andorid11 DeviceOwner 应用默认授权

客户需求：设置应用程序为设备所有者并且不需要用户确认，附带adb设置命令如下

E:\decompiling\apktool>adb shell dpm set-device-owner de.liefermia.printer/de.liefermia.printer.LiefermiaAdminReceiver
Success: Device owner set to package ComponentInfo{de.liefermia.printer/de.liefermia.printer.LiefermiaAdminReceiver}
Active admin set to component {de.liefermia.printer/de.liefermia.printer.LiefermiaAdminReceiver}

使用apktools工具查看客户应用的AndroidManifest.xml

• LiefermiaAdminReceiver

<receiver android:exported="true" android:name="de.liefermia.printer.LiefermiaAdminReceiver" android:permission="android.permission.BIND_DEVICE_ADMIN">
     <meta-data android:name="android.app.device_admin" android:resource="@xml/device_admin"/>
     <intent-filter>
          <action android:name="android.app.action.DEVICE_ADMIN_ENABLED"/>
     </intent-filter>
</receiver>

• device_admin.xml

<?xml version="1.0" encoding="utf-8"?>
<device-admin
  xmlns:android="http://schemas.android.com/apk/res/android">
    <uses-policies>
        <force-lock />
        <wipe-data />
    </uses-policies>
</device-admin>

使用adb命令设置后/data/system目录下会生成device_owner_2.xml和更新device_policies.xml文件

• device_owner_2.xml

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<root>
<device-owner package="de.liefermia.printer" name="" component="de.liefermia.printer/de.liefermia.printer.LiefermiaAdminReceiver" userRestrictionsMigrated="true" isPoOrganizationOwnedDevice="true" />
<device-owner-context userId="0" />
</root>

• device_policies.xml

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<policies setup-complete="true" provisioning-state="3">
<admin name="de.liefermia.printer/de.liefermia.printer.LiefermiaAdminReceiver">
<policies flags="24" />
<strong-auth-unlock-timeout value="0" />
<cross-profile-calendar-packages />
<cross-profile-packages />
</admin>
<lock-task-features value="16" />
</policies>

内置客户MDM应用并默认授权，也就是需要把device_owner_2.xml和device_policies.xml这两个文件内置到/data/system目录下
data 分区下预制文件，开机会无法启动，所以我们曲线救国，先将文件放到 system 下，系统起来后在 init.rc 执行 copy

• device/mediatek/mt6761/device.mk

LOCAL_PATH:= vendor/mediatek/proprietary/packages/3rd-party/
PRODUCT_COPY_FILES += \
	$(LOCAL_PATH)/LiefermiaPrinter/device_owner_2.xml:system/device_owner_2.xml \
	$(LOCAL_PATH)/LiefermiaPrinter/device_policies.xml:system/device_policies.xml 

• system/core/rootdir/init.rc

mkdir /data/system 0775 system system encryption=Require
mkdir /data/system/dropbox 0700 system system
mkdir /data/system/heapdump 0700 system system
mkdir /data/system/users 0775 system system
    
copy /system/device_policies.xml /data/system/device_policies.xml 
chmod 0600 /data/system/device_policies.xml
chown system system /data/system/device_policies.xml
copy /system/device_owner_2.xml /data/system/device_owner_2.xml 
chmod 0600 /data/system/device_owner_2.xml
chown system system /data/system/device_owner_2.xml

编译完成后，MDM apk 就默认拥有 DeviceOwner 权限了

DeviceOwner 应用默认授权