src/com/android/settings/ChooseLockGeneric.java

   1 /*
   2  * Copyright (C) 2010 The Android Open Source Project
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 package com.android.settings;
  18
  19 import static android.app.admin.DevicePolicyManager.ACTION_SET_NEW_PARENT_PROFILE_PASSWORD;
  20 import static android.app.admin.DevicePolicyManager.ACTION_SET_NEW_PASSWORD;
  21 import static com.android.settings.ChooseLockPassword.ChooseLockPasswordFragment.RESULT_FINISHED;
  22 import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
  23
  24 import android.accessibilityservice.AccessibilityServiceInfo;
  25 import android.app.Activity;
  26 import android.app.AlertDialog;
  27 import android.app.Dialog;
  28 import android.app.DialogFragment;
  29 import android.app.Fragment;
  30 import android.app.FragmentManager;
  31 import android.app.admin.DevicePolicyManager;
  32 import android.content.Context;
  33 import android.content.DialogInterface;
  34 import android.content.Intent;
  35 import android.content.pm.UserInfo;
  36 import android.hardware.fingerprint.Fingerprint;
  37 import android.hardware.fingerprint.FingerprintManager;
  38 import android.hardware.fingerprint.FingerprintManager.RemovalCallback;
  39 import android.os.Bundle;
  40 import android.os.UserHandle;
  41 import android.os.UserManager;
  42 import android.os.storage.StorageManager;
  43 import android.security.KeyStore;
  44 import android.support.v7.preference.Preference;
  45 import android.support.v7.preference.PreferenceScreen;
  46 import android.text.TextUtils;
  47 import android.util.EventLog;
  48 import android.util.Log;
  49 import android.view.accessibility.AccessibilityManager;
  50 import android.widget.TextView;
  51
  52 import com.android.internal.logging.MetricsProto.MetricsEvent;
  53 import com.android.internal.widget.LockPatternUtils;
  54 import com.android.settings.fingerprint.FingerprintEnrollBase;
  55 import com.android.settings.fingerprint.FingerprintEnrollFindSensor;
  56 import com.android.settingslib.RestrictedLockUtils;
  57 import com.android.settingslib.RestrictedPreference;
  58
  59 import java.util.List;
  60
  61 public class ChooseLockGeneric extends SettingsActivity {
  62     public static final String CONFIRM_CREDENTIALS = "confirm_credentials";
  63
  64     @Override
  65     public Intent getIntent() {
  66         Intent modIntent = new Intent(super.getIntent());
  67         modIntent.putExtra(EXTRA_SHOW_FRAGMENT, getFragmentClass().getName());
  68
  69         String action = modIntent.getAction();
  70         if (ACTION_SET_NEW_PASSWORD.equals(action)
  71                 || ACTION_SET_NEW_PARENT_PROFILE_PASSWORD.equals(action)) {
  72             modIntent.putExtra(EXTRA_HIDE_DRAWER, true);
  73         }
  74         return modIntent;
  75     }
  76
  77     @Override
  78     protected boolean isValidFragment(String fragmentName) {
  79         if (ChooseLockGenericFragment.class.getName().equals(fragmentName)) return true;
  80         return false;
  81     }
  82
  83     /* package */ Class<? extends Fragment> getFragmentClass() {
  84         return ChooseLockGenericFragment.class;
  85     }
  86
  87     public static class InternalActivity extends ChooseLockGeneric {
  88     }
  89
  90     public static class ChooseLockGenericFragment extends SettingsPreferenceFragment {
  91         private static final String TAG = "ChooseLockGenericFragment";
  92         private static final int MIN_PASSWORD_LENGTH = 4;
  93         private static final String KEY_UNLOCK_SET_OFF = "unlock_set_off";
  94         private static final String KEY_UNLOCK_SET_NONE = "unlock_set_none";
  95         private static final String KEY_UNLOCK_SET_PIN = "unlock_set_pin";
  96         private static final String KEY_UNLOCK_SET_PASSWORD = "unlock_set_password";
  97         private static final String KEY_UNLOCK_SET_PATTERN = "unlock_set_pattern";
  98         private static final String KEY_UNLOCK_SET_MANAGED = "unlock_set_managed";
  99         private static final String KEY_SKIP_FINGERPRINT = "unlock_skip_fingerprint";
 100         private static final String PASSWORD_CONFIRMED = "password_confirmed";
 101         private static final String WAITING_FOR_CONFIRMATION = "waiting_for_confirmation";
 102         public static final String MINIMUM_QUALITY_KEY = "minimum_quality";
 103         public static final String HIDE_DISABLED_PREFS = "hide_disabled_prefs";
 104         public static final String ENCRYPT_REQUESTED_QUALITY = "encrypt_requested_quality";
 105         public static final String ENCRYPT_REQUESTED_DISABLED = "encrypt_requested_disabled";
 106         public static final String TAG_FRP_WARNING_DIALOG = "frp_warning_dialog";
 107
 108         private static final int CONFIRM_EXISTING_REQUEST = 100;
 109         private static final int ENABLE_ENCRYPTION_REQUEST = 101;
 110         private static final int CHOOSE_LOCK_REQUEST = 102;
 111         private static final int CHOOSE_LOCK_BEFORE_FINGERPRINT_REQUEST = 103;
 112         private static final int SKIP_FINGERPRINT_REQUEST = 104;
 113
 114         private ChooseLockSettingsHelper mChooseLockSettingsHelper;
 115         private DevicePolicyManager mDPM;
 116         private KeyStore mKeyStore;
 117         private boolean mHasChallenge = false;
 118         private long mChallenge;
 119         private boolean mPasswordConfirmed = false;
 120         private boolean mWaitingForConfirmation = false;
 121         private int mEncryptionRequestQuality;
 122         private boolean mEncryptionRequestDisabled;
 123         private boolean mRequirePassword;
 124         private boolean mForChangeCredRequiredForBoot = false;
 125         private String mUserPassword;
 126         private LockPatternUtils mLockPatternUtils;
 127         private FingerprintManager mFingerprintManager;
 128         private int mUserId;
 129         private boolean mHideDrawer = false;
 130         private ManagedLockPasswordProvider mManagedPasswordProvider;
 131         private boolean mIsSetNewPassword = false;
 132
 133         protected boolean mForFingerprint = false;
 134
 135         @Override
 136         protected int getMetricsCategory() {
 137             return MetricsEvent.CHOOSE_LOCK_GENERIC;
 138         }
 139
 140         @Override
 141         public void onCreate(Bundle savedInstanceState) {
 142             super.onCreate(savedInstanceState);
 143
 144             String chooseLockAction = getActivity().getIntent().getAction();
 145             mFingerprintManager =
 146                 (FingerprintManager) getActivity().getSystemService(Context.FINGERPRINT_SERVICE);
