Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Stop loading fs-verity certificate from keystore" into rvc-dev

Browse Source
This commit is contained in:
Victor Hsieh
2020-03-04 21:09:58 +00:00
committed by Android (Google) Code Review
parent 019ff80d23 bd3d30b26d
commit 3a9bb2ba50
1 changed files with 0 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
services/core/java/com/android/server/security/FileIntegrityService.java
View File

@@ -22,11 +22,8 @@ import android.content.Context;
import android.content.pm.PackageManager; import android.content.pm.PackageManager;
import android.os.Build; import android.os.Build;
import android.os.IBinder; import android.os.IBinder;
import android.os.Process;
import android.os.SystemProperties; import android.os.SystemProperties;
import android.security.Credentials;
import android.security.IFileIntegrityService; import android.security.IFileIntegrityService;
import android.security.KeyStore;
import android.util.Slog; import android.util.Slog;
import com.android.server.SystemService; import com.android.server.SystemService;
@@ -114,9 +111,6 @@ public class FileIntegrityService extends SystemService {
// Load certificates trusted by the device manufacturer. // Load certificates trusted by the device manufacturer.
loadCertificatesFromDirectory("/product/etc/security/fsverity"); loadCertificatesFromDirectory("/product/etc/security/fsverity");
// Load certificates trusted by the device owner.
loadCertificatesFromKeystore(KeyStore.getInstance());
} }
private void loadCertificatesFromDirectory(String path) { private void loadCertificatesFromDirectory(String path) {
@@ -139,19 +133,6 @@ public class FileIntegrityService extends SystemService {
} }
} }
private void loadCertificatesFromKeystore(KeyStore keystore) {
for (final String alias : keystore.list(Credentials.APP_SOURCE_CERTIFICATE,
Process.FSVERITY_CERT_UID)) {
byte[] certificateBytes = keystore.get(Credentials.APP_SOURCE_CERTIFICATE + alias,
Process.FSVERITY_CERT_UID, false /* suppressKeyNotFoundWarning */);
if (certificateBytes == null) {
Slog.w(TAG, "The retrieved fs-verity certificate is null, ignored " + alias);
continue;
}
collectCertificate(certificateBytes);
}
}
/** /**
* Tries to convert {@code bytes} into an X.509 certificate and store in memory. * Tries to convert {@code bytes} into an X.509 certificate and store in memory.
* Errors need to be surpressed in order fo the next certificates to still be collected. * Errors need to be surpressed in order fo the next certificates to still be collected.