diff options
| -rw-r--r-- | services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index d3d05f3ca36a..6f6991cbd4db 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -4170,6 +4170,23 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { } } + private void removeCaApprovalsIfNeeded(int userId) { + for (UserInfo userInfo : mUserManager.getProfiles(userId)) { + boolean isSecure = mLockPatternUtils.isSecure(userInfo.id); + if (userInfo.isManagedProfile()){ + isSecure |= mLockPatternUtils.isSecure(getProfileParentId(userInfo.id)); + } + if (!isSecure) { + synchronized (this) { + getUserData(userInfo.id).mAcceptedCaCertificates.clear(); + saveSettingsLocked(userInfo.id); + } + + new MonitoringCertNotificationTask().execute(userInfo.id); + } + } + } + @Override public boolean installCaCert(ComponentName admin, byte[] certBuffer) throws RemoteException { enforceCanManageCaCerts(admin); @@ -4596,6 +4613,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub { DeviceAdminReceiver.ACTION_PASSWORD_CHANGED, DeviceAdminInfo.USES_POLICY_LIMIT_PASSWORD, userHandle); } + removeCaApprovalsIfNeeded(userHandle); } finally { mInjector.binderRestoreCallingIdentity(ident); } |