# Protected: ROM Enrollment – Android 11 Summary: -------- ### Step – 1: Generate ROM Configuration File Generate the ROM Configuration file from your Hexnode UEM console and download the file. You will get a **hex\_rom\_config.txt** file. ### Step – 2: Add Hexnode for Work App as a Pre-built Application The **Hexnode for Work** app must be added as a system app. The app must not be signed by the vendor. If the app is signed, **Hexnode for Work** app will not be able to update itself unless each update is signed by the vendor. So, it is recommended to leave the Hexnode for Work app with the default signature. Download the latest version of the Hexnode app here – [HexnodeforWork.apk](https://downloads.hexnode.com/hexnodeforwork.apk). ### Step – 3: Declare Necessary Permissions The following permissions required by the **Hexnode for Work** app must be declared. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 ### Step – 4: Allow Dangerous Permissions Silently The app must be able to get all possible permissions without user interaction. When the device boots up, **Hexnode for Work** should have all possible permissions allowed. To do this, the dangerous permission exceptions must be declared. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Notes:- For detailed steps, see the detailed explanation later in the doc. - All permissions that must be auto-granted can be given here, based on the compliance requirements. ### Step – 5: Device Owner Permissions The **Hexnode for Work** app must be provided device owner permissions. The following must be added to **device\_policies.xml** file.

1 2 3 4 5 6 7

The following must be added to **device\_owner.xml** file.

1 2 3 4 5 6

Both of these files must be present in the **/system** folder once the build is complete. ### Step – 6: Place Hexnode Configuration File Place the **hex\_rom\_config.txt** file in **/system**. The file must be accessible by the **Hexnode for Work** app. ### Step – 7: Draw over Other Apps Allow **Hexnode for Work** app to draw over other apps if possible. ### Step – 8: Default Launcher Optional step. **Hexnode for Work** app must be set up as the default launcher for the device, if the device is intended for use as a kiosk. ### Step – 9: Provide Root Permissions Optional step. If root access is required, provide root privileges to **Hexnode for Work** app. ### Step – 10: Build the ROM Build the ROM and flash the ROM on the devices. The devices must boot up and directly open the **Hexnode for Work** app. Detailed Steps: --------------- ### To be performed by a Hexnode admin at NatHealth. #### Step – 1: Generate ROM Configuration File. From the Hexnode UEM console, generate the ROM configuration file and download it. You should obtain a file named **hex\_rom\_config.txt**. If the downloaded file has a different name, please rename the file to **hex\_rom\_config.txt**. Also, download the latest version of the Hexnode app – [HexnodeforWork.apk](https://downloads.hexnode.com/hexnodeforwork.apk). Pass the generated file, the **Hexnode for Work** application and this document to the device vendor. ### To be performed by the device vendor before building the ROM. #### Step – 2: Add Hexnode for Work app as a pre-built application. 1. In your source move to the apps directory. Path – /package/apps/ 1 /package/apps/ 2. Create a folder with the name **hexnodemdm** 3. Move to the folder **hexnodemdm**. Path – /package/apps/hexnodemdm 1 /package/apps/hexnodemdm 4. Place the **Hexnode for Work** app in the **hexnodemdm** folder. The latest app can be downloaded from this link – [HexnodeforWork.apk](https://downloads.hexnode.com/hexnodeforwork.apk). 5. Create a file named **Android.mk** in the same directory. 6. Add these lines to the file **Android.mk** and save it. LOCAL\_PATH := $(call my-dir) include $(CLEAR\_VARS) LOCAL\_MODULE\_TAGS := optional LOCAL\_MODULE := hexnodemdm LOCAL\_CERTIFICATE := PRESIGNED LOCAL\_SRC\_FILES := hexnodeforwork.apk LOCAL\_MODULE\_CLASS := APPS LOCAL\_PRIVILEGED\_MODULE := true LOCAL\_DEX\_PREOPT := false LOCAL\_MODULE\_SUFFIX := $(COMMON\_ANDROID\_PACKAGE\_SUFFIX) include $(BUILD\_PREBUILT) 1 2 3 4 5 6 7 8 9 10 11 LOCAL\_PATH := $(call my-dir) include $(CLEAR\_VARS) LOCAL\_MODULE\_TAGS := optional LOCAL\_MODULE := hexnodemdm LOCAL\_CERTIFICATE := PRESIGNED LOCAL\_SRC\_FILES := hexnodeforwork.apk LOCAL\_MODULE\_CLASS := APPS LOCAL\_PRIVILEGED\_MODULE := true LOCAL\_DEX\_PREOPT := false LOCAL\_MODULE\_SUFFIX := $(COMMON\_ANDROID\_PACKAGE\_SUFFIX) include $(BUILD\_PREBUILT) 7. Move to the product directory. Path – /build/target/product/ 1 /build/target/product/ 8. Find the file named **handheld\_system.mk**. 9. Edit the file **handheld\_system.mk** and mention the module name **hexnodemdm** under **PRODUCT\_PACKAGES** list. 10. Save the file. #### Step – 3: Declare Necessary Permissions. 1. Move to the folder **etc**. Path – /frameworks/base/data/etc/ 1 /frameworks/base/data/etc/ 2. Find the file named **privapp-permissions-platform.xml**. 3. Edit the file and add the following lines – 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 4. Save the file **privapp-permissions-platform.xml**. #### Step – 4: Allow Permissions Silently 1. Move to the folder ****.This can be in a core folder on the device where the default permissions for apps such as Phone, Messages, etc. are stored. Path – /device/// 1 /device/// Example – For Pixel 4a 5G, the folder is **/device/google/bramble/** 5. Create a file named **default-permissions-sample.xml**. 6. Edit the file and add the following lines – 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 8. Save the file **default-permissions-sample.xml**. #### Step – 5: Device Owner Permissions 1. Move to the folder ****.This can be in a core folder on the device where the default permissions for apps such as Phone, Messages, etc. are stored. Path – /device/// 1 /device/// Example – For Pixel 4a 5G, the folder is **/device/google/bramble/** 2. Create a file named **device\_policies.xml**. Add the following lines and save the file.