 147             mDPM = (DevicePolicyManager) getSystemService(Context.DEVICE_POLICY_SERVICE);
 148             mKeyStore = KeyStore.getInstance();
 149             mChooseLockSettingsHelper = new ChooseLockSettingsHelper(this.getActivity());
 150             mLockPatternUtils = new LockPatternUtils(getActivity());
 151             mIsSetNewPassword = ACTION_SET_NEW_PARENT_PROFILE_PASSWORD.equals(chooseLockAction)
 152                     || ACTION_SET_NEW_PASSWORD.equals(chooseLockAction);
 153
 154             // Defaults to needing to confirm credentials
 155             final boolean confirmCredentials = getActivity().getIntent()
 156                 .getBooleanExtra(CONFIRM_CREDENTIALS, true);
 157             if (getActivity() instanceof ChooseLockGeneric.InternalActivity) {
 158                 mPasswordConfirmed = !confirmCredentials;
 159             }
 160             mHideDrawer = getActivity().getIntent().getBooleanExtra(EXTRA_HIDE_DRAWER, false);
 161
 162             mHasChallenge = getActivity().getIntent().getBooleanExtra(
 163                     ChooseLockSettingsHelper.EXTRA_KEY_HAS_CHALLENGE, false);
 164             mChallenge = getActivity().getIntent().getLongExtra(
 165                     ChooseLockSettingsHelper.EXTRA_KEY_CHALLENGE, 0);
 166             mForFingerprint = getActivity().getIntent().getBooleanExtra(
 167                     ChooseLockSettingsHelper.EXTRA_KEY_FOR_FINGERPRINT, false);
 168             mForChangeCredRequiredForBoot = getArguments() != null && getArguments().getBoolean(
 169                     ChooseLockSettingsHelper.EXTRA_KEY_FOR_CHANGE_CRED_REQUIRED_FOR_BOOT);
 170             if (mIsSetNewPassword) {
 171                 // In ACTION_SET_NEW_PARENT_PROFILE_PASSWORD or ACTION_SET_NEW_PASSWORD, the user
 172                 // will be asked to confirm the password if one has been set.
 173                 // On fingerprint supported device, fingerprint options are represented in the
 174                 // options. If the user chooses to skip fingerprint setup, ChooseLockGeneric is
 175                 // relaunched to only show options without fingerprint. In this case, we shouldn't
 176                 // ask the user to confirm the password again.
 177                 mPasswordConfirmed = getActivity().getIntent().getBooleanExtra(
 178                         PASSWORD_CONFIRMED, false);
 179             }
 180
 181             if (savedInstanceState != null) {
 182                 mPasswordConfirmed = savedInstanceState.getBoolean(PASSWORD_CONFIRMED);
 183                 mWaitingForConfirmation = savedInstanceState.getBoolean(WAITING_FOR_CONFIRMATION);
 184                 mEncryptionRequestQuality = savedInstanceState.getInt(ENCRYPT_REQUESTED_QUALITY);
 185                 mEncryptionRequestDisabled = savedInstanceState.getBoolean(
 186                         ENCRYPT_REQUESTED_DISABLED);
 187             }
 188
 189             // a) If this is started from other user, use that user id.
 190             // b) If this is started from the same user, read the extra if this is launched
 191             //    from Settings app itself.
 192             // c) Otherwise, use UserHandle.myUserId().
 193             mUserId = Utils.getSecureTargetUser(
 194                     getActivity().getActivityToken(),
 195                     UserManager.get(getActivity()),
 196                     getArguments(),
 197                     getActivity().getIntent().getExtras()).getIdentifier();
 198             if (ACTION_SET_NEW_PASSWORD.equals(chooseLockAction)
 199                     && Utils.isManagedProfile(UserManager.get(getActivity()), mUserId)
 200                     && mLockPatternUtils.isSeparateProfileChallengeEnabled(mUserId)) {
 201                 getActivity().setTitle(R.string.lock_settings_picker_title_profile);
 202             }
 203
 204             mManagedPasswordProvider = ManagedLockPasswordProvider.get(getActivity(), mUserId);
 205
 206             if (mPasswordConfirmed) {
 207                 updatePreferencesOrFinish();
 208                 if (mForChangeCredRequiredForBoot) {
 209                     maybeEnableEncryption(mLockPatternUtils.getKeyguardStoredPasswordQuality(
 210                             mUserId), false);
 211                 }
 212             } else if (!mWaitingForConfirmation) {
 213                 ChooseLockSettingsHelper helper =
 214                         new ChooseLockSettingsHelper(this.getActivity(), this);
 215                 boolean managedProfileWithUnifiedLock = Utils
 216                         .isManagedProfile(UserManager.get(getActivity()), mUserId)
 217                         && !mLockPatternUtils.isSeparateProfileChallengeEnabled(mUserId);
 218                 if (managedProfileWithUnifiedLock
 219                         || !helper.launchConfirmationActivity(CONFIRM_EXISTING_REQUEST,
 220                         getString(R.string.unlock_set_unlock_launch_picker_title), true, mUserId)) {
 221                     mPasswordConfirmed = true; // no password set, so no need to confirm
 222                     updatePreferencesOrFinish();
 223                 } else {
 224                     mWaitingForConfirmation = true;
 225                 }
 226             }
 227             addHeaderView();
 228         }
 229
 230         protected void addHeaderView() {
 231             if (mForFingerprint) {
 232                 setHeaderView(R.layout.choose_lock_generic_fingerprint_header);
 233                 if (mIsSetNewPassword) {
 234                     ((TextView) getHeaderView().findViewById(R.id.fingerprint_header_description))
 235                             .setText(R.string.fingerprint_unlock_title);
 236                 }
 237             }
 238         }
 239
 240         @Override
 241         public boolean onPreferenceTreeClick(Preference preference) {
 242             final String key = preference.getKey();
 243
 244             if (!isUnlockMethodSecure(key) && mLockPatternUtils.isSecure(mUserId)) {
 245                 // Show the disabling FRP warning only when the user is switching from a secure
 246                 // unlock method to an insecure one
 247                 showFactoryResetProtectionWarningDialog(key);
 248                 return true;
 249             } else if (KEY_SKIP_FINGERPRINT.equals(key)) {
 250                 Intent chooseLockGenericIntent = new Intent(getActivity(), ChooseLockGeneric.class);
 251                 chooseLockGenericIntent.setAction(getIntent().getAction());
 252                 // Forward the target user id to  ChooseLockGeneric.
