Android Device Locking

Question

I'm currently researching ways that we can lock down our Android devices that we will have out in the field. First and foremost I want to ensure that users cannot install any apps that they want, and I want to ensure that users cannot modify the settings of the device. I'd also like to have some control over which apps are actually able to be run (for instance, I don't the camera to be able to be run at all times). Finally, I'd like some logging to be available to me, for instance I'd like to be able to keep track of the websites visited on the device.

I know there are apps out there that do these sort of things so there must be a way to do it but I've spent about two hours now researching ways and I haven't had much luck.

I was looking into using the Device Admin API to do some of this but it seems that as of now that is limited to password stuff and locking/wiping of the entire device. I was also looking into using intent filters/broadcast receivers to intercept or at least log when an application is opened or a website is visited.

So basically, is something like this possible (either logging or locking), and if so where should I start looking?

Thanks a bunch!

Answer 1

First and foremost I want to ensure that users cannot install any apps that they want, and I want to ensure that users cannot modify the settings of the device.

This is impossible, except by creating custom firmware.

I'd also like to have some control over which apps are actually able to be run (for instance, I don't the camera to be able to be run at all times).

Except that this runs counter to:

Finally, I'd like some logging to be available to me, for instance I'd like to be able to keep track of the websites visited on the device.

If you are letting them use a browser, then they can arrange to run any application they want on the device. And, BTW, the logging you want is impossible except by creating custom firmware or writing your own Web browser.

I know there are apps out there that do these sort of things

Name any.

is something like this possible (either logging or locking)

It is all possible if you create your own custom rendition of the Android OS and put it on either your own custom-crafted hardware or find ways to load it on existing hardware.

The closest thing to this you can do with just the Android SDK, as @Aaron C notes, is create your own custom home screen. From here, you control what apps the user can launch from this screen (but, again, a Web page could bypass this, as will anything that raises a Notification). By setting your app as the home screen, you have some limited control over user behavior. But, a safe-mode reboot of the device will restore the firmware's own home screen, let alone all the other holes that I mentioned. And none of this achieves your logging functionality.

Android is designed explicitly to empower the person who holds the device. Enterprises and malware authors have the same objective: take control from the user and give that control to somebody else. Android defends users against malware authors, which limits enterprise flexibility.

Eventually, businesses will crop up to help firms like yours create OS remixes with capabilities like the ones you seek -- this is the logical outgrowth of projects like CyanogenMod.