From 1c277a5d8f79ebf8beeb80f67b67512d9217d953 Mon Sep 17 00:00:00 2001
From: Sudheer Shanka <sudheersai@google.com>
Date: Wed, 11 Nov 2015 21:58:24 +0000
Subject: [PATCH] Add per-user version of
 DevicePolicyManager.getUserRestrictions.

Bug: 25663001
Change-Id: Ic5b34fee7b57670c338f11263330a1c702002edc
---
 .../java/android/app/admin/DevicePolicyManager.java |  8 +++++++-
 .../android/app/admin/IDevicePolicyManager.aidl     |  2 +-
 .../devicepolicy/DevicePolicyManagerService.java    | 13 ++++++++++---
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index faed7a01f6f54..c7f872a1345d1 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -3763,12 +3763,18 @@ public class DevicePolicyManager {
      * {@link UserManager#getUserRestrictions()}.
      *
      * @param admin Which {@link DeviceAdminReceiver} this request is associated with.
+     * @throws SecurityException if the {@code admin} is not an active admin.
      */
     public Bundle getUserRestrictions(@NonNull ComponentName admin) {
+        return getUserRestrictions(admin, myUserId());
+    }
+
+    /** @hide per-user version */
+    public Bundle getUserRestrictions(@NonNull ComponentName admin, int userHandle) {
         Bundle ret = null;
         if (mService != null) {
             try {
-                ret = mService.getUserRestrictions(admin);
+                ret = mService.getUserRestrictions(admin, userHandle);
             } catch (RemoteException e) {
                 Log.w(TAG, "Failed talking with device policy service", e);
             }
diff --git a/core/java/android/app/admin/IDevicePolicyManager.aidl b/core/java/android/app/admin/IDevicePolicyManager.aidl
index 7601cf2bb2e04..93a5503f7e9e1 100644
--- a/core/java/android/app/admin/IDevicePolicyManager.aidl
+++ b/core/java/android/app/admin/IDevicePolicyManager.aidl
@@ -149,7 +149,7 @@ interface IDevicePolicyManager {
     ComponentName getRestrictionsProvider(int userHandle);
 
     void setUserRestriction(in ComponentName who, in String key, boolean enable);
-    Bundle getUserRestrictions(in ComponentName who);
+    Bundle getUserRestrictions(in ComponentName who, int userId);
     void addCrossProfileIntentFilter(in ComponentName admin, in IntentFilter filter, int flags);
     void clearCrossProfileIntentFilters(in ComponentName admin);
 
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index c61150376d4c6..6cc6797f8f5ed 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -5703,11 +5703,18 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
     }
 
     @Override
-    public Bundle getUserRestrictions(ComponentName who) {
+    public Bundle getUserRestrictions(ComponentName who, int userHandle) {
         Preconditions.checkNotNull(who, "ComponentName is null");
+        enforceCrossUserPermission(userHandle);
         synchronized (this) {
-            final ActiveAdmin activeAdmin =
-                    getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
+            ActiveAdmin activeAdmin = getActiveAdminUncheckedLocked(who, userHandle);
+            if (activeAdmin == null) {
+                throw new SecurityException("No active admin: " + activeAdmin);
+            }
+            if (activeAdmin.getUid() != mInjector.binderGetCallingUid()) {
+                mContext.enforceCallingOrSelfPermission(
+                        android.Manifest.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS, null);
+            }
             return activeAdmin.userRestrictions;
         }
     }