diff --git a/services/java/com/android/server/accounts/AccountManagerService.java b/services/java/com/android/server/accounts/AccountManagerService.java
index 49295f5..09daf56 100644
--- a/services/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/java/com/android/server/accounts/AccountManagerService.java
@@ -455,7 +455,6 @@
 
     @Override
     public void onServiceChanged(AuthenticatorDescription desc, int userId, boolean removed) {
-        Slog.d(TAG, "onServiceChanged() for userId " + userId);
         validateAccountsInternal(getUserAccounts(userId), false /* invalidateAuthenticatorCache */);
     }
 
@@ -588,16 +587,12 @@
                     if (result != null) {
                         if (result.getBoolean(AccountManager.KEY_BOOLEAN_RESULT, false)) {
                             // Create a Session for the target user and pass in the bundle
-                            Slog.i(TAG, "getAccountCredentialsForCloning returned success, "
-                                    + "sending result to target user");
                             completeCloningAccount(result, account, toAccounts);
                         } else {
-                            Slog.e(TAG, "getAccountCredentialsForCloning returned failure");
                             clonePassword(fromAccounts, toAccounts, account);
                         }
                         return;
                     } else {
-                        Slog.e(TAG, "getAccountCredentialsForCloning returned null");
                         clonePassword(fromAccounts, toAccounts, account);
                         super.onResult(result);
                     }
@@ -645,15 +640,12 @@
                     if (result != null) {
                         if (result.getBoolean(AccountManager.KEY_BOOLEAN_RESULT, false)) {
                             // TODO: Anything?
-                            Slog.i(TAG, "addAccount returned success");
                         } else {
                             // TODO: Show error notification
                             // TODO: Should we remove the shadow account to avoid retries?
-                            Slog.e(TAG, "addAccountFromCredentials returned failure");
                         }
                         return;
                     } else {
-                        Slog.e(TAG, "addAccountFromCredentials returned null");
                         super.onResult(result);
                     }
                 }
@@ -1433,6 +1425,17 @@
         if (accountType == null) throw new IllegalArgumentException("accountType is null");
         checkManageAccountsPermission();
 
+        // Is user allowed to modify accounts?
+        if (!getUserManager().getUserRestrictions(Binder.getCallingUserHandle())
+                .getBoolean(UserManager.ALLOW_MODIFY_ACCOUNTS)) {
+            try {
+                response.onError(AccountManager.ERROR_CODE_USER_RESTRICTED,
+                        "User is not allowed to add an account!");
+            } catch (RemoteException re) {
+            }
+            return;
+        }
+
         UserAccounts accounts = getUserAccountsForCaller();
         final int pid = Binder.getCallingPid();
         final int uid = Binder.getCallingUid();
@@ -1573,17 +1576,19 @@
         private volatile Account[] mAccountsOfType = null;
         private volatile ArrayList<Account> mAccountsWithFeatures = null;
         private volatile int mCurrentAccount = 0;
+        private int mCallingUid;
 
         public GetAccountsByTypeAndFeatureSession(UserAccounts accounts,
-                IAccountManagerResponse response, String type, String[] features) {
+                IAccountManagerResponse response, String type, String[] features, int callingUid) {
             super(accounts, response, type, false /* expectActivityLaunch */,
                     true /* stripAuthTokenFromResult */);
+            mCallingUid = callingUid;
             mFeatures = features;
         }
 
         public void run() throws RemoteException {
             synchronized (mAccounts.cacheLock) {
-                mAccountsOfType = getAccountsFromCacheLocked(mAccounts, mAccountType);
+                mAccountsOfType = getAccountsFromCacheLocked(mAccounts, mAccountType, mCallingUid);
             }
             // check whether each account matches the requested features
             mAccountsWithFeatures = new ArrayList<Account>(mAccountsOfType.length);
@@ -1668,10 +1673,11 @@
     public Account[] getAccounts(int userId) {
         checkReadAccountsPermission();
         UserAccounts accounts = getUserAccounts(userId);
+        int callingUid = Binder.getCallingUid();
         long identityToken = clearCallingIdentity();
         try {
             synchronized (accounts.cacheLock) {
-                return getAccountsFromCacheLocked(accounts, null);
+                return getAccountsFromCacheLocked(accounts, null, callingUid);
             }
         } finally {
             restoreCallingIdentity(identityToken);
@@ -1711,7 +1717,8 @@
                 UserAccounts userAccounts = getUserAccounts(userId);
                 if (userAccounts == null) continue;
                 synchronized (userAccounts.cacheLock) {
-                    Account[] accounts = getAccountsFromCacheLocked(userAccounts, null);
+                    Account[] accounts = getAccountsFromCacheLocked(userAccounts, null,
+                            Binder.getCallingUid());
                     for (int a = 0; a < accounts.length; a++) {
                         runningAccounts.add(new AccountAndUser(accounts[a], userId));
                     }
@@ -1725,9 +1732,10 @@
 
