1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
|
/*
* Copyright (C) 2010 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.app;
import org.xmlpull.v1.XmlPullParserException;
import android.annotation.SdkConstant;
import android.annotation.SdkConstant.SdkConstantType;
import android.content.ComponentName;
import android.content.Context;
import android.content.pm.ActivityInfo;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.os.Handler;
import android.os.RemoteCallback;
import android.os.RemoteException;
import android.os.ServiceManager;
import android.util.Log;
import java.io.IOException;
import java.util.List;
/**
* Public interface for managing policies enforced on a device. Most clients
* of this class must have published a {@link DeviceAdmin} that the user
* has currently enabled.
*/
public class DevicePolicyManager {
private static String TAG = "DevicePolicyManager";
private static boolean DEBUG = false;
private static boolean localLOGV = DEBUG || android.util.Config.LOGV;
private final Context mContext;
private final IDevicePolicyManager mService;
private final Handler mHandler;
/*package*/ DevicePolicyManager(Context context, Handler handler) {
mContext = context;
mHandler = handler;
mService = IDevicePolicyManager.Stub.asInterface(
ServiceManager.getService(Context.DEVICE_POLICY_SERVICE));
}
/**
* Activity action: ask the user to add a new device administrator to the system.
* The desired policy is the ComponentName of the policy in the
* {@link #EXTRA_DEVICE_ADMIN} extra field. This will invoke a UI to
* bring the user through adding the device administrator to the system (or
* allowing them to reject it).
*
* <p>You can optionally include the {@link #EXTRA_ADD_EXPLANATION}
* field to provide the user with additional explanation (in addition
* to your component's description) about what is being added.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_ADD_DEVICE_ADMIN
= "android.app.action.ADD_DEVICE_ADMIN";
/**
* The ComponentName of the administrator component.
*
* @see #ACTION_ADD_DEVICE_ADMIN
*/
public static final String EXTRA_DEVICE_ADMIN = "android.app.extra.DEVICE_ADMIN";
/**
* An optional CharSequence providing additional explanation for why the
* admin is being added.
*
* @see #ACTION_ADD_DEVICE_ADMIN
*/
public static final String EXTRA_ADD_EXPLANATION = "android.app.extra.ADD_EXPLANATION";
/**
* Activity action: have the user enter a new password. This activity
* should be launched after using {@link #setPasswordMode(ComponentName, int)}
* or {@link #setPasswordMinimumLength(ComponentName, int)} to have the
* user enter a new password that meets the current requirements. You can
* use {@link #isActivePasswordSufficient()} to determine whether you need
* to have the user select a new password in order to meet the current
* constraints. Upon being resumed from this activity,
* you can check the new password characteristics to see if they are
* sufficient.
*/
@SdkConstant(SdkConstantType.ACTIVITY_INTENT_ACTION)
public static final String ACTION_SET_NEW_PASSWORD
= "android.app.action.SET_NEW_PASSWORD";
/**
* Return true if the given administrator component is currently
* active (enabled) in the system.
*/
public boolean isAdminActive(ComponentName who) {
if (mService != null) {
try {
return mService.isAdminActive(who);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return false;
}
/**
* Return a list of all currently active device administrator's component
* names. Note that if there are no administrators than null may be
* returned.
*/
public List<ComponentName> getActiveAdmins() {
if (mService != null) {
try {
return mService.getActiveAdmins();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return null;
}
/**
* Remove a current administration component. This can only be called
* by the application that owns the administration component; if you
* try to remove someone else's component, a security exception will be
* thrown.
*/
public void removeActiveAdmin(ComponentName who) {
if (mService != null) {
try {
mService.removeActiveAdmin(who);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Constant for {@link #setPasswordMode}: the policy has no requirements
* for the password. Note that mode constants are ordered so that higher
* values are more restrictive.
*/
public static final int PASSWORD_MODE_UNSPECIFIED = 0;
/**
* Constant for {@link #setPasswordMode}: the policy requires some kind
* of password, but doesn't care what it is. Note that mode constants
* are ordered so that higher values are more restrictive.
*/
public static final int PASSWORD_MODE_SOMETHING = 1000;
/**
* Constant for {@link #setPasswordMode}: the user must have at least a
* numeric password. Note that mode constants are ordered so that higher
* values are more restrictive.
