From 5b5662d7065fac7284128d0b239e000707e7065a Mon Sep 17 00:00:00 2001 From: Kevin Chyn Date: Fri, 29 May 2020 14:38:29 -0700 Subject: [PATCH] Send callingUserId from AuthService -> BiometricServiceBase Since authenticatorIds are collected from AuthService, which is system_server, we need to get the callingUserId before the code enters system_server, which clears calling identity. Test: 1) Set up work profile, install BiometricPromptDemo 2) Enroll work profile fingerprint 3) Open work profile version of BiometricPromptDemo 4) Create biometric-bound keys and authenticate with fingerprint Before this change, key was unusable. After this change, the key can be used Fixes: 157486161 Change-Id: I4ec89b9cb13caff397b1a1acd844962736290040 --- .../android/hardware/biometrics/IBiometricAuthenticator.aidl | 2 +- core/java/android/hardware/biometrics/IBiometricService.aidl | 2 +- core/java/android/hardware/face/IFaceService.aidl | 2 +- .../android/hardware/fingerprint/IFingerprintService.aidl | 2 +- .../core/java/com/android/server/biometrics/AuthService.java | 3 ++- .../java/com/android/server/biometrics/BiometricService.java | 4 ++-- .../com/android/server/biometrics/BiometricServiceBase.java | 5 ++--- .../android/server/biometrics/face/FaceAuthenticator.java | 4 ++-- .../java/com/android/server/biometrics/face/FaceService.java | 4 ++-- .../biometrics/fingerprint/FingerprintAuthenticator.java | 4 ++-- .../server/biometrics/fingerprint/FingerprintService.java | 4 ++-- .../android/server/biometrics/iris/IrisAuthenticator.java | 2 +- 12 files changed, 19 insertions(+), 19 deletions(-) diff --git a/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl b/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl index e259c7f99826c..41590da4c33b5 100644 --- a/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl +++ b/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl @@ -57,5 +57,5 @@ interface IBiometricAuthenticator { void setActiveUser(int uid); // Gets the authenticator ID representing the current set of enrolled templates - long getAuthenticatorId(); + long getAuthenticatorId(int callingUserId); } diff --git a/core/java/android/hardware/biometrics/IBiometricService.aidl b/core/java/android/hardware/biometrics/IBiometricService.aidl index 46eec50c2688a..b277539427dd4 100644 --- a/core/java/android/hardware/biometrics/IBiometricService.aidl +++ b/core/java/android/hardware/biometrics/IBiometricService.aidl @@ -65,7 +65,7 @@ interface IBiometricService { // Get a list of AuthenticatorIDs for authenticators which have enrolled templates and meet // the requirements for integrating with Keystore. The AuthenticatorID are known in Keystore // land as SIDs, and are used during key generation. - long[] getAuthenticatorIds(); + long[] getAuthenticatorIds(int callingUserId); int getCurrentStrength(int sensorId); } diff --git a/core/java/android/hardware/face/IFaceService.aidl b/core/java/android/hardware/face/IFaceService.aidl index 30ece3e619f68..6be3d5c687d5a 100644 --- a/core/java/android/hardware/face/IFaceService.aidl +++ b/core/java/android/hardware/face/IFaceService.aidl @@ -84,7 +84,7 @@ interface IFaceService { boolean hasEnrolledFaces(int userId, String opPackageName); // Gets the authenticator ID for face - long getAuthenticatorId(); + long getAuthenticatorId(int callingUserId); // Reset the lockout when user authenticates with strong auth (e.g. PIN, pattern or password) void resetLockout(in byte [] token); diff --git a/core/java/android/hardware/fingerprint/IFingerprintService.aidl b/core/java/android/hardware/fingerprint/IFingerprintService.aidl index eaf2bb21a5f4b..edd8f7d6c9cfa 100644 --- a/core/java/android/hardware/fingerprint/IFingerprintService.aidl +++ b/core/java/android/hardware/fingerprint/IFingerprintService.aidl @@ -85,7 +85,7 @@ interface IFingerprintService { boolean hasEnrolledFingerprints(int groupId, String opPackageName); // Gets the authenticator ID for fingerprint - long getAuthenticatorId(); + long getAuthenticatorId(int callingUserId); // Reset the timeout when user authenticates with strong auth (e.g. PIN, pattern or password) void resetTimeout(in byte [] cryptoToken); diff --git a/services/core/java/com/android/server/biometrics/AuthService.java b/services/core/java/com/android/server/biometrics/AuthService.java index b91f4e17e3d17..cb725ff297ad8 100644 --- a/services/core/java/com/android/server/biometrics/AuthService.java +++ b/services/core/java/com/android/server/biometrics/AuthService.java @@ -282,9 +282,10 @@ public class AuthService extends SystemService { // The permission check should be restored once Android Keystore no longer invokes this // method from inside app processes. + final int callingUserId = UserHandle.getCallingUserId(); final long identity = Binder.clearCallingIdentity(); try { - return mBiometricService.getAuthenticatorIds(); + return mBiometricService.getAuthenticatorIds(callingUserId); } finally { Binder.restoreCallingIdentity(identity); } diff --git a/services/core/java/com/android/server/biometrics/BiometricService.java