Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package com.android.server.trust; |
| 18 | |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 19 | import android.app.AlarmManager; |
| 20 | import android.app.PendingIntent; |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 21 | import android.app.admin.DevicePolicyManager; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 22 | import android.content.BroadcastReceiver; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 23 | import android.content.ComponentName; |
| 24 | import android.content.Context; |
| 25 | import android.content.Intent; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 26 | import android.content.IntentFilter; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 27 | import android.content.ServiceConnection; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 28 | import android.net.Uri; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 29 | import android.os.Binder; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 30 | import android.os.Handler; |
| 31 | import android.os.IBinder; |
| 32 | import android.os.Message; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 33 | import android.os.PatternMatcher; |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 34 | import android.os.PersistableBundle; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 35 | import android.os.RemoteException; |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 36 | import android.os.SystemClock; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 37 | import android.os.UserHandle; |
| 38 | import android.util.Log; |
| 39 | import android.util.Slog; |
| 40 | import android.service.trust.ITrustAgentService; |
| 41 | import android.service.trust.ITrustAgentServiceCallback; |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 42 | |
Adrian Roos | a43fd03 | 2015-03-09 19:10:15 +0100 | [diff] [blame] | 43 | import java.util.Collections; |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 44 | import java.util.List; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 45 | |
| 46 | /** |
| 47 | * A wrapper around a TrustAgentService interface. Coordinates communication between |
| 48 | * TrustManager and the actual TrustAgent. |
| 49 | */ |
| 50 | public class TrustAgentWrapper { |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 51 | private static final String EXTRA_COMPONENT_NAME = "componentName"; |
| 52 | private static final String TRUST_EXPIRED_ACTION = "android.server.trust.TRUST_EXPIRED_ACTION"; |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 53 | private static final String PERMISSION = android.Manifest.permission.PROVIDE_TRUST_AGENT; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 54 | private static final boolean DEBUG = false; |
| 55 | private static final String TAG = "TrustAgentWrapper"; |
| 56 | |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 57 | private static final int MSG_GRANT_TRUST = 1; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 58 | private static final int MSG_REVOKE_TRUST = 2; |
| 59 | private static final int MSG_TRUST_TIMEOUT = 3; |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 60 | private static final int MSG_RESTART_TIMEOUT = 4; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 61 | private static final int MSG_SET_TRUST_AGENT_FEATURES_COMPLETED = 5; |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 62 | private static final int MSG_MANAGING_TRUST = 6; |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 63 | |
| 64 | /** |
| 65 | * Time in uptime millis that we wait for the service connection, both when starting |
| 66 | * and when the service disconnects. |
| 67 | */ |
| 68 | private static final long RESTART_TIMEOUT_MILLIS = 5 * 60000; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 69 | |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 70 | /** |
| 71 | * Long extra for {@link #MSG_GRANT_TRUST} |
| 72 | */ |
| 73 | private static final String DATA_DURATION = "duration"; |
| 74 | |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 75 | private final TrustManagerService mTrustManagerService; |
| 76 | private final int mUserId; |
| 77 | private final Context mContext; |
| 78 | private final ComponentName mName; |
