From 9de713d42269a5888d31423b74d4203dce382853 Mon Sep 17 00:00:00 2001
From: Paul Lawrence <paullawrence@google.com>
Date: Mon, 2 May 2016 22:45:33 +0000
Subject: [PATCH] Revert "Don't enforce this API - it's not sensitive"

This reverts commit 895504e55788c5c7fd90830dcf01c41a79ca7fe4.
Also adds a change to device manager to prevent failure there
as in the bug below.

Bug: 28512889

Change-Id: I4a445ec365133e9e2764e2d625d61fc6ee2008ec
---
 services/core/java/com/android/server/MountService.java    | 3 +++
 .../server/devicepolicy/DevicePolicyManagerService.java    | 7 ++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/MountService.java b/services/core/java/com/android/server/MountService.java
index 8abbb1112f089..7253870d2f126 100644
--- a/services/core/java/com/android/server/MountService.java
+++ b/services/core/java/com/android/server/MountService.java
@@ -2648,6 +2648,9 @@ class MountService extends IMountService.Stub
      */
     @Override
     public int getPasswordType() {
+        mContext.enforceCallingOrSelfPermission(Manifest.permission.STORAGE_INTERNAL,
+            "no permission to access the crypt keeper");
+
         waitForReady();
 
         final NativeDaemonEvent event;
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 93fbe5cd7e7a6..8d17572f4e035 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -1395,7 +1395,12 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
 
         boolean storageManagerIsNonDefaultBlockEncrypted() {
-            return StorageManager.isNonDefaultBlockEncrypted();
+            long identity = Binder.clearCallingIdentity();
+            try {
+                return StorageManager.isNonDefaultBlockEncrypted();
+            } finally {
+                Binder.restoreCallingIdentity(identity);
+            }
         }
 
         boolean storageManagerIsEncrypted() {