From cb94dbee93d4a1407305c3484420af8eef39dad8 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 20 Mar 2023 18:32:52 +0000
Subject: [PATCH] locksettings: allow {get,set}-disabled without providing
 current LSKF

There is no reason for the get-disabled and set-disabled commands to
require the current LSKF, so remove the requirement that it be provided.
This is safe for set-disabled because the lockscreen isn't actually
disabled until the LSKF is cleared, which must be done separately.

This avoids unlocking screen-lock-bound Keystore keys when not intended.

Bug: 273304787
Change-Id: I6472905c759a0e08e6bb59a59b51c5b40fe830ab
---
 .../locksettings/LockSettingsShellCommand.java     | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java b/services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java
index 1aee345f96d4e..f107d0bf99327 100644
--- a/services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java
+++ b/services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java
@@ -106,6 +106,14 @@ class LockSettingsShellCommand extends ShellCommand {
                 case COMMAND_HELP:
                     onHelp();
                     return 0;
+                case COMMAND_GET_DISABLED:
+                    runGetDisabled();
+                    return 0;
+                case COMMAND_SET_DISABLED:
+                    // Note: if the user has an LSKF, then this has no immediate effect but instead
+                    // just ensures the lockscreen will be disabled later when the LSKF is cleared.
+                    runSetDisabled();
+                    return 0;
             }
             if (!checkCredential()) {
                 return -1;
@@ -124,15 +132,9 @@ class LockSettingsShellCommand extends ShellCommand {
                 case COMMAND_CLEAR:
                     success = runClear();
                     break;
-                case COMMAND_SET_DISABLED:
-                    runSetDisabled();
-                    break;
                 case COMMAND_VERIFY:
                     runVerify();
                     break;
-                case COMMAND_GET_DISABLED:
-                    runGetDisabled();
-                    break;
                 default:
                     getErrPrintWriter().println("Unknown command: " + cmd);
                     break;