android - 控制 MDM/MAM 受控设备的用户可以下载哪些应用程序

Question

我正在使用 WSO2 的 EMM(企业移动管理)，这是一个开源的 MDM(移动设备管理)和 MAM(移动应用程序管理)解决方案。专门实现BYOD(Bring Your Own Device)方案。我对一些功能不满意。

我想自己实现的一个主要功能是严格控制用户可以安装哪些应用。

1) By not allowing installation of apps from 'Unknown Sources'. That is to not allow the user to check the 'Allow Installation of Apps From Unknown Sources' option or at least to be able to flag it if they do.

2) Black-Listing only specific apps that can be downloaded from the Play Store.

3) Even better would be the ability to White-List apps that can be downloaded form the Play Store

4) And in a perfect world I would like the ability to mix both an Enterprise App Store and the above restrictions to Play Store app downloads. (The benefit to that would be the ability to push corporate software to users, and still allow a safe and user friendly experience through the Play Store.)

Android 的设备管理 API 没有明确允许这些控件。然而，AirWatch 等付费企业 MDM 解决方案拥有这些功能。任何帮助将不胜感激。

Answer 1

经过大量研究，我发现了一些我想分享的东西:

当前的 Android 设备管理 API 非常有限，包含的功能有:

• 设备密码限制
• 禁用摄像头
• 锁定并删除设备
• 设备加密

除此之外(如 Victor Ronin 在上述回答中所述)您的应用只能检查合规性但不能强制执行。

The only way to enforce policies beyond the scope of the Device Administration API is to have system level permissions. The only way to get these system level permissions is to have your app signed by the OEM of the device running your software. This is exactly how enterprise MDM solutions can enforce such rules, their apps are actually signed by the OEM and then returned and distributed. Once your UID is given the system permissions you can enforce most policies needed to secure a device in the MDM scenario.

如果有兴趣看这个video它描述了这种情况和详细的系统级利用。