Skip to content

Commit 7151ede

Browse files
Kholoud MohamedAndroid (Google) Code Review
Kholoud Mohamed
authored and
Android (Google) Code Review
committed
Merge "Add API to allow DMRH to set max policy storage limit per admin" into main
2 parents 383a45f + 3f0488d commit 7151ede

File tree

5 files changed

+134
-7
lines changed

5 files changed

+134
-7
lines changed

‎core/api/system-current.txt

+2
Original file line numberDiff line numberDiff line change
@@ -1307,6 +1307,7 @@ package android.app.admin {
13071307
method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public android.os.UserHandle getDeviceOwnerUser();
13081308
method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public android.app.admin.DevicePolicyState getDevicePolicyState();
13091309
method @Nullable @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public String getFinancedDeviceKioskRoleHolder();
1310+
method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public int getMaxPolicyStorageLimit();
13101311
method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedAccessibilityServices(int);
13111312
method @Nullable @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.QUERY_ADMIN_POLICY}) public java.util.List<java.lang.String> getPermittedInputMethodsForCurrentUser();
13121313
method @NonNull @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public java.util.List<android.os.UserHandle> getPolicyManagedProfiles(@NonNull android.os.UserHandle);
@@ -1329,6 +1330,7 @@ package android.app.admin {
13291330
method @RequiresPermission(android.Manifest.permission.MANAGE_DEVICE_POLICY_APP_EXEMPTIONS) public void setApplicationExemptions(@NonNull String, @NonNull java.util.Set<java.lang.Integer>) throws android.content.pm.PackageManager.NameNotFoundException;
13301331
method @RequiresPermission(android.Manifest.permission.MANAGE_USERS) public void setDeviceProvisioningConfigApplied();
13311332
method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setDpcDownloaded(boolean);
1333+
method @FlaggedApi("android.app.admin.flags.device_policy_size_tracking_enabled") @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setMaxPolicyStorageLimit(int);
13321334
method @Deprecated @RequiresPermission(value=android.Manifest.permission.GRANT_PROFILE_OWNER_DEVICE_IDS_ACCESS, conditional=true) public void setProfileOwnerCanAccessDeviceIds(@NonNull android.content.ComponentName);
13331335
method public void setSecondaryLockscreenEnabled(@NonNull android.content.ComponentName, boolean);
13341336
method @RequiresPermission(android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS) public void setUserProvisioningState(int, @NonNull android.os.UserHandle);

‎core/java/android/app/admin/DevicePolicyManager.java

+43
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
import static android.Manifest.permission.SET_TIME;
5353
import static android.Manifest.permission.SET_TIME_ZONE;
5454
import static android.app.admin.flags.Flags.FLAG_ESIM_MANAGEMENT_ENABLED;
55+
import static android.app.admin.flags.Flags.FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED;
5556
import static android.app.admin.flags.Flags.onboardingBugreportV2Enabled;
5657
import static android.content.Intent.LOCAL_FLAG_FROM_SYSTEM;
5758
import static android.net.NetworkCapabilities.NET_ENTERPRISE_ID_1;
@@ -17348,4 +17349,46 @@ public Set<Integer> getSubscriptionsIds() {
1734817349
}
1734917350
return new HashSet<>();
1735017351
}
17352+
17353+
/**
17354+
* Controls the maximum storage size allowed for policies associated with an admin.
17355+
* Setting a limit of -1 effectively removes any storage restrictions.
17356+
*
17357+
* @param storageLimit Maximum storage allowed in bytes. Use -1 to disable limits.
17358+
*
17359+
* @hide
17360+
*/
17361+
@SystemApi
17362+
@RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)
17363+
@FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)
17364+
public void setMaxPolicyStorageLimit(int storageLimit) {
17365+
if (mService != null) {
17366+
try {
17367+
mService.setMaxPolicyStorageLimit(mContext.getPackageName(), storageLimit);
17368+
} catch (RemoteException e) {
17369+
throw e.rethrowFromSystemServer();
17370+
}
17371+
}
17372+
}
17373+
17374+
/**
17375+
* Retrieves the current maximum storage limit for policies associated with an admin.
17376+
*
17377+
* @return The maximum storage limit in bytes, or -1 if no limit is enforced.
17378+
*
17379+
* @hide
17380+
*/
17381+
@SystemApi
17382+
@RequiresPermission(permission.MANAGE_PROFILE_AND_DEVICE_OWNERS)
17383+
@FlaggedApi(FLAG_DEVICE_POLICY_SIZE_TRACKING_ENABLED)
17384+
public int getMaxPolicyStorageLimit() {
17385+
if (mService != null) {
17386+
try {
17387+
return mService.getMaxPolicyStorageLimit(mContext.getPackageName());
17388+
} catch (RemoteException e) {
17389+
throw e.rethrowFromSystemServer();
17390+
}
17391+
}
17392+
return -1;
17393+
}
1735117394
}

