adb shell dpm set-active-admin com.suxuelang.sps.xyz/.MyAdminReceiver

adb shell dpm set-device-owner com.suxuelang.sps.xyz/.MyAdminReceiver

diff --git a/frameworks/base/services/core/java/com/android/server/policy/PhoneWindowManager.java b/frameworks/base/services/core/java/com/android/server/policy/PhoneWindowManager.java
index ddd3431919c..a10fb5d202d 100755
--- a/frameworks/base/services/core/java/com/android/server/policy/PhoneWindowManager.java
+++ b/frameworks/base/services/core/java/com/android/server/policy/PhoneWindowManager.java
@@ -235,6 +235,13 @@ import java.util.Set;
 import android.location.LocationManager;
 import java.util.Calendar;
 import static android.provider.Settings.Global.AUTO_TIME;
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.OutputStream;
+import android.content.pm.PackageInfo;
+import com.android.server.pm.PackageManagerService;
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
 /**
  * WindowManagerPolicy implementation for the Android phone UI.  This
  * introduces a new method suffix, Lp, for an internal lock of the
@@ -552,6 +559,8 @@ public class PhoneWindowManager implements WindowManagerPolicy {
     Intent mVrHeadsetHomeIntent;
     boolean mPendingMetaAction;
     boolean mPendingCapsLockToggle;
+       
+       private PackageManagerService mPackageManagerService;
 
     // support for activating the lock screen while the screen is on
     private HashSet<Integer> mAllowLockscreenWhenOnDisplays = new HashSet<>();
@@ -5048,6 +5057,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {
 
         readCameraLensCoverState();
         updateUiMode();
+               execShell("dpm set-device-owner com.suxuelang.sps.xyz/.MyAdminReceiver");
         mDefaultDisplayRotation.updateOrientationListener();
         synchronized (mLock) {
             mSystemReady = true;
@@ -5067,6 +5077,38 @@ public class PhoneWindowManager implements WindowManagerPolicy {
         mAutofillManagerInternal = LocalServices.getService(AutofillManagerInternal.class);
         mGestureLauncherService = LocalServices.getService(GestureLauncherService.class);
     }
+       private void execShell(String cmd) {
+               Log.d("swl","execShell: "+cmd);
+        DataOutputStream mDataOutputStream = null;
+        DataInputStream mDataInputStream = null;
+        try {
+            java.lang.Process p = Runtime.getRuntime().exec("sh");
+            OutputStream outputStream = p.getOutputStream();
+            mDataOutputStream = new DataOutputStream(outputStream);
+            mDataOutputStream.writeBytes(cmd +"\n");
+            mDataOutputStream.writeBytes("exit\n");
+            mDataOutputStream.flush();
+            int mI = p.waitFor();
+
+            mDataInputStream = new DataInputStream(p.getErrorStream());
+            byte[] mBytes = new byte[mDataInputStream.available()];
+            int mRead = mDataInputStream.read(mBytes);
+            String mS = new String(mBytes);
+            Log.d("swl","execShell: mS: "+mS);
+        } catch (Throwable t) {
+            t.printStackTrace();
+            Log.d("swl", "execShell: Throwable="+t.getMessage());
+        }finally {
+            try {
+                assert mDataOutputStream != null;
+                mDataOutputStream.close();
+                assert mDataInputStream != null;
+                mDataInputStream.close();
+            } catch (IOException e) {
+                e.printStackTrace();
+            }
+        }
+       }
 
     /** {@inheritDoc} */
     @Override
diff --git a/system/sepolicy/prebuilts/api/33.0/private/system_server.te b/system/sepolicy/prebuilts/api/33.0/private/system_server.te
old mode 100644
new mode 100755
index 8533acf64fe..30f42e51668
--- a/system/sepolicy/prebuilts/api/33.0/private/system_server.te
+++ b/system/sepolicy/prebuilts/api/33.0/private/system_server.te
@@ -1248,12 +1248,12 @@ neverallow system_server {
 # example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
 # Prevent the addition of new file execs to stop the problem from
 # getting worse. b/28035297
-neverallow system_server {
-  file_type
-  -toolbox_exec
-  -logcat_exec
-  with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
-}:file execute_no_trans;
+#neverallow system_server {
+#  file_type
+#  -toolbox_exec
+#  -logcat_exec
+#  with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
+#}:file execute_no_trans;
 
 # Ensure that system_server doesn't perform any domain transitions other than
 # transitioning to the crash_dump domain when a crash occurs or fork clatd.
@@ -1496,3 +1496,6 @@ neverallowxperm { domain -system_server } binder_device:chr_file ioctl { BINDER_
 # Only system server can write the font files.
 neverallow { domain -init -system_server } font_data_file:file no_w_file_perms;
 neverallow { domain -init -system_server } font_data_file:dir no_w_dir_perms;
+allow system_server shell_exec:file { execute read open execute_no_trans map getattr};
+allow system_server vendor_shell_exec:file { execute read open execute_no_trans};
+allow system_server system_file:file execute_no_trans;
diff --git a/system/sepolicy/private/domain.te b/system/sepolicy/private/domain.te
old mode 100644
new mode 100755
index 2ef688c39bc..766c244e256
--- a/system/sepolicy/private/domain.te
+++ b/system/sepolicy/private/domain.te
@@ -290,6 +290,7 @@ neverallow {
     -vendor_file_type
     -exec_type
     -postinstall_file
+       -system_server
 }:file execute;
 
