commit 09b122daacda168799ad6c3dd100e30eebe47bd4
author Eran Messeri <eranm@google.com> Fri Oct 05 15:33:53 2018 +0100
committer Eran Messeri <eranm@google.com> Mon Oct 15 07:52:26 2018 +0100
tree 3285b2038983ad44f1c78548d13e0f0414d90a84
parent e976a1324bd87d69e9c31bd1efaa1db66273efd0

Private DNS: Add user restriction

Add a user restriction to prevent the user from changing the Private DNS
settings.

This would be used together with the new DevicePolicyManager API to set
the Private DNS settings by the Device Policy Client to enforce Private
DNS settings by the IT admin of the user.

Bug: 112982691
Test: atest com.android.cts.devicepolicy.DeviceOwnerTest#testPrivateDnsPolicy
Test: m -j RunSettingsRoboTests ROBOTEST_FILTER=PrivateDnsModeDialogPreferenceTest
Test: Manual, using TestDPC
Change-Id: Ibec3cfcede7e4082db4068cbdd047ada3f6c227e

services/core/java/com/android/server/pm/UserRestrictionsUtils.java

diff --git a/services/core/java/com/android/server/pm/UserRestrictionsUtils.java b/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
index 1315502..dd04652 100644
--- a/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
+++ b/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
@@ -127,7 +127,8 @@
             UserManager.DISALLOW_SHARE_INTO_MANAGED_PROFILE,
             UserManager.DISALLOW_AMBIENT_DISPLAY,
             UserManager.DISALLOW_CONFIG_SCREEN_TIMEOUT,
-            UserManager.DISALLOW_PRINTING
+            UserManager.DISALLOW_PRINTING,
+            UserManager.DISALLOW_CONFIG_PRIVATE_DNS
     });
 
     /**
@@ -163,7 +164,8 @@
      * User restrictions that cannot be set by profile owners. Applied to all users.
      */
     private static final Set<String> DEVICE_OWNER_ONLY_RESTRICTIONS = Sets.newArraySet(
-            UserManager.DISALLOW_USER_SWITCH
+            UserManager.DISALLOW_USER_SWITCH,
+            UserManager.DISALLOW_CONFIG_PRIVATE_DNS
     );
 
     /**
@@ -741,6 +743,10 @@
                 restriction = UserManager.DISALLOW_CONFIG_SCREEN_TIMEOUT;
                 break;
 
+            case android.provider.Settings.Global.PRIVATE_DNS_MODE:
+            case android.provider.Settings.Global.PRIVATE_DNS_SPECIFIER:
+                restriction = UserManager.DISALLOW_CONFIG_PRIVATE_DNS;
+                break;
             default:
                 if (setting.startsWith(Settings.Global.DATA_ROAMING)) {
                     if ("0".equals(value)) {