From 731ee1a3575b7374bde9ae8957db07ba0f0be238 Mon Sep 17 00:00:00 2001
From: Pavel Grafov <pgrafov@google.com>
Date: Tue, 4 Oct 2022 13:42:15 +0000
Subject: [PATCH] RESTRICT AUTOMERGE Add cross-user check to streaming policy
 getters

Bug: 235822336
Bug: 235821829
Test: atest CtsDevicePolicyTestCases:android.devicepolicy.cts.NearbyAppStreamingPolicyTest
Test: atest CtsDevicePolicyTestCases:android.devicepolicy.cts.NearbyNotificationStreamingPolicyTest
Change-Id: If8c10b5742f256d0b954a89634f2ca3e41d46778
---
 .../android/server/devicepolicy/DevicePolicyManagerService.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 6aca14f08188e..538d6bc85278b 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -7783,6 +7783,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
         Preconditions.checkCallAuthorization(
                 isProfileOwner(caller) || isDefaultDeviceOwner(caller)
                         || hasCallingOrSelfPermission(permission.READ_NEARBY_STREAMING_POLICY));
+        Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userId));
 
         synchronized (getLockObject()) {
             if (mOwners.hasProfileOwner(userId) || mOwners.hasDeviceOwner()) {
@@ -7823,6 +7824,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
         Preconditions.checkCallAuthorization(
                 isProfileOwner(caller) || isDefaultDeviceOwner(caller)
                         || hasCallingOrSelfPermission(permission.READ_NEARBY_STREAMING_POLICY));
+        Preconditions.checkCallAuthorization(hasCrossUsersPermission(caller, userId));
 
         synchronized (getLockObject()) {
             if (mOwners.hasProfileOwner(userId) || mOwners.hasDeviceOwner()) {