‎core/java/android/app/admin/IDevicePolicyManager.aidl

+3
Original file line numberDiff line numberDiff line change
@@ -615,4 +615,7 @@ interface IDevicePolicyManager {
615615
int getContentProtectionPolicy(in ComponentName who, String callerPackageName);
616616

617617
int[] getSubscriptionIds(String callerPackageName);
618+
619+
void setMaxPolicyStorageLimit(String packageName, int storageLimit);
620+
int getMaxPolicyStorageLimit(String packageName);
618621
}

‎services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java

+53-3
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ final class DevicePolicyEngine {
102102
DevicePolicyIdentifiers.getIdentifierForUserRestriction(
103103
UserManager.DISALLOW_CELLULAR_2G);
104104

105+
//TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit
106+
private static final int DEFAULT_POLICY_SIZE_LIMIT = -1;
107+
105108
private final Context mContext;
106109
private final UserManager mUserManager;
107110

@@ -122,10 +125,11 @@ final class DevicePolicyEngine {
122125
* Map containing the current set of admins in each user with active policies.
123126
*/
124127
private final SparseArray<Set<EnforcingAdmin>> mEnforcingAdmins;
128+
125129
private final SparseArray<HashMap<EnforcingAdmin, Integer>> mAdminPolicySize;
126130

127-
//TODO(b/295504706) : Speak to security team to decide what to set Policy_Size_Limit
128-
private static final int POLICY_SIZE_LIMIT = 99999;
131+
private int mPolicySizeLimit = DEFAULT_POLICY_SIZE_LIMIT;
132+
129133
private final DeviceAdminServiceController mDeviceAdminServiceController;
130134

131135
DevicePolicyEngine(
@@ -1594,7 +1598,9 @@ private <V> boolean handleAdminPolicySizeLimit(PolicyState<V> policyState, Enfor
15941598
existingPolicySize = sizeOf(policyState.getPoliciesSetByAdmins().get(admin));
15951599
}
15961600
int policySize = sizeOf(value);
1597-
if (currentAdminPoliciesSize + policySize - existingPolicySize < POLICY_SIZE_LIMIT) {
1601+
// Policy size limit is disabled if mPolicySizeLimit is -1.
1602+
if (mPolicySizeLimit == -1
1603+
|| currentAdminPoliciesSize + policySize - existingPolicySize < mPolicySizeLimit) {
15981604
increasePolicySizeForAdmin(
15991605
admin, /* policySizeDiff = */ policySize - existingPolicySize);
16001606
return true;
@@ -1642,6 +1648,26 @@ private <V> void decreasePolicySizeForAdmin(PolicyState<V> policyState, Enforcin
16421648
}
16431649
}
16441650

1651+
/**
1652+
* Updates the max allowed size limit for policies per admin. Setting it to -1, disables
1653+
* the limitation.
1654+
*/
1655+
void setMaxPolicyStorageLimit(int storageLimit) {
1656+
if (storageLimit < DEFAULT_POLICY_SIZE_LIMIT && storageLimit != -1) {
1657+
throw new IllegalArgumentException("Can't set a size limit less than the minimum "
1658+
+ "allowed size.");
1659+
}
1660+
mPolicySizeLimit = storageLimit;
1661+
}
1662+
1663+
/**
1664+
* Returns the max allowed size limit for policies per admin. -1 means the limitation is
1665+
* disabled.
1666+
*/
1667+
int getMaxPolicyStorageLimit() {
1668+
return mPolicySizeLimit;
1669+
}
1670+
16451671
public void dump(IndentingPrintWriter pw) {
16461672
synchronized (mLock) {
16471673
pw.println("Local Policies: ");
@@ -1761,6 +1787,7 @@ private class DevicePoliciesReaderWriter {
17611787
private static final String TAG_ENFORCING_ADMIN_AND_SIZE = "enforcing-admin-and-size";
17621788
private static final String TAG_ENFORCING_ADMIN = "enforcing-admin";
17631789
private static final String TAG_POLICY_SUM_SIZE = "policy-sum-size";
1790+
private static final String TAG_MAX_POLICY_SIZE_LIMIT = "max-policy-size-limit";
17641791
private static final String ATTR_USER_ID = "user-id";
17651792
private static final String ATTR_POLICY_SUM_SIZE = "size";
17661793

@@ -1805,6 +1832,7 @@ void writeInner(TypedXmlSerializer serializer) throws IOException {
18051832
writeGlobalPoliciesInner(serializer);
18061833
writeEnforcingAdminsInner(serializer);
18071834
writeEnforcingAdminSizeInner(serializer);
1835+
writeMaxPolicySizeInner(serializer);
18081836
}
18091837

