kiosk_mode: How to activate "Lock Task Mode"?

[myThorsten]

Hello Mews-Community,
I'm trying to start a self-developed flutter app (Android 6+, but we can assume a modern Android) in kiosk mode. I am really glad your package exists, but I need real kiosk mode, not pinned. So I have work to do. But after reading multiple articles and documentation I am even more confused. I found lots of bits and pieces but couldn't manage to stitch them all together into a comprehensive step-by-step guide. Could someone please clearify?

• What is the difference between "Enterprise Mobility Management" and "Android Management API" and do I really need this for my own little app?
• Where can I find and edit the "Device Policy Controller" to allowlist my app?
• The "Lock Task Mode" and kiosk mode seem to be the same. How is this related?
• Is is correct that I have to boot the device in a certain way? How?
• Maybe I can make my app priviledged?
• And how can I integrate all this with flutter?

As you can see I even have trouble formulating precise questions. I would appreciate every pointer.
Best regards,
Thorsten

[Sevastyan]

@myThorsten

Thank you for your interest in our package!

I'd be happy to help on your endeavour of having a true kiosk lockdown (not a pinned app). The matter is a bit complex, and ideally I should have written a blog post about it already. Maybe, one day I will.

In this message, iOS is out of the picture. Everything I write about is for Android platform.

So, for Android, here are the building blocks:

1. Android 7.0 and above. The device must allow for QR code provisioning. Be aware, that not every manufacture allows for it. A device vendor usually modifies Android to its liking (to give it its own look and feel, pre-install its own apps, etc.) - and in the process some vendors remove QR code provisioning module from the OS. Samsung tablets of the time when Android 7.0 was the newest version of Android usually have QR code provisioning. However, the latest Samsung tablets usually come with Knox that modifies the device setup wizard and throws away QR code provisioning. Be careful of what you buy. Unfortunately, there is no easy way to find you in advance whether the device supports QR code provisioning or not - distributors don't know it, sellers don't know it. Ideally, one should look into the source code to figure out what the device's vendor has modified in the OS, but that is a closed piece of software. Logically, Google Pixel tablets should be fine, as they should have vanilla version of the OS.
2. You should have a Device Policy Controller app (DPC) to whitelist your app that you want to run in a kiosk mode. There should be some documentation how to do it, but generally, it's a matter of calling one method from Andriod SDK. DPC app must be a device owner. How do you make DPC app to be a device owner? It's via QR code provisioning.
3. You need to have your app that you want to run in a Kiosk mode. It may be an app written in Android natively, or just an .apk generated by Flutter framework.

That's really all there is to it. Now I will describe the QR code provisioning process:

1. You boot up a brand new device, or a device after a factory reset.
2. You land on a device setup wizard - a page that usually says "Welcome!" and allows you to choose the language.
3. Choose the language.
4. Without clicking NEXT - you should stay on the landing page - initiate a QR code provisioning procedure by tapping 11 (or something like that) time in one area of the screen.
5. The system will then guide you through the whole process: connecting to Wi-Fi, downling QR code scanner app, scanning provisioning QR code and installing your DPC app.
6. The system will make your DPC app a device owner.

What is that provisioning QR code you ask? Here is an example of what might be encoded in that QR code:

{
    "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
        "YouOwnParameter": "you_own_custom_value_that_your_dpc_app_might_need"
    },
    "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<package>/admin_receiver_class",
    "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "612u35e5DOAI52gQr8ZfF7HJXhjlldLmMhAm5GeKukY",
    "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://path.to.where.you.store.your.dpc.app",
    "android.app.extra.PROVISIONING_SKIP_ENCRYPTION": true
}

android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE is optional.
android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME is required. It's value must point to the receiver that will be called during QR code provisioning. That receiver is the one who should call some method to whitelists your kiosk app for the system. The value must be in a format <package>/admin_receiver_class. For example, com.example.myapp/.android.receivers.AdminReceiver, where com.example.myapp is a package name, and AdminReceiver is locate at app/src/main/java/com/example/myapp/android/receivers/AdminReceiver.kt.
android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM is the checksum for your DPC app, so the system checks its integrity before calling its device admin component.
android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION is form where Android will download your DPC app during QR code provisioning.

