From 06abbc7d4766b41e4c7e227acb36c43cfa502873 Mon Sep 17 00:00:00 2001
From: Alex Johnston <acjohnston@google.com>
Date: Fri, 23 Apr 2021 11:01:09 +0100
Subject: [PATCH] Fix installKeyPair cred mng app access control

* Should not be user selectable

Bug: 186159641
Test: atest android.devicepolicy.cts.CredentialManagementAppTest
Change-Id: Ie1ddbe79ed5fe6e9aba33aeb3fd92fe275a48d47
---
 .../android/server/devicepolicy/DevicePolicyManagerService.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 9a996795622c6..bb97f165cf903 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -5457,7 +5457,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
                 && (isProfileOwner(caller) || isDeviceOwner(caller)))
                 || (caller.hasPackage() && (isCallerDelegate || isCredentialManagementApp)));
         if (isCredentialManagementApp) {
-            Preconditions.checkCallAuthorization(isUserSelectable, "The credential "
+            Preconditions.checkCallAuthorization(!isUserSelectable, "The credential "
                     + "management app is not allowed to install a user selectable key pair");
             Preconditions.checkCallAuthorization(
                     isAliasInCredentialManagementAppPolicy(caller, alias),