From 68570cc5a76f7637f1277d04bf452cfd29d2ffa2 Mon Sep 17 00:00:00 2001 From: Janis Danisevskis Date: Mon, 22 Mar 2021 17:28:33 -0700 Subject: [PATCH] Keystore 2.0: Add @IntDef for Keystore namespaces. Bug: 182914789 Test: N/A Change-Id: Ibdfd2a4a37d7200317ef449ef857f34401625237 --- .../keystore/KeyGenParameterSpec.java | 10 ++++---- .../security/keystore/KeyProperties.java | 24 ++++++++++++++----- .../AndroidKeyStoreLoadStoreParameter.java | 8 ++++--- .../keystore2/AndroidKeyStoreSpi.java | 4 ++-- 4 files changed, 30 insertions(+), 16 deletions(-) diff --git a/keystore/java/android/security/keystore/KeyGenParameterSpec.java b/keystore/java/android/security/keystore/KeyGenParameterSpec.java index 5cb2c3b41517d..9ca551b26aabd 100644 --- a/keystore/java/android/security/keystore/KeyGenParameterSpec.java +++ b/keystore/java/android/security/keystore/KeyGenParameterSpec.java @@ -288,7 +288,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu private static final Date DEFAULT_CERT_NOT_AFTER = new Date(2461449600000L); // Jan 1 2048 private final String mKeystoreAlias; - private final int mNamespace; + private final @KeyProperties.Namespace int mNamespace; private final int mKeySize; private final AlgorithmParameterSpec mSpec; private final X500Principal mCertificateSubject; @@ -331,7 +331,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu */ public KeyGenParameterSpec( String keyStoreAlias, - int namespace, + @KeyProperties.Namespace int namespace, int keySize, AlgorithmParameterSpec spec, X500Principal certificateSubject, @@ -472,7 +472,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu * @hide */ @SystemApi - public int getNamespace() { + public @KeyProperties.Namespace int getNamespace() { return mNamespace; } @@ -896,7 +896,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu private final String mKeystoreAlias; private @KeyProperties.PurposeEnum int mPurposes; - private int mNamespace = KeyProperties.NAMESPACE_APPLICATION; + private @KeyProperties.Namespace int mNamespace = KeyProperties.NAMESPACE_APPLICATION; private int mKeySize = -1; private AlgorithmParameterSpec mSpec; private X500Principal mCertificateSubject; @@ -1051,7 +1051,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu */ @SystemApi @NonNull - public Builder setNamespace(int namespace) { + public Builder setNamespace(@KeyProperties.Namespace int namespace) { mNamespace = namespace; return this; } diff --git a/keystore/java/android/security/keystore/KeyProperties.java b/keystore/java/android/security/keystore/KeyProperties.java index 7b0fa91380e15..682d12a65ea34 100644 --- a/keystore/java/android/security/keystore/KeyProperties.java +++ b/keystore/java/android/security/keystore/KeyProperties.java @@ -891,6 +891,22 @@ public abstract class KeyProperties { } } + /** + * Namespaces provide system developers and vendors with a way to use keystore without + * requiring an applications uid. Namespaces can be configured using SEPolicy. + * See + * Keystore 2.0 access-control + * {@See KeyGenParameterSpec.Builder#setNamespace} + * {@See android.security.keystore2.AndroidKeyStoreLoadStoreParameter} + * @hide + */ + @Retention(RetentionPolicy.SOURCE) + @IntDef(prefix = { "NAMESPACE_" }, value = { + NAMESPACE_APPLICATION, + NAMESPACE_WIFI, + }) + public @interface Namespace {} + /** * This value indicates the implicit keystore namespace of the calling application. * It is used by default. Only select system components can choose a different namespace @@ -912,14 +928,12 @@ public abstract class KeyProperties { * For legacy support, translate namespaces into known UIDs. * @hide */ - public static int namespaceToLegacyUid(int namespace) { + public static int namespaceToLegacyUid(@Namespace int namespace) { switch (namespace) { case NAMESPACE_APPLICATION: return KeyStore.UID_SELF; case NAMESPACE_WIFI: return Process.WIFI_UID; - // TODO Translate WIFI and VPN UIDs once the namespaces are defined. - // b/171305388 and b/171305607 default: throw new IllegalArgumentException("No UID corresponding to namespace " + namespace); @@ -930,14 +944,12 @@ public abstract class KeyProperties { * For legacy support, translate namespaces into known UIDs. * @hide */ - public static int legacyUidToNamespace(int uid) { + public static @Namespace int legacyUidToNamespace(int uid) { switch (uid) { case KeyStore.UID_SELF: return NAMESPACE_APPLICATION; case Process.WIFI_UID: return NAMESPACE_WIFI; - // TODO Translate WIFI and VPN UIDs once the namespaces are defined. - // b/171305388 and b/171305607 default: throw new IllegalArgumentException("No namespace corresponding to uid " + uid); diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreLoadStoreParameter.java b/keystore/java/android/security/keystore2/AndroidKeyStoreLoadStoreParameter.java index 0c6744f9822ca..25b1c864b5d10 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreLoadStoreParameter.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreLoadStoreParameter.java @@ -16,6 +16,8 @@ package android.security.keystore2; +import android.security.keystore.KeyProperties; + import java.security.KeyStore; import java.security.KeyStore.ProtectionParameter; @@ -24,9 +26,9 @@ import java.security.KeyStore.ProtectionParameter; */ public class AndroidKeyStoreLoadStoreParameter implements KeyStore.LoadStoreParameter { - private final int mNamespace; + private final @KeyProperties.Namespace int mNamespace; - public AndroidKeyStoreLoadStoreParameter(int namespace) { + public AndroidKeyStoreLoadStoreParameter(@KeyProperties.Namespace int namespace) { mNamespace = namespace; } @@ -35,7 +37,7 @@ public class AndroidKeyStoreLoadStoreParameter implements KeyStore.LoadStorePara return null; } - int getNamespace() { + @KeyProperties.Namespace int getNamespace() { return mNamespace; } } diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java index 39607aeb38522..32f98a2538f37 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreSpi.java @@ -100,7 +100,7 @@ public class AndroidKeyStoreSpi extends KeyStoreSpi { public static final String NAME = "AndroidKeyStore"; private KeyStore2 mKeyStore; - private int mNamespace = KeyProperties.NAMESPACE_APPLICATION; + private @KeyProperties.Namespace int mNamespace = KeyProperties.NAMESPACE_APPLICATION; @Override public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, @@ -1125,7 +1125,7 @@ public class AndroidKeyStoreSpi extends KeyStoreSpi { @Override public void engineLoad(LoadStoreParameter param) throws IOException, NoSuchAlgorithmException, CertificateException { - int namespace = KeyProperties.NAMESPACE_APPLICATION; + @KeyProperties.Namespace int namespace = KeyProperties.NAMESPACE_APPLICATION; if (param != null) { if (param instanceof AndroidKeyStoreLoadStoreParameter) { namespace = ((AndroidKeyStoreLoadStoreParameter) param).getNamespace();