commit 2ca3017f8e2a98de85212e3057e9bc21c8c9f0f4
author Andrew Scull <ascull@google.com> Wed Sep 06 17:53:25 2017 +0100
committer Andrew Scull <ascull@google.com> Fri Sep 08 16:11:36 2017 +0000
tree 12fca5018bc426dde6db7c6c771adb113e993541
parent 4ce113d6f8a9728b4e1ece20f74cab50f2b114c8

Policy transparency when DISALLOW_FACTORY_RESET prevents OEM unlock.

If an admin has set the DISALLOW_FACTORY_RESET user restriction, OEM
unlock is also restricted. If this is the case, it should be explained
to the user that the admin is preventing the OEM unlock.

DISALLOW_OEM_UNLOCK is deprecated and now managed by OemLockManager.
This restriction is also one set by the carrier, not an admin.

Test: RunSettingsRoboTests
Test: CTS verifier test from the bug
Bug: 65124732
Change-Id: I8bde87a522742a7cbda006eee17c2a19797b1835
(cherry picked from commit 0aa45bed65f544e68e0d38f255da005b3ce9fddf)

src/com/android/settings/development/DevelopmentSettings.java

diff --git a/src/com/android/settings/development/DevelopmentSettings.java b/src/com/android/settings/development/DevelopmentSettings.java
index 8477a33..137b697 100644
--- a/src/com/android/settings/development/DevelopmentSettings.java
+++ b/src/com/android/settings/development/DevelopmentSettings.java
@@ -54,6 +54,7 @@
 import android.os.ServiceManager;
 import android.os.StrictMode;
 import android.os.SystemProperties;
+import android.os.UserHandle;
 import android.os.UserManager;
 import android.os.storage.IStorageManager;
 import android.provider.SearchIndexableResource;
@@ -1054,8 +1055,19 @@
         return context.getSystemService(Context.OEM_LOCK_SERVICE) != null;
     }
 
+    /**
+     * Returns whether OEM unlock is allowed by the user and carrier.
+     *
+     * This does not take into account any restrictions imposed by the device policy.
+     */
+    private boolean isOemUnlockAllowedByUserAndCarrier() {
+        final UserHandle userHandle = UserHandle.of(UserHandle.myUserId());
+        return mOemLockManager.isOemUnlockAllowedByCarrier()
+                && !mUm.hasBaseUserRestriction(UserManager.DISALLOW_FACTORY_RESET, userHandle);
+    }
+
     private boolean enableOemUnlockPreference() {
-        return !isBootloaderUnlocked() && mOemLockManager.canUserAllowOemUnlock();
+        return !isBootloaderUnlocked() && isOemUnlockAllowedByUserAndCarrier();
     }
 
     private void updateOemUnlockOptions() {
@@ -1069,10 +1081,6 @@
                 // Check restriction, disable mEnableOemUnlock and apply policy transparency.
                 mEnableOemUnlock.checkRestrictionAndSetDisabled(UserManager.DISALLOW_FACTORY_RESET);
             }
-            if (mEnableOemUnlock.isEnabled()) {
-                // Check restriction, disable mEnableOemUnlock and apply policy transparency.
-                mEnableOemUnlock.checkRestrictionAndSetDisabled(UserManager.DISALLOW_OEM_UNLOCK);
-            }
         }
     }
 
@@ -2834,7 +2842,7 @@
                 oemUnlockSummary = R.string.oem_unlock_enable_disabled_summary_bootloader_unlocked;
             } else if (isSimLockedDevice()) {
                 oemUnlockSummary = R.string.oem_unlock_enable_disabled_summary_sim_locked_device;
-            } else if (!mOemLockManager.canUserAllowOemUnlock()) {
+            } else if (!isOemUnlockAllowedByUserAndCarrier()) {
                 // If the device isn't SIM-locked but OEM unlock is disallowed by some party, this
                 // means either some other carrier restriction is in place or the device hasn't been
                 // able to confirm which restrictions (SIM-lock or otherwise) apply.

tests/robotests/src/android/service/oemlock/OemLockManager.java

diff --git a/tests/robotests/src/android/service/oemlock/OemLockManager.java b/tests/robotests/src/android/service/oemlock/OemLockManager.java
index 7c015cf..c168089 100644
--- a/tests/robotests/src/android/service/oemlock/OemLockManager.java
+++ b/tests/robotests/src/android/service/oemlock/OemLockManager.java
@@ -32,9 +32,6 @@
         return false;
     }
 
-    public boolean canUserAllowOemUnlock() {
-        return true;
-    }
     public boolean isOemUnlockAllowed() {
         return false;
     }