From 8115bfc791598ba12d07ad069ba0c8f5e6ae5a1f Mon Sep 17 00:00:00 2001 From: Kevin Chyn Date: Thu, 18 Mar 2021 12:31:38 -0700 Subject: [PATCH] Add BiometricPrompt.Builder#setAllowBackgroundAuthentication TestApi By default, auth via BiometricPrompt is not allowed unless the caller is foreground. However, for cases like CTS, which may request auth from the test itself (and not a test activity, which has no way of getting access to protected TestApis), auth is requested from background. This would also allow us to easily add regression tests for the security bug b/159249069 Bug: 163058911 Test: atest CtsBiometricsTestCases Test: atest com.android.server.biometrics Change-Id: I74bfdcd7989aa9256d1bf10eefae354983b42e6c --- core/api/test-current.txt | 2 ++ .../hardware/biometrics/BiometricPrompt.java | 23 +++++++++++++++++++ .../biometrics/IBiometricAuthenticator.aidl | 2 +- .../hardware/biometrics/PromptInfo.java | 13 +++++++++++ .../android/hardware/face/IFaceService.aidl | 2 +- .../fingerprint/IFingerprintService.aidl | 3 ++- .../server/biometrics/AuthSession.java | 3 ++- .../server/biometrics/BiometricSensor.java | 5 ++-- .../sensors/AuthenticationClient.java | 16 +++++++++---- .../sensors/face/FaceAuthenticator.java | 4 ++-- .../biometrics/sensors/face/FaceService.java | 5 ++-- .../sensors/face/ServiceProvider.java | 3 ++- .../face/aidl/FaceAuthenticationClient.java | 4 ++-- .../sensors/face/aidl/FaceProvider.java | 5 ++-- .../biometrics/sensors/face/hidl/Face10.java | 4 ++-- .../face/hidl/FaceAuthenticationClient.java | 4 ++-- .../fingerprint/FingerprintAuthenticator.java | 4 ++-- .../fingerprint/FingerprintService.java | 4 ++-- .../sensors/fingerprint/ServiceProvider.java | 3 ++- .../aidl/FingerprintAuthenticationClient.java | 5 ++-- .../fingerprint/aidl/FingerprintProvider.java | 4 ++-- .../fingerprint/hidl/Fingerprint21.java | 5 ++-- .../hidl/FingerprintAuthenticationClient.java | 5 ++-- .../sensors/iris/IrisAuthenticator.java | 3 ++- .../server/biometrics/AuthSessionTest.java | 3 ++- .../biometrics/BiometricServiceTest.java | 3 ++- 26 files changed, 97 insertions(+), 40 deletions(-) diff --git a/core/api/test-current.txt b/core/api/test-current.txt index 6de6594a21fa4..48500186fe34d 100644 --- a/core/api/test-current.txt +++ b/core/api/test-current.txt @@ -1028,9 +1028,11 @@ package android.hardware.biometrics { public class BiometricPrompt { method @NonNull public java.util.List getAllowedSensorIds(); + method public boolean isAllowBackgroundAuthentication(); } public static class BiometricPrompt.Builder { + method @NonNull @RequiresPermission(anyOf={android.Manifest.permission.TEST_BIOMETRIC, "android.permission.USE_BIOMETRIC_INTERNAL"}) public android.hardware.biometrics.BiometricPrompt.Builder setAllowBackgroundAuthentication(boolean); method @NonNull @RequiresPermission(anyOf={android.Manifest.permission.TEST_BIOMETRIC, "android.permission.USE_BIOMETRIC_INTERNAL"}) public android.hardware.biometrics.BiometricPrompt.Builder setAllowedSensorIds(@NonNull java.util.List); } diff --git a/core/java/android/hardware/biometrics/BiometricPrompt.java b/core/java/android/hardware/biometrics/BiometricPrompt.java index 125824707402d..2e51dc4427fee 100644 --- a/core/java/android/hardware/biometrics/BiometricPrompt.java +++ b/core/java/android/hardware/biometrics/BiometricPrompt.java @@ -367,6 +367,20 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan return this; } + /** + * @param allow If true, allows authentication when the calling package is not in the + * foreground. This is set to false by default. + * @return This builder + * @hide + */ + @TestApi + @NonNull + @RequiresPermission(anyOf = {TEST_BIOMETRIC, USE_BIOMETRIC_INTERNAL}) + public Builder setAllowBackgroundAuthentication(boolean allow) { + mPromptInfo.setAllowBackgroundAuthentication(allow); + return this; + } + /** * If set check the Device Policy Manager for disabled biometrics. * @@ -619,6 +633,15 @@ public class