commit d444ff120774ef87710ee3106534ea7ca44baa5d
author Mahaver Chopra <mahaver@google.com> Thu Jun 16 14:05:58 2016 +0100
committer Mahaver Chopra <mahaver@google.com> Thu Jun 16 14:42:52 2016 +0100
tree 6256b586ecaffa746ea25a717650b389b647c3f4
parent 18c57b5cd546120ccbc9cce80758813244af6d37

Global.OEM_UNLOCK_DISALLOWED should only restrict when enabling oem

Bug:29409746
Change-Id: I5254456cc2364c93809cebbe2d134a873873790d

services/core/java/com/android/server/PersistentDataBlockService.java

diff --git a/services/core/java/com/android/server/PersistentDataBlockService.java b/services/core/java/com/android/server/PersistentDataBlockService.java
index 1e0b693..e233b1c 100644
--- a/services/core/java/com/android/server/PersistentDataBlockService.java
+++ b/services/core/java/com/android/server/PersistentDataBlockService.java
@@ -466,12 +466,13 @@
             enforceOemUnlockWritePermission();
             enforceIsAdmin();
 
-            // Do not allow oem unlock modification if it has been disallowed.
-            if (Settings.Global.getInt(getContext().getContentResolver(),
-                    Settings.Global.OEM_UNLOCK_DISALLOWED, 0) == 1) {
-                throw new SecurityException("OEM unlock has been disallowed.");
-            }
             if (enabled) {
+                // Do not allow oem unlock to be enabled if it has been disallowed.
+                if (Settings.Global.getInt(getContext().getContentResolver(),
+                        Settings.Global.OEM_UNLOCK_DISALLOWED, 0) == 1) {
+                    throw new SecurityException(
+                            "OEM unlock has been disallowed by OEM_UNLOCK_DISALLOWED.");
+                }
                 enforceFactoryResetAllowed();
             }
             synchronized (mLock) {

services/core/java/com/android/server/pm/UserRestrictionsUtils.java

diff --git a/services/core/java/com/android/server/pm/UserRestrictionsUtils.java b/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
index 414d165..c082143 100644
--- a/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
+++ b/services/core/java/com/android/server/pm/UserRestrictionsUtils.java
@@ -429,7 +429,7 @@
                     if (newValue) {
                         PersistentDataBlockManager manager = (PersistentDataBlockManager) context
                                 .getSystemService(Context.PERSISTENT_DATA_BLOCK_SERVICE);
-                        if (manager != null) {
+                        if (manager != null && manager.getOemUnlockEnabled()) {
                             manager.setOemUnlockEnabled(false);
                         }
                     }