blob: 2c1b45219d0f1ab952c62b8091b0816ce1be68d1 [file] [log] [blame]
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.android.settings.security;
import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
import android.app.Activity;
import android.app.admin.DevicePolicyEventLogger;
import android.app.admin.DevicePolicyManager;
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.UserInfo;
import android.content.res.Configuration;
import android.net.Uri;
import android.os.Bundle;
import android.os.Handler;
import android.os.HandlerThread;
import android.os.Process;
import android.os.RemoteException;
import android.os.UserManager;
import android.security.AppUriAuthenticationPolicy;
import android.security.Credentials;
import android.security.KeyChain;
import android.stats.devicepolicy.DevicePolicyEnums;
import android.text.TextUtils;
import android.util.Log;
import android.view.View;
import android.widget.Button;
import android.widget.ImageView;
import android.widget.LinearLayout;
import android.widget.TextView;
import androidx.annotation.NonNull;
import androidx.annotation.Nullable;
import androidx.annotation.VisibleForTesting;
import androidx.recyclerview.widget.LinearLayoutManager;
import androidx.recyclerview.widget.RecyclerView;
import com.android.settings.R;
import com.google.android.material.floatingactionbutton.ExtendedFloatingActionButton;
import java.util.Map;
/**
* Displays a full screen to the user asking whether the calling app can manage the user's
* KeyChain credentials. This screen includes the authentication policy highlighting what apps and
* URLs the calling app can authenticate the user to.
* <p>
* Users can allow or deny the calling app. If denied, the calling app may re-request this
* capability. If allowed, the calling app will become the credential management app and will be
* able to manage the user's KeyChain credentials. The following APIs can be called to manage
* KeyChain credentials:
* {@link DevicePolicyManager#installKeyPair}
* {@link DevicePolicyManager#removeKeyPair}
* {@link DevicePolicyManager#generateKeyPair}
* {@link DevicePolicyManager#setKeyPairCertificate}
* <p>
*
* @see AppUriAuthenticationPolicy
*/
public class RequestManageCredentials extends Activity {
private static final String TAG = "ManageCredentials";
private String mCredentialManagerPackage;
private AppUriAuthenticationPolicy mAuthenticationPolicy;
private RecyclerView mRecyclerView;
private LinearLayoutManager mLayoutManager;
private LinearLayout mButtonPanel;
private ExtendedFloatingActionButton mExtendedFab;
private HandlerThread mKeyChainTread;
private KeyChain.KeyChainConnection mKeyChainConnection;
private boolean mDisplayingButtonPanel = false;
private boolean mIsLandscapeMode = false;
@Override
public void onCreate(@Nullable Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
if (!Credentials.ACTION_MANAGE_CREDENTIALS.equals(getIntent().getAction())) {
Log.e(TAG, "Unable to start activity because intent action is not "
+ Credentials.ACTION_MANAGE_CREDENTIALS);
logRequestFailure();
finishWithResultCancelled();
return;
}
if (isManagedDevice()) {
Log.e(TAG, "Credential management on managed devices should be done by the Device "
+ "Policy Controller, not a credential management app");
logRequestFailure();
finishWithResultCancelled();
return;
}
mCredentialManagerPackage = getLaunchedFromPackage();
if (TextUtils.isEmpty(mCredentialManagerPackage)) {
Log.e(TAG, "Unknown credential manager app");
logRequestFailure();
finishWithResultCancelled();
return;
}
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_NAME)
.setStrings(mCredentialManagerPackage)
.write();
setContentView(R.layout.request_manage_credentials);
getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
mIsLandscapeMode = getResources().getConfiguration().orientation
== Configuration.ORIENTATION_LANDSCAPE;
mKeyChainTread = new HandlerThread("KeyChainConnection");
mKeyChainTread.start();
mKeyChainConnection = getKeyChainConnection(this, mKeyChainTread);
AppUriAuthenticationPolicy policy =
getIntent().getParcelableExtra(KeyChain.EXTRA_AUTHENTICATION_POLICY);
if (!isValidAuthenticationPolicy(policy)) {
Log.e(TAG, "Invalid authentication policy");
logRequestFailure();
finishWithResultCancelled();
return;
}
mAuthenticationPolicy = policy;
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_POLICY)
.setStrings(getNumberOfAuthenticationPolicyApps(mAuthenticationPolicy),
getNumberOfAuthenticationPolicyUris(mAuthenticationPolicy))
.write();
if (mIsLandscapeMode) {
loadHeader();
}
loadRecyclerView();
loadButtons();
loadExtendedFloatingActionButton();
addOnScrollListener();
}
@Override
protected void onDestroy() {
super.onDestroy();
if (mKeyChainConnection != null) {
mKeyChainConnection.close();
mKeyChainConnection = null;
mKeyChainTread.quitSafely();
}
}
private boolean isValidAuthenticationPolicy(AppUriAuthenticationPolicy policy) {
if (policy == null || policy.getAppAndUriMappings().isEmpty()) {
return false;
}
try {
// Check whether any of the aliases in the policy already exist
for (String alias : policy.getAliases()) {
if (mKeyChainConnection.getService().requestPrivateKey(alias) != null) {
return false;
}
}
} catch (RemoteException e) {
Log.e(TAG, "Invalid authentication policy", e);
return false;
}
