diff --git a/services/core/java/com/android/server/MountService.java b/services/core/java/com/android/server/MountService.java
index 8abbb1112f089..7253870d2f126 100644
--- a/services/core/java/com/android/server/MountService.java
+++ b/services/core/java/com/android/server/MountService.java
@@ -2648,6 +2648,9 @@ class MountService extends IMountService.Stub
      */
     @Override
     public int getPasswordType() {
+        mContext.enforceCallingOrSelfPermission(Manifest.permission.STORAGE_INTERNAL,
+            "no permission to access the crypt keeper");
+
         waitForReady();
 
         final NativeDaemonEvent event;
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index cbec270c5e9b8..764ac0590134b 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -1395,7 +1395,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
 
         boolean storageManagerIsNonDefaultBlockEncrypted() {
-            return StorageManager.isNonDefaultBlockEncrypted();
+            long identity = Binder.clearCallingIdentity();
+            try {
+                return StorageManager.isNonDefaultBlockEncrypted();
+            } finally {
+                Binder.restoreCallingIdentity(identity);
+            }
         }
 
         boolean storageManagerIsEncrypted() {