     @Override
     public Account[] getAccountsAsUser(String type, int userId) {
+        final int callingUid = Binder.getCallingUid();
         // Only allow the system process to read accounts of other users
         if (userId != UserHandle.getCallingUserId()
-                && Binder.getCallingUid() != android.os.Process.myUid()) {
+                && callingUid != android.os.Process.myUid()) {
             throw new SecurityException("User " + UserHandle.getCallingUserId()
                     + " trying to get account for " + userId);
         }
@@ -1742,7 +1750,7 @@
         long identityToken = clearCallingIdentity();
         try {
             synchronized (accounts.cacheLock) {
-                return getAccountsFromCacheLocked(accounts, type);
+                return getAccountsFromCacheLocked(accounts, type, callingUid);
             }
         } finally {
             restoreCallingIdentity(identityToken);
@@ -1826,19 +1834,21 @@
         if (type == null) throw new IllegalArgumentException("accountType is null");
         checkReadAccountsPermission();
         UserAccounts userAccounts = getUserAccountsForCaller();
+        int callingUid = Binder.getCallingUid();
         long identityToken = clearCallingIdentity();
         try {
             if (features == null || features.length == 0) {
                 Account[] accounts;
                 synchronized (userAccounts.cacheLock) {
-                    accounts = getAccountsFromCacheLocked(userAccounts, type);
+                    accounts = getAccountsFromCacheLocked(userAccounts, type, callingUid);
                 }
                 Bundle result = new Bundle();
                 result.putParcelableArray(AccountManager.KEY_ACCOUNTS, accounts);
                 onResult(response, result);
                 return;
             }
-            new GetAccountsByTypeAndFeatureSession(userAccounts, response, type, features).bind();
+            new GetAccountsByTypeAndFeatureSession(userAccounts, response, type, features,
+                    callingUid).bind();
         } finally {
             restoreCallingIdentity(identityToken);
         }
@@ -2352,7 +2362,8 @@
                     }
                 }
             } else {
-                Account[] accounts = getAccountsFromCacheLocked(userAccounts, null /* type */);
+                Account[] accounts = getAccountsFromCacheLocked(userAccounts, null /* type */,
+                        android.os.Process.myUid());
                 fout.println("Accounts: " + accounts.length);
                 for (Account account : accounts) {
                     fout.println("  " + account);
@@ -2691,13 +2702,56 @@
         accounts.accountCache.put(account.type, newAccountsForType);
     }
 
-    protected Account[] getAccountsFromCacheLocked(UserAccounts userAccounts, String accountType) {
+    private Account[] filterSharedAccounts(UserAccounts userAccounts, Account[] unfiltered,
+            int callingUid) {
+        if (getUserManager() == null || userAccounts == null || userAccounts.userId < 0
+                || callingUid == android.os.Process.myUid()) {
+            return unfiltered;
+        }
+        if (mUserManager.getUserInfo(userAccounts.userId).isRestricted()) {
+            String[] packages = mPackageManager.getPackagesForUid(callingUid);
+            // If any of the packages includes a white listed package, return the full set,
+            // otherwise return non-shared accounts only.
+            // This might be a temporary way to specify a whitelist
+            String whiteList = mContext.getResources().getString(
+                    com.android.internal.R.string.config_appsAuthorizedForSharedAccounts);
+            for (String packageName : packages) {
+                if (whiteList.contains(";" + packageName + ";")) {
+                    return unfiltered;
+                }
+            }
+            ArrayList<Account> allowed = new ArrayList<Account>();
+            Account[] sharedAccounts = getSharedAccountsAsUser(userAccounts.userId);
+            if (sharedAccounts == null || sharedAccounts.length == 0) return unfiltered;
+            for (Account account : unfiltered) {
+                boolean found = false;
+                for (Account shared : sharedAccounts) {
+                    if (shared.equals(account)) {
+                        found = true;
+                        break;
+                    }
+                }
+                if (!found) {
+                    allowed.add(account);
+                }
+            }
+            Account[] filtered = new Account[allowed.size()];
+            allowed.toArray(filtered);
+            return filtered;
+        } else {
+            return unfiltered;
+        }
+    }
+
+    protected Account[] getAccountsFromCacheLocked(UserAccounts userAccounts, String accountType,
+            int callingUid) {
         if (accountType != null) {
             final Account[] accounts = userAccounts.accountCache.get(accountType);
             if (accounts == null) {
                 return EMPTY_ACCOUNT_ARRAY;
             } else {
-                return Arrays.copyOf(accounts, accounts.length);
+                return filterSharedAccounts(userAccounts, Arrays.copyOf(accounts, accounts.length),
+                        callingUid);
             }
         } else {
             int totalLength = 0;
@@ -2714,7 +2768,7 @@
                         accountsOfType.length);
                 totalLength += accountsOfType.length;
             }
-            return accounts;
+            return filterSharedAccounts(userAccounts, accounts, callingUid);
         }
     }
 