18101838
private void writeLocalPoliciesInner(TypedXmlSerializer serializer) throws IOException {
@@ -1886,6 +1914,17 @@ private void writeEnforcingAdminSizeInner(TypedXmlSerializer serializer)
18861914
}
18871915
}
18881916

1917+
private void writeMaxPolicySizeInner(TypedXmlSerializer serializer)
1918+
throws IOException {
1919+
if (!devicePolicySizeTrackingEnabled()) {
1920+
return;
1921+
}
1922+
serializer.startTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);
1923+
serializer.attributeInt(
1924+
/* namespace= */ null, ATTR_POLICY_SUM_SIZE, mPolicySizeLimit);
1925+
serializer.endTag(/* namespace= */ null, TAG_MAX_POLICY_SIZE_LIMIT);
1926+
}
1927+
18891928
void readFromFileLocked() {
18901929
if (!mFile.exists()) {
18911930
Log.d(TAG, "" + mFile + " doesn't exist");
@@ -1926,6 +1965,9 @@ private void readInner(TypedXmlPullParser parser)
19261965
case TAG_ENFORCING_ADMIN_AND_SIZE:
19271966
readEnforcingAdminAndSizeInner(parser);
19281967
break;
1968+
case TAG_MAX_POLICY_SIZE_LIMIT:
1969+
readMaxPolicySizeInner(parser);
1970+
break;
19291971
default:
19301972
Slogf.wtf(TAG, "Unknown tag " + tag);
19311973
}
@@ -2036,5 +2078,13 @@ private void readEnforcingAdminAndSizeInner(TypedXmlPullParser parser)
20362078
}
20372079
mAdminPolicySize.get(admin.getUserId()).put(admin, size);
20382080
}
2081+
2082+
private void readMaxPolicySizeInner(TypedXmlPullParser parser)
2083+
throws XmlPullParserException, IOException {
2084+
if (!devicePolicySizeTrackingEnabled()) {
2085+
return;
2086+
}
2087+
mPolicySizeLimit = parser.getAttributeInt(/* namespace= */ null, ATTR_POLICY_SUM_SIZE);
2088+
}
20392089
}
20402090
}

‎services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

+33-4
Original file line numberDiff line numberDiff line change
@@ -12042,8 +12042,10 @@ public boolean setPermittedInputMethods(ComponentName who, String callerPackageN
1204212042
}
1204312043

1204412044
if (packageList != null) {
12045-
for (String pkg : packageList) {
12046-
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
12045+
if (!devicePolicySizeTrackingEnabled()) {
12046+
for (String pkg : packageList) {
12047+
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
12048+
}
1204712049
}
1204812050

1204912051
List<InputMethodInfo> enabledImes = mInjector.binderWithCleanCallingIdentity(() ->
@@ -14362,8 +14364,10 @@ && isManagedProfile(caller.getUserId()))
1436214364
public void setLockTaskPackages(ComponentName who, String callerPackageName, String[] packages)
1436314365
throws SecurityException {
1436414366
Objects.requireNonNull(packages, "packages is null");
14365-
for (String pkg : packages) {
14366-
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
14367+
if (!devicePolicySizeTrackingEnabled()) {
14368+
for (String pkg : packages) {
14369+
PolicySizeVerifier.enforceMaxPackageNameLength(pkg);
14370+
}
1436714371
}
1436814372

1436914373
CallerIdentity caller = getCallerIdentity(who, callerPackageName);
@@ -24075,5 +24079,30 @@ private IntArray getSubscriptionIdsInternal(String callerPackageName) {
2407524079
}
2407624080
return adminOwnedSubscriptions;
2407724081
});
24082+
24083+
}
24084+
24085+
@Override
24086+
public void setMaxPolicyStorageLimit(String callerPackageName, int storageLimit) {
24087+
if (!devicePolicySizeTrackingEnabled()) {
24088+
return;
24089+
}
24090+
CallerIdentity caller = getCallerIdentity(callerPackageName);
24091+
enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),
24092+
caller.getUserId());
24093+
24094+
mDevicePolicyEngine.setMaxPolicyStorageLimit(storageLimit);
24095+
}
24096+
24097+
@Override
24098+
public int getMaxPolicyStorageLimit(String callerPackageName) {
24099+
if (!devicePolicySizeTrackingEnabled()) {
24100+
return -1;
24101+
}
24102+
CallerIdentity caller = getCallerIdentity(callerPackageName);
24103+
enforcePermission(MANAGE_PROFILE_AND_DEVICE_OWNERS, caller.getPackageName(),
24104+
caller.getUserId());
24105+
24106+
return mDevicePolicyEngine.getMaxPolicyStorageLimit();
2407824107
}
2407924108
}

0 commit comments

Comments
 (0)