commit 3d9805d50281882b4420ee2d4ede8a8bdd94d455
author Mahaver Chopra <mahaver@google.com> Thu Jul 07 16:25:05 2016 +0100
committer Mahaver Chopra <mahaver@google.com> Tue Jul 12 19:29:14 2016 +0100
tree eadca4fde21820e3564bcf6e66ef4ead258705b0
parent 7e10bcffc5fb34ea2051961ed07838c93018fd94

Added UM.DISALLOW_OEM_UNLOCK, Removed Global.OEM_UNLOCK_DISALLOWED.

Currently we used global setting to restrict user from enabling oem
unlock. As global settings can be chagned using adb, using user
restrictions instead.

Bug: 29893399
Change-Id: Ic83112a4838b8279bf50408a29ae205e0b8639ee

services/core/java/com/android/server/PersistentDataBlockService.java

diff --git a/services/core/java/com/android/server/PersistentDataBlockService.java b/services/core/java/com/android/server/PersistentDataBlockService.java
index e233b1c..080b46c 100644
--- a/services/core/java/com/android/server/PersistentDataBlockService.java
+++ b/services/core/java/com/android/server/PersistentDataBlockService.java
@@ -157,11 +157,10 @@
         }
     }
 
-    private void enforceFactoryResetAllowed() {
-        final boolean isOemUnlockRestricted = UserManager.get(mContext)
-                .hasUserRestriction(UserManager.DISALLOW_FACTORY_RESET);
-        if (isOemUnlockRestricted) {
-            throw new SecurityException("OEM unlock is disallowed by DISALLOW_FACTORY_RESET");
+    private void enforceUserRestriction(String userRestriction) {
+        if (UserManager.get(mContext).hasUserRestriction(userRestriction)) {
+            throw new SecurityException(
+                    "OEM unlock is disallowed by user restriction: " + userRestriction);
         }
     }
 
@@ -467,13 +466,9 @@
             enforceIsAdmin();
 
             if (enabled) {
-                // Do not allow oem unlock to be enabled if it has been disallowed.
-                if (Settings.Global.getInt(getContext().getContentResolver(),
-                        Settings.Global.OEM_UNLOCK_DISALLOWED, 0) == 1) {
-                    throw new SecurityException(
-                            "OEM unlock has been disallowed by OEM_UNLOCK_DISALLOWED.");
-                }
-                enforceFactoryResetAllowed();
+                // Do not allow oem unlock to be enabled if it's disallowed by a user restriction.
+                enforceUserRestriction(UserManager.DISALLOW_OEM_UNLOCK);
+                enforceUserRestriction(UserManager.DISALLOW_FACTORY_RESET);
             }
             synchronized (mLock) {
                 doSetOemUnlockEnabledLocked(enabled);