 253                 chooseLockGenericIntent.putExtra(Intent.EXTRA_USER_ID, mUserId);
 254                 chooseLockGenericIntent.putExtra(PASSWORD_CONFIRMED, mPasswordConfirmed);
 255                 startActivityForResult(chooseLockGenericIntent, SKIP_FINGERPRINT_REQUEST);
 256                 return true;
 257             } else {
 258                 return setUnlockMethod(key);
 259             }
 260         }
 261
 262         /**
 263          * If the device has encryption already enabled, then ask the user if they
 264          * also want to encrypt the phone with this password.
 265          *
 266          * @param quality
 267          * @param disabled
 268          */
 269         // TODO: why does this take disabled, its always called with a quality higher than
 270         // what makes sense with disabled == true
 271         private void maybeEnableEncryption(int quality, boolean disabled) {
 272             DevicePolicyManager dpm = (DevicePolicyManager) getSystemService(DEVICE_POLICY_SERVICE);
 273             if (UserManager.get(getActivity()).isAdminUser()
 274                     && mUserId == UserHandle.myUserId()
 275                     && LockPatternUtils.isDeviceEncryptionEnabled()
 276                     && !LockPatternUtils.isFileEncryptionEnabled()
 277                     && !dpm.getDoNotAskCredentialsOnBoot()) {
 278                 mEncryptionRequestQuality = quality;
 279                 mEncryptionRequestDisabled = disabled;
 280                 // Get the intent that the encryption interstitial should start for creating
 281                 // the new unlock method.
 282                 Intent unlockMethodIntent = getIntentForUnlockMethod(quality, disabled);
 283                 unlockMethodIntent.putExtra(
 284                         ChooseLockSettingsHelper.EXTRA_KEY_FOR_CHANGE_CRED_REQUIRED_FOR_BOOT,
 285                         mForChangeCredRequiredForBoot);
 286                 final Context context = getActivity();
 287                 // If accessibility is enabled and the user hasn't seen this dialog before, set the
 288                 // default state to agree with that which is compatible with accessibility
 289                 // (password not required).
 290                 final boolean accEn = AccessibilityManager.getInstance(context).isEnabled();
 291                 final boolean required = mLockPatternUtils.isCredentialRequiredToDecrypt(!accEn);
 292                 Intent intent = getEncryptionInterstitialIntent(context, quality, required,
 293                         unlockMethodIntent);
 294                 intent.putExtra(ChooseLockSettingsHelper.EXTRA_KEY_FOR_FINGERPRINT,
 295                         mForFingerprint);
 296                 intent.putExtra(EXTRA_HIDE_DRAWER, mHideDrawer);
 297                 startActivityForResult(
 298                         intent,
 299                         mIsSetNewPassword && mHasChallenge
 300                                 ? CHOOSE_LOCK_BEFORE_FINGERPRINT_REQUEST
 301                                 : ENABLE_ENCRYPTION_REQUEST);
 302             } else {
 303                 if (mForChangeCredRequiredForBoot) {
 304                     // Welp, couldn't change it. Oh well.
 305                     finish();
 306                     return;
 307                 }
 308                 mRequirePassword = false; // device encryption not enabled or not device owner.
 309                 updateUnlockMethodAndFinish(quality, disabled);
 310             }
 311         }
 312
 313         @Override
 314         public void onActivityResult(int requestCode, int resultCode, Intent data) {
 315             super.onActivityResult(requestCode, resultCode, data);
 316             mWaitingForConfirmation = false;
 317             if (requestCode == CONFIRM_EXISTING_REQUEST && resultCode == Activity.RESULT_OK) {
 318                 mPasswordConfirmed = true;
 319                 mUserPassword = data.getStringExtra(ChooseLockSettingsHelper.EXTRA_KEY_PASSWORD);
 320                 updatePreferencesOrFinish();
 321                 if (mForChangeCredRequiredForBoot) {
 322                     if (!TextUtils.isEmpty(mUserPassword)) {
 323                         maybeEnableEncryption(
 324                                 mLockPatternUtils.getKeyguardStoredPasswordQuality(mUserId), false);
 325                     } else {
 326                         finish();
 327                     }
 328                 }
 329             } else if (requestCode == CHOOSE_LOCK_REQUEST
 330                     || requestCode == ENABLE_ENCRYPTION_REQUEST) {
 331                 if (resultCode != RESULT_CANCELED || mForChangeCredRequiredForBoot) {
 332                     getActivity().setResult(resultCode, data);
 333                     finish();
 334                 }
 335             } else if (requestCode == CHOOSE_LOCK_BEFORE_FINGERPRINT_REQUEST
 336                     && resultCode == FingerprintEnrollBase.RESULT_FINISHED) {
 337                 Intent intent = new Intent(getActivity(), FingerprintEnrollFindSensor.class);
 338                 if (data != null) {
 339                     intent.putExtras(data.getExtras());
 340                 }
 341                 // Forward the target user id to fingerprint setup page.
