From cfc5d19eb65fb26c7de13e16d511da534a8a2322 Mon Sep 17 00:00:00 2001
From: Bookatz <bookatz@google.com>
Date: Tue, 5 Nov 2019 17:25:53 -0800
Subject: [PATCH] Fix isSetWallpaperAllowed secondary user

isSetWallpaperAllowed calls hasUserRestriction
which has a permission check that was violated
because isSetWallpaperAllowed was calling from
the wrong user (the system rather than the
original caller).

Bug: 143958690
Test: Go to seconary user and try to change wallpaper
Change-Id: I42f8ed17fb76cb6f84d0c11266f163356656c0ac
---
 .../server/wallpaper/WallpaperManagerService.java    | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
index 3cdb59beb23ce..08c85d9bb739e 100644
--- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
+++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
@@ -77,6 +77,7 @@ import android.os.SELinux;
 import android.os.SystemClock;
 import android.os.UserHandle;
 import android.os.UserManager;
+import android.os.UserManagerInternal;
 import android.os.storage.StorageManager;
 import android.service.wallpaper.IWallpaperConnection;
 import android.service.wallpaper.IWallpaperEngine;
@@ -2747,12 +2748,19 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
             return false;   // callingPackage was faked.
         }
 
+        // TODO(b/144048540): DPM needs to take into account the userId, not just the package.
         final DevicePolicyManager dpm = mContext.getSystemService(DevicePolicyManager.class);
         if (dpm.isDeviceOwnerApp(callingPackage) || dpm.isProfileOwnerApp(callingPackage)) {
             return true;
         }
-        final UserManager um = (UserManager) mContext.getSystemService(Context.USER_SERVICE);
-        return !um.hasUserRestriction(UserManager.DISALLOW_SET_WALLPAPER);
+        final int callingUserId = UserHandle.getCallingUserId();
+        final long ident = Binder.clearCallingIdentity();
+        try {
+            UserManagerInternal umi = LocalServices.getService(UserManagerInternal.class);
+            return !umi.hasUserRestriction(UserManager.DISALLOW_SET_WALLPAPER, callingUserId);
+        } finally {
+            Binder.restoreCallingIdentity(ident);
+        }
     }
 
     @Override