From 91f6bfe7dbb9e0a343e229dfa8a145bd953aa85b Mon Sep 17 00:00:00 2001
From: Alain Vongsouvanh <alainv@google.com>
Date: Wed, 23 Mar 2022 11:23:22 -0700
Subject: [PATCH] LockSettingsService: clear gatekeeper state when removing
 user

On some devices gatekeeper would fail after certain enrollments due to
some persistent state left around when removing users.

Bug: 224397241
Fixes: 224397241
Test: atest com.android.server.locksettings
Change-Id: I49861e11b265b56c395cdb25eef13c8b3a33ef19
(cherry picked from commit 6a5deda4b31d219791b4531e7426c80425a0d813)
---
 .../android/server/locksettings/LockSettingsService.java | 2 +-
 .../server/locksettings/SyntheticPasswordManager.java    | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java
index 135af2d739047..b9238902f44be 100644
--- a/services/core/java/com/android/server/locksettings/LockSettingsService.java
+++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java
@@ -2473,7 +2473,7 @@ public class LockSettingsService extends ILockSettings.Stub {
     private void removeUser(int userId, boolean unknownUser) {
         Slog.i(TAG, "RemoveUser: " + userId);
         removeBiometricsForUser(userId);
-        mSpManager.removeUser(userId);
+        mSpManager.removeUser(getGateKeeperService(), userId);
         mStrongAuth.removeUser(userId);
 
         AndroidKeyStoreMaintenance.onUserRemoved(userId);
diff --git a/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java b/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java
index 2da443116a42c..24bd42e7d7750 100644
--- a/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java
+++ b/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java
@@ -565,11 +565,18 @@ public class SyntheticPasswordManager {
         return response[0];
     }
 
-    public void removeUser(int userId) {
+    public void removeUser(IGateKeeperService gatekeeper, int userId) {
         for (long handle : mStorage.listSyntheticPasswordHandlesForUser(SP_BLOB_NAME, userId)) {
             destroyWeaverSlot(handle, userId);
             destroySPBlobKey(getKeyName(handle));
         }
+        // Remove potential persistent state (in RPMB), to prevent them from accumulating and
+        // causing problems.
+        try {
+            gatekeeper.clearSecureUserId(fakeUid(userId));
+        } catch (RemoteException ignore) {
+            Slog.w(TAG, "Failed to clear SID from gatekeeper");
+        }
     }
 
     int getCredentialType(long handle, int userId) {