From 4ec033ca8a0ccc4deceb7d2bc9124ad2929fdf0a Mon Sep 17 00:00:00 2001 From: Tianjie Date: Wed, 13 Jan 2021 23:40:18 -0800 Subject: [PATCH] Do not remove the k_k until all users are unlocked The key in keystore is used to encrypt the escrow data. We need to iterate over all users before deleting it from key store. Otherwise, the RoR for the 2nd user will fail. Bug: 172780686 Test: atest CtsAppSecurityHostTestCases:ResumeOnRebootHostTest#resumeOnReboot_TwoUsers_BothUserUnlock_Success Change-Id: I82d94195fe5716d42e363604be5ead3eb3e300fd --- .../android/server/locksettings/RebootEscrowManager.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/locksettings/RebootEscrowManager.java b/services/core/java/com/android/server/locksettings/RebootEscrowManager.java index 289290bab4dc8..fbec91576ca11 100644 --- a/services/core/java/com/android/server/locksettings/RebootEscrowManager.java +++ b/services/core/java/com/android/server/locksettings/RebootEscrowManager.java @@ -224,6 +224,10 @@ class RebootEscrowManager { for (UserInfo user : rebootEscrowUsers) { allUsersUnlocked &= restoreRebootEscrowForUser(user.id, escrowKey, kk); } + + // Clear the old key in keystore. A new key will be generated by new RoR requests. + mKeyStoreManager.clearKeyStoreEncryptionKey(); + onEscrowRestoreComplete(allUsersUnlocked); } @@ -273,9 +277,6 @@ class RebootEscrowManager { } catch (IOException e) { Slog.w(TAG, "Could not load reboot escrow data for user " + userId, e); return false; - } finally { - // Clear the old key in keystore. A new key will be generated by new RoR requests. - mKeyStoreManager.clearKeyStoreEncryptionKey(); } }