b/services/core/java/com/android/server/biometrics/BiometricService.java index 5c111676ebc5d..a6f2012f0a995 100644 --- a/services/core/java/com/android/server/biometrics/BiometricService.java +++ b/services/core/java/com/android/server/biometrics/BiometricService.java @@ -664,13 +664,13 @@ public class BiometricService extends SystemService { } @Override // Binder call - public long[] getAuthenticatorIds() { + public long[] getAuthenticatorIds(int callingUserId) { checkInternalPermission(); final List ids = new ArrayList<>(); for (BiometricSensor sensor : mSensors) { try { - final long id = sensor.impl.getAuthenticatorId(); + final long id = sensor.impl.getAuthenticatorId(callingUserId); if (Utils.isAtLeastStrength(sensor.getCurrentStrength(), Authenticators.BIOMETRIC_STRONG) && id != 0) { ids.add(id); diff --git a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java index 8d4bd6d374330..b013aaf29635d 100644 --- a/services/core/java/com/android/server/biometrics/BiometricServiceBase.java +++ b/services/core/java/com/android/server/biometrics/BiometricServiceBase.java @@ -1253,9 +1253,8 @@ public abstract class BiometricServiceBase extends SystemService /*** * @return authenticator id for the calling user */ - protected long getAuthenticatorId() { - final int userId = getUserOrWorkProfileId(null /* clientPackage */, - UserHandle.getCallingUserId()); + protected long getAuthenticatorId(int callingUserId) { + final int userId = getUserOrWorkProfileId(null /* clientPackage */, callingUserId); return mAuthenticatorIds.getOrDefault(userId, 0L); } diff --git a/services/core/java/com/android/server/biometrics/face/FaceAuthenticator.java b/services/core/java/com/android/server/biometrics/face/FaceAuthenticator.java index 9cb48665eb1f3..722b66117377d 100644 --- a/services/core/java/com/android/server/biometrics/face/FaceAuthenticator.java +++ b/services/core/java/com/android/server/biometrics/face/FaceAuthenticator.java @@ -78,7 +78,7 @@ public final class FaceAuthenticator extends IBiometricAuthenticator.Stub { } @Override - public long getAuthenticatorId() throws RemoteException { - return mFaceService.getAuthenticatorId(); + public long getAuthenticatorId(int callingUserId) throws RemoteException { + return mFaceService.getAuthenticatorId(callingUserId); } } diff --git a/services/core/java/com/android/server/biometrics/face/FaceService.java b/services/core/java/com/android/server/biometrics/face/FaceService.java index defdfcd4b47ff..094b85f6e6106 100644 --- a/services/core/java/com/android/server/biometrics/face/FaceService.java +++ b/services/core/java/com/android/server/biometrics/face/FaceService.java @@ -606,9 +606,9 @@ public class FaceService extends BiometricServiceBase { } @Override // Binder call - public long getAuthenticatorId() { + public long getAuthenticatorId(int callingUserId) { checkPermission(USE_BIOMETRIC_INTERNAL); - return FaceService.this.getAuthenticatorId(); + return FaceService.this.getAuthenticatorId(callingUserId); } @Override // Binder call diff --git a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintAuthenticator.java b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintAuthenticator.java index 24f35c83d0233..d47c1b36c1e30 100644 --- a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintAuthenticator.java +++ b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintAuthenticator.java @@ -78,7 +78,7 @@ public final class FingerprintAuthenticator extends IBiometricAuthenticator.Stub } @Override - public long getAuthenticatorId() throws RemoteException { - return mFingerprintService.getAuthenticatorId(); + public long getAuthenticatorId(int callingUserId) throws RemoteException { + return mFingerprintService.getAuthenticatorId(callingUserId); } } diff --git a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java index 238c9c4a2f317..16d6002258b85 100644 --- a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java +++ b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java @@ -404,9 +404,9 @@ public class FingerprintService extends BiometricServiceBase { } @Override // Binder call - public long getAuthenticatorId() { + public long getAuthenticatorId(int callingUserId) { checkPermission(USE_BIOMETRIC_INTERNAL); - return FingerprintService.this.getAuthenticatorId(); + return FingerprintService.this.getAuthenticatorId(callingUserId); } @Override // Binder call diff --git a/services/core/java/com/android/server/biometrics/iris/IrisAuthenticator.java b/services/core/java/com/android/server/biometrics/iris/IrisAuthenticator.java index 251f6d9665268..3cd1c91f8f9d9 100644 --- a/services/core/java/com/android/server/biometrics/iris/IrisAuthenticator.java +++ b/services/core/java/com/android/server/biometrics/iris/IrisAuthenticator.java @@ -70,7 +70,7 @@ public final class IrisAuthenticator extends IBiometricAuthenticator.Stub { } @Override - public long getAuthenticatorId() throws RemoteException { + public long getAuthenticatorId(int callingUserId) throws RemoteException { return 0; } }