*/
public static final int PASSWORD_MODE_NUMERIC = 2000;
/**
* Constant for {@link #setPasswordMode}: the user must have at least an
* alphanumeric password. Note that mode constants are ordered so that higher
* values are more restrictive.
*/
public static final int PASSWORD_MODE_ALPHANUMERIC = 3000;
/**
* Called by an application that is administering the device to set the
* password restrictions it is imposing. After setting this, the user
* will not be able to enter a new password that is not at least as
* restrictive as what has been set. Note that the current password
* will remain until the user has set a new one, so the change does not
* take place immediately. To prompt the user for a new password, use
* {@link #ACTION_SET_NEW_PASSWORD} after setting this value.
*
* <p>Mode constants are ordered so that higher values are more restrictive;
* thus the highest requested mode constant (between the policy set here,
* the user's preference, and any other considerations) is the one that
* is in effect.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @param admin Which {@link DeviceAdmin} this request is associated with.
* @param mode The new desired mode. One of
* {@link #PASSWORD_MODE_UNSPECIFIED}, {@link #PASSWORD_MODE_SOMETHING},
* {@link #PASSWORD_MODE_NUMERIC}, or {@link #PASSWORD_MODE_ALPHANUMERIC}.
*/
public void setPasswordMode(ComponentName admin, int mode) {
if (mService != null) {
try {
mService.setPasswordMode(admin, mode);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Retrieve the current minimum password mode for all admins
* or a particular one.
* @param admin The name of the admin component to check, or null to aggregate
* all admins.
*/
public int getPasswordMode(ComponentName admin) {
if (mService != null) {
try {
return mService.getPasswordMode(admin);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return PASSWORD_MODE_UNSPECIFIED;
}
/**
* Called by an application that is administering the device to set the
* minimum allowed password length. After setting this, the user
* will not be able to enter a new password that is not at least as
* restrictive as what has been set. Note that the current password
* will remain until the user has set a new one, so the change does not
* take place immediately. To prompt the user for a new password, use
* {@link #ACTION_SET_NEW_PASSWORD} after setting this value. This
* constraint is only imposed if the administrator has also requested either
* {@link #PASSWORD_MODE_NUMERIC} or {@link #PASSWORD_MODE_ALPHANUMERIC}
* with {@link #setPasswordMode}.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @param admin Which {@link DeviceAdmin} this request is associated with.
* @param length The new desired minimum password length. A value of 0
* means there is no restriction.
*/
public void setPasswordMinimumLength(ComponentName admin, int length) {
if (mService != null) {
try {
mService.setPasswordMinimumLength(admin, length);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Retrieve the current minimum password length for all admins
* or a particular one.
* @param admin The name of the admin component to check, or null to aggregate
* all admins.
*/
public int getPasswordMinimumLength(ComponentName admin) {
if (mService != null) {
try {
return mService.getPasswordMinimumLength(admin);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return 0;
}
/**
* Return the maximum password length that the device supports for a
* particular password mode.
* @param mode The mode being interrogated.
* @return Returns the maximum length that the user can enter.
*/
public int getPasswordMaximumLength(int mode) {
// Kind-of arbitrary.
return 16;
}
/**
* Determine whether the current password the user has set is sufficient
* to meet the policy requirements (mode, minimum length) that have been
* requested.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_PASSWORD} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @return Returns true if the password meets the current requirements,
* else false.
*/
public boolean isActivePasswordSufficient() {
if (mService != null) {
try {
return mService.isActivePasswordSufficient();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return false;
}
/**
* Retrieve the number of times the user has failed at entering a
* password since that last successful password entry.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} to be able to call
* this method; if it has not, a security exception will be thrown.
*/
public int getCurrentFailedPasswordAttempts() {
if (mService != null) {
try {
return mService.getCurrentFailedPasswordAttempts();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return -1;
}
/**
* Set the maximum number of failed password attempts that are allowed
* before the device wipes its data. This is convenience for implementing
* the corresponding functionality with a combination of watching failed
* password attempts and calling {@link #wipeData} upon reaching a certain
* count, and as such requires that you request both
* {@link DeviceAdminInfo#USES_POLICY_WATCH_LOGIN} and
* {@link DeviceAdminInfo#USES_POLICY_WIPE_DATA}}.
*
* @param admin Which {@link DeviceAdmin} this request is associated with.
* @param num The number of failed password attempts at which point the
* device will wipe its data.
