com.google.android.overlay.devicelockcontroller Copy

A small resource-only package that, going by its name, is a runtime resource overlay (RRO) for the Device Lock Controller (com.android.devicelockcontroller, documented separately on this site). An RRO contains no code; it only changes the values of resources that already exist in its target package at runtime. The Device Lock Controller's own configuration in AOSP defines resources intended to be set per build, including the host name, port and API key for its check-in and finalise servers (which default to "localhost") and a list of packages allowed while the device is locked, so an overlay like this would be how a build points the controller at a real device-financing back end. Its exact contents are not documented in the sources cited here. In our sample it is 8 to 21 KB with no permissions, signed by Google keys on Pixel devices and by the OEM's own keys on Motorola, Xiaomi, TCL and vivo builds (it is also seen on Infinix). Version note: the device-lock API it relates to was introduced in Android 14, and in our sample this overlay only appears on Android 14 to 17 devices, consistent with that. It is present on fewer devices than the controller itself, so not every build that ships the controller ships this overlay. For Android Enterprise, EMM and kiosk use it has no role in enrolment or management. On devices that are not part of a financing programme it is expected to be dormant along with the controller it configures. Because it only exists to configure that controller, disabling it offers no benefit and, on a device genuinely enrolled in a financing programme, could interfere with how the lock is set up, so leave it in place.

• Runtime resource overlays (RROs) - Android Open Source Project →
• DeviceLockController res/values/config.xml - platform/packages/modules/DeviceLock - Git at Google →
• android.devicelock - API reference - Android Developers →
• Package provenance for com.google.android.overlay.devicelockcontroller - Android System App Database →

• Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 10 different Google signing keys appear across the fleet.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.