return true;
}
private boolean isManagedDevice() {
DevicePolicyManager dpm = getSystemService(DevicePolicyManager.class);
return dpm.getDeviceOwnerUser() != null
|| dpm.getProfileOwner() != null
|| hasManagedProfile();
}
private boolean hasManagedProfile() {
UserManager um = getSystemService(UserManager.class);
for (final UserInfo userInfo : um.getProfiles(getUserId())) {
if (userInfo.isManagedProfile()) {
return true;
}
}
return false;
}
private void loadRecyclerView() {
mLayoutManager = new LinearLayoutManager(this);
mRecyclerView = findViewById(R.id.apps_list);
mRecyclerView.setLayoutManager(mLayoutManager);
CredentialManagementAppAdapter recyclerViewAdapter = new CredentialManagementAppAdapter(
this, mCredentialManagerPackage, mAuthenticationPolicy.getAppAndUriMappings(),
/* include header= */ !mIsLandscapeMode, /* include expander= */ false);
mRecyclerView.setAdapter(recyclerViewAdapter);
}
private void loadButtons() {
mButtonPanel = findViewById(R.id.button_panel);
Button dontAllowButton = findViewById(R.id.dont_allow_button);
dontAllowButton.setFilterTouchesWhenObscured(true);
Button allowButton = findViewById(R.id.allow_button);
allowButton.setFilterTouchesWhenObscured(true);
dontAllowButton.setOnClickListener(b -> {
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_DENIED)
.write();
finishWithResultCancelled();
});
allowButton.setOnClickListener(b -> setOrUpdateCredentialManagementAppAndFinish());
}
private void loadExtendedFloatingActionButton() {
mExtendedFab = findViewById(R.id.extended_fab);
mExtendedFab.setOnClickListener(v -> {
final int position = mIsLandscapeMode
? mAuthenticationPolicy.getAppAndUriMappings().size() - 1
: mAuthenticationPolicy.getAppAndUriMappings().size();
mRecyclerView.scrollToPosition(position);
mExtendedFab.hide();
showButtonPanel();
});
}
private void loadHeader() {
final ImageView mAppIconView = findViewById(R.id.credential_management_app_icon);
final TextView mTitleView = findViewById(R.id.credential_management_app_title);
try {
ApplicationInfo applicationInfo =
getPackageManager().getApplicationInfo(mCredentialManagerPackage, 0);
mAppIconView.setImageDrawable(getPackageManager().getApplicationIcon(applicationInfo));
mTitleView.setText(TextUtils.expandTemplate(
getText(R.string.request_manage_credentials_title),
applicationInfo.loadLabel(getPackageManager())));
} catch (PackageManager.NameNotFoundException e) {
mAppIconView.setImageDrawable(null);
mTitleView.setText(TextUtils.expandTemplate(
getText(R.string.request_manage_credentials_title),
mCredentialManagerPackage));
}
}
private void setOrUpdateCredentialManagementAppAndFinish() {
try {
mKeyChainConnection.getService().setCredentialManagementApp(
mCredentialManagerPackage, mAuthenticationPolicy);
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_ACCEPTED)
.write();
setResult(RESULT_OK);
} catch (RemoteException e) {
Log.e(TAG, "Unable to set credential manager app", e);
logRequestFailure();
}
finish();
}
@VisibleForTesting
KeyChain.KeyChainConnection getKeyChainConnection(Context context, HandlerThread thread) {
final Handler handler = new Handler(thread.getLooper());
try {
KeyChain.KeyChainConnection connection = KeyChain.bindAsUser(
context, handler, Process.myUserHandle());
return connection;
} catch (InterruptedException e) {
throw new RuntimeException("Faile to bind to KeyChain", e);
}
}
private void addOnScrollListener() {
mRecyclerView.addOnScrollListener(new RecyclerView.OnScrollListener() {
@Override
public void onScrolled(@NonNull RecyclerView recyclerView, int dx, int dy) {
super.onScrolled(recyclerView, dx, dy);
if (!mDisplayingButtonPanel) {
// On down scroll, hide text in floating action button by setting
// extended to false.
if (dy > 0 && mExtendedFab.getVisibility() == View.VISIBLE) {
mExtendedFab.shrink();
}
if (isRecyclerScrollable()) {
mExtendedFab.show();
hideButtonPanel();
} else {
mExtendedFab.hide();
showButtonPanel();
}
}
}
});
}
private void showButtonPanel() {
// Add padding to remove overlap between recycler view and button panel.
int padding_in_px = (int) (60 * getResources().getDisplayMetrics().density + 0.5f);
mRecyclerView.setPadding(0, 0, 0, padding_in_px);
mButtonPanel.setVisibility(View.VISIBLE);
mDisplayingButtonPanel = true;
}
private void hideButtonPanel() {
mRecyclerView.setPadding(0, 0, 0, 0);
mButtonPanel.setVisibility(View.GONE);
}
private boolean isRecyclerScrollable() {
if (mLayoutManager == null || mRecyclerView.getAdapter() == null) {
return false;
}
return mLayoutManager.findLastCompletelyVisibleItemPosition()
< mRecyclerView.getAdapter().getItemCount() - 1;
}
private void finishWithResultCancelled() {
setResult(RESULT_CANCELED);
finish();
}
private void logRequestFailure() {
DevicePolicyEventLogger
.createEvent(DevicePolicyEnums.CREDENTIAL_MANAGEMENT_APP_REQUEST_FAILED)
.write();
}
private String getNumberOfAuthenticationPolicyUris(AppUriAuthenticationPolicy policy) {
int numberOfUris = 0;
for (Map.Entry<String, Map<Uri, String>> appsToUris :
policy.getAppAndUriMappings().entrySet()) {
numberOfUris += appsToUris.getValue().size();
}
return String.valueOf(numberOfUris);
}
private String getNumberOfAuthenticationPolicyApps(AppUriAuthenticationPolicy policy) {
return String.valueOf(policy.getAppAndUriMappings().size());
}
}