Skip to content

Commit 3f0488d

Browse files
author
Kholoud Mohamed
committed
Add API to allow DMRH to set max policy storage limit per admin
Bug: 325036682 Test: btest android.devicepolicy.cts.DevicePolicyManagerTest Change-Id: I1e408fbf418abe9adc7a1de7d7e3030a97496f0e
1 parent 2e54a73 commit 3f0488d

File tree

5 files changed

+134
-7
lines changed

5 files changed

+134
-7
lines changed

‎core/api/system-current.txt

+2
Original file line numberDiff line numberDiff line change
@@ -1307,6 +1307,7 @@ package android.app.admin {
13071307
method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public android.os.UserHandle getDeviceOwnerUser();
13081308
method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public android.app.admin.DevicePolicyState getDevicePolicyState();
13091309
method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public String getFinancedDeviceKioskRoleHolder();
1310+
method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public int getMaxPolicyStorageLimit();
13101311
method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedAccessibilityServices(int);
13111312
method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedInputMethodsForCurrentUser();
13121313
method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public java.util.List<android.os.UserHandle> getPolicyManagedProfiles(@NonNull android.os.UserHandle);
@@ -1329,6 +1330,7 @@ package android.app.admin {
13291330
method @RequiresPermission(android.Manifest.permission.MANAGE_DEVICE_POLICY_APP_EXEMPTIONS) public void setApplicationExemptions(@NonNull String, @NonNull java.util.Set<java.lang.Integer>) throws android.content.pm.PackageManager.NameNotFoundException;
13301331
method @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public void setDeviceProvisioningConfigApplied();
13311332
method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setDpcDownloaded(boolean);
1333+
method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setMaxPolicyStorageLimit(int);
13321334
method @Deprecated @RequiresPermission(value=android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS, conditional=true) public void setProfileOwnerCanAccessDeviceIds(@NonNull android.content.ComponentName);
13331335
method public void setSecondaryLockscreenEnabled(@NonNull android.content.ComponentName, boolean);
13341336
method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setUserProvisioningState(int, @NonNull android.os.UserHandle);

‎core/java/android/app/admin/DevicePolicyManager.java

+43
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
import static android.Manifest.permission.SET_TIME;
5353
import static android.Manifest.permission.SET_TIME_ZONE;
5454
import static android.app.admin.flags.Flags.FLAG_ESIM_MANAGEMENT_ENABLED;
55+
import static android.app.admin.flags.Flags.FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED;
5556
import static android.app.admin.flags.Flags.onboardingBugreportV2Enabled;
5657
import static android.content.Intent.LOCAL_FLAG_FROM_SYSTEM;
5758
import static android.net.NetworkCapabilities.NET_ENTERPRISE_ID_1;
@@ -17348,4 +17349,46 @@ public Set<Integer> getSubscriptionsIds() {
1734817349
}
1734917350
return new HashSet<>();
1735017351
}
17352+
17353+
/**
17354+
* Controls the maximum storage size allowed for policies associated with an admin.
17355+
* Setting a limit of -1 effectively removes any storage restrictions.
17356+
*
17357+
* @param storageLimit Maximum storage allowed in bytes. Use -1 to disable limits.
17358+
*
17359+
* @hide
17360+
*/
17361+
@SystemApi
17362+
@RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)
17363+
@FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)
17364+
public void setMaxPolicyStorageLimit(int storageLimit) {
17365+
if (mService != null) {
17366+
try {
17367+
mService.setMaxPolicyStorageLimit(mContext.getPackageName(), storageLimit);
17368+
} catch (RemoteException e) {
17369+
throw e.rethrowFromSystemServer();
17370+
}
17371+
}
17372+
}
17373+
17374+
/**
17375+
* Retrieves the current maximum storage limit for policies associated with an admin.
17376+
*
17377+
* @return The maximum storage limit in bytes, or -1 if no limit is enforced.
17378+
*
17379+
* @hide
17380+
*/
17381+
@SystemApi
17382+
@RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)
17383+
@FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)
17384+
public int getMaxPolicyStorageLimit() {
17385+
if (mService != null) {
17386+
try {
17387+
return mService.getMaxPolicyStorageLimit(mContext.getPackageName());
17388+
} catch (RemoteException e) {
17389+
throw e.rethrowFromSystemServer();
17390+
}
17391+
}
17392+
return -1;
17393+
}
1735117394
}

