From 8afa1abb82796ed7e3d307ad031852b454f086fa Mon Sep 17 00:00:00 2001 From: Eran Messeri Date: Wed, 19 Mar 2025 14:02:50 +0000 Subject: DPM/MTE: Fix MTE developer Option when AAPM is on This change fixes the Memory Tagging Extension developer option Settings to be greyed out if the MTE state is controlled by AAPM. The fix consists of: * A change to the DevicePolicyManagerService to return the MTE policy regardless of the caller identity - as the getMtePolicy metthod does not care which admin has set the MTE policy, just the resolved policy for the device. * A change to RestrictedLockUtilsInternal to return an EnfocredAdmin representing that the MTE policy is managed somehow. Other code in the RestrictedLockUtilsInternal knows how to resolve the right admin from the EnforcedAdmin. To test the fix, the MANAGE_DEVICE_POLICY_MTE permission was added to the shell. It is safe for the shell to have this permission because: * A human can query and modify the state of the Memory Tagging Extension policy via Developer Options. * If the device is managed and the user tries to disable MTE, there is an additional check in the DevicePolicyManagerService that only the device policy client (DPC) can disable MTE. Bug: 402456665 Test: Manual, turn on AAPM with adb commands and observe the toggle in Settings. Test: atest CtsSecurityTestCases:android.security.cts.advancedprotection.MemoryTaggingExtensionTest Test: atest CtsDevicePolicyTestCases:android.devicepolicy.cts.MtePolicyTest Test: atest CtsDevicePolicyTestCases:android.devicepolicy.cts.DeviceManagementCoexistenceTest Flag: EXEMPT bugfix Change-Id: I55ffdec9b7abc29be503d85a7ae2607ba81938de --- packages/Shell/AndroidManifest.xml | 1 + 1 file changed, 1 insertion(+) (limited to 'packages/Shell') diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml index 55f7317f25e4..b8534ffe9476 100644 --- a/packages/Shell/AndroidManifest.xml +++ b/packages/Shell/AndroidManifest.xml @@ -961,6 +961,7 @@ android:featureFlag="android.security.aapm_api"/> +