If after scanning QR code during provisioning you will get an error message along the lines of "Cannot setup as work device, contact your IT admin", that means your device most probably disallows QR code provisioning (the setup wizard that the device comes with disallows it). We observed it with Samsung Knox security suit. Another reason for the error might be that you haven't removed all the accounts from the device (if it is not a brand new device and you have factory reset it). So, go and remove all accounts first before doing QR code provisioning.

All in all, your DPC app should be native Android. And your kiosk app may be written in Flutter. DPC app whitelists your kiosk app - the app must already be present on the device. That means, that DPC should also know how to download your kiosk app and it should install it. Then, you can even write some more custom logic to update your kiosk app silently, since your DPC app will be a device owner.

How does kiosk_mode package fits into all this? Well, it can be used by your Flutter kiosk app to put itself into kiosk mode. And since kiosk app would be whitelisted, it will put itself into proper kiosk lockdown (not a pinned mode).

With all that, I should note that it became increasingly harder to buy some Android tablet off-the-shelf that will have QR code provisioning. If you cannot find it, then you have 2 other options:

1. Custom ROM. You should install your DPC app into your custom ROM and make it a system app. I have no experience with it, so cannot really help you here.
2. Use some MDM platform (mobile device management platform). For example https://www.hexnode.com/. Mind, that it is a paid solution. I do not have much experience with it either, but they have pretty good documentation and support.

Hope that helps. Please, stay tuned and check Mews Devs blog (https://developers.mews.com/) - who knows, maybe I will write a blog-post on "how to have yourself a Kiosk". 😄

[ookami-kb]

To add up to what @Sevastyan described: I wrote a blog post about the DPC part of this process here.

[myThorsten]

This was a triumph. I'm making a note here: huge success.

I finally made sense of your post and even found a 'default' DPC implementation:
https://github.com/DonnKey/KioskInstaller

Now, of course, I want to build on that. I want the kiosk app to start automatically when the user has the idea to restart the device.

Using these two posts

• https://stackoverflow.com/questions/70966081/how-to-start-your--android-app-at-boot-in-flutter
• https://stackoverflow.com/questions/3872063/how-to-launch-an-activity-from-another-application-in-android.

I have set up the DPC to be informed when the device has rebooted. The DPC then launches the kiosk app. The most important places are:

and:

And that works. Eventually. After restarting the device, it sometimes takes 15 seconds, sometimes 30 seconds, sometimes 60 seconds for the kiosk-app to start. Until then, the user can use the device normally and do all sorts of things.

Do you know a better way?

Full disclosure: I have already sent a corresponding request to the DonnKey team, but have not yet received an answer:
DonnKey/KioskInstaller#2

[Sevastyan]

I'm glad that you have some progress! Unfortunately, "boot completed" broadcast event is sent by the OS. I am not aware of any action that can be taken by the app to directly influence it. I am afraid that's where you start hitting first limitations when it comes to providing a perfect kiosk experience with DPC provisioning setup.

With that said, I presume having your kiosk app installed as a system app would solve it. See option 1 from my original comment:

1. Custom ROM. You should install your DPC app into your custom ROM and make it a system app. I have no experience with it, so cannot really help you here.

[ookami-kb]

Do you know a better way?

As an option, try to set up keylock and dismiss it when the app starts (it may require additional permissions, but, IIRC, it can be done via DPC app).

[myThorsten]

Thank you. I will look into those options and report back.

[myThorsten]

Thank you very much for your detailed answer. This is very helpful indeed and very much appreciated. Now I have to make sense of it all :).