| 79 | |
| 80 | private ITrustAgentService mTrustAgentService; |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 81 | private boolean mBound; |
| 82 | private long mScheduledRestartUptimeMillis; |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 83 | private long mMaximumTimeToLock; // from DevicePolicyManager |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 84 | |
| 85 | // Trust state |
| 86 | private boolean mTrusted; |
Adrian Roos | 7e03dfc | 2014-05-16 16:06:28 +0200 | [diff] [blame] | 87 | private CharSequence mMessage; |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 88 | private boolean mTrustDisabledByDpm; |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 89 | private boolean mManagingTrust; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 90 | private IBinder mSetTrustAgentFeaturesToken; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 91 | private AlarmManager mAlarmManager; |
| 92 | private final Intent mAlarmIntent; |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 93 | private PendingIntent mAlarmPendingIntent; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 94 | |
| 95 | private final BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() { |
| 96 | @Override |
| 97 | public void onReceive(Context context, Intent intent) { |
| 98 | ComponentName component = intent.getParcelableExtra(EXTRA_COMPONENT_NAME); |
| 99 | if (TRUST_EXPIRED_ACTION.equals(intent.getAction()) |
| 100 | && mName.equals(component)) { |
| 101 | mHandler.removeMessages(MSG_TRUST_TIMEOUT); |
| 102 | mHandler.sendEmptyMessage(MSG_TRUST_TIMEOUT); |
| 103 | } |
| 104 | } |
| 105 | }; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 106 | |
| 107 | private final Handler mHandler = new Handler() { |
| 108 | @Override |
| 109 | public void handleMessage(Message msg) { |
| 110 | switch (msg.what) { |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 111 | case MSG_GRANT_TRUST: |
Adrian Roos | 7d59b4f | 2014-05-27 20:01:31 +0200 | [diff] [blame] | 112 | if (!isConnected()) { |
| 113 | Log.w(TAG, "Agent is not connected, cannot grant trust: " |
| 114 | + mName.flattenToShortString()); |
| 115 | return; |
| 116 | } |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 117 | mTrusted = true; |
Adrian Roos | 7e03dfc | 2014-05-16 16:06:28 +0200 | [diff] [blame] | 118 | mMessage = (CharSequence) msg.obj; |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 119 | int flags = msg.arg1; |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 120 | long durationMs = msg.getData().getLong(DATA_DURATION); |
| 121 | if (durationMs > 0) { |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 122 | final long duration; |
| 123 | if (mMaximumTimeToLock != 0) { |
| 124 | // Enforce DevicePolicyManager timeout. This is here as a safeguard to |
| 125 | // ensure trust agents are evaluating trust state at least as often as |
| 126 | // the policy dictates. Admins that want more guarantees should be using |
| 127 | // DevicePolicyManager#KEYGUARD_DISABLE_TRUST_AGENTS. |
| 128 | duration = Math.min(durationMs, mMaximumTimeToLock); |
| 129 | if (DEBUG) { |
| 130 | Log.v(TAG, "DPM lock timeout in effect. Timeout adjusted from " |
| 131 | + durationMs + " to " + duration); |
| 132 | } |
| 133 | } else { |
| 134 | duration = durationMs; |
| 135 | } |
| 136 | long expiration = SystemClock.elapsedRealtime() + duration; |
| 137 | mAlarmPendingIntent = PendingIntent.getBroadcast(mContext, 0, mAlarmIntent, |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 138 | PendingIntent.FLAG_CANCEL_CURRENT); |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 139 | mAlarmManager.set(AlarmManager.ELAPSED_REALTIME_WAKEUP, expiration, |
| 140 | mAlarmPendingIntent); |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 141 | } |
| 142 | mTrustManagerService.mArchive.logGrantTrust(mUserId, mName, |
| 143 | (mMessage != null ? mMessage.toString() : null), |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 144 | durationMs, flags); |
| 145 | mTrustManagerService.updateTrust(mUserId, flags); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 146 | break; |
| 147 | case MSG_TRUST_TIMEOUT: |
