diff --git a/FsCrypt.cpp b/FsCrypt.cpp
index cfa74e0..04def5c 100644
--- a/FsCrypt.cpp
+++ b/FsCrypt.cpp
@@ -730,6 +730,14 @@
     return true;
 }
 
+std::vector<int> fscrypt_get_unlocked_users() {
+    std::vector<int> user_ids;
+    for (const auto& it : s_ce_policies) {
+        user_ids.push_back(it.first);
+    }
+    return user_ids;
+}
+
 // TODO: rename to 'install' for consistency, and take flags to know which keys to install
 bool fscrypt_unlock_user_key(userid_t user_id, int serial, const std::string& secret_hex) {
     LOG(DEBUG) << "fscrypt_unlock_user_key " << user_id << " serial=" << serial;
diff --git a/FsCrypt.h b/FsCrypt.h
index 96159d5..2946be5 100644
--- a/FsCrypt.h
+++ b/FsCrypt.h
@@ -15,6 +15,7 @@
  */
 
 #include <string>
+#include <vector>
 
 #include <cutils/multiuser.h>
 
@@ -27,6 +28,7 @@
 bool fscrypt_clear_user_key_auth(userid_t user_id, int serial, const std::string& secret);
 bool fscrypt_fixate_newest_user_key_auth(userid_t user_id);
 
+std::vector<int> fscrypt_get_unlocked_users();
 bool fscrypt_unlock_user_key(userid_t user_id, int serial, const std::string& secret);
 bool fscrypt_lock_user_key(userid_t user_id);
 
diff --git a/VoldNativeService.cpp b/VoldNativeService.cpp
index 938e7db..5ea72bb 100644
--- a/VoldNativeService.cpp
+++ b/VoldNativeService.cpp
@@ -764,6 +764,14 @@
     return translateBool(fscrypt_fixate_newest_user_key_auth(userId));
 }
 
+binder::Status VoldNativeService::getUnlockedUsers(std::vector<int>* _aidl_return) {
+    ENFORCE_SYSTEM_OR_ROOT;
+    ACQUIRE_CRYPT_LOCK;
+
+    *_aidl_return = fscrypt_get_unlocked_users();
+    return Ok();
+}
+
 binder::Status VoldNativeService::unlockUserKey(int32_t userId, int32_t userSerial,
                                                 const std::string& token,
                                                 const std::string& secret) {
diff --git a/VoldNativeService.h b/VoldNativeService.h
index 123f127..33d0f3a 100644
--- a/VoldNativeService.h
+++ b/VoldNativeService.h
@@ -127,6 +127,7 @@
                                     const std::string& secret);
     binder::Status fixateNewestUserKeyAuth(int32_t userId);
 
+    binder::Status getUnlockedUsers(std::vector<int>* _aidl_return);
     binder::Status unlockUserKey(int32_t userId, int32_t userSerial, const std::string& token,
                                  const std::string& secret);
     binder::Status lockUserKey(int32_t userId);
diff --git a/binder/android/os/IVold.aidl b/binder/android/os/IVold.aidl
index fd134c5..62685e5 100644
--- a/binder/android/os/IVold.aidl
+++ b/binder/android/os/IVold.aidl
@@ -102,6 +102,7 @@
                         @utf8InCpp String secret);
     void fixateNewestUserKeyAuth(int userId);
 
+    int[] getUnlockedUsers();
     void unlockUserKey(int userId, int userSerial, @utf8InCpp String token,
                        @utf8InCpp String secret);
     void lockUserKey(int userId);