‎core/java/android/app/admin/IDevicePolicyManager.aidl

+3
Original file line numberDiff line numberDiff line change
@@ -615,4 +615,7 @@ interface IDevicePolicyManager {
615615
int getContentProtectionPolicy(in ComponentName who, String callerPackageName);
616616

617617
int[] getSubscriptionIds(String callerPackageName);
618+
619+
void setMaxPolicyStorageLimit(String packageName, int storageLimit);
620+
int getMaxPolicyStorageLimit(String packageName);
618621
}

‎services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java

+53-3
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ final class DevicePolicyEngine {
102102
DevicePolicyIdentifiers.getIdentifierForUserRestriction(
103103
UserManager.DISALLOW_CELLULAR_2G);
104104

105+
//TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit
106+
private static final int DEFAULT_POLICY_SIZE_LIMIT = -1;
107+
105108
private final Context mContext;
106109
private final UserManager mUserManager;
107110

@@ -122,10 +125,11 @@ final class DevicePolicyEngine {
122125
* Map containing the current set of admins in each user with active policies.
123126
*/
124127
private final SparseArray<Set<EnforcingAdmin>> mEnforcingAdmins;
128+
125129
private final SparseArray<HashMap<EnforcingAdmin, Integer>> mAdminPolicySize;
126130

127-
//TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit
128-
private static final int POLICY_SIZE_LIMIT = 99999;
131+
private int mPolicySizeLimit = DEFAULT_POLICY_SIZE_LIMIT;
132+
129133
private final DeviceAdminServiceController mDeviceAdminServiceController;
130134

131135
DevicePolicyEngine(
@@ -1594,7 +1598,9 @@ private <V> boolean handleAdminPolicySizeLimit(PolicyState<V> policyState, Enfor
15941598
existingPolicySize = sizeOf(policyState.getPoliciesSetByAdmins().get(admin));
15951599
}
15961600
int policySize = sizeOf(value);
1597-
if (currentAdminPoliciesSize + policySize - existingPolicySize < POLICY_SIZE_LIMIT) {
1601+
// Policy size limit is disabled if mPolicySizeLimit is -1.
1602+
if (mPolicySizeLimit == -1
1603+
|| currentAdminPoliciesSize + policySize - existingPolicySize < mPolicySizeLimit) {
15981604
increasePolicySizeForAdmin(
15991605
admin, /* policySizeDiff = */ policySize - existingPolicySize);
16001606
return true;
@@ -1642,6 +1648,26 @@ private <V> void decreasePolicySizeForAdmin(PolicyState<V> policyState, Enforcin
16421648
}
16431649
}
16441650

1651+
/**
1652+
* Updates the max allowed size limit for policies per admin. Setting it to -1, disables
1653+
* the limitation.
1654+
*/
1655+
void setMaxPolicyStorageLimit(int storageLimit) {
1656+
if (storageLimit < DEFAULT_POLICY_SIZE_LIMIT && storageLimit != -1) {
1657+
throw new IllegalArgumentException("Can't set a size limit less than the minimum "
1658+
+ "allowed size.");
1659+
}
1660+
mPolicySizeLimit = storageLimit;
1661+
}
1662+
1663+
/**
1664+
* Returns the max allowed size limit for policies per admin. -1 means the limitation is
1665+
* disabled.
1666+
*/
1667+
int getMaxPolicyStorageLimit() {
1668+
return mPolicySizeLimit;
1669+
}
1670+
16451671
public void dump(IndentingPrintWriter pw) {
16461672
synchronized (mLock) {
16471673
pw.println("Local Policies: ");
@@ -1761,6 +1787,7 @@ private class DevicePoliciesReaderWriter {
17611787
private static final String TAG_ENFORCING_ADMIN_AND_SIZE = "enforcing-admin-and-size";
17621788
private static final String TAG_ENFORCING_ADMIN = "enforcing-admin";
17631789
private static final String TAG_POLICY_SUM_SIZE = "policy-sum-size";
1790+
private static final String TAG_MAX_POLICY_SIZE_LIMIT = "max-policy-size-limit";
17641791
private static final String ATTR_USER_ID = "user-id";
17651792
private static final String ATTR_POLICY_SUM_SIZE = "size";
17661793

@@ -1805,6 +1832,7 @@ void writeInner(TypedXmlSerializer serializer) throws IOException {
18051832
writeGlobalPoliciesInner(serializer);
18061833
writeEnforcingAdminsInner(serializer);
18071834
writeEnforcingAdminSizeInner(serializer);
1835+
writeMaxPolicySizeInner(serializer);
18081836
}
18091837

