Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clear WIFI namspace on primary user keystore reset.

Browse Source 
This patch makes LocksettingsService clear the WIFI namspace when
Keystore is reset for the primary user.

Test: Using Settings, install a WIFI certificate, tap clear credentials,
      and check that the certificate was removed from the stored
      credentials.
Bug: 189601008
Merged-In: I9364c860250653e50fa8c92c11c510c864f3c3d8
Change-Id: I9364c860250653e50fa8c92c11c510c864f3c3d8
This commit is contained in:
Janis Danisevskis
2021-06-01 10:37:18 -07:00
parent 65db2bd3b3
commit 008502bf74
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/locksettings/LockSettingsService.java
View File

@@ -105,6 +105,7 @@ import android.security.keystore2.AndroidKeyStoreLoadStoreParameter;
import android.security.keystore2.AndroidKeyStoreProvider;
import android.service.gatekeeper.GateKeeperResponse;
import android.service.gatekeeper.IGateKeeperService;
import android.system.keystore2.Domain;
import android.text.TextUtils;
import android.util.ArrayMap;
import android.util.ArraySet;
@@ -253,8 +254,7 @@ public class LockSettingsService extends ILockSettings.Stub {
* The UIDs that are used for system credential storage in keystore.
*/
private static final int[] SYSTEM_CREDENTIAL_UIDS = {
Process.WIFI_UID, Process.VPN_UID,
Process.ROOT_UID, Process.SYSTEM_UID };
Process.VPN_UID, Process.ROOT_UID, Process.SYSTEM_UID};
// This class manages life cycle events for encrypted users on File Based Encryption (FBE)
// devices. The most basic of these is to show/hide notifications about missing features until
@@ -1987,9 +1987,14 @@ public class LockSettingsService extends ILockSettings.Stub {
// Clear all the users credentials could have been installed in for this user.
for (int profileId : mUserManager.getProfileIdsWithDisabled(userId)) {
for (int uid : SYSTEM_CREDENTIAL_UIDS) {
mKeyStore.clearUid(UserHandle.getUid(profileId, uid));
AndroidKeyStoreMaintenance.clearNamespace(Domain.APP,
UserHandle.getUid(profileId, uid));
}
}
if (mUserManager.getUserInfo(userId).isPrimary()) {
AndroidKeyStoreMaintenance.clearNamespace(Domain.SELINUX,
KeyProperties.NAMESPACE_WIFI);
}
} finally {
if (managedUserId != -1 && managedUserDecryptedPassword != null) {
if (DEBUG) Slog.v(TAG, "Restore tied profile lock");