Android Management API features: Set up policy compliance rules - android

I've been following the Android Management API guide quickstart: https://developers.google.com/android/management/compliance
Then, I've been testing on my device (in this case, my device fails to comply with any of the passwordPolicies), and it worked.
My setup:
{
"policyEnforcementRules": [
{
"settingName": "passwordPolicies",
"blockAction": {
"blockAfterDays": 0,
"blockScope": "BLOCK_SCOPE_DEVICE"
},
"wipeAction": {
"wipeAfterDays": 1,
"preserveFrp": false
}
}
]
}
The device I am testing this on is Pixel 5 running Android 12.
When my device fails with passwordPolicies, many apps on this device have been blocked.
I don't know the list of apps to block. How to set up a list of apps to block when failing policy compliance rules?
Please help me, Thanks!

Related

com.google.android.gms.common.api.ApiException: 17: API: Games.API is not available on this device

recently I ported my old Android game developed in Eclipse from 2011-2016, to Android Studio because I was forced to a much higher MinSdk by Google. To the following according to build.gradle:
compileSdk 30
minSdk 26
targetSdk 31
Everything worked fine after the porting, but I am not able to get the GooglePlayServices (Leaderboards, Achievements) working again.
I am able to trigger that the user signs in with it GooglePlay account. This works and I get the account and can log its name. That is working.
mGoogleSignedInAccount = completedTask.getResult(ApiException.class);
Log.e(TAG, "account: " + mGoogleSignedInAccount.getDisplayName());
But when I try open the leaderboard, so that the user can see their highscore compared to other players
LeaderboardsClient lbc = Games.getLeaderboardsClient(v.getContext(),
ApplSettings.getInstance()._mainActivity).mGoogleSignedInAccount);
Task<Intent> lbt = lbc.getAllLeaderboardsIntent();
lbt.addOnSuccessListener(new OnSuccessListener<Intent>() {
public void onSuccess(Intent intent) {
Log.d(TAG," ..onSuccess");
((Activity) (v.getContext())).startActivityForResult( intent, 9004 );
}
});
lbt.addOnFailureListener(new OnFailureListener() {
#Override
public void onFailure(#NonNull Exception e) {
Log.d(TAG,".. onFailure: "+e.toString());
}
});
I get the following error:
.. onFailure: com.google.android.gms.common.api.ApiException:
17: API: Games.API is not available on this device.
Connection failed with: ConnectionResult{statusCode=DEVELOPER_ERROR, resolution=null, message=null}
I really don't understand this error. What does it mean? It is independent of the phones I use (OnePlus6T, Samsung Galaxy S9). And of course other game apps on those phones, including my other older games app, can show Leaderboards!
What is also strange, is the following message in the GooglePlayConsole of my app in Play-GamesSevice->Configuration.
It says the 5 tasks have to be done to enable the Play-GameServices, and its states that 4 have been done, and 1 task is remaing:
Play-GameService enabling:
Create a Play GamesService project -> done
Create OAuth ConfirmationScreen in the Google Cloud Platform -> done
Create Credentials -> done
Add the SDK for Google Play-GamesServices to your production APK -> OPEN !!!
Publish Project -> done
What does point 4 mean? How to add an SDK to my games app?
Is it not enough to mention those play-service 'libraries' in the build.gradle of my app?
buildscript {
repositories {
google()
mavenCentral()
}
}
dependencies {
. . .
implementation 'com.google.android.gms:play-services-games:23.1.0'
implementation 'com.google.android.gms:play-services-measurement-api:20.0.0'
implementation 'com.google.android.gms:play-services-auth:20.4.1'
}
So I am not sure if this task (number 4) mentioned by Google as outstanding, is related to the error "Games.API is not available on this device", but it would make sense.
But still I don't understand "not available on this device"? Does not the app is build with libraries that communicate with the Google services in the cloud? What shall be missing on the device? All games app (my other very old game, and also very new apps) can without problem show leaderboards on my devices I use for testing.

How to add NET_RAW capability to the android app prebuilt in aosp?

I'm working on the custom AOSP build. And MyApp is a prebuilt application of it. So I'm having full control of the security policies of it. MyApp is using native library via jni. This library is using socket of NET_RAW type under the hood. The problem right now is that I'm not able to create such socket due the lack of CAP_NET_RAW capability.
And I don't really know how to properly set this capability for the android app. The docs on the source.android.com describes adding of it to services, not prebuilt .apk.
I suppose I have to use sepolicies files.
The android.bp of the module below.
cc_library_shared {
name: "libMyLib",
...
cpp_std: "c++17",
sdk_version: "current"
}
android_app {
name: "MyApp",
vendor: true,
use_embedded_native_libs: true,
required: [
"privapp_whitelist.myapp",
],
jni_libs: [
"libMyLib",
...
],
optimize: {
enabled: false,
},
...
}
I tried to add config.fs file and request capabilities as shown here https://source.android.com/docs/core/permissions/filesystem#using-file-system-capabilities
but it didn't work.
[path/to/apk] #also tried the [path/to/lib]
mode: 0755
user: AID_MY_AID
group: AID_MY_AID
caps: NET_RAW
As I said before, the docs are saying it is applying for the services, not the ready apps, so I'm not sure if its really working.
Also I've added INTERNET permission to the app manifest & privapp_whitelist.myapp.xml file, just to make sure the things are set up.

