Xiaomi Pocophone F1 64Gb+6Gb Dual LTE [107/118] Premium sms warning

[C-2-1] MUST support restricted profiles, a feature that allows device owners to manage

additional users and their capabilities on the device. With restricted profiles, device

owners can quickly set up separate environments for additional users to work in, with the

ability to manage finer-grained restrictions in the apps that are available in those

environments.

If device implementations include multiple users and declare the android.hardware.telephony feature flag,

they:

[C-3-1] MUST NOT support restricted profiles but MUST align with the AOSP

implementation of controls to enable /disable other users from accessing the voice calls

and SMS.

9.6. Premium SMS Warning

Android includes support for warning users of any outgoing premium SMS message . Premium SMS

messages are text messages sent to a service registered with a carrier that may incur a charge to the

user.

If device implementations declare support for android.hardware.telephony , they:

[C-1-1] MUST warn users before sending a SMS message to numbers identified by regular

expressions defined in /data/misc/sms/codes.xml file in the device. The upstream Android Open

Source Project provides an implementation that satisfies this requirement.

9.7. Kernel Security Features

The Android Sandbox includes features that use the Security-Enhanced Linux (SELinux) mandatory

access control (MAC) system, seccomp sandboxing, and other security features in the Linux kernel.

Device implementations:

[C-0-1] MUST maintain compatibility with existing applications, even when SELinux or any

other security features are implemented below the Android framework.

[C-0-2] MUST NOT have a visible user interface when a security violation is detected and

successfully blocked by the security feature implemented below the Android framework,

but MAY have a visible user interface when an unblocked security violation occurs

resulting in a successful exploit.

[C-0-3] MUST NOT make SELinux or any other security features implemented below the

Android framework configurable to the user or app developer.

[C-0-4] MUST NOT allow an application that can affect another application through an API

(such as a Device Administration API) to configure a policy that breaks compatibility.

[C-0-5] MUST split the media framework into multiple processes so that it is possible to

more narrowly grant access for each process as described in the Android Open Source

Project site.

[C-0-6] MUST implement a kernel application sandboxing mechanism which allows

filtering of system calls using a configurable policy from multithreaded programs. The

upstream Android Open Source Project meets this requirement through enabling the

seccomp-BPF with threadgroup synchronization (TSYNC) as described in the Kernel

Configuration section of source.android.com .

Kernel integrity and self-protection features are integral to Android security. Device implementations:

[C-0-7] MUST implement kernel stack buffer overflow protection mechanisms. Examples

of such mechanisms are CC_STACKPROTECTOR_REGULAR and

Page 107 of 118