| 148 | if (DEBUG) Slog.v(TAG, "Trust timed out : " + mName.flattenToShortString()); |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 149 | mTrustManagerService.mArchive.logTrustTimeout(mUserId, mName); |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 150 | onTrustTimeout(); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 151 | // Fall through. |
| 152 | case MSG_REVOKE_TRUST: |
| 153 | mTrusted = false; |
| 154 | mMessage = null; |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 155 | mHandler.removeMessages(MSG_TRUST_TIMEOUT); |
| 156 | if (msg.what == MSG_REVOKE_TRUST) { |
| 157 | mTrustManagerService.mArchive.logRevokeTrust(mUserId, mName); |
| 158 | } |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 159 | mTrustManagerService.updateTrust(mUserId, 0); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 160 | break; |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 161 | case MSG_RESTART_TIMEOUT: |
Adrian Roos | fc29e0b | 2014-11-11 12:55:44 +0100 | [diff] [blame] | 162 | destroy(); |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 163 | mTrustManagerService.resetAgent(mName, mUserId); |
| 164 | break; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 165 | case MSG_SET_TRUST_AGENT_FEATURES_COMPLETED: |
| 166 | IBinder token = (IBinder) msg.obj; |
| 167 | boolean result = msg.arg1 != 0; |
| 168 | if (mSetTrustAgentFeaturesToken == token) { |
| 169 | mSetTrustAgentFeaturesToken = null; |
| 170 | if (mTrustDisabledByDpm && result) { |
| 171 | if (DEBUG) Log.v(TAG, "Re-enabling agent because it acknowledged " |
| 172 | + "enabled features: " + mName); |
| 173 | mTrustDisabledByDpm = false; |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 174 | mTrustManagerService.updateTrust(mUserId, 0); |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 175 | } |
| 176 | } else { |
| 177 | if (DEBUG) Log.w(TAG, "Ignoring MSG_SET_TRUST_AGENT_FEATURES_COMPLETED " |
| 178 | + "with obsolete token: " + mName); |
| 179 | } |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 180 | break; |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 181 | case MSG_MANAGING_TRUST: |
| 182 | mManagingTrust = msg.arg1 != 0; |
| 183 | if (!mManagingTrust) { |
| 184 | mTrusted = false; |
| 185 | mMessage = null; |
| 186 | } |
| 187 | mTrustManagerService.mArchive.logManagingTrust(mUserId, mName, mManagingTrust); |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 188 | mTrustManagerService.updateTrust(mUserId, 0); |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 189 | break; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 190 | } |
| 191 | } |
| 192 | }; |
| 193 | |
| 194 | private ITrustAgentServiceCallback mCallback = new ITrustAgentServiceCallback.Stub() { |
| 195 | |
Adrian Roos | 7e03dfc | 2014-05-16 16:06:28 +0200 | [diff] [blame] | 196 | @Override |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 197 | public void grantTrust(CharSequence userMessage, long durationMs, int flags) { |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 198 | if (DEBUG) Slog.v(TAG, "enableTrust(" + userMessage + ", durationMs = " + durationMs |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 199 | + ", flags = " + flags + ")"); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 200 | |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 201 | Message msg = mHandler.obtainMessage( |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 202 | MSG_GRANT_TRUST, flags, 0, userMessage); |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 203 | msg.getData().putLong(DATA_DURATION, durationMs); |
| 204 | msg.sendToTarget(); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 205 | } |
| 206 | |
Adrian Roos | 7e03dfc | 2014-05-16 16:06:28 +0200 | [diff] [blame] | 207 | @Override |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 208 | public void revokeTrust() { |
| 209 | if (DEBUG) Slog.v(TAG, "revokeTrust()"); |
| 210 | mHandler.sendEmptyMessage(MSG_REVOKE_TRUST); |
| 211 | } |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 212 | |
| 213 | @Override |
| 214 | public void setManagingTrust(boolean managingTrust) { |
| 215 | if (DEBUG) Slog.v(TAG, "managingTrust()"); |
| 216 | mHandler.obtainMessage(MSG_MANAGING_TRUST, managingTrust ? 1 : 0, 0).sendToTarget(); |
| 217 | } |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 218 | |