diff --git a/services/java/com/android/server/pm/UserManagerService.java b/services/java/com/android/server/pm/UserManagerService.java
index 1414cbd..636b0e5 100644
--- a/services/java/com/android/server/pm/UserManagerService.java
+++ b/services/java/com/android/server/pm/UserManagerService.java
@@ -25,7 +25,10 @@
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
+import android.content.RestrictionEntry;
+import android.content.SharedPreferences;
 import android.content.pm.PackageManager;
+import android.content.pm.PackageManager.NameNotFoundException;
 import android.content.pm.UserInfo;
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
@@ -83,11 +86,17 @@
     private static final String TAG_USERS = "users";
     private static final String TAG_USER = "user";
     private static final String TAG_RESTRICTIONS = "restrictions";
+    private static final String TAG_ENTRY = "entry";
+    private static final String TAG_VALUE = "value";
+    private static final String ATTR_KEY = "key";
+    private static final String ATTR_MULTIPLE = "m";
 
     private static final String USER_INFO_DIR = "system" + File.separator + "users";
     private static final String USER_LIST_FILENAME = "userlist.xml";
     private static final String USER_PHOTO_FILENAME = "photo.png";
 
+    private static final String RESTRICTIONS_FILE_PREFIX = "res_";
+
     private static final int MIN_USER_ID = 10;
 
