Limit IsSeparateProfileChallengeAllowed to system callers

am: 1b6301cf24

Change-Id: I1145186590622d415c6c10c4750cf9429806bdbe

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

@@ -3930,6 +3930,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
 
     @Override
     public boolean isSeparateProfileChallengeAllowed(int userHandle) {
+        if (!isCallerWithSystemUid()) {
+            throw new SecurityException("Caller must be system");
+        }
         ComponentName profileOwner = getProfileOwner(userHandle);
         // Profile challenge is supported on N or newer release.
         return profileOwner != null &&