| 219 | @Override |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 220 | public void onConfigureCompleted(boolean result, IBinder token) { |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 221 | if (DEBUG) Slog.v(TAG, "onSetTrustAgentFeaturesEnabledCompleted(result=" + result); |
| 222 | mHandler.obtainMessage(MSG_SET_TRUST_AGENT_FEATURES_COMPLETED, |
| 223 | result ? 1 : 0, 0, token).sendToTarget(); |
| 224 | } |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 225 | }; |
| 226 | |
| 227 | private final ServiceConnection mConnection = new ServiceConnection() { |
| 228 | @Override |
| 229 | public void onServiceConnected(ComponentName name, IBinder service) { |
| 230 | if (DEBUG) Log.v(TAG, "TrustAgent started : " + name.flattenToString()); |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 231 | mHandler.removeMessages(MSG_RESTART_TIMEOUT); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 232 | mTrustAgentService = ITrustAgentService.Stub.asInterface(service); |
Adrian Roos | 7d59b4f | 2014-05-27 20:01:31 +0200 | [diff] [blame] | 233 | mTrustManagerService.mArchive.logAgentConnected(mUserId, name); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 234 | setCallback(mCallback); |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 235 | updateDevicePolicyFeatures(); |
Adrian Roos | 481a6df | 2014-11-20 19:48:56 +0100 | [diff] [blame] | 236 | |
| 237 | if (mTrustManagerService.isDeviceLockedInner(mUserId)) { |
| 238 | onDeviceLocked(); |
| 239 | } else { |
| 240 | onDeviceUnlocked(); |
| 241 | } |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 242 | } |
| 243 | |
| 244 | @Override |
| 245 | public void onServiceDisconnected(ComponentName name) { |
| 246 | if (DEBUG) Log.v(TAG, "TrustAgent disconnected : " + name.flattenToShortString()); |
| 247 | mTrustAgentService = null; |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 248 | mManagingTrust = false; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 249 | mSetTrustAgentFeaturesToken = null; |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 250 | mTrustManagerService.mArchive.logAgentDied(mUserId, name); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 251 | mHandler.sendEmptyMessage(MSG_REVOKE_TRUST); |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 252 | if (mBound) { |
| 253 | scheduleRestart(); |
| 254 | } |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 255 | // mTrustDisabledByDpm maintains state |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 256 | } |
| 257 | }; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 258 | |
| 259 | public TrustAgentWrapper(Context context, TrustManagerService trustManagerService, |
| 260 | Intent intent, UserHandle user) { |
| 261 | mContext = context; |
| 262 | mTrustManagerService = trustManagerService; |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 263 | mAlarmManager = (AlarmManager) mContext.getSystemService(Context.ALARM_SERVICE); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 264 | mUserId = user.getIdentifier(); |
| 265 | mName = intent.getComponent(); |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 266 | |
| 267 | mAlarmIntent = new Intent(TRUST_EXPIRED_ACTION).putExtra(EXTRA_COMPONENT_NAME, mName); |
| 268 | mAlarmIntent.setData(Uri.parse(mAlarmIntent.toUri(Intent.URI_INTENT_SCHEME))); |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 269 | mAlarmIntent.setPackage(context.getPackageName()); |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 270 | |
| 271 | final IntentFilter alarmFilter = new IntentFilter(TRUST_EXPIRED_ACTION); |
| 272 | alarmFilter.addDataScheme(mAlarmIntent.getScheme()); |
| 273 | final String pathUri = mAlarmIntent.toUri(Intent.URI_INTENT_SCHEME); |
| 274 | alarmFilter.addDataPath(pathUri, PatternMatcher.PATTERN_LITERAL); |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 275 | |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 276 | // Schedules a restart for when connecting times out. If the connection succeeds, |
| 277 | // the restart is canceled in mCallback's onConnected. |
| 278 | scheduleRestart(); |
Dianne Hackborn | d69e4c1 | 2015-04-24 09:54:54 -0700 | [diff] [blame] | 279 | mBound = context.bindServiceAsUser(intent, mConnection, |
| 280 | Context.BIND_AUTO_CREATE | Context.BIND_FOREGROUND_SERVICE, user); |