BiometricPrompt implements BiometricAuthenticator, BiometricConstan return mPromptInfo.getAllowedSensorIds(); } + /** + * @return The value set by {@link Builder#setAllowBackgroundAuthentication(boolean)} + * @hide + */ + @TestApi + public boolean isAllowBackgroundAuthentication() { + return mPromptInfo.isAllowBackgroundAuthentication(); + } + /** * A wrapper class for the cryptographic operations supported by BiometricPrompt. * diff --git a/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl b/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl index 059bf2622b009..876513f266e82 100644 --- a/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl +++ b/core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl @@ -48,7 +48,7 @@ interface IBiometricAuthenticator { // startPreparedClient(). void prepareForAuthentication(boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, - int cookie); + int cookie, boolean allowBackgroundAuthentication); // Starts authentication with the previously prepared client. void startPreparedClient(int cookie); diff --git a/core/java/android/hardware/biometrics/PromptInfo.java b/core/java/android/hardware/biometrics/PromptInfo.java index 20c25fb82b4c6..339c654f4d2f5 100644 --- a/core/java/android/hardware/biometrics/PromptInfo.java +++ b/core/java/android/hardware/biometrics/PromptInfo.java @@ -44,6 +44,7 @@ public class PromptInfo implements Parcelable { private boolean mDisallowBiometricsIfPolicyExists; private boolean mReceiveSystemEvents; @NonNull private List mAllowedSensorIds = new ArrayList<>(); + private boolean mAllowBackgroundAuthentication; public PromptInfo() { @@ -64,6 +65,7 @@ public class PromptInfo implements Parcelable { mDisallowBiometricsIfPolicyExists = in.readBoolean(); mReceiveSystemEvents = in.readBoolean(); mAllowedSensorIds = in.readArrayList(Integer.class.getClassLoader()); + mAllowBackgroundAuthentication = in.readBoolean(); } public static final Creator CREATOR = new Creator() { @@ -99,11 +101,14 @@ public class PromptInfo implements Parcelable { dest.writeBoolean(mDisallowBiometricsIfPolicyExists); dest.writeBoolean(mReceiveSystemEvents); dest.writeList(mAllowedSensorIds); + dest.writeBoolean(mAllowBackgroundAuthentication); } public boolean containsTestConfigurations() { if (!mAllowedSensorIds.isEmpty()) { return true; + } else if (mAllowBackgroundAuthentication) { + return true; } return false; } @@ -183,6 +188,10 @@ public class PromptInfo implements Parcelable { mAllowedSensorIds = sensorIds; } + public void setAllowBackgroundAuthentication(boolean allow) { + mAllowBackgroundAuthentication = allow; + } + // Getters public CharSequence getTitle() { @@ -248,4 +257,8 @@ public class PromptInfo implements Parcelable { public List getAllowedSensorIds() { return mAllowedSensorIds; } + + public boolean isAllowBackgroundAuthentication() { + return mAllowBackgroundAuthentication; + } } diff --git a/core/java/android/hardware/face/IFaceService.aidl b/core/java/android/hardware/face/IFaceService.aidl index 6e7c701ef5ff8..0b44150afa4df 100644 --- a/core/java/android/hardware/face/IFaceService.aidl +++ b/core/java/android/hardware/face/IFaceService.aidl @@ -59,7 +59,7 @@ interface IFaceService { // startPreparedClient(). void prepareForAuthentication(int sensorId, boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, - int cookie); + int cookie, boolean allowBackgroundAuthentication); // Starts authentication with the previously prepared client. void startPreparedClient(int sensorId, int cookie); diff --git a/core/java/android/hardware/fingerprint/IFingerprintService.aidl b/core/java/android/hardware/fingerprint/IFingerprintService.aidl index 054c0d0f65132..469e87e2390ac 100644 --- a/core/java/android/hardware/fingerprint/IFingerprintService.aidl +++ b/core/java/android/hardware/fingerprint/IFingerprintService.aidl @@ -62,7 +62,8 @@ interface IFingerprintService { // by BiometricService. To start authentication after the clients are