Screen Lock Service as a Device Administrator

Question

Background:

I was looking at the device administrators of my phone in the settings and saw a device administrator called "screen lock service". It's description is "Activating this administrator will allow the app Google play services to perform the following operations: set password rules".

A previously unsettled question is found here.

I searched the net for the apk file of the application but could not find one. So as per suggestions, I ran

adb shell dumpsys package  resolvers | sed -n /android.app.action.DEVICE_ADMIN_ENABLED/,/:/p

The output for the above code was:

  android.app.action.DEVICE_ADMIN_ENABLED:
    438a74 com.motorola.demo/.admin.DemoModeAdminReceiver
    2acd3de com.google.android.gms/.auth.managed.admin.DeviceAdminReceiver
    36b5d24 ch.deletescape.lawnchair.ci/ch.deletescape.lawnchair.gestures.handlers.SleepMethodDeviceAdmin$SleepDeviceAdmin
    42aae3e com.google.android.gms/.tapandpay.admin.TpDeviceAdminReceiver
    8efd08d com.google.android.gms/.kids.account.receiver.ProfileOwnerReceiver
    9b4f242 com.google.android.gms/.mdm.receivers.MdmDeviceAdminReceiver
    a9980b6 com.oasisfeng.greenify/.DeviceAdmin
    b5771b7 com.google.android.gm/com.android.email.SecurityPolicy$PolicyAdmin
  com.motorola.internal.intent.action.INETCONDITION_REPORT:

The data for the code is quite unsettling for the fact that none seem to correspond to screen lock service.
For reference, I am using Moto G5 Plus (not rooted, stock build with no customizations)

Also note that, I own another same device which is rooted and runs Pixel-Experience (Android 10 latest build) and unfortunately it does not have the Screen Lock Service.

An insight/breakdown for this application is helpful.

Answer 1

The data for the code is quite unsettling for the fact that none seem to correspond to screen lock service.

I can see why it confused you, believing that there would be an app or a service running with the same name on the system which you would have been able to identify quite easily, but could not.

The device administrator "Screen Lock Service" is a device administration service offered by Google Play Services (com.google.android.gms) app.

This is how I approached the problem:

1. I searched for a device with this problem. I managed to get my hands on a Xiaomi Redmi Note 5 running Android 9 having this administrator service enabled.

2. I went ahead with disabling Screen Lock Service administrator. Side by side, I had logcat running to grep any entry beginning with "admin".

3. Through logcat I got the following output on disabling the said administrator.

   Device admin ComponentInfo{com.google.android.gms/com.google.android.gms.auth.managed.admin.DeviceAdminReceiver} removed from user 0
   

4. com.google.android.gms/com.google.android.gms.auth.managed.admin.DeviceAdminReceiver is one among the many device administrators mentioned in the output of the command adb shell dumpsys package resolvers | sed -n /android.app.action.DEVICE_ADMIN_ENABLED/,/:/p and is also mentioned in your output.

5. I decided to verify further by pulling the apk of Google Play Services and decompiling it. In the decompiled AndroidManifest.xml file, the relevant entry for this device administrator was this:

   <receiver android:description="@string/auth_device_admin_receiver_description" android:enabled="false" android:exported="true" android:icon="@drawable/product_logo_security_shield_color_24" android:label="@string/auth_device_admin_receiver_label" android:name="com.google.android.gms.auth.managed.admin.DeviceAdminReceiver" android:permission="android.permission.BIND_DEVICE_ADMIN" android:process="@string/common_persistent_process" chimera:autoEnabled="false">
            <meta-data android:name="android.app.device_admin" android:resource="@xml/auth_password_complexity_device_admin"/>
            <intent-filter>
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED"/>
                <action android:name="android.app.action.DEVICE_ADMIN_DISABLED"/>
            </intent-filter>
   

6. I used the information in step 6 to get three things:

   • the label of the device administrator in res/values/string.xml:

     <string name="auth_device_admin_receiver_label">Screen lock service</string>
     

   • the description of the device administrator in res/values/string.xml:

     <string name="auth_device_admin_receiver_description">"<b>Allow apps to determine the quality of the device's screen lock</b>"</string>
     

   • the icon for the device administrator in res/drawable-xhdpi/product_logo_security_shield_color_24.png:

     

7. As for disabling it. While you can disable it, a reboot re-enables it automatically without user intervention. It appears to me that com.google.android.gms.persistent process is responsible for this. Not only is that process mentioned in the Manifest, but also during logcat it was the one after which auto-enabling of Screen Lock Service took place. Relevant logcat of post boot process:

    [ 10-01 19:59:17.126  3058: 7809 W/.gms.persisten ]
    Long monitor contention with owner lowpool[10] (7811) at void java.lang.ref.FinalizerReference.add(java.lang.Object)(FinalizerReference.java:56) waiters=0 in java.util.Map bggj.a() for 980ms   
   
   [ 10-01 19:59:17.163  3441: 7374 I/Auth     ]
   [AuthManaged, PasswordComplexityHelperImpl] Updating password complexity components state.
   
   [ 10-01 19:59:17.163  3441: 7374 I/Auth     ]
   [AuthManaged, PasswordComplexityHelperImpl] Enabling com.google.android.gms.auth.managed.ui.SetNewPasswordActivity
   
   [ 10-01 19:59:17.164  3441: 7374 I/Auth     ]
   [AuthManaged, PasswordComplexityHelperImpl] Enabling com.google.android.gms.auth.managed.admin.DeviceAdminReceiver
   

---

Summary

1. Screen Lock Service is a device administrator feature of Google Play Services app

2. If you disable it, Google Play Services app would re-enable it without seeking your authentication.

3. Its purpose is not documented on Google Support / Answers as of now.