From b84b315bce5532641580187bb6ae76473f753c01 Mon Sep 17 00:00:00 2001
From: Ayush Sharma <ayushsha@google.com>
Date: Tue, 14 Dec 2021 22:13:11 +0000
Subject: [PATCH] Enforce system privilege for getGlobalProxyAdmin

getGlobalProxyAdmin is a hidden API and called just from Settings.
So enforcing system uid check.

Bug: 206127671
Test: NA
Change-Id: Id4bce828bc69867c9c4d20b991e9e53e8ae385f2
Merged-In: Id4bce828bc69867c9c4d20b991e9e53e8ae385f2
(cherry picked from commit 554e19a375bb3c61db7643b17ea411baf6bbe3e5)
---
 .../server/devicepolicy/DevicePolicyManagerService.java        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 41e605bea0a49..e8ad56d874ce1 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -7452,7 +7452,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
         Preconditions.checkArgumentNonnegative(userHandle, "Invalid userId");
 
         final CallerIdentity caller = getCallerIdentity();
-        Preconditions.checkCallAuthorization(hasFullCrossUsersPermission(caller, userHandle));
+        Preconditions.checkCallAuthorization(
+                hasFullCrossUsersPermission(caller, userHandle) && isSystemUid(caller));
 
         synchronized (getLockObject()) {
             DevicePolicyData policy = getUserData(UserHandle.USER_SYSTEM);