Merge changes from topic "bug158482162_rvc-qpr-dev" into rvc-qpr-dev

* changes:
  Fix DevicePolicyManager.isBackupServiceEnabled() breakage.
  BackupManagerService: Make new behavior conditional on ChangeId.
  Enforce BACKUP permission on Service end.

core/java/android/app/backup/BackupManager.java

@@ -21,10 +21,14 @@ import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
 import android.annotation.SystemApi;
 import android.annotation.TestApi;
+import android.app.compat.CompatChanges;
+import android.compat.annotation.ChangeId;
+import android.compat.annotation.EnabledAfter;
 import android.compat.annotation.UnsupportedAppUsage;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.Message;
@@ -391,6 +395,17 @@ public class BackupManager {
         return false;
     }
 
+
+    /**
+     * If this change is enabled, the {@code BACKUP} permission needed for
+     * {@code isBackupServiceActive()} will be enforced on the service end
+     * rather than client-side in {@link BackupManager}.
+     * @hide
+     */
+    @ChangeId
+    @EnabledAfter(targetSdkVersion = Build.VERSION_CODES.R)
+    public static final long IS_BACKUP_SERVICE_ACTIVE_ENFORCE_PERMISSION_IN_SERVICE = 158482162;
+
     /**
      * Report whether the backup mechanism is currently active.
      * When it is inactive, the device will not perform any backup operations, nor will it
@@ -401,8 +416,11 @@ public class BackupManager {
     @SystemApi
     @RequiresPermission(android.Manifest.permission.BACKUP)
     public boolean isBackupServiceActive(UserHandle user) {
-        mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP,
+        if (!CompatChanges.isChangeEnabled(
-                "isBackupServiceActive");
+                IS_BACKUP_SERVICE_ACTIVE_ENFORCE_PERMISSION_IN_SERVICE)) {
+            mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP,
+                    "isBackupServiceActive");
+        }
         checkServiceBinder();
         if (sService != null) {
             try {

services/backup/java/com/android/server/backup/BackupManagerService.java

@@ -30,6 +30,7 @@ import android.app.backup.IBackupObserver;
 import android.app.backup.IFullBackupRestoreObserver;
 import android.app.backup.IRestoreSession;
 import android.app.backup.ISelectBackupTransportCallback;
+import android.app.compat.CompatChanges;
 import android.app.job.JobParameters;
 import android.app.job.JobScheduler;
 import android.app.job.JobService;
@@ -506,6 +507,12 @@ public class BackupManagerService extends IBackupManager.Stub {
      */
     @Override
     public boolean isBackupServiceActive(int userId) {
+        int callingUid = Binder.getCallingUid();
+        if (CompatChanges.isChangeEnabled(
+                BackupManager.IS_BACKUP_SERVICE_ACTIVE_ENFORCE_PERMISSION_IN_SERVICE, callingUid)) {
+            mContext.enforceCallingOrSelfPermission(android.Manifest.permission.BACKUP,
+                    "isBackupServiceActive");
+        }
         synchronized (mStateLock) {
             return !mGlobalDisable && isBackupActivatedForUser(userId);
         }

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

@@ -14481,15 +14481,17 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
         }
 
         enforceProfileOrDeviceOwner(admin);
-        synchronized (getLockObject()) {
+        final int userId = mInjector.userHandleGetCallingUserId();
-            try {
+        return mInjector.binderWithCleanCallingIdentity(() -> {
-                IBackupManager ibm = mInjector.getIBackupManager();
+            synchronized (getLockObject()) {
-                return ibm != null && ibm.isBackupServiceActive(
+                try {
-                    mInjector.userHandleGetCallingUserId());
+                    IBackupManager ibm = mInjector.getIBackupManager();
-            } catch (RemoteException e) {
+                    return ibm != null && ibm.isBackupServiceActive(userId);
-                throw new IllegalStateException("Failed requesting backup service state.", e);
+                } catch (RemoteException e) {
+                    throw new IllegalStateException("Failed requesting backup service state.", e);
+                }
             }
-        }
+        });
     }
 
     @Override