 342                 intent.putExtra(Intent.EXTRA_USER_ID, mUserId);
 343                 startActivity(intent);
 344                 finish();
 345             } else if (requestCode == SKIP_FINGERPRINT_REQUEST) {
 346                 if (resultCode != RESULT_CANCELED) {
 347                     getActivity().setResult(
 348                             resultCode == RESULT_FINISHED ? RESULT_OK : resultCode, data);
 349                     finish();
 350                 }
 351             } else {
 352                 getActivity().setResult(Activity.RESULT_CANCELED);
 353                 finish();
 354             }
 355             if (requestCode == Activity.RESULT_CANCELED && mForChangeCredRequiredForBoot) {
 356                 finish();
 357             }
 358         }
 359
 360         @Override
 361         public void onSaveInstanceState(Bundle outState) {
 362             super.onSaveInstanceState(outState);
 363             // Saved so we don't force user to re-enter their password if configuration changes
 364             outState.putBoolean(PASSWORD_CONFIRMED, mPasswordConfirmed);
 365             outState.putBoolean(WAITING_FOR_CONFIRMATION, mWaitingForConfirmation);
 366             outState.putInt(ENCRYPT_REQUESTED_QUALITY, mEncryptionRequestQuality);
 367             outState.putBoolean(ENCRYPT_REQUESTED_DISABLED, mEncryptionRequestDisabled);
 368         }
 369
 370         private void updatePreferencesOrFinish() {
 371             Intent intent = getActivity().getIntent();
 372             int quality = intent.getIntExtra(LockPatternUtils.PASSWORD_TYPE_KEY, -1);
 373             if (quality == -1) {
 374                 // If caller didn't specify password quality, show UI and allow the user to choose.
 375                 quality = intent.getIntExtra(MINIMUM_QUALITY_KEY, -1);
 376                 quality = upgradeQuality(quality);
 377                 final boolean hideDisabledPrefs = intent.getBooleanExtra(
 378                         HIDE_DISABLED_PREFS, false);
 379                 final PreferenceScreen prefScreen = getPreferenceScreen();
 380                 if (prefScreen != null) {
 381                     prefScreen.removeAll();
 382                 }
 383                 addPreferences();
 384                 disableUnusablePreferences(quality, hideDisabledPrefs);
 385                 updatePreferenceText();
 386                 updateCurrentPreference();
 387                 updatePreferenceSummaryIfNeeded();
 388             } else {
 389                 updateUnlockMethodAndFinish(quality, false);
 390             }
 391         }
 392
 393         protected void addPreferences() {
 394             addPreferencesFromResource(R.xml.security_settings_picker);
 395
 396             // Used for testing purposes
 397             findPreference(KEY_UNLOCK_SET_NONE).setViewId(R.id.lock_none);
 398             findPreference(KEY_SKIP_FINGERPRINT).setViewId(R.id.lock_none);
 399             findPreference(KEY_UNLOCK_SET_PIN).setViewId(R.id.lock_pin);
 400             findPreference(KEY_UNLOCK_SET_PASSWORD).setViewId(R.id.lock_password);
 401         }
 402
 403         private void updatePreferenceText() {
 404             if (mForFingerprint) {
 405                 final String key[] = { KEY_UNLOCK_SET_PATTERN,
 406                         KEY_UNLOCK_SET_PIN,
 407                         KEY_UNLOCK_SET_PASSWORD };
 408                 final int res[] = { R.string.fingerprint_unlock_set_unlock_pattern,
 409                         R.string.fingerprint_unlock_set_unlock_pin,
 410                         R.string.fingerprint_unlock_set_unlock_password };
 411                 for (int i = 0; i < key.length; i++) {
 412                     Preference pref = findPreference(key[i]);
 413                     if (pref != null) { // can be removed by device admin
 414                         pref.setTitle(res[i]);
 415                     }
 416                 }
 417             }
 418
 419             if (mManagedPasswordProvider.isSettingManagedPasswordSupported()) {
 420                 Preference managed = findPreference(KEY_UNLOCK_SET_MANAGED);
 421                 managed.setTitle(mManagedPasswordProvider.getPickerOptionTitle(mForFingerprint));
 422             } else {
 423                 removePreference(KEY_UNLOCK_SET_MANAGED);
 424             }
 425
 426             if (!(mForFingerprint && mIsSetNewPassword)) {
 427                 removePreference(KEY_SKIP_FINGERPRINT);
 428             }
 429         }
 430
 431         private void updateCurrentPreference() {
 432             String currentKey = getKeyForCurrent();
 433             Preference preference = findPreference(currentKey);
 434             if (preference != null) {
 435                 preference.setSummary(R.string.current_screen_lock);
 436             }
 437         }
 438
 439         private String getKeyForCurrent() {
 440             final int credentialOwner = UserManager.get(getContext())
 441                     .getCredentialOwnerProfile(mUserId);
 442             if (mLockPatternUtils.isLockScreenDisabled(credentialOwner)) {
 443                 return KEY_UNLOCK_SET_OFF;
 444             }
 445             switch (mLockPatternUtils.getKeyguardStoredPasswordQuality(credentialOwner)) {
 446                 case DevicePolicyManager.PASSWORD_QUALITY_SOMETHING:
 447                     return KEY_UNLOCK_SET_PATTERN;
 448                 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC:
 449                 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC_COMPLEX:
 450                     return KEY_UNLOCK_SET_PIN;
 451                 case DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC:
 452                 case DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC:
 453                 case DevicePolicyManager.PASSWORD_QUALITY_COMPLEX:
 454                     return KEY_UNLOCK_SET_PASSWORD;
 455                 case DevicePolicyManager.PASSWORD_QUALITY_MANAGED:
 456                     return KEY_UNLOCK_SET_MANAGED;
 457                 case DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED:
 458                     return KEY_UNLOCK_SET_NONE;
 459             }
 460             return null;
 461         }
 462
 463         /** increases the quality if necessary */
 464         private int upgradeQuality(int quality) {
 465             quality = upgradeQualityForDPM(quality);
 466             return quality;
 467         }
 468
 469         private int upgradeQualityForDPM(int quality) {
 470             // Compare min allowed password quality
 471             int minQuality = mDPM.getPasswordQuality(null, mUserId);
 472             if (quality < minQuality) {
 473                 quality = minQuality;
 474             }
 475             return quality;
 476         }
 477
 478         /***
 479          * Disables preferences that are less secure than required quality. The actual
 480          * implementation is in disableUnusablePreferenceImpl.