ready, use // startPreparedClient(). void prepareForAuthentication(int sensorId, IBinder token, long operationId, int userId, - IBiometricSensorReceiver sensorReceiver, String opPackageName, int cookie); + IBiometricSensorReceiver sensorReceiver, String opPackageName, int cookie, + boolean allowBackgroundAuthentication); // Starts authentication with the previously prepared client. void startPreparedClient(int sensorId, int cookie); diff --git a/services/core/java/com/android/server/biometrics/AuthSession.java b/services/core/java/com/android/server/biometrics/AuthSession.java index f888200837684..5083c5ecd1ec2 100644 --- a/services/core/java/com/android/server/biometrics/AuthSession.java +++ b/services/core/java/com/android/server/biometrics/AuthSession.java @@ -195,7 +195,8 @@ public final class AuthSession implements IBinder.DeathRecipient { final int cookie = mRandom.nextInt(Integer.MAX_VALUE - 1) + 1; final boolean requireConfirmation = isConfirmationRequired(sensor); sensor.goToStateWaitingForCookie(requireConfirmation, mToken, mOperationId, - mUserId, mSensorReceiver, mOpPackageName, cookie); + mUserId, mSensorReceiver, mOpPackageName, cookie, + mPromptInfo.isAllowBackgroundAuthentication()); } } diff --git a/services/core/java/com/android/server/biometrics/BiometricSensor.java b/services/core/java/com/android/server/biometrics/BiometricSensor.java index 85de81bb34911..c9e148f9b6fff 100644 --- a/services/core/java/com/android/server/biometrics/BiometricSensor.java +++ b/services/core/java/com/android/server/biometrics/BiometricSensor.java @@ -103,11 +103,12 @@ public abstract class BiometricSensor { void goToStateWaitingForCookie(boolean requireConfirmation, IBinder token, long sessionId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, - int cookie) + int cookie, boolean allowBackgroundAuthentication) throws RemoteException { mCookie = cookie; impl.prepareForAuthentication(requireConfirmation, token, - sessionId, userId, sensorReceiver, opPackageName, mCookie); + sessionId, userId, sensorReceiver, opPackageName, mCookie, + allowBackgroundAuthentication); mSensorState = STATE_WAITING_FOR_COOKIE; } diff --git a/services/core/java/com/android/server/biometrics/sensors/AuthenticationClient.java b/services/core/java/com/android/server/biometrics/sensors/AuthenticationClient.java index 9617bb09e153f..79e75b16dbf22 100644 --- a/services/core/java/com/android/server/biometrics/sensors/AuthenticationClient.java +++ b/services/core/java/com/android/server/biometrics/sensors/AuthenticationClient.java @@ -55,7 +55,7 @@ public abstract class AuthenticationClient extends AcquisitionClient @Nullable private final TaskStackListener mTaskStackListener; private final LockoutTracker mLockoutTracker; private final boolean mIsRestricted; - private final boolean mIsKeyguard; + private final boolean mAllowBackgroundAuthentication; protected final long mOperationId; @@ -68,7 +68,7 @@ public abstract class AuthenticationClient extends AcquisitionClient int targetUserId, long operationId, boolean restricted, @NonNull String owner, int cookie, boolean requireConfirmation, int sensorId, boolean isStrongBiometric, int statsModality, int statsClient, @Nullable TaskStackListener taskStackListener, - @NonNull LockoutTracker lockoutTracker, boolean isKeyguard) { + @NonNull LockoutTracker lockoutTracker, boolean allowBackgroundAuthentication) { super(context, lazyDaemon, token, listener, targetUserId, owner, cookie, sensorId, statsModality, BiometricsProtoEnums.ACTION_AUTHENTICATE, statsClient); mIsStrongBiometric = isStrongBiometric; @@ -79,7 +79,7 @@ public abstract class AuthenticationClient extends AcquisitionClient mTaskStackListener = taskStackListener; mLockoutTracker = lockoutTracker; mIsRestricted = restricted; - mIsKeyguard = isKeyguard; + mAllowBackgroundAuthentication = allowBackgroundAuthentication; } public @LockoutTracker.LockoutMode int handleFailedAttempt(int userId) { @@ -120,7 +120,7 @@ public