Adrian Roos | 1221b06 | 2015-03-26 12:29:51 -0700 | [diff] [blame] | 281 | if (mBound) { |
| 282 | mContext.registerReceiver(mBroadcastReceiver, alarmFilter, PERMISSION, null); |
| 283 | } else { |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 284 | Log.e(TAG, "Can't bind to TrustAgent " + mName.flattenToShortString()); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 285 | } |
| 286 | } |
| 287 | |
| 288 | private void onError(Exception e) { |
| 289 | Slog.w(TAG , "Remote Exception", e); |
| 290 | } |
| 291 | |
Jim Miller | d4efaac | 2014-08-14 18:02:45 -0700 | [diff] [blame] | 292 | private void onTrustTimeout() { |
| 293 | try { |
| 294 | if (mTrustAgentService != null) mTrustAgentService.onTrustTimeout(); |
| 295 | } catch (RemoteException e) { |
| 296 | onError(e); |
| 297 | } |
| 298 | } |
Adrian Roos | 481a6df | 2014-11-20 19:48:56 +0100 | [diff] [blame] | 299 | |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 300 | /** |
| 301 | * @see android.service.trust.TrustAgentService#onUnlockAttempt(boolean) |
| 302 | */ |
| 303 | public void onUnlockAttempt(boolean successful) { |
| 304 | try { |
| 305 | if (mTrustAgentService != null) mTrustAgentService.onUnlockAttempt(successful); |
| 306 | } catch (RemoteException e) { |
| 307 | onError(e); |
| 308 | } |
| 309 | } |
| 310 | |
Adrian Roos | 481a6df | 2014-11-20 19:48:56 +0100 | [diff] [blame] | 311 | /** |
| 312 | * @see android.service.trust.TrustAgentService#onDeviceLocked() |
| 313 | */ |
| 314 | public void onDeviceLocked() { |
| 315 | try { |
| 316 | if (mTrustAgentService != null) mTrustAgentService.onDeviceLocked(); |
| 317 | } catch (RemoteException e) { |
| 318 | onError(e); |
| 319 | } |
| 320 | } |
| 321 | |
| 322 | /** |
| 323 | * @see android.service.trust.TrustAgentService#onDeviceUnlocked() |
| 324 | */ |
| 325 | public void onDeviceUnlocked() { |
| 326 | try { |
| 327 | if (mTrustAgentService != null) mTrustAgentService.onDeviceUnlocked(); |
| 328 | } catch (RemoteException e) { |
| 329 | onError(e); |
| 330 | } |
| 331 | } |
| 332 | |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 333 | private void setCallback(ITrustAgentServiceCallback callback) { |
| 334 | try { |
| 335 | if (mTrustAgentService != null) { |
| 336 | mTrustAgentService.setCallback(callback); |
| 337 | } |
| 338 | } catch (RemoteException e) { |
| 339 | onError(e); |
| 340 | } |
| 341 | } |
| 342 | |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 343 | boolean updateDevicePolicyFeatures() { |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 344 | boolean trustDisabled = false; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 345 | if (DEBUG) Slog.v(TAG, "updateDevicePolicyFeatures(" + mName + ")"); |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 346 | try { |
| 347 | if (mTrustAgentService != null) { |
| 348 | DevicePolicyManager dpm = |
| 349 | (DevicePolicyManager) mContext.getSystemService(Context.DEVICE_POLICY_SERVICE); |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 350 | |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 351 | if ((dpm.getKeyguardDisabledFeatures(null, mUserId) |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 352 | & DevicePolicyManager.KEYGUARD_DISABLE_TRUST_AGENTS) != 0) { |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 353 | List<PersistableBundle> config = dpm.getTrustAgentConfiguration( |
| 354 | null, mName, mUserId); |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 355 | trustDisabled = true; |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 356 | if (DEBUG) Slog.v(TAG, "Detected trust agents disabled. Config = " + config); |
| 357 | if (config != null && config.size() > 0) { |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 358 | if (DEBUG) { |
| 359 | Slog.v(TAG, "TrustAgent " + mName.flattenToShortString() |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 360 | + " disabled until it acknowledges "+ config); |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 361 | } |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 362 | mSetTrustAgentFeaturesToken = new Binder(); |
Jim Miller | e303bf4 | 2014-08-26 17:12:29 -0700 | [diff] [blame] | 363 | mTrustAgentService.onConfigure(config, mSetTrustAgentFeaturesToken); |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 364 | } |