 481          *
 482          * @param quality the requested quality.
 483          * @param hideDisabledPrefs if false preferences show why they were disabled; otherwise
 484          * they're not shown at all.
 485          */
 486         protected void disableUnusablePreferences(final int quality, boolean hideDisabledPrefs) {
 487             disableUnusablePreferencesImpl(quality, hideDisabledPrefs);
 488         }
 489
 490         /***
 491          * Disables preferences that are less secure than required quality.
 492          *
 493          * @param quality the requested quality.
 494          * @param hideDisabled whether to hide disable screen lock options.
 495          */
 496         protected void disableUnusablePreferencesImpl(final int quality,
 497                 boolean hideDisabled) {
 498             final PreferenceScreen entries = getPreferenceScreen();
 499
 500             int adminEnforcedQuality = mDPM.getPasswordQuality(null, mUserId);
 501             EnforcedAdmin enforcedAdmin = RestrictedLockUtils.checkIfPasswordQualityIsSet(
 502                     getActivity(), mUserId);
 503             for (int i = entries.getPreferenceCount() - 1; i >= 0; --i) {
 504                 Preference pref = entries.getPreference(i);
 505                 if (pref instanceof RestrictedPreference) {
 506                     final String key = pref.getKey();
 507                     boolean enabled = true;
 508                     boolean visible = true;
 509                     boolean disabledByAdmin = false;
 510                     if (KEY_UNLOCK_SET_OFF.equals(key)) {
 511                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED;
 512                         if (getResources().getBoolean(R.bool.config_hide_none_security_option)) {
 513                             enabled = false;
 514                             visible = false;
 515                         }
 516                         disabledByAdmin = adminEnforcedQuality
 517                                 > DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED;
 518                     } else if (KEY_UNLOCK_SET_NONE.equals(key)) {
 519                         if (mUserId != UserHandle.myUserId()) {
 520                             // Swipe doesn't make sense for profiles.
 521                             visible = false;
 522                         }
 523                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED;
 524                         disabledByAdmin = adminEnforcedQuality
 525                                 > DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED;
 526                     } else if (KEY_UNLOCK_SET_PATTERN.equals(key)) {
 527                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_SOMETHING;
 528                         disabledByAdmin = adminEnforcedQuality
 529                                 > DevicePolicyManager.PASSWORD_QUALITY_SOMETHING;
 530                     } else if (KEY_UNLOCK_SET_PIN.equals(key)) {
 531                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_NUMERIC_COMPLEX;
 532                         disabledByAdmin = adminEnforcedQuality
 533                                 > DevicePolicyManager.PASSWORD_QUALITY_NUMERIC_COMPLEX;
 534                     } else if (KEY_UNLOCK_SET_PASSWORD.equals(key)) {
 535                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_COMPLEX;
 536                         disabledByAdmin = adminEnforcedQuality
 537                                 > DevicePolicyManager.PASSWORD_QUALITY_COMPLEX;
 538                     } else if (KEY_UNLOCK_SET_MANAGED.equals(key)) {
 539                         enabled = quality <= DevicePolicyManager.PASSWORD_QUALITY_MANAGED
 540                                 && mManagedPasswordProvider.isManagedPasswordChoosable();
 541                         disabledByAdmin = adminEnforcedQuality
 542                                 > DevicePolicyManager.PASSWORD_QUALITY_MANAGED;
 543                     }
 544                     if (hideDisabled) {
 545                         visible = enabled;
 546                     }
 547                     if (!visible) {
 548                         entries.removePreference(pref);
 549                     } else if (disabledByAdmin && enforcedAdmin != null) {
 550                         ((RestrictedPreference) pref).setDisabledByAdmin(enforcedAdmin);
 551                     } else if (!enabled) {
 552                         // we need to setDisabledByAdmin to null first to disable the padlock
 553                         // in case it was set earlier.