abstract class AuthenticationClient extends AcquisitionClient } public boolean isKeyguard() { - return mIsKeyguard; + return Utils.isKeyguard(getContext(), getOwnerString()); } @Override @@ -152,9 +152,15 @@ public abstract class AuthenticationClient extends AcquisitionClient pm.incrementAuthForUser(getTargetUserId(), authenticated); } + if (mAllowBackgroundAuthentication) { + Slog.w(TAG, "Allowing background authentication," + + " this is allowed only for platform or test invocations"); + } + // Ensure authentication only succeeds if the client activity is on top. boolean isBackgroundAuth = false; - if (authenticated && !Utils.isKeyguard(getContext(), getOwnerString()) + if (!mAllowBackgroundAuthentication && authenticated + && !Utils.isKeyguard(getContext(), getOwnerString()) && !Utils.isSystem(getContext(), getOwnerString())) { final List tasks = mActivityTaskManager.getTasks(1); diff --git a/services/core/java/com/android/server/biometrics/sensors/face/FaceAuthenticator.java b/services/core/java/com/android/server/biometrics/sensors/face/FaceAuthenticator.java index 2926260321f1f..0002ad249376d 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/FaceAuthenticator.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/FaceAuthenticator.java @@ -61,10 +61,10 @@ public final class FaceAuthenticator extends IBiometricAuthenticator.Stub { @Override public void prepareForAuthentication(boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, - String opPackageName, int cookie) + String opPackageName, int cookie, boolean allowBackgroundAuthentication) throws RemoteException { mFaceService.prepareForAuthentication(mSensorId, requireConfirmation, token, operationId, - userId, sensorReceiver, opPackageName, cookie); + userId, sensorReceiver, opPackageName, cookie, allowBackgroundAuthentication); } @Override diff --git a/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java b/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java index a74e2da300776..9f5dc69b404ef 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/FaceService.java @@ -306,7 +306,8 @@ public class FaceService extends SystemService implements BiometricServiceCallba @Override // Binder call public void prepareForAuthentication(int sensorId, boolean requireConfirmation, IBinder token, long operationId, int userId, - IBiometricSensorReceiver sensorReceiver, String opPackageName, int cookie) { + IBiometricSensorReceiver sensorReceiver, String opPackageName, int cookie, + boolean allowBackgroundAuthentication) { Utils.checkPermission(getContext(), USE_BIOMETRIC_INTERNAL); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -318,7 +319,7 @@ public class FaceService extends SystemService implements BiometricServiceCallba final boolean restricted = true; // BiometricPrompt is always restricted provider.scheduleAuthenticate(sensorId, token, operationId, userId, cookie, new ClientMonitorCallbackConverter(sensorReceiver), opPackageName, restricted, - BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, false /* isKeyguard */); + BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, allowBackgroundAuthentication); } @Override // Binder call diff --git a/services/core/java/com/android/server/biometrics/sensors/face/ServiceProvider.java b/services/core/java/com/android/server/biometrics/sensors/face/ServiceProvider.java index 88edfbf12df11..9b6fb0b75c579 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/ServiceProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/ServiceProvider.java @@ -103,7 +103,8 @@ public interface ServiceProvider { void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter callback, - @NonNull String opPackageName, boolean restricted, int statsClient, boolean isKeyguard); + @NonNull String opPackageName, boolean restricted, int statsClient, + boolean allowBackgroundAuthentication); void cancelAuthentication(int sensorId, @NonNull IBinder token); diff --git a/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceAuthenticationClient.java b/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceAuthenticationClient.java index 089cf1e4cee87..07d173c8da02e 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceAuthenticationClient.