From 67f11e65cab3bcccacd059be9635700096716466 Mon Sep 17 00:00:00 2001
From: Pavel Grafov <pgrafov@google.com>
Date: Wed, 21 Apr 2021 15:48:45 +0100
Subject: [PATCH] Make sure DPC knows if revoke fails

Bug: 183098396
Test: atest MixedDeviceOwnerTest#testKeyManagement
Change-Id: I89b51a1fb4be3b53eb46a7c194924b5255cd262b
---
 keystore/java/android/security/IKeyChainService.aidl           | 3 ++-
 .../server/devicepolicy/DevicePolicyManagerService.java        | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/keystore/java/android/security/IKeyChainService.aidl b/keystore/java/android/security/IKeyChainService.aidl
index 091f5795784f8..6d3d84c755184 100644
--- a/keystore/java/android/security/IKeyChainService.aidl
+++ b/keystore/java/android/security/IKeyChainService.aidl
@@ -66,7 +66,8 @@ interface IKeyChainService {
     boolean isCredentialManagementApp(String packageName);
 
     // APIs used by KeyChainActivity
-    void setGrant(int uid, String alias, boolean value);
+    // setGrant may fail with value=false when ungrant operation fails in KeyStore.
+    boolean setGrant(int uid, String alias, boolean value);
     boolean hasGrant(int uid, String alias);
 
     // API used by Wifi
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 20c56fb30ec2f..8678d9d500877 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -5657,8 +5657,7 @@ public class DevicePolicyManagerService extends BaseIDevicePolicyManager {
             try (KeyChainConnection keyChainConnection =
                          KeyChain.bindAsUser(mContext, userHandle)) {
                 IKeyChainService keyChain = keyChainConnection.getService();
-                keyChain.setGrant(granteeUid, alias, hasGrant);
-                return true;
+                return keyChain.setGrant(granteeUid, alias, hasGrant);
             } catch (RemoteException e) {
                 Slogf.e(LOG_TAG, "Setting grant for package.", e);
                 return false;