 554                         ((RestrictedPreference) pref).setDisabledByAdmin(null);
 555                         pref.setSummary(R.string.unlock_set_unlock_disabled_summary);
 556                         pref.setEnabled(false);
 557                     } else {
 558                         ((RestrictedPreference) pref).setDisabledByAdmin(null);
 559                     }
 560                 }
 561             }
 562         }
 563
 564         private void updatePreferenceSummaryIfNeeded() {
 565             // On a default block encrypted device with accessibility, add a warning
 566             // that your data is not credential encrypted
 567             if (!StorageManager.isBlockEncrypted()) {
 568                 return;
 569             }
 570
 571             if (StorageManager.isNonDefaultBlockEncrypted()) {
 572                 return;
 573             }
 574
 575             if (AccessibilityManager.getInstance(getActivity()).getEnabledAccessibilityServiceList(
 576                     AccessibilityServiceInfo.FEEDBACK_ALL_MASK).isEmpty()) {
 577                 return;
 578             }
 579
 580             CharSequence summary = getString(R.string.secure_lock_encryption_warning);
 581
 582             PreferenceScreen screen = getPreferenceScreen();
 583             final int preferenceCount = screen.getPreferenceCount();
 584             for (int i = 0; i < preferenceCount; i++) {
 585                 Preference preference = screen.getPreference(i);
 586                 switch (preference.getKey()) {
 587                     case KEY_UNLOCK_SET_PATTERN:
 588                     case KEY_UNLOCK_SET_PIN:
 589                     case KEY_UNLOCK_SET_PASSWORD:
 590                     case KEY_UNLOCK_SET_MANAGED: {
 591                         preference.setSummary(summary);
 592                     } break;
 593                 }
 594             }
 595         }
 596
 597         protected Intent getLockManagedPasswordIntent(boolean requirePassword, String password) {
 598             return mManagedPasswordProvider.createIntent(requirePassword, password);
 599         }
 600
 601         protected Intent getLockPasswordIntent(Context context, int quality,
 602                 int minLength, final int maxLength,
 603                 boolean requirePasswordToDecrypt, boolean confirmCredentials, int userId) {
 604             return ChooseLockPassword.createIntent(context, quality, minLength,
 605                     maxLength, requirePasswordToDecrypt, confirmCredentials, userId);
 606         }
 607
 608         protected Intent getLockPasswordIntent(Context context, int quality,
 609                 int minLength, final int maxLength,
 610                 boolean requirePasswordToDecrypt, long challenge, int userId) {
 611             return ChooseLockPassword.createIntent(context, quality, minLength,
 612                     maxLength, requirePasswordToDecrypt, challenge, userId);
 613         }
 614
 615         protected Intent getLockPasswordIntent(Context context, int quality, int minLength,
 616                 int maxLength, boolean requirePasswordToDecrypt, String password, int userId) {
 617             return ChooseLockPassword.createIntent(context, quality, minLength, maxLength,
 618                     requirePasswordToDecrypt, password, userId);
 619         }
 620
 621         protected Intent getLockPatternIntent(Context context, final boolean requirePassword,
 622                 final boolean confirmCredentials, int userId) {
 623             return ChooseLockPattern.createIntent(context, requirePassword,
 624                     confirmCredentials, userId);
 625         }
 626
 627         protected Intent getLockPatternIntent(Context context, final boolean requirePassword,
 628                long challenge, int userId) {
 629             return ChooseLockPattern.createIntent(context, requirePassword, challenge, userId);
 630         }
 631
 632         protected Intent getLockPatternIntent(Context context, final boolean requirePassword,
 633                 final String pattern, int userId) {
 634             return ChooseLockPattern.createIntent(context, requirePassword, pattern, userId);
 635         }
 636
 637         protected Intent getEncryptionInterstitialIntent(Context context, int quality,
 638                 boolean required, Intent unlockMethodIntent) {
 639             return EncryptionInterstitial.createStartIntent(context, quality, required,
 640                     unlockMethodIntent);
 641         }
 642
 643         /**
 644          * Invokes an activity to change the user's pattern, password or PIN based on given quality
 645          * and minimum quality specified by DevicePolicyManager. If quality is
 646          * {@link DevicePolicyManager#PASSWORD_QUALITY_UNSPECIFIED}, password is cleared.
 647          *
 648          * @param quality the desired quality. Ignored if DevicePolicyManager requires more security
 649          * @param disabled whether or not to show LockScreen at all. Only meaningful when quality is
 650          * {@link DevicePolicyManager#PASSWORD_QUALITY_UNSPECIFIED}
 651          */
 652         void updateUnlockMethodAndFinish(int quality, boolean disabled) {
 653             // Sanity check. We should never get here without confirming user's existing password.
 654             if (!mPasswordConfirmed) {
 655                 throw new IllegalStateException("Tried to update password without confirming it");
 656             }
 657
 658             quality = upgradeQuality(quality);
 659             Intent intent = getIntentForUnlockMethod(quality, disabled);
 660             if (intent != null) {
 661                 startActivityForResult(intent,
 662                         mIsSetNewPassword && mHasChallenge
 663                                 ? CHOOSE_LOCK_BEFORE_FINGERPRINT_REQUEST
 664                                 : CHOOSE_LOCK_REQUEST);
 665                 return;
 666             }
 667
 668             if (quality == DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED) {
 669                 mLockPatternUtils.setSeparateProfileChallengeEnabled(mUserId, true, mUserPassword);
 670                 mChooseLockSettingsHelper.utils().clearLock(mUserId);
 671                 mChooseLockSettingsHelper.utils().setLockScreenDisabled(disabled, mUserId);
 672                 getActivity().setResult(Activity.RESULT_OK);
 673                 removeAllFingerprintForUserAndFinish(mUserId);
 674             } else {
 675                 removeAllFingerprintForUserAndFinish(mUserId);
 676             }
 677         }
 678
 679         private Intent getIntentForUnlockMethod(int quality, boolean disabled) {
 680             Intent intent = null;
 681             final Context context = getActivity();
 682             if (quality >= DevicePolicyManager.PASSWORD_QUALITY_MANAGED) {
 683                 intent = getLockManagedPasswordIntent(mRequirePassword, mUserPassword);
 684             } else if (quality >= DevicePolicyManager.PASSWORD_QUALITY_NUMERIC) {
 685                 int minLength = mDPM.getPasswordMinimumLength(null, mUserId);
 686                 if (minLength < MIN_PASSWORD_LENGTH) {
 687                     minLength = MIN_PASSWORD_LENGTH;
 688                 }
 689                 final int maxLength = mDPM.getPasswordMaximumLength(quality);
 690                 if (mHasChallenge) {
 691                     intent = getLockPasswordIntent(context, quality, minLength,
 692                             maxLength, mRequirePassword, mChallenge, mUserId);
 693                 } else {
 694                     intent = getLockPasswordIntent(context, quality, minLength,
 695                             maxLength, mRequirePassword, mUserPassword, mUserId);
 696                 }
 697             } else if (quality == DevicePolicyManager.PASSWORD_QUALITY_SOMETHING) {
 698                 if (mHasChallenge) {
 699                     intent = getLockPatternIntent(context, mRequirePassword,
 700                             mChallenge, mUserId);
 701                 } else {
 702                     intent = getLockPatternIntent(context, mRequirePassword,
 703                             mUserPassword, mUserId);
 704                 }
 705             }
 706             if (intent != null) {
 707                 intent.putExtra(EXTRA_HIDE_DRAWER, mHideDrawer);
 708             }
 709             return intent;
 710         }
 711
 712         private void removeAllFingerprintForUserAndFinish(final int userId) {
 713             if (mFingerprintManager != null && mFingerprintManager.isHardwareDetected()) {
 714                 if (mFingerprintManager.hasEnrolledFingerprints(userId)) {
 715                     mFingerprintManager.setActiveUser(userId);
 716                     // For the purposes of M and N, groupId is the same as userId.
