From 98bb355acbb9b673aaab8322cde611569bc97143 Mon Sep 17 00:00:00 2001 From: Alex Johnston Date: Thu, 18 Mar 2021 14:18:40 +0000 Subject: [PATCH] hasKeyPair callable by the cred mng app The credential management app can call hasKeyPair. The provided alias must be found in the credential management app's authentication policy. Bug: 177979648 Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest atest android.devicepolicy.cts.CredentialManagementAppTest Change-Id: Ib28549fb4e2848ba012df2d154d28f2002ec6e59 --- .../android/app/admin/DevicePolicyManager.java | 17 +++++++++++++---- .../DevicePolicyManagerService.java | 3 ++- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java index 930717b975551..3bafdc44563c8 100644 --- a/core/java/android/app/admin/DevicePolicyManager.java +++ b/core/java/android/app/admin/DevicePolicyManager.java @@ -6159,13 +6159,22 @@ public class DevicePolicyManager { // STOPSHIP(b/174298501): clarify the expected return value following generateKeyPair call. /** - * Called by a device or profile owner, or delegated certificate installer, to query whether a - * certificate and private key are installed under a given alias. + * This API can be called by the following to query whether a certificate and private key are + * installed under a given alias: + * + * + * If called by the credential management app, the alias must exist in the credential + * management app's {@link android.security.AppUriAuthenticationPolicy}. * * @param alias The alias under which the key pair is installed. * @return {@code true} if a key pair with this alias exists, {@code false} otherwise. - * @throws SecurityException if the caller is not a device or profile owner or a delegated - * certificate installer. + * @throws SecurityException if the caller is not a device or profile owner, a delegated + * certificate installer or the credential management app. * @see #setDelegatedScopes * @see #DELEGATION_CERT_INSTALL */ diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java index 1a2eee06da4f2..7e6e2fa5300a7 100644 --- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java +++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java @@ -5488,7 +5488,8 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager { @Override public boolean hasKeyPair(String callerPackage, String alias) { final CallerIdentity caller = getCallerIdentity(callerPackage); - Preconditions.checkCallAuthorization(canManageCertificates(caller)); + Preconditions.checkCallAuthorization(canManageCertificates(caller) + || isCredentialManagementApp(caller, alias)); return mInjector.binderWithCleanCallingIdentity(() -> { try (KeyChainConnection keyChainConnection =