Enforce BACKUP permission for BackupManager#excludeKeysFromRestore()

Bug: 153415469
Test: atest UserBackupManagerServiceTest

Change-Id: I3d3c0e518a2e9b3805da02f4b0850c428cb8ff0e

1 files changed, 18 insertions, 0 deletions

diff --git a/services/robotests/backup/src/com/android/server/backup/UserBackupManagerServiceTest.java b/services/robotests/backup/src/com/android/server/backup/UserBackupManagerServiceTest.java
index 8b2f15c2babb..fea61aa43442 100644
--- a/services/robotests/backup/src/com/android/server/backup/UserBackupManagerServiceTest.java
+++ b/services/robotests/backup/src/com/android/server/backup/UserBackupManagerServiceTest.java
@@ -85,6 +85,7 @@ import java.io.FileDescriptor;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.io.StringWriter;
+import java.util.ArrayList;
 import java.util.List;
 
 /**
@@ -519,6 +520,23 @@ public class UserBackupManagerServiceTest {
         expectThrows(SecurityException.class, backupManagerService::getCurrentTransportComponent);
     }
 
+    /**
+     * Test verifying that {@link UserBackupManagerService#excludeKeysFromRestore(String, List)}
+     * throws a {@link SecurityException} if the caller does not have backup permission.
+     */
+    @Test
+    public void testExcludeKeysFromRestore_withoutPermission() throws Exception {
+        mShadowContext.denyPermissions(android.Manifest.permission.BACKUP);
+        UserBackupManagerService backupManagerService = createUserBackupManagerServiceAndRunTasks();
+
+        expectThrows(
+                SecurityException.class,
+                () ->
+                        backupManagerService.excludeKeysFromRestore(
+                                PACKAGE_1,
+                                new ArrayList<String>(){}));
+    }
+
     /* Tests for updating transport attributes */
 
     private static final int PACKAGE_UID = 10;