Doc: http://shortn/_Prb3SJ3xJ3
Bug: 142798722
Test: Run robo tests with this command:
make -j64 RunSettingsRoboTests
Change-Id: I2aadf32aef52ba5ad0db7aa0cd83bac9d9941589
(cherry picked from commit f4759e00d5)
- Added switch and user delete functionality to details screen.
- Added robo tests.
Screenshots: http://shortn/_S6fbIMhAYO
Bug: 142798722
Test: Run robo tests with this command:
make -j64 RunSettingsRoboTests ROBOTEST_FILTER="com.android.settings.users.*SettingsTest"
Change-Id: Ied67290e8fed87feb0a60a3f2c40eb91cc57988e
- Added switch and user delete functionality to details screen.
- Added robo tests.
Screenshots: http://shortn/_S6fbIMhAYO
Bug: 142798722
Test: Run robo tests with this command:
make -j64 RunSettingsRoboTests ROBOTEST_FILTER="com.android.settings.users.*SettingsTest"
Change-Id: Id51c12c5470e30e2dffe93f3bd8c22380d8bdc1f
This means that in some cases RestrictedLockUtils has to be used and in
some RestrictedLockUtilsInternal.
This causes a lot of trivial code changes.
I also updated the ordering of the imports in all affected files.
Bug: 110953302
Test: Built
make -j RunSettingsRoboTests
Change-Id: I9bdf8b89134f853bae4f38c81af436715c73e924
Having consistent import order will reduce chance of merge
conflict between internal and external master
Test: rebuild
Change-Id: I0b1a170967ddcce7f388603fd521f6ed1eeba30b
Bug: 30681771
Test: SettingsUnitTests
Refactor visibility logging from InstrumentedFragment into a mixin. And
apply mixin in remaining fragments.
Change-Id: Ibbb59904336254a3e4bb9e8c7d0b36e5a6bc2622
