Merge "Enforce file transfer restrictions for shell."

import android.annotation.Nullable;

import android.app.usage.StorageStatsManager;

import android.content.ContentResolver;

import android.content.Context;

import android.content.UriPermission;

import android.database.Cursor;

import android.database.MatrixCursor;

import android.os.Binder;

import android.os.Bundle;

import android.os.Environment;

import android.os.IBinder;

import android.os.UserHandle;

import android.os.UserManager;

import android.os.storage.DiskInfo;

import android.os.storage.StorageManager;

import android.os.storage.VolumeInfo;

    private static final String ROOT_ID_HOME = "home";

    private StorageManager mStorageManager;

    private UserManager mUserManager;

    private final Object mRootsLock = new Object();

    public boolean onCreate() {

        super.onCreate(DEFAULT_DOCUMENT_PROJECTION);

        mStorageManager = (StorageManager) getContext().getSystemService(Context.STORAGE_SERVICE);

        mStorageManager = getContext().getSystemService(StorageManager.class);

        mUserManager = getContext().getSystemService(UserManager.class);

        updateVolumes();

        return true;

    }

    private void enforceShellRestrictions() {

        if (UserHandle.getCallingAppId() == android.os.Process.SHELL_UID

                && mUserManager.hasUserRestriction(UserManager.DISALLOW_USB_FILE_TRANSFER)) {

            throw new SecurityException(

                    "Shell user cannot access files for user " + UserHandle.myUserId());

        }

    }

    @Override

    protected int enforceReadPermissionInner(Uri uri, String callingPkg, IBinder callerToken)

            throws SecurityException {

        enforceShellRestrictions();

        return super.enforceReadPermissionInner(uri, callingPkg, callerToken);

    }

    @Override

    protected int enforceWritePermissionInner(Uri uri, String callingPkg, IBinder callerToken)

            throws SecurityException {

        enforceShellRestrictions();

        return super.enforceWritePermissionInner(uri, callingPkg, callerToken);

    }

    public void updateVolumes() {

        synchronized (mRootsLock) {

            updateVolumesLocked();