 717                     final int groupId = userId;
 718                     Fingerprint finger = new Fingerprint(null, groupId, 0, 0);
 719                     mFingerprintManager.remove(finger, userId,
 720                             new RemovalCallback() {
 721                                 @Override
 722                                 public void onRemovalError(Fingerprint fp, int errMsgId,
 723                                         CharSequence errString) {
 724                                     Log.v(TAG, "Fingerprint removed: " + fp.getFingerId());
 725                                     if (fp.getFingerId() == 0) {
 726                                         removeManagedProfileFingerprintsAndFinishIfNecessary(userId);
 727                                     }
 728                                 }
 729
 730                                 @Override
 731                                 public void onRemovalSucceeded(Fingerprint fingerprint) {
 732                                     if (fingerprint.getFingerId() == 0) {
 733                                         removeManagedProfileFingerprintsAndFinishIfNecessary(userId);
 734                                     }
 735                                 }
 736                             });
 737                 } else {
 738                     // No fingerprints in this user, we may also want to delete managed profile
 739                     // fingerprints
 740                     removeManagedProfileFingerprintsAndFinishIfNecessary(userId);
 741                 }
 742             } else {
 743                 // The removal callback will call finish, once all fingerprints are removed.
 744                 // We need to wait for that to occur, otherwise, the UI will still show that
 745                 // fingerprints exist even though they are (about to) be removed depending on
 746                 // the race condition.
 747                 finish();
 748             }
 749         }
 750
 751         private void removeManagedProfileFingerprintsAndFinishIfNecessary(final int parentUserId) {
 752             mFingerprintManager.setActiveUser(UserHandle.myUserId());
 753             final UserManager um = UserManager.get(getActivity());
 754             boolean hasChildProfile = false;
 755             if (!um.getUserInfo(parentUserId).isManagedProfile()) {
 756                 // Current user is primary profile, remove work profile fingerprints if necessary
 757                 final List<UserInfo> profiles = um.getProfiles(parentUserId);
 758                 final int profilesSize = profiles.size();
 759                 for (int i = 0; i < profilesSize; i++) {
 760                     final UserInfo userInfo = profiles.get(i);
 761                     if (userInfo.isManagedProfile() && !mLockPatternUtils
 762                             .isSeparateProfileChallengeEnabled(userInfo.id)) {
 763                         removeAllFingerprintForUserAndFinish(userInfo.id);
 764                         hasChildProfile = true;
 765                         break;
 766                     }
 767                 }
 768             }
 769             if (!hasChildProfile) {
 770                 finish();
 771             }
 772         }
 773
 774         @Override
 775         public void onDestroy() {
 776             super.onDestroy();
 777         }
 778
 779         @Override
 780         protected int getHelpResource() {
 781             return R.string.help_url_choose_lockscreen;
 782         }
 783
 784         private int getResIdForFactoryResetProtectionWarningTitle() {
 785             boolean isProfile = Utils.isManagedProfile(UserManager.get(getActivity()), mUserId);
 786             return isProfile ? R.string.unlock_disable_frp_warning_title_profile
 787                     : R.string.unlock_disable_frp_warning_title;
 788         }
 789
 790         private int getResIdForFactoryResetProtectionWarningMessage() {
 791             boolean hasFingerprints = mFingerprintManager.hasEnrolledFingerprints(mUserId);
 792             boolean isProfile = Utils.isManagedProfile(UserManager.get(getActivity()), mUserId);
 793             switch (mLockPatternUtils.getKeyguardStoredPasswordQuality(mUserId)) {
 794                 case DevicePolicyManager.PASSWORD_QUALITY_SOMETHING:
 795                     if (hasFingerprints && isProfile) {
 796                         return R.string
 797                                 .unlock_disable_frp_warning_content_pattern_fingerprint_profile;
 798                     } else if (hasFingerprints && !isProfile) {
 799                         return R.string.unlock_disable_frp_warning_content_pattern_fingerprint;
 800                     } else if (isProfile) {
 801                         return R.string.unlock_disable_frp_warning_content_pattern_profile;
 802                     } else {
 803                         return R.string.unlock_disable_frp_warning_content_pattern;
 804                     }
 805                 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC:
 806                 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC_COMPLEX:
 807                     if (hasFingerprints && isProfile) {
 808                         return R.string.unlock_disable_frp_warning_content_pin_fingerprint_profile;
 809                     } else if (hasFingerprints && !isProfile) {
 810                         return R.string.unlock_disable_frp_warning_content_pin_fingerprint;
 811                     } else if (isProfile) {
 812                         return R.string.unlock_disable_frp_warning_content_pin_profile;
 813                     } else {
 814                         return R.string.unlock_disable_frp_warning_content_pin;
 815                     }
 816                 case DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC:
 817                 case DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC:
 818                 case DevicePolicyManager.PASSWORD_QUALITY_COMPLEX:
 819                 case DevicePolicyManager.PASSWORD_QUALITY_MANAGED:
 820                     if (hasFingerprints && isProfile) {
 821                         return R.string
 822                                 .unlock_disable_frp_warning_content_password_fingerprint_profile;
 823                     } else if (hasFingerprints && !isProfile) {
 824                         return R.string.unlock_disable_frp_warning_content_password_fingerprint;