Adrian Roos | a43fd03 | 2015-03-09 19:10:15 +0100 | [diff] [blame] | 365 | } else { |
| 366 | mTrustAgentService.onConfigure(Collections.EMPTY_LIST, null); |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 367 | } |
Jim Miller | 76b9b8b | 2014-08-22 17:04:57 -0700 | [diff] [blame] | 368 | final long maxTimeToLock = dpm.getMaximumTimeToLock(null); |
| 369 | if (maxTimeToLock != mMaximumTimeToLock) { |
| 370 | // If the timeout changes, cancel the alarm and send a timeout event to have |
| 371 | // the agent re-evaluate trust. |
| 372 | mMaximumTimeToLock = maxTimeToLock; |
| 373 | if (mAlarmPendingIntent != null) { |
| 374 | mAlarmManager.cancel(mAlarmPendingIntent); |
| 375 | mAlarmPendingIntent = null; |
| 376 | mHandler.sendEmptyMessage(MSG_TRUST_TIMEOUT); |
| 377 | } |
| 378 | } |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 379 | } |
| 380 | } catch (RemoteException e) { |
| 381 | onError(e); |
| 382 | } |
| 383 | if (mTrustDisabledByDpm != trustDisabled) { |
| 384 | mTrustDisabledByDpm = trustDisabled; |
Adrian Roos | 94e15a5 | 2015-04-16 12:23:18 -0700 | [diff] [blame] | 385 | mTrustManagerService.updateTrust(mUserId, 0); |
Jim Miller | 604e755 | 2014-07-18 19:00:02 -0700 | [diff] [blame] | 386 | } |
| 387 | return trustDisabled; |
| 388 | } |
| 389 | |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 390 | public boolean isTrusted() { |
Adrian Roos | 7861c66 | 2014-07-25 15:37:28 +0200 | [diff] [blame] | 391 | return mTrusted && mManagingTrust && !mTrustDisabledByDpm; |
| 392 | } |
| 393 | |
| 394 | public boolean isManagingTrust() { |
| 395 | return mManagingTrust && !mTrustDisabledByDpm; |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 396 | } |
| 397 | |
Adrian Roos | 7e03dfc | 2014-05-16 16:06:28 +0200 | [diff] [blame] | 398 | public CharSequence getMessage() { |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 399 | return mMessage; |
| 400 | } |
| 401 | |
Adrian Roos | fc29e0b | 2014-11-11 12:55:44 +0100 | [diff] [blame] | 402 | public void destroy() { |
| 403 | mHandler.removeMessages(MSG_RESTART_TIMEOUT); |
| 404 | |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 405 | if (!mBound) { |
| 406 | return; |
| 407 | } |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 408 | if (DEBUG) Log.v(TAG, "TrustAgent unbound : " + mName.flattenToShortString()); |
Adrian Roos | 7d59b4f | 2014-05-27 20:01:31 +0200 | [diff] [blame] | 409 | mTrustManagerService.mArchive.logAgentStopped(mUserId, mName); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 410 | mContext.unbindService(mConnection); |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 411 | mBound = false; |
Adrian Roos | 1221b06 | 2015-03-26 12:29:51 -0700 | [diff] [blame] | 412 | mContext.unregisterReceiver(mBroadcastReceiver); |
Adrian Roos | 7d59b4f | 2014-05-27 20:01:31 +0200 | [diff] [blame] | 413 | mTrustAgentService = null; |
Adrian Roos | 8f21158 | 2014-07-29 15:09:57 +0200 | [diff] [blame] | 414 | mSetTrustAgentFeaturesToken = null; |
Adrian Roos | 7d59b4f | 2014-05-27 20:01:31 +0200 | [diff] [blame] | 415 | mHandler.sendEmptyMessage(MSG_REVOKE_TRUST); |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 416 | } |
Adrian Roos | 7a4f3d4 | 2014-05-02 12:12:20 +0200 | [diff] [blame] | 417 | |
| 418 | public boolean isConnected() { |
| 419 | return mTrustAgentService != null; |
| 420 | } |
Adrian Roos | c5f95ce | 2014-07-24 16:00:46 +0200 | [diff] [blame] | 421 | |
| 422 | public boolean isBound() { |
| 423 | return mBound; |
| 424 | } |
| 425 | |
| 426 | /** |
| 427 | * If not connected, returns the time at which the agent is restarted. |
| 428 | * |
| 429 | * @return restart time in uptime millis. |
| 430 | */ |
| 431 | public long getScheduledRestartUptimeMillis() { |
| 432 | return mScheduledRestartUptimeMillis; |
| 433 | } |
| 434 | |
| 435 | private void scheduleRestart() { |
| 436 | mHandler.removeMessages(MSG_RESTART_TIMEOUT); |
| 437 | mScheduledRestartUptimeMillis = SystemClock.uptimeMillis() + RESTART_TIMEOUT_MILLIS; |
| 438 | mHandler.sendEmptyMessageAtTime(MSG_RESTART_TIMEOUT, mScheduledRestartUptimeMillis); |
| 439 | } |
Adrian Roos | 82142c2 | 2014-03-27 14:56:59 +0100 | [diff] [blame] | 440 | } |