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceAuthenticationClient.java @@ -69,11 +69,11 @@ class FaceAuthenticationClient extends AuthenticationClient implements @NonNull ClientMonitorCallbackConverter listener, int targetUserId, long operationId, boolean restricted, String owner, int cookie, boolean requireConfirmation, int sensorId, boolean isStrongBiometric, int statsClient, @NonNull UsageStats usageStats, - @NonNull LockoutCache lockoutCache, boolean isKeyguard) { + @NonNull LockoutCache lockoutCache, boolean allowBackgroundAuthentication) { super(context, lazyDaemon, token, listener, targetUserId, operationId, restricted, owner, cookie, requireConfirmation, sensorId, isStrongBiometric, BiometricsProtoEnums.MODALITY_FACE, statsClient, null /* taskStackListener */, - lockoutCache, isKeyguard); + lockoutCache, allowBackgroundAuthentication); mUsageStats = usageStats; mLockoutCache = lockoutCache; mNotificationManager = context.getSystemService(NotificationManager.class); diff --git a/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceProvider.java b/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceProvider.java index 07a653fcfd3f7..3f3ed9c250e95 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceProvider.java @@ -433,7 +433,7 @@ public class FaceProvider implements IBinder.DeathRecipient, ServiceProvider { public void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter callback, @NonNull String opPackageName, boolean restricted, int statsClient, - boolean isKeyguard) { + boolean allowBackgroundAuthentication) { mHandler.post(() -> { final IFace daemon = getHalInstance(); if (daemon == null) { @@ -454,7 +454,8 @@ public class FaceProvider implements IBinder.DeathRecipient, ServiceProvider { mContext, mSensors.get(sensorId).getLazySession(), token, callback, userId, operationId, restricted, opPackageName, cookie, false /* requireConfirmation */, sensorId, isStrongBiometric, statsClient, - mUsageStats, mSensors.get(sensorId).getLockoutCache(), isKeyguard); + mUsageStats, mSensors.get(sensorId).getLockoutCache(), + allowBackgroundAuthentication); mSensors.get(sensorId).getScheduler().scheduleClientMonitor(client); } catch (RemoteException e) { Slog.e(getTag(), "Remote exception when scheduling authenticate", e); diff --git a/services/core/java/com/android/server/biometrics/sensors/face/hidl/Face10.java b/services/core/java/com/android/server/biometrics/sensors/face/hidl/Face10.java index 40c050f4838b9..e2888f43665c0 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/hidl/Face10.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/hidl/Face10.java @@ -635,7 +635,7 @@ public class Face10 implements IHwBinder.DeathRecipient, ServiceProvider { public void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter receiver, @NonNull String opPackageName, boolean restricted, int statsClient, - boolean isKeyguard) { + boolean allowBackgroundAuthentication) { mHandler.post(() -> { scheduleUpdateActiveUserWithoutHandler(userId); @@ -643,7 +643,7 @@ public class Face10 implements IHwBinder.DeathRecipient, ServiceProvider { final FaceAuthenticationClient client = new FaceAuthenticationClient(mContext, mLazyDaemon, token, receiver, userId, operationId, restricted, opPackageName, cookie, false /* requireConfirmation */, mSensorId, isStrongBiometric, - statsClient, mLockoutTracker, mUsageStats, isKeyguard); + statsClient, mLockoutTracker, mUsageStats, allowBackgroundAuthentication); mScheduler.scheduleClientMonitor(client); }); } diff --git a/services/core/java/com/android/server/biometrics/sensors/face/hidl/FaceAuthenticationClient.java b/services/core/java/com/android/server/biometrics/sensors/face/hidl/FaceAuthenticationClient.java index 