From 28860b7570d2b3e7bc6a136a7bb7312e5aaf6e61 Mon Sep 17 00:00:00 2001
From: Alan Treadway <alantreadway@google.com>
Date: Thu, 26 Nov 2015 15:30:37 +0000
Subject: [PATCH] Fix for being able to setup Managed User from system user.

Also move feature flag check to ensure it is used in all cases.

Change-Id: If42787c5bc9ab824449c70f90fb827cf2da7507f
---
 .../DevicePolicyManagerService.java           | 25 +++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 47951deceea0c..d7afdf4153c21 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -6823,6 +6823,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
     public boolean isProvisioningAllowed(String action) {
         final int callingUserId = mInjector.userHandleGetCallingUserId();
         if (DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE.equals(action)) {
+            if (!hasFeatureManagedUsers()) {
+                return false;
+            }
             synchronized (this) {
                 if (mOwners.hasDeviceOwner()) {
                     if (!mInjector.userManagerIsSplitSystemUser()) {
@@ -6845,13 +6848,6 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                 // Managed user cannot have a managed profile.
                 return false;
             }
-            try {
-                if (!mIPackageManager.hasSystemFeature(PackageManager.FEATURE_MANAGED_USERS)) {
-                    return false;
-                }
-            } catch (RemoteException e) {
-                return false;
-            }
             final long ident = mInjector.binderClearCallingIdentity();
             try {
                 if (!mUserManager.canAddMoreManagedProfiles(callingUserId, true)) {
@@ -6864,10 +6860,17 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         } else if (DevicePolicyManager.ACTION_PROVISION_MANAGED_DEVICE.equals(action)) {
             return isDeviceOwnerProvisioningAllowed(callingUserId);
         } else if (DevicePolicyManager.ACTION_PROVISION_MANAGED_USER.equals(action)) {
+            if (!hasFeatureManagedUsers()) {
+                return false;
+            }
             if (!mInjector.userManagerIsSplitSystemUser()) {
                 // ACTION_PROVISION_MANAGED_USER only supported on split-user systems.
                 return false;
             }
+            if (callingUserId == UserHandle.USER_SYSTEM) {
+                // System user cannot be a managed user.
+                return false;
+            }
             if (hasUserSetupCompleted(callingUserId)) {
                 return false;
             }
@@ -6901,6 +6904,14 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         return true;
     }
 
+    private boolean hasFeatureManagedUsers() {
+        try {
+            return mIPackageManager.hasSystemFeature(PackageManager.FEATURE_MANAGED_USERS);
+        } catch (RemoteException e) {
+            return false;
+        }
+    }
+
     @Override
     public String getWifiMacAddress() {
         // Make sure caller has DO.