1 2 3 4 5 6 7

4. Create a file named **device\_owner.xml** in the same directory and add these lines.

1 2 3 4 5 6

6. Save the files. #### Step – 6: Place the ROM Config File 1. Move to the folder ****.This can be in a core folder on the device where the default permissions for apps such as Phone, Messages, etc. are stored. Path – /device/// 1 /device/// Example – For Pixel 4a 5G, the folder is **/device/google/bramble/** 5. Place the **hex\_rom\_config.txt** file inside this folder that was obtained from Step – 1. #### Step – 7: Inject Rom Config, Device Owner and the Permission Files 1. Move to the folder ****.This can be in a core folder on the device where the default permissions for apps such as Phone, Messages, etc. are stored. Path – /device/// 1 /device/// Example – For Pixel 4a 5G, the folder is **/device/google/bramble/** 5. Find the configuration files – **aosp\_.mk** and **device\_.mk**. For a Pixel 4a 5G, the files are named **aosp\_bramble.mk** and **device\_bramble.mk**. 7. Add the following lines to both of these files. PRODUCT\_COPY\_FILES += device///device\_policies.xml:system/device\_policies.xml PRODUCT\_COPY\_FILES += device///hex\_rom\_config.txt:system/hex\_rom\_config.txt PRODUCT\_COPY\_FILES += device///default-permission-sample.xml:$(TARGET\_COPY\_OUT\_PRODUCT)/etc/default-permissions/default-permission-sample.xml PRODUCT\_COPY\_FILES += device///device\_owner\_2.xml:system/ device\_owner\_2.xml 1 2 3 4 PRODUCT\_COPY\_FILES += device///device\_policies.xml:system/device\_policies.xml PRODUCT\_COPY\_FILES += device///hex\_rom\_config.txt:system/hex\_rom\_config.txt PRODUCT\_COPY\_FILES += device///default-permission-sample.xml:$(TARGET\_COPY\_OUT\_PRODUCT)/etc/default-permissions/default-permission-sample.xml PRODUCT\_COPY\_FILES += device///device\_owner\_2.xml:system/ device\_owner\_2.xml 9. Save the files. 10. Edit your **init.rc** file. Path – /system/core/rootdir/init.rc 1 /system/core/rootdir/init.rc 13. Add the following lines under **post-fs-data**. copy /system/device\_policies.xml /data/system/device\_policies.xml chmod 0600 /data/system/device\_policies.xml chown system system /data/system/device\_policies.xml copy /system/device\_owner\_2.xml /data/system/device\_owner\_2.xml chmod 0600 /data/system/device\_owner\_2.xml chown system system /data/system/device\_owner\_2.xml 1 2 3 4 5 6 copy /system/device\_policies.xml /data/system/device\_policies.xml chmod 0600 /data/system/device\_policies.xml chown system system /data/system/device\_policies.xml copy /system/device\_owner\_2.xml /data/system/device\_owner\_2.xml chmod 0600 /data/system/device\_owner\_2.xml chown system system /data/system/device\_owner\_2.xml #### Step – 8: Draw over Other Apps - Allow the **Hexnode for Work** app to draw over other apps if possible. The method to do this is different for each vendor. #### Step – 9: Default Launcher - Optional step. The **Hexnode for Work** app must be set up as the default launcher for the device, if the device is intended for use as a kiosk. #### Step – 10: Provide Root Permissions - Optional step. If root access is required, provide root privileges to the **Hexnode for Work** app. #### Step – 11: Build your ROM - Once these steps are completed, build your ROM and flash it on a test device. ### Testing and Troubleshooting #### The following cases must be tested to ensure that the ROM Enrollment is successful. ##### Illegal entries error while building ROM. The **PRODUCT\_COPY\_FILES** action on **default-permission-sample.xml** may return an illegal entry error. In such cases, change the initial file location to **base\_product.mk** or **base\_system.mk**, make necessary changes to the file and retry the build. ##### Hexnode for Work is notautomatically started at device boot. The Hexnode for Work app must be automatically started and the app must run in full screen as soon as the device boots up. If the app does not open, sufficient permissions are not provided. Please check if all permissions are provided.