 825                     } else if (isProfile) {
 826                         return R.string.unlock_disable_frp_warning_content_password_profile;
 827                     } else {
 828                         return R.string.unlock_disable_frp_warning_content_password;
 829                     }
 830                 default:
 831                     if (hasFingerprints && isProfile) {
 832                         return R.string
 833                                 .unlock_disable_frp_warning_content_unknown_fingerprint_profile;
 834                     } else if (hasFingerprints && !isProfile) {
 835                         return R.string.unlock_disable_frp_warning_content_unknown_fingerprint;
 836                     } else if (isProfile) {
 837                         return R.string.unlock_disable_frp_warning_content_unknown_profile;
 838                     } else {
 839                         return R.string.unlock_disable_frp_warning_content_unknown;
 840                     }
 841             }
 842         }
 843
 844         private boolean isUnlockMethodSecure(String unlockMethod) {
 845             return !(KEY_UNLOCK_SET_OFF.equals(unlockMethod) ||
 846                     KEY_UNLOCK_SET_NONE.equals(unlockMethod));
 847         }
 848
 849         private boolean setUnlockMethod(String unlockMethod) {
 850             EventLog.writeEvent(EventLogTags.LOCK_SCREEN_TYPE, unlockMethod);
 851
 852             if (KEY_UNLOCK_SET_OFF.equals(unlockMethod)) {
 853                 updateUnlockMethodAndFinish(
 854                         DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, true /* disabled */ );
 855             } else if (KEY_UNLOCK_SET_NONE.equals(unlockMethod)) {
 856                 updateUnlockMethodAndFinish(
 857                         DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, false /* disabled */ );
 858             } else if (KEY_UNLOCK_SET_MANAGED.equals(unlockMethod)) {
 859                 maybeEnableEncryption(DevicePolicyManager.PASSWORD_QUALITY_MANAGED, false);
 860             } else if (KEY_UNLOCK_SET_PATTERN.equals(unlockMethod)) {
 861                 maybeEnableEncryption(
 862                         DevicePolicyManager.PASSWORD_QUALITY_SOMETHING, false);
 863             } else if (KEY_UNLOCK_SET_PIN.equals(unlockMethod)) {
 864                 maybeEnableEncryption(
 865                         DevicePolicyManager.PASSWORD_QUALITY_NUMERIC, false);
 866             } else if (KEY_UNLOCK_SET_PASSWORD.equals(unlockMethod)) {
 867                 maybeEnableEncryption(
 868                         DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC, false);
 869             } else {
 870                 Log.e(TAG, "Encountered unknown unlock method to set: " + unlockMethod);
 871                 return false;
 872             }
 873             return true;
 874         }
 875
 876         private void showFactoryResetProtectionWarningDialog(String unlockMethodToSet) {
 877             int title = getResIdForFactoryResetProtectionWarningTitle();
 878             int message = getResIdForFactoryResetProtectionWarningMessage();
 879             FactoryResetProtectionWarningDialog dialog =
 880                     FactoryResetProtectionWarningDialog.newInstance(
 881                             title, message, unlockMethodToSet);
 882             dialog.show(getChildFragmentManager(), TAG_FRP_WARNING_DIALOG);
 883         }
 884
 885         public static class FactoryResetProtectionWarningDialog extends DialogFragment {
 886
 887             private static final String ARG_TITLE_RES = "titleRes";
 888             private static final String ARG_MESSAGE_RES = "messageRes";
 889             private static final String ARG_UNLOCK_METHOD_TO_SET = "unlockMethodToSet";
 890
 891             public static FactoryResetProtectionWarningDialog newInstance(
 892                     int titleRes, int messageRes, String unlockMethodToSet) {
 893                 FactoryResetProtectionWarningDialog frag =
 894                         new FactoryResetProtectionWarningDialog();
 895                 Bundle args = new Bundle();
 896                 args.putInt(ARG_TITLE_RES, titleRes);
 897                 args.putInt(ARG_MESSAGE_RES, messageRes);
 898                 args.putString(ARG_UNLOCK_METHOD_TO_SET, unlockMethodToSet);
 899                 frag.setArguments(args);
 900                 return frag;
 901             }
 902
 903             @Override
 904             public void show(FragmentManager manager, String tag) {
 905                 if (manager.findFragmentByTag(tag) == null) {
 906                     // Prevent opening multiple dialogs if tapped on button quickly
 907                     super.show(manager, tag);
 908                 }
 909             }
 910
 911             @Override
 912             public Dialog onCreateDialog(Bundle savedInstanceState) {
 913                 final Bundle args = getArguments();
 914
 915                 return new AlertDialog.Builder(getActivity())
 916                         .setTitle(args.getInt(ARG_TITLE_RES))
 917                         .setMessage(args.getInt(ARG_MESSAGE_RES))
 918                         .setPositiveButton(R.string.unlock_disable_frp_warning_ok,
 919                                 new DialogInterface.OnClickListener() {
 920                                     @Override
 921                                     public void onClick(DialogInterface dialog, int whichButton) {
 922                                         ((ChooseLockGenericFragment) getParentFragment())
 923                                                 .setUnlockMethod(
 924                                                         args.getString(ARG_UNLOCK_METHOD_TO_SET));
 925                                     }
 926                                 }
 927                         )
 928                         .setNegativeButton(R.string.cancel,
 929                                 new DialogInterface.OnClickListener() {
 930                                     @Override
 931                                     public void onClick(DialogInterface dialog, int whichButton) {
 932                                         dismiss();
 933                                     }
 934                                 }
 935                         )
 936                         .create();
 937             }
 938         }
 939     }
 940 }