     private static final int USER_VERSION = 2;
@@ -947,6 +956,151 @@
     }
 
     @Override
+    public List<RestrictionEntry> getApplicationRestrictions(String packageName, int userId) {
+        if (UserHandle.getCallingUserId() != userId
+                || Binder.getCallingUid() != getUidForPackage(packageName)) {
+            checkManageUsersPermission("Only system can get restrictions for other users/apps");
+        }
+        synchronized (mPackagesLock) {
+            // Read the restrictions from XML
+            return readApplicationRestrictionsLocked(packageName, userId);
+        }
+    }
+
+    @Override
+    public void setApplicationRestrictions(String packageName, List<RestrictionEntry> entries,
+            int userId) {
+        if (UserHandle.getCallingUserId() != userId
+                || Binder.getCallingUid() != getUidForPackage(packageName)) {
+            checkManageUsersPermission("Only system can set restrictions for other users/apps");
+        }
+        synchronized (mPackagesLock) {
+            // Write the restrictions to XML
+            writeApplicationRestrictionsLocked(packageName, entries, userId);
+        }
+    }
+
+    private int getUidForPackage(String packageName) {
+        try {
+            return mContext.getPackageManager().getApplicationInfo(packageName,
+                    PackageManager.GET_UNINSTALLED_PACKAGES).uid;
+        } catch (NameNotFoundException nnfe) {
+            return -1;
+        }
+    }
+
+    private List<RestrictionEntry> readApplicationRestrictionsLocked(String packageName,
+            int userId) {
+        final ArrayList<RestrictionEntry> entries = new ArrayList<RestrictionEntry>();
+        final ArrayList<String> values = new ArrayList<String>();
+
+        FileInputStream fis = null;
+        try {
+            AtomicFile restrictionsFile =
+                    new AtomicFile(new File(Environment.getUserSystemDirectory(userId),
+                            RESTRICTIONS_FILE_PREFIX + packageName + ".xml"));
+            fis = restrictionsFile.openRead();
+            XmlPullParser parser = Xml.newPullParser();
+            parser.setInput(fis, null);
+            int type;
+            while ((type = parser.next()) != XmlPullParser.START_TAG
+                    && type != XmlPullParser.END_DOCUMENT) {
+                ;
+            }
+
+            if (type != XmlPullParser.START_TAG) {
+                Slog.e(LOG_TAG, "Unable to read restrictions file "
+                        + restrictionsFile.getBaseFile());
+                return entries;
+            }
+
+            while ((type = parser.next()) != XmlPullParser.END_DOCUMENT) {
+                if (type == XmlPullParser.START_TAG && parser.getName().equals(TAG_ENTRY)) {
+                    String key = parser.getAttributeValue(null, ATTR_KEY);
+                    String multiple = parser.getAttributeValue(null, ATTR_MULTIPLE);
+                    if (multiple != null) {
+                        int count = Integer.parseInt(multiple);
+                        while (count > 0 && (type = parser.next()) != XmlPullParser.END_DOCUMENT) {
+                            if (type == XmlPullParser.START_TAG
+                                    && parser.getName().equals(TAG_VALUE)) {
+                                values.add(parser.nextText().trim());
+                                count--;
+                            }
+                        }
+                        String [] valueStrings = new String[values.size()];
+                        values.toArray(valueStrings);
+                        Slog.d(LOG_TAG, "Got RestrictionEntry " + key + "," + valueStrings);
+                        RestrictionEntry entry = new RestrictionEntry(key, valueStrings);
+                        entries.add(entry);
+                    } else {
+                        String value = parser.nextText().trim();
+                        Slog.d(LOG_TAG, "Got RestrictionEntry " + key + "," + value);
+                        RestrictionEntry entry = new RestrictionEntry(key, value);
+                        entries.add(entry);
+                    }
+                }
+            }
+
+        } catch (IOException ioe) {
+        } catch (XmlPullParserException pe) {
+        } finally {
+            if (fis != null) {
+                try {
+                    fis.close();
+                } catch (IOException e) {
+                }
+            }
+        }
+        return entries;
+    }
+
+    private void writeApplicationRestrictionsLocked(String packageName,
+            List<RestrictionEntry> entries, int userId) {
+        FileOutputStream fos = null;
+        AtomicFile restrictionsFile = new AtomicFile(
+                new File(Environment.getUserSystemDirectory(userId),
+                        RESTRICTIONS_FILE_PREFIX + packageName + ".xml"));
+        try {
+            fos = restrictionsFile.startWrite();
+            final BufferedOutputStream bos = new BufferedOutputStream(fos);
+
+            // XmlSerializer serializer = XmlUtils.serializerInstance();
+            final XmlSerializer serializer = new FastXmlSerializer();
+            serializer.setOutput(bos, "utf-8");
+            serializer.startDocument(null, true);
+            serializer.setFeature("http://xmlpull.org/v1/doc/features.html#indent-output", true);
+
+            serializer.startTag(null, TAG_RESTRICTIONS);
+
+            for (RestrictionEntry entry : entries) {
+                serializer.startTag(null, TAG_ENTRY);
+                serializer.attribute(null, ATTR_KEY, entry.key);
+                if (entry.getStringValue() != null || entry.getMultipleValues() == null) {
+                    String value = entry.getStringValue();
+                    serializer.text(value != null ? value : "");
+                } else {
+                    String[] values = entry.getMultipleValues();
+                    serializer.attribute(null, ATTR_MULTIPLE, Integer.toString(values.length));
+                    for (String value : values) {
+                        serializer.startTag(null, TAG_VALUE);
+                        serializer.text(value != null ? value : "");
+                        serializer.endTag(null, TAG_VALUE);
+                    }
+                }
+                serializer.endTag(null, TAG_ENTRY);
+            }
+
+            serializer.endTag(null, TAG_RESTRICTIONS);
+
+            serializer.endDocument();
+            restrictionsFile.finishWrite(fos);
+        } catch (Exception e) {
+            restrictionsFile.failWrite(fos);
+            Slog.e(LOG_TAG, "Error writing application restrictions list");
+        }
+    }
+
+    @Override
     public int getUserSerialNumber(int userHandle) {
         synchronized (mPackagesLock) {
             if (!exists(userHandle)) return -1;