Skip to main content

Setting Up the Supervisor Plugin

Starting with Android 15, additional packages must be allowlisted by the OEM for supervisor. If you are considering managing Android 15+ devices, or upgrading from Android 14, and using a supervisor plugin ensure you understand the additional requirements before proceeding.

A Supervisor Plugin enables features that otherwise wouldn’t be available on devices, such as Remote Control. Customers can work with their device manufacturers to automate Esper’s Remote Control setup and enable remote access right out of the box. 

In this article: 

Preparing the Requirements 

You will need the following details to request a supervisor plugin: 

  • Manufacturer 
  • Model 

Manufacturer and model information may not be the same as those displayed in the device’s advertisements and packaging. You can find this information using the following methods: 

On Provisioned Devices

For devices that are already provisioned with Esper, search for the device in Devices & Groups. Then click on the device’s ID, and navigate to the Overview > Hardware section. 

 

On Unprovisioned Devices 

Adb 

Use the adb shell to find device information. 

Find the manufacturer

adb shell getprop ro.product.manufacturer

Find the model 

adb shell getprop ro.product.model

See Installing the Android Debug Bridget (ADB) Tool for more information. 

AOSP Builds

By default, this information is typically defined in the Product Directory > build.prop file in your AOSP source. Occasionally, this can also be defined under the system, system_etc, vendor, or odm directories.

Android Settings 

On some devices, this information can be found in Android Settings > About. 

Additional Requirements for Android 15+ Devices

 For Android 15, OEMs must now take additional steps to ensure the supervisor functions correctly. This article explains the additional requirements.

Starting with Android 15, Google has introduced new permission and signing requirements that affect how the Esper Supervisor Plugin functions. Previously, the Supervisor Plugin could operate simply by being signed with the platform key. From Android 15 onward, that is no longer sufficient.

To ensure Supervisor features work correctly, the plugin must meet one of the following conditions:

  • Be preloaded in the system partition, with required platform-level permissions allowlisted.
  • Be explicitly allowlisted by the device manufacturer (OEM), including both the package name and required permissions.

Notes: 

  • Devices updating from Android 14 to 15 will need to follow these steps to be allowedlisted by their OEM.
  • Samsung Knox devices are not affected by these changes.

Android 15+ Setup

In addition to the requirements listed in Setting Up a Supervisor Plugin, the following are also required: 

  • Esper agent version 9.0+

OEMs must follow the steps below. 

Step 1: Allowlist the Supervisor Package

The OEM must allowlist the following package:

io.esper.plugin.supervisor

Step 2: Allowlist the Required Permissions

The OEM must allowlist all of the following permissions to enable full Supervisor functionality:

android.permission.ACCESS_SURFACE_FLINGER

android.permission.DEVICE_POWER

android.permission.READ_FRAME_BUFFER

android.permission.INJECT_EVENTS

android.permission.CAPTURE_SECURE_VIDEO_OUTPUT

android.permission.CAPTURE_VIDEO_OUTPUT

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.INSTALL_PACKAGES

android.permission.DELETE_PACKAGES

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SET_TIME_ZONE

android.permission.REBOOT

android.permission.UPDATE_APP_OPS_STATS

android.permission.TETHER_PRIVILEGED

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.OVERRIDE_WIFI_CONFIG

android.permission.MODIFY_PHONE_STATE

android.permission.WRITE_APN_SETTINGS

android.permission.BLUETOOTH_PRIVILEGED

android.permission.CHANGE_CONFIGURATION

android.permission.SET_TIME

android.permission.SHUTDOWN

android.permission.STATUS_BAR_SERVICE

android.permission.MANAGE_APP_OPS_MODES

android.permission.QUERY_ALL_PACKAGES

android.permission.STATUS_BAR

Step 3: Sign the Supervisor Plugin

  • The OEM must sign the Supervisor Plugin using their platform key and the latest version of the  APK.
  • Once signed, the plugin should be returned to Esper for deployment.

Ensure that the plugin is signed with the same platform key as the device image. Values that don't match won't be granted sufficient permissions.

Requesting and Sharing the Plugin

In order to request and share the plugin, customers will have to: 

  1. Request a plugin for each device model from Esper. 
  2. Share the plugin with the device manufacturer. The manufacturer will then sign these plugins with specified platform model keys. 
  3. Then share the signed plugin with Esper. 

Device manufacturers must use the latest version of the  APK signer tool to sign the plugin. 

Ensure that the plugin is signed with the same platform key as the device image. Values that don't match won't be granted sufficient permissions.

After the plugin is signed, run the following commands to verify the matching signatures. First, pull the following file from the device through adb:

adb pull /system/framework/framework-res.apk

Next, match the outputs of the following two commands:

apksigner verify --print-certs supervisor.apk
apksigner verify --print-certs framework-res.apk

Matching signatures ensure that the plugin will have sufficient permissions to use Esper features.

Related articles

Featured content