Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove HardwareAuthToken parameter from addUserKeyAuth am: 5eb0659999

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2021758

Change-Id: Ie2743f47fc840367efb4ed11f2eeff98fbc032af
This commit is contained in:
Eric Biggers
2022-03-15 22:12:07 +00:00
committed by Automerger Merge Worker
parent 753693671d 5eb0659999
commit 2e4db6c49e
4 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/java/android/os/storage/IStorageManager.aidl
View File

@@ -126,7 +126,7 @@ interface IStorageManager {
void prepareUserStorage(in String volumeUuid, int userId, int serialNumber, int flags) = 66;
void destroyUserStorage(in String volumeUuid, int userId, int flags) = 67;
boolean isConvertibleToFBE() = 68;
void addUserKeyAuth(int userId, int serialNumber, in byte[] token, in byte[] secret) = 70;
void addUserKeyAuth(int userId, int serialNumber, in byte[] secret) = 70;
void fixateNewestUserKeyAuth(int userId) = 71;
void fstrim(int flags, IVoldTaskListener listener) = 72;
AppFuseMount mountProxyFileDescriptorBridge() = 73;

15
services/core/java/com/android/server/StorageManagerService.java
View File

@@ -3184,18 +3184,19 @@ class StorageManagerService extends IStorageManager.Stub
}
/*
* Add this token/secret pair to the set of ways we can recover a disk encryption key.
* Changing the token/secret for a disk encryption key is done in two phases: first, adding
* a new token/secret pair with this call, then delting all other pairs with
* fixateNewestUserKeyAuth. This allows other places where a credential is used, such as
* Gatekeeper, to be updated between the two calls.
* Add this secret to the set of ways we can recover a user's disk
* encryption key. Changing the secret for a disk encryption key is done in
* two phases. First, this method is called to add the new secret binding.
* Second, fixateNewestUserKeyAuth is called to delete all other bindings.
* This allows other places where a credential is used, such as Gatekeeper,
* to be updated between the two calls.
*/
@Override
public void addUserKeyAuth(int userId, int serialNumber, byte[] token, byte[] secret) {
public void addUserKeyAuth(int userId, int serialNumber, byte[] secret) {
enforcePermission(android.Manifest.permission.STORAGE_INTERNAL);
try {
mVold.addUserKeyAuth(userId, serialNumber, encodeBytes(token), encodeBytes(secret));
mVold.addUserKeyAuth(userId, serialNumber, encodeBytes(secret));
} catch (Exception e) {
Slog.wtf(TAG, e);
}

14
services/core/java/com/android/server/locksettings/LockSettingsService.java
View File

@@ -1887,9 +1887,9 @@ public class LockSettingsService extends ILockSettings.Stub {
mStorage.writeChildProfileLock(userId, outputStream.toByteArray());
}
private void setAuthlessUserKeyProtection(int userId, byte[] key) {
if (DEBUG) Slog.d(TAG, "setAuthlessUserKeyProtectiond: user=" + userId);
addUserKeyAuth(userId, null, key);
private void setUserKeyProtection(int userId, byte[] key) {
if (DEBUG) Slog.d(TAG, "setUserKeyProtection: user=" + userId);
addUserKeyAuth(userId, key);
}
private void clearUserKeyProtection(int userId, byte[] secret) {
@@ -1940,11 +1940,11 @@ public class LockSettingsService extends ILockSettings.Stub {
}
}
private void addUserKeyAuth(int userId, byte[] token, byte[] secret) {
private void addUserKeyAuth(int userId, byte[] secret) {
final UserInfo userInfo = mUserManager.getUserInfo(userId);
final long callingId = Binder.clearCallingIdentity();
try {
mStorageManager.addUserKeyAuth(userId, userInfo.serialNumber, token, secret);
mStorageManager.addUserKeyAuth(userId, userInfo.serialNumber, secret);
} catch (RemoteException e) {
throw new IllegalStateException("Failed to add new key to vold " + userId, e);
} finally {
@@ -2650,7 +2650,7 @@ public class LockSettingsService extends ILockSettings.Stub {
mSpManager.newSidForUser(getGateKeeperService(), auth, userId);
}
mSpManager.verifyChallenge(getGateKeeperService(), auth, 0L, userId);
setAuthlessUserKeyProtection(userId, auth.deriveDiskEncryptionKey());
setUserKeyProtection(userId, auth.deriveDiskEncryptionKey());
setKeystorePassword(auth.deriveKeyStorePassword(), userId);
} else {
clearUserKeyProtection(userId, null);
@@ -2852,7 +2852,7 @@ public class LockSettingsService extends ILockSettings.Stub {
// a new SID, and re-add keys to vold and keystore.
mSpManager.newSidForUser(getGateKeeperService(), auth, userId);
mSpManager.verifyChallenge(getGateKeeperService(), auth, 0L, userId);
setAuthlessUserKeyProtection(userId, auth.deriveDiskEncryptionKey());
setUserKeyProtection(userId, auth.deriveDiskEncryptionKey());
fixateNewestUserKeyAuth(userId);
setKeystorePassword(auth.deriveKeyStorePassword(), userId);
}

4
services/tests/servicestests/src/com/android/server/locksettings/BaseLockSettingsServiceTests.java
View File

@@ -221,10 +221,10 @@ public abstract class BaseLockSettingsServiceTests {
Object[] args = invocation.getArguments();
mStorageManager.addUserKeyAuth((int) args[0] /* userId */,
(int) args[1] /* serialNumber */,
(byte[]) args[3] /* secret */);
(byte[]) args[2] /* secret */);
return null;
}
}).when(sm).addUserKeyAuth(anyInt(), anyInt(), any(), any());
}).when(sm).addUserKeyAuth(anyInt(), anyInt(), any());
doAnswer(new Answer<Void>() {
@Override