From e53f69bb0df2e71c326f4a724b5d73a3cce8dd05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CAyush?= <ayushsha@google.com>
Date: Tue, 20 Jul 2021 13:40:35 +0000
Subject: [PATCH] Restrict getPasswordMinimumMetrics to system callers

Bug: 173502924
Test: atest FrameworksServicesTests:DevicePolicyManagerTest
Change-Id: Ifbe991c29d88054f4fed2f0e0b156a909eac8241
---
 .../server/devicepolicy/DevicePolicyManagerService.java       | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 193d92a3b2ff9..7efe9d4606a9f 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -4567,7 +4567,9 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
     public PasswordMetrics getPasswordMinimumMetrics(@UserIdInt int userHandle,
             boolean deviceWideOnly) {
         final CallerIdentity caller = getCallerIdentity();
-        Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle));
+        Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle)
+                && (isSystemUid(caller) || hasCallingOrSelfPermission(
+                permission.SET_INITIAL_LOCK)));
         return getPasswordMinimumMetricsUnchecked(userHandle, deviceWideOnly);
     }