Android Management Device Provision Fail

I used this quick start guide to setup my project and enterprise. Currently the project is under 'No Organization' on the Google Cloud Console hierarchy.
I have setup the following device policy with a single app in kiosk mode. The app is restricted to a single country and is developed in-house.
{
"safeBootDisabled": true,
"screenCaptureDisabled": true,
"factoryResetDisabled": true,
"systemUpdate": {
"type": "WINDOWED",
"startMinutes": 0,
"endMinutes": 240
},
"applications": [
{
"packageName": "com.xxx.yyy",
"installType": "KIOSK",
"defaultPermissionPolicy": "GRANT"
}
],
"debuggingFeaturesAllowed": true,
"funDisabled": true,
"appAutoUpdatePolicy": "WIFI_ONLY",
"kioskCustomization": {
"statusBar": "NOTIFICATIONS_AND_SYSTEM_INFO_ENABLED"
}
}
I currently use the QR method to provision devices.
The problem I am having is that the provisioning process is failing at the stage when the app is being installed.
When I use this API to check what went wrong I can see that it failed because of the following error:
{
"nonComplianceDetails": [
{
"settingName": "applications",
"nonComplianceReason": "APP_NOT_INSTALLED",
"packageName": "com.xxx.yyy",
"installationFailureReason": "NOT_AVAILABLE_IN_COUNTRY"
},
{
"settingName": "persistentPreferredActivities",
"nonComplianceReason": "APP_NOT_INSTALLED",
"packageName": "com.xxx.yyy"
}
]
}
If I change my device policy from install type "KIOSK" to "AVAILIBLE" the device is successfully provisioned. I can then install the app from the Play store and reset the install type to "KIOSK" mode.
But this is far from ideal because the entire device fleet of 85 production devices settings', are then changed just to provision a single device.
So it seems that while provisioning the device the location settings are incorrect?
Does anybody know why this is happening?
Try to create a separate policy just for this device so that you can provision it without affecting other devices, and once provisioned, you can update which policy is applied to the device to be the same to all other devices.
You can use policies.patch to update the policy or devices.patch.
This also could be for a lack of Kiosk support mode for a given app as KIOSK required the app to have an official “lock task mode” per https://developer.android.com/work/dpc/dedicated-devices/lock-task-mode.

How to emulate outdated SSL Provider on Android?

I'm implementing 'Update security provider' feature for an Android application.
I implemented as it said in 'Patch asynchronously' and need to test/emulate all outcomes: user prompt demonstration and the error is unrecoverable.
I tried to delete Play Store updates, use previous com.google.gms:google-services version or android 6.0 — it always silently goes to onProviderInstalled(), never shows prompt or goes to onProviderInstallFailed().
I did exactly as said at https://developer.android.com/training/articles/security-gms-provider#example_async
Also in android\build.gradle:
buildscript {
...
dependencies {
...
classpath("com.google.gms:google-services:4.3.3")
}
}

How to detect android wear 1.0 and 2.0

i have successfully made a project apk which allow the watch download the wear app. And i am trying to use that wearable code to support standalone for wear 2.0 as well - seem not much resources in the internet.
my question is how to determine if the wearable device is 1.0 or 2.0. i made use of productFlavors based on this link as follows:
android {
// Allows you to reference product flavors in your
// phone module's build.gradle file
publishNonDefault true
...
defaultConfig
{
// This is the minSdkVersion of the Wear 1.x embedded app
minSdkVersion 23
...
}
buildTypes {...}
productFlavors {
wear1 {
// Use the defaultConfig value
}
wear2 {
minSdkVersion 25
}
}
}
As i recalled, wear 1.0 usually collect data from phone and wear 2.0 has ability to access data via the internet. Please correct me if i am wrong.
So if the wearable is 1.0, it uses Wearable.API and sync with the phone. Otherwise, the wearable sync with cloud.
I had a look on this post which seems useful but i do not quite understand.
PackageManager pm = getApplicationContext().getPackageManager();
pm.getPackageInfo(packagename, PackageManager.GET_ACTIVITIES);
Should i set a different packagename(or applicationId) for wear2 so that i can use this method?
is there any drawback when i put standalone version on play store? i suppose i have to create a new project in this way.
Please can anyone advise the best way to achieve my purpose?
If you want to distribute and maintain two separate APKs, then the build flavor is probably a reasonable way to go. But I would suggest that this won't be a good experience for either you or your users; it's more work for you, and it'll be confusing for them (which version do I install? why doesn't this app work after I my watch upgraded to Wear 2.0? and so on).
My suggestion would be to put it all in one APK, and simply choose which sync technique to use at run time:
if (Build.VERSION.SDK_INT < 24) {
// Wear 1.x
} else {
// Wear 2+
}

Categories

Resources