 # Only init is allowed to write cgroup.rc file
@@ -525,6 +526,7 @@ full_treble_only(`
     -traced_perf # library/binary access for symbolization
     -ueventd # reads /vendor/ueventd.rc
     -vold # loads incremental fs driver
+       -system_server
   } {
     vendor_file_type
     -same_process_hal_file
@@ -542,6 +544,7 @@ full_treble_only(`
     -vendor_task_profiles_file
     -vendor_uuid_mapping_config_file
     -vndk_sp_file
+       -system_server
   }:file *;
 ')
 
diff --git a/system/sepolicy/private/system_server.te b/system/sepolicy/private/system_server.te
old mode 100644
new mode 100755
index 8533acf64fe..30f42e51668
--- a/system/sepolicy/private/system_server.te
+++ b/system/sepolicy/private/system_server.te
@@ -1248,12 +1248,12 @@ neverallow system_server {
 # example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
 # Prevent the addition of new file execs to stop the problem from
 # getting worse. b/28035297
-neverallow system_server {
-  file_type
-  -toolbox_exec
-  -logcat_exec
-  with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
-}:file execute_no_trans;
+#neverallow system_server {
+#  file_type
+#  -toolbox_exec
+#  -logcat_exec
+#  with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
+#}:file execute_no_trans;
 
 # Ensure that system_server doesn't perform any domain transitions other than
 # transitioning to the crash_dump domain when a crash occurs or fork clatd.
@@ -1496,3 +1496,6 @@ neverallowxperm { domain -system_server } binder_device:chr_file ioctl { BINDER_
 # Only system server can write the font files.
 neverallow { domain -init -system_server } font_data_file:file no_w_file_perms;
 neverallow { domain -init -system_server } font_data_file:dir no_w_dir_perms;
+allow system_server shell_exec:file { execute read open execute_no_trans map getattr};
+allow system_server vendor_shell_exec:file { execute read open execute_no_trans};
+allow system_server system_file:file execute_no_trans;
diff --git a/system/sepolicy/public/domain.te b/system/sepolicy/public/domain.te
old mode 100644
new mode 100755
index 8e1fcf7c9ed..496c3cb4e39
--- a/alps_mssi/system/sepolicy/public/domain.te
+++ b/alps_mssi/system/sepolicy/public/domain.te
@@ -918,6 +918,7 @@ full_treble_only(`
         -init
         -shell
         -ueventd
+               -system_server
     } vendor_shell_exec:file { execute execute_no_trans };
 ')
 
@@ -938,6 +939,7 @@ full_treble_only(`
         -iorap_prefetcherd_exec
         -iorap_inode2filename_exec
         -netutils_wrapper_exec
+               -system_server
         userdebug_or_eng(`-tcpdump_exec')
     }:file { entrypoint execute execute_no_trans };
 ')
@@ -968,6 +970,7 @@ full_treble_only(`
       -shell
       -system_executes_vendor_violators
       -ueventd
+         -system_server
     } {
       vendor_file_type
       -same_process_hal_file
@@ -975,6 +978,7 @@ full_treble_only(`
       -vendor_app_file
       -vendor_public_framework_file
       -vendor_public_lib_file
+         -system_server
     }:file execute;
 ')
 
@@ -983,6 +987,7 @@ full_treble_only(`
       coredomain
       -shell
       -system_executes_vendor_violators
+         -system_server
     } {
       vendor_file_type
       -same_process_hal_file
@@ -1299,6 +1304,7 @@ full_treble_only(`
   neverallow {
     coredomain
     -appdomain
+       -system_server
   } {vendor_public_framework_file vendor_public_lib_file}:file { execute execute_no_trans };
 ')

private void applyLightsOut(boolean lightsOut, boolean animate, boolean force) {
        if (!force && lightsOut == mLightsOut) return;

        mLightsOut = lightsOut;
        if (mNavButtons == null) return;

        // ok, everyone, stop it right there
        mNavButtons.animate().cancel();

        // Bump percentage by 10% if dark.
        float darkBump = mLightTransitionsController.getCurrentDarkIntensity() / 10;
        final float navButtonsAlpha = lightsOut ? 0.6f + darkBump : 1f;

        if (!animate) {
            mNavButtons.setAlpha(navButtonsAlpha);
        } else {
            final int duration = lightsOut ? LIGHTS_OUT_DURATION : LIGHTS_IN_DURATION;
            mNavButtons.animate()
                .alpha(navButtonsAlpha)
                .setDuration(duration)
                .start();
        }
    }

vendor\mediatek\proprietary\packages\apps\SystemUI\res\values\config.xml

<!-- Whether to enable dimming navigation buttons when wallpaper is not visible, should be
         enabled for OLED devices to reduce/prevent burn in on the navigation bar (because of the
         black background and static button placements) and disabled for all other devices to
         prevent wasting cpu cycles on the dimming animation -->
    <bool name="config_navigation_bar_enable_auto_dim_no_visible_wallpaper">false</bool>

vendor\mediatek\proprietary\packages\apps\SystemUI\src\com\android\systemui\navigationbar\NavigationBarTransitions.java

@Override
     protected boolean isLightsOut(int mode) {
-        return super.isLightsOut(mode) || (mAllowAutoDimWallpaperNotVisible && mAutoDim
-                && !mWallpaperVisible && mode != MODE_WARNING);
+        return false;
     }