*/
public void setMaximumFailedPasswordsForWipe(ComponentName admin, int num) {
if (mService != null) {
try {
mService.setMaximumFailedPasswordsForWipe(admin, num);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Retrieve the current maximum number of login attempts that are allowed
* before the device wipes itself, for all admins
* or a particular one.
* @param admin The name of the admin component to check, or null to aggregate
* all admins.
*/
public int getMaximumFailedPasswordsForWipe(ComponentName admin) {
if (mService != null) {
try {
return mService.getMaximumFailedPasswordsForWipe(admin);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return 0;
}
/**
* Force a new password on the user. This takes effect immediately. The
* given password must meet the current password minimum length constraint
* or it will be rejected. The given password will be accepted regardless
* of the current password mode, automatically adjusting the password mode
* higher if needed to meet the requirements of all active administrators.
* (The string you give here is acceptable for any mode;
* if it contains only digits, that is still an acceptable alphanumeric
* password.)
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_RESET_PASSWORD} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @param password The new password for the user.
* @return Returns true if the password was applied, or false if it is
* not acceptable for the current constraints.
*/
public boolean resetPassword(String password) {
if (mService != null) {
try {
return mService.resetPassword(password);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return false;
}
/**
* Called by an application that is administering the device to set the
* maximum time for user activity until the device will lock. This limits
* the length that the user can set. It takes effect immediately.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_LIMIT_UNLOCK} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @param admin Which {@link DeviceAdmin} this request is associated with.
* @param timeMs The new desired maximum time to lock in milliseconds.
* A value of 0 means there is no restriction.
*/
public void setMaximumTimeToLock(ComponentName admin, long timeMs) {
if (mService != null) {
try {
mService.setMaximumTimeToLock(admin, timeMs);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Retrieve the current maximum time to unlock for all admins
* or a particular one.
* @param admin The name of the admin component to check, or null to aggregate
* all admins.
*/
public long getMaximumTimeToLock(ComponentName admin) {
if (mService != null) {
try {
return mService.getMaximumTimeToLock(admin);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
return 0;
}
/**
* Make the device lock immediately, as if the lock screen timeout has
* expired at the point of this call.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_FORCE_LOCK} to be able to call
* this method; if it has not, a security exception will be thrown.
*/
public void lockNow() {
if (mService != null) {
try {
mService.lockNow();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* Ask the user date be wiped. This will cause the device to reboot,
* erasing all user data while next booting up. External storage such
* as SD cards will not be erased.
*
* <p>The calling device admin must have requested
* {@link DeviceAdminInfo#USES_POLICY_WIPE_DATA} to be able to call
* this method; if it has not, a security exception will be thrown.
*
* @param flags Bit mask of additional options: currently must be 0.
*/
public void wipeData(int flags) {
if (mService != null) {
try {
mService.wipeData(flags);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* @hide
*/
public void setActiveAdmin(ComponentName policyReceiver) {
if (mService != null) {
try {
mService.setActiveAdmin(policyReceiver);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* @hide
*/
public DeviceAdminInfo getAdminInfo(ComponentName cn) {
ActivityInfo ai;
try {
ai = mContext.getPackageManager().getReceiverInfo(cn,
PackageManager.GET_META_DATA);
} catch (PackageManager.NameNotFoundException e) {
Log.w(TAG, "Unable to retrieve device policy " + cn, e);
return null;
}
ResolveInfo ri = new ResolveInfo();
ri.activityInfo = ai;
try {
return new DeviceAdminInfo(mContext, ri);
} catch (XmlPullParserException e) {
Log.w(TAG, "Unable to parse device policy " + cn, e);
return null;
} catch (IOException e) {
Log.w(TAG, "Unable to parse device policy " + cn, e);
return null;
}
}
/**
* @hide
*/
public void getRemoveWarning(ComponentName admin, RemoteCallback result) {
if (mService != null) {
try {
mService.getRemoveWarning(admin, result);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* @hide
*/
public void setActivePasswordState(int mode, int length) {
if (mService != null) {
try {
mService.setActivePasswordState(mode, length);
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* @hide
*/
public void reportFailedPasswordAttempt() {
if (mService != null) {
try {
mService.reportFailedPasswordAttempt();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
/**
* @hide
*/
public void reportSuccessfulPasswordAttempt() {
if (mService != null) {
try {
mService.reportSuccessfulPasswordAttempt();
} catch (RemoteException e) {
Log.w(TAG, "Failed talking with device policy service", e);
}
}
}
}
|