diff options
| -rw-r--r-- | services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 1de704d1239d..c58eae1cf330 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -2691,6 +2691,27 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { } } + /** + * If the device is in Device Owner mode, apply the restriction on adding + * a managed profile. + */ + @GuardedBy("getLockObject()") + void applyManagedProfileRestrictionIfDeviceOwnerLocked() { + final int doUserId = mOwners.getDeviceOwnerUserId(); + if (doUserId == UserHandle.USER_NULL) { + logIfVerbose("No DO found, skipping application of restriction."); + return; + } + + final UserHandle doUserHandle = UserHandle.of(doUserId); + // Set the restriction if not set. + if (!mUserManager.hasUserRestriction( + UserManager.DISALLOW_ADD_MANAGED_PROFILE, doUserHandle)) { + mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_MANAGED_PROFILE, true, + doUserHandle); + } + } + /** Apply default restrictions that haven't been applied to profile owners yet. */ private void maybeSetDefaultProfileOwnerUserRestrictions() { synchronized (getLockObject()) { @@ -3901,6 +3922,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { maybeStartSecurityLogMonitorOnActivityManagerReady(); synchronized (getLockObject()) { migrateToProfileOnOrganizationOwnedDeviceIfCompLocked(); + applyManagedProfileRestrictionIfDeviceOwnerLocked(); } final int userId = getManagedUserId(UserHandle.USER_SYSTEM); if (userId >= 0) { @@ -8764,6 +8786,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { mOwners.writeProfileOwner(userId); deleteTransferOwnershipBundleLocked(userId); toggleBackupServiceActive(userId, true); + applyManagedProfileRestrictionIfDeviceOwnerLocked(); } @Override |