diff --git a/core/java/android/hardware/fingerprint/FingerprintManager.java b/core/java/android/hardware/fingerprint/FingerprintManager.java
index 9f8c28ee12168..abd02f0ecc9b7 100644
--- a/core/java/android/hardware/fingerprint/FingerprintManager.java
+++ b/core/java/android/hardware/fingerprint/FingerprintManager.java
@@ -40,6 +40,7 @@ import java.util.List;
 import javax.crypto.Cipher;
 import javax.crypto.Mac;
 
+import static android.Manifest.permission.INTERACT_ACROSS_USERS;
 import static android.Manifest.permission.USE_FINGERPRINT;
 import static android.Manifest.permission.MANAGE_FINGERPRINT;
 
@@ -655,8 +656,23 @@ public class FingerprintManager {
     @RequiresPermission(USE_FINGERPRINT)
     public boolean hasEnrolledFingerprints() {
         if (mService != null) try {
-            return mService.hasEnrolledFingerprints(UserHandle.myUserId(),
-                    mContext.getOpPackageName());
+            return mService.hasEnrolledFingerprints(
+                    UserHandle.myUserId(), mContext.getOpPackageName());
+        } catch (RemoteException e) {
+            Log.v(TAG, "Remote exception in getEnrolledFingerprints: ", e);
+        }
+        return false;
+    }
+
+    /**
+     * @hide
+     */
+    @RequiresPermission(allOf = {
+            USE_FINGERPRINT,
+            INTERACT_ACROSS_USERS})
+    public boolean hasEnrolledFingerprints(int userId) {
+        if (mService != null) try {
+            return mService.hasEnrolledFingerprints(userId, mContext.getOpPackageName());
         } catch (RemoteException e) {
             Log.v(TAG, "Remote exception in getEnrolledFingerprints: ", e);
         }
diff --git a/services/core/java/com/android/server/fingerprint/FingerprintService.java b/services/core/java/com/android/server/fingerprint/FingerprintService.java
index 13e764828c34a..e9d684a6154e4 100644
--- a/services/core/java/com/android/server/fingerprint/FingerprintService.java
+++ b/services/core/java/com/android/server/fingerprint/FingerprintService.java
@@ -62,6 +62,7 @@ import android.hardware.fingerprint.IFingerprintDaemon;
 import android.hardware.fingerprint.IFingerprintDaemonCallback;
 import android.hardware.fingerprint.IFingerprintServiceReceiver;
 
+import static android.Manifest.permission.INTERACT_ACROSS_USERS;
 import static android.app.ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND;
 import static android.Manifest.permission.MANAGE_FINGERPRINT;
 import static android.Manifest.permission.RESET_FINGERPRINT_LOCKOUT;
@@ -504,6 +505,9 @@ public class FingerprintService extends SystemService implements IBinder.DeathRe
     }
 
     public boolean hasEnrolledFingerprints(int userId) {
+        if (userId != Binder.getCallingUid()) {
+            checkPermission(INTERACT_ACROSS_USERS);
+        }
         return mFingerprintUtils.getFingerprintsForUser(mContext, userId).size() > 0;
     }