18101838
private void writeLocalPoliciesInner(TypedXmlSerializer serializer) throws IOException {
@@ -1886,6 +1914,17 @@ private void writeEnforcingAdminSizeInner(TypedXmlSerializer serializer)
18861914
}
18871915
}
18881916

1917+
private void writeMaxPolicySizeInner(TypedXmlSerializer serializer)
1918+
throws IOException {
1919+
if (!devicePolicySizeTrackingEnabled()) {
1920+
return;
1921+
}
1922+
serializer.startTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);
1923+
serializer.attributeInt(
1924+
/* namespace= */ null, ATTR_POLICY_SUM_SIZE, mPolicySizeLimit);
1925+
serializer.endTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);
1926+
}
1927+
18891928
void readFromFileLocked() {
18901929
if (!mFile.exists()) {
18911930
Log.d(TAG, "" + mFile + " doesn't exist");
@@ -1926,6 +1965,9 @@ private void readInner(TypedXmlPullParser parser)
19261965
case TAG_ENFORCING_ADMIN_AND_SIZE:
19271966
readEnforcingAdminAndSizeInner(parser);
19281967
break;
1968+
case TAG_MAX_POLICY_SIZE_LIMIT:
1969+
readMaxPolicySizeInner(parser);
1970+
break;
19291971
default:
19301972
Slogf.wtf(TAG, "Unknown tag " + tag);
19311973
}
@@ -2036,5 +2078,13 @@ private void readEnforcingAdminAndSizeInner(TypedXmlPullParser parser)
20362078
}
20372079
mAdminPolicySize.get(admin.getUserId()).put(admin, size);
20382080
}
2081+
2082+
private void readMaxPolicySizeInner(TypedXmlPullParser parser)
2083+
throws XmlPullParserException, IOException {
2084+
if (!devicePolicySizeTrackingEnabled()) {
2085+
return;
2086+
}
2087+
mPolicySizeLimit = parser.getAttributeInt(/* namespace= */ null, ATTR_POLICY_SUM_SIZE);
2088+
}
20392089
}
20402090
}

‎services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+33-4
Original file line numberDiff line numberDiff line change
@@ -12042,8 +12042,10 @@ public boolean setPermittedInputMethods(ComponentName who, String callerPackageN
1204212042
}
1204312043

1204412044
if (packageList != null) {
12045-
for (String pkg : packageList) {
12046-
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
12045+
if (!devicePolicySizeTrackingEnabled()) {
12046+
for (String pkg : packageList) {
12047+
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
12048+
}
1204712049
}
1204812050

1204912051
List<InputMethodInfo> enabledImes = mInjector.binderWithCleanCallingIdentity(() ->
@@ -14362,8 +14364,10 @@ && isManagedProfile(caller.getUserId()))
1436214364
public void setLockTaskPackages(ComponentName who, String callerPackageName, String[] packages)
1436314365
throws SecurityException {
1436414366
Objects.requireNonNull(packages, "packages is null");
14365-
for (String pkg : packages) {
14366-
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
14367+
if (!devicePolicySizeTrackingEnabled()) {
14368+
for (String pkg : packages) {
14369+
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
14370+
}
1436714371
}
1436814372

1436914373
CallerIdentity caller = getCallerIdentity(who, callerPackageName);
@@ -24075,5 +24079,30 @@ private IntArray getSubscriptionIdsInternal(String callerPackageName) {
2407524079
}
2407624080
return adminOwnedSubscriptions;
2407724081
});
24082+
24083+
}
24084+
24085+
@Override
24086+
public void setMaxPolicyStorageLimit(String callerPackageName, int storageLimit) {
24087+
if (!devicePolicySizeTrackingEnabled()) {
24088+
return;
24089+
}
24090+
CallerIdentity caller = getCallerIdentity(callerPackageName);
24091+
enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),
24092+
caller.getUserId());
24093+
24094+
mDevicePolicyEngine.setMaxPolicyStorageLimit(storageLimit);
24095+
}
24096+
24097+
@Override
24098+
public int getMaxPolicyStorageLimit(String callerPackageName) {
24099+
if (!devicePolicySizeTrackingEnabled()) {
24100+
return -1;
24101+
}
24102+
CallerIdentity caller = getCallerIdentity(callerPackageName);
24103+
enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),
24104+
caller.getUserId());
24105+
24106+
return mDevicePolicyEngine.getMaxPolicyStorageLimit();
2407824107
}
2407924108
}

0 commit comments

Comments
 (0)