diff options
4 files changed, 32 insertions, 3 deletions
diff --git a/core/api/current.txt b/core/api/current.txt index 714f59ec13be..07f839571c92 100644 --- a/core/api/current.txt +++ b/core/api/current.txt @@ -7344,6 +7344,7 @@ package android.app.admin { field public static final int TAG_MEDIA_UNMOUNT = 210014; // 0x3345e field public static final int TAG_OS_SHUTDOWN = 210010; // 0x3345a field public static final int TAG_OS_STARTUP = 210009; // 0x33459 + field public static final int TAG_PASSWORD_COMPLEXITY_REQUIRED = 210035; // 0x33473 field public static final int TAG_PASSWORD_COMPLEXITY_SET = 210017; // 0x33461 field public static final int TAG_PASSWORD_EXPIRATION_SET = 210016; // 0x33460 field public static final int TAG_PASSWORD_HISTORY_LENGTH_SET = 210018; // 0x33462 diff --git a/core/java/android/app/admin/SecurityLog.java b/core/java/android/app/admin/SecurityLog.java index 86f91d79ad2b..1cf45670ed93 100644 --- a/core/java/android/app/admin/SecurityLog.java +++ b/core/java/android/app/admin/SecurityLog.java @@ -85,7 +85,8 @@ public class SecurityLog { TAG_CRYPTO_SELF_TEST_COMPLETED, TAG_KEY_INTEGRITY_VIOLATION, TAG_CERT_VALIDATION_FAILURE, - TAG_CAMERA_POLICY_SET + TAG_CAMERA_POLICY_SET, + TAG_PASSWORD_COMPLEXITY_REQUIRED }) public @interface SecurityLogTag {} @@ -478,6 +479,21 @@ public class SecurityLog { SecurityLogTags.SECURITY_CAMERA_POLICY_SET; /** + * Indicates that an admin has set a password complexity requirement, using the platform's + * pre-defined complexity levels. The log entry contains the following information about the + * event, encapsulated in an {@link Object} array and accessible via + * {@link SecurityEvent#getData()}: + * <li> [0] admin package name ({@code String}) + * <li> [1] admin user ID ({@code Integer}) + * <li> [2] target user ID ({@code Integer}) + * <li> [3] Password complexity ({@code Integer}) + * + * @see DevicePolicyManager#setRequiredPasswordComplexity(int) + */ + public static final int TAG_PASSWORD_COMPLEXITY_REQUIRED = + SecurityLogTags.SECURITY_PASSWORD_COMPLEXITY_REQUIRED; + + /** * Event severity level indicating that the event corresponds to normal workflow. */ public static final int LEVEL_INFO = 1; @@ -617,6 +633,7 @@ public class SecurityLog { case TAG_USER_RESTRICTION_ADDED: case TAG_USER_RESTRICTION_REMOVED: case TAG_CAMERA_POLICY_SET: + case TAG_PASSWORD_COMPLEXITY_REQUIRED: return LEVEL_INFO; case TAG_CERT_AUTHORITY_REMOVED: case TAG_CRYPTO_SELF_TEST_COMPLETED: diff --git a/core/java/android/app/admin/SecurityLogTags.logtags b/core/java/android/app/admin/SecurityLogTags.logtags index 100fd4cbd40f..db5245c919ab 100644 --- a/core/java/android/app/admin/SecurityLogTags.logtags +++ b/core/java/android/app/admin/SecurityLogTags.logtags @@ -1,4 +1,4 @@ -# See system/core/logcat/event.logtags for a description of the format of this file. +# See system/logging/logcat/event.logtags for a description of the format of this file. option java_package android.app.admin @@ -39,3 +39,4 @@ option java_package android.app.admin 210032 security_key_integrity_violation (key_id|3),(uid|1) 210033 security_cert_validation_failure (reason|3) 210034 security_camera_policy_set (package|3),(admin_user|1),(target_user|1),(disabled|1) +210035 security_password_complexity_required (package|3),(admin_user|1),(target_user|1),(complexity|1) diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 38381d2d74f8..83b4c823e4c5 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -4304,13 +4304,23 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { updatePasswordValidityCheckpointLocked(caller.getUserId(), calledOnParent); updatePasswordQualityCacheForUserGroup(caller.getUserId()); saveSettingsLocked(caller.getUserId()); - //TODO: Log password complexity change if security logging is enabled. }); } + logPasswordComplexityRequiredIfSecurityLogEnabled(admin.info.getComponent(), + caller.getUserId(), calledOnParent, passwordComplexity); } //TODO: Log metrics. } + private void logPasswordComplexityRequiredIfSecurityLogEnabled(ComponentName who, int userId, + boolean parent, int complexity) { + if (SecurityLog.isLoggingEnabled()) { + final int affectedUserId = parent ? getProfileParentId(userId) : userId; + SecurityLog.writeEvent(SecurityLog.TAG_PASSWORD_COMPLEXITY_REQUIRED, + who.getPackageName(), userId, affectedUserId, complexity); + } + } + private int getEffectivePasswordComplexityRequirementLocked(@UserIdInt int userHandle) { ensureLocked(); List<ActiveAdmin> admins = getActiveAdminsForLockscreenPoliciesLocked(userHandle); |