3ca51d32797ef..ff06a4a30a800 100644 --- a/services/core/java/com/android/server/biometrics/sensors/face/hidl/FaceAuthenticationClient.java +++ b/services/core/java/com/android/server/biometrics/sensors/face/hidl/FaceAuthenticationClient.java @@ -62,11 +62,11 @@ class FaceAuthenticationClient extends AuthenticationClient { @NonNull ClientMonitorCallbackConverter listener, int targetUserId, long operationId, boolean restricted, String owner, int cookie, boolean requireConfirmation, int sensorId, boolean isStrongBiometric, int statsClient, @NonNull LockoutTracker lockoutTracker, - @NonNull UsageStats usageStats, boolean isKeyguard) { + @NonNull UsageStats usageStats, boolean allowBackgroundAuthentication) { super(context, lazyDaemon, token, listener, targetUserId, operationId, restricted, owner, cookie, requireConfirmation, sensorId, isStrongBiometric, BiometricsProtoEnums.MODALITY_FACE, statsClient, null /* taskStackListener */, - lockoutTracker, isKeyguard); + lockoutTracker, allowBackgroundAuthentication); mUsageStats = usageStats; final Resources resources = getContext().getResources(); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintAuthenticator.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintAuthenticator.java index 9e82ffcfadc6c..81096802a78b6 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintAuthenticator.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintAuthenticator.java @@ -62,10 +62,10 @@ public final class FingerprintAuthenticator extends IBiometricAuthenticator.Stub @Override public void prepareForAuthentication(boolean requireConfirmation, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, - String opPackageName, int cookie) + String opPackageName, int cookie, boolean allowBackgroundAuthentication) throws RemoteException { mFingerprintService.prepareForAuthentication(mSensorId, token, operationId, userId, - sensorReceiver, opPackageName, cookie); + sensorReceiver, opPackageName, cookie, allowBackgroundAuthentication); } @Override diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java index aa5afb728a9b0..e4397fd158e11 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/FingerprintService.java @@ -403,7 +403,7 @@ public class FingerprintService extends SystemService implements BiometricServic @Override // Binder call public void prepareForAuthentication(int sensorId, IBinder token, long operationId, int userId, IBiometricSensorReceiver sensorReceiver, String opPackageName, - int cookie) { + int cookie, boolean allowBackgroundAuthentication) { Utils.checkPermission(getContext(), MANAGE_BIOMETRIC); final ServiceProvider provider = getProviderForSensor(sensorId); @@ -415,7 +415,7 @@ public class FingerprintService extends SystemService implements BiometricServic final boolean restricted = true; // BiometricPrompt is always restricted provider.scheduleAuthenticate(sensorId, token, operationId, userId, cookie, new ClientMonitorCallbackConverter(sensorReceiver), opPackageName, restricted, - BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, false /* isKeyguard */); + BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, allowBackgroundAuthentication); } @Override // Binder call diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java index 0d50499bd02a1..c09d2d37de445 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/ServiceProvider.java @@ -96,7 +96,8 @@ public interface ServiceProvider { void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter callback, - @NonNull String opPackageName, boolean restricted, int statsClient, boolean isKeyguard); + @NonNull String opPackageName, boolean restricted, int statsClient, + boolean allowBackgroundAuthentication); void startPreparedClient(int sensorId, int cookie); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintAuthenticationClient.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintAuthenticationClient.java index e2743f624c37c..76a47d382e4b4 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintAuthenticationClient.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintAuthenticationClient.java @@ -59,11 +59,12 @@ class FingerprintAuthenticationClient extends AuthenticationClient imp boolean restricted, @NonNull String owner, int cookie, boolean requireConfirmation, int sensorId, boolean isStrongBiometric, int statsClient, @Nullable TaskStackListener taskStackListener, @NonNull LockoutCache lockoutCache, - @Nullable IUdfpsOverlayController udfpsOverlayController, boolean isKeyguard) { + @Nullable IUdfpsOverlayController udfpsOverlayController, + boolean allowBackgroundAuthentication) { super(context, lazyDaemon, token, listener, targetUserId, operationId, restricted, owner, cookie, requireConfirmation, sensorId, isStrongBiometric, BiometricsProtoEnums.MODALITY_FINGERPRINT, statsClient, taskStackListener, - lockoutCache, isKeyguard); + lockoutCache, allowBackgroundAuthentication); mLockoutCache = lockoutCache; mUdfpsOverlayController = udfpsOverlayController; } diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java index d798198782eae..1758d72ccb86c 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/aidl/FingerprintProvider.java @@ -457,7 +457,7 @@ public class FingerprintProvider implements IBinder.DeathRecipient, ServiceProvi public void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter callback, @NonNull String opPackageName, boolean restricted, int statsClient, - boolean isKeyguard) { + boolean allowBackgroundAuthentication) { mHandler.post(() -> { final IFingerprint daemon = getHalInstance(); if (daemon == null) { @@ -479,7 +479,7 @@ public class FingerprintProvider implements IBinder.DeathRecipient, ServiceProvi operationId, restricted, opPackageName, cookie, false /* requireConfirmation */, sensorId, isStrongBiometric, statsClient, mTaskStackListener, mSensors.get(sensorId).getLockoutCache(), - mUdfpsOverlayController, isKeyguard); + mUdfpsOverlayController, allowBackgroundAuthentication); mSensors.get(sensorId).getScheduler().scheduleClientMonitor(client); } catch (RemoteException e) { Slog.e(getTag(), "Remote exception when scheduling authenticate", e); diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/Fingerprint21.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/Fingerprint21.java index e737677a7f530..e7e5ffc0f38d9 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/Fingerprint21.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/Fingerprint21.java @@ -609,7 +609,7 @@ public class Fingerprint21 implements IHwBinder.DeathRecipient, ServiceProvider public void scheduleAuthenticate(int sensorId, @NonNull IBinder token, long operationId, int userId, int cookie, @NonNull ClientMonitorCallbackConverter listener, @NonNull String opPackageName, boolean restricted, int statsClient, - boolean isKeyguard) { + boolean allowBackgroundAuthentication) { mHandler.post(() -> { scheduleUpdateActiveUserWithoutHandler(userId); @@ -618,7 +618,8 @@ public class Fingerprint21 implements IHwBinder.DeathRecipient, ServiceProvider mContext, mLazyDaemon, token, listener, userId, operationId, restricted, opPackageName, cookie, false /* requireConfirmation */, mSensorProperties.sensorId, isStrongBiometric, statsClient, - mTaskStackListener, mLockoutTracker, mUdfpsOverlayController, isKeyguard); + mTaskStackListener, mLockoutTracker, mUdfpsOverlayController, + allowBackgroundAuthentication); mScheduler.scheduleClientMonitor(client); }); } diff --git a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/FingerprintAuthenticationClient.java b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/FingerprintAuthenticationClient.java index db371125478d7..97f128748bcc0 100644 --- a/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/FingerprintAuthenticationClient.java +++ b/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/FingerprintAuthenticationClient.java @@ -59,11 +59,12 @@ class FingerprintAuthenticationClient extends AuthenticationClient