Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Specify UID in getAuthenticatorIds

Browse Source 
Allow the caller to get authenticator IDs for a specific UID. If
that UID is not the caller UID the USE_BIOMETRIC_INTERNAL permission
is required; this is enforced by AuthService.

Test: aosp/1686345
Bug: 163866361
Merged-In: I0eef28ecefb85f1c10a73a354d08c38087d59814
Change-Id: I0eef28ecefb85f1c10a73a354d08c38087d59814
This commit is contained in:
[6;7~
2021-04-26 14:22:25 -07:00
committed by Paul Crowley
parent 6b8f292b17
commit 6e14fdc46b
3 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
core/java/android/hardware/biometrics/BiometricManager.java
View File

@@ -26,7 +26,7 @@ import android.annotation.SystemApi;
import android.annotation.SystemService;
import android.content.Context;
import android.os.RemoteException;
import android.security.keystore.KeyGenParameterSpec;
import android.os.UserHandle;
import android.security.keystore.KeyProperties;
import android.util.Slog;
@@ -334,11 +334,23 @@ public class BiometricManager {
* in Keystore land as SIDs, and are used during key generation.
* @hide
*/
@RequiresPermission(USE_BIOMETRIC_INTERNAL)
public long[] getAuthenticatorIds() {
return getAuthenticatorIds(UserHandle.getCallingUserId());
}
/**
* Get a list of AuthenticatorIDs for biometric authenticators which have 1) enrolled templates,
* and 2) meet the requirements for integrating with Keystore. The AuthenticatorIDs are known
* in Keystore land as SIDs, and are used during key generation.
*
* @param userId Android user ID for user to look up.
*
* @hide
*/
public long[] getAuthenticatorIds(int userId) {
if (mService != null) {
try {
return mService.getAuthenticatorIds();
return mService.getAuthenticatorIds(userId);
} catch (RemoteException e) {
throw e.rethrowFromSystemServer();
}
@@ -347,6 +359,5 @@ public class BiometricManager {
return new long[0];
}
}
}

4
core/java/android/hardware/biometrics/IAuthService.aidl
View File

@@ -55,5 +55,7 @@ interface IAuthService {
// Get a list of AuthenticatorIDs for authenticators which have enrolled templates and meet
// the requirements for integrating with Keystore. The AuthenticatorID are known in Keystore
// land as SIDs, and are used during key generation.
long[] getAuthenticatorIds();
// If userId is not equal to the calling user ID, the caller must have the
// USE_BIOMETRIC_INTERNAL permission.
long[] getAuthenticatorIds(in int userId);
}

8
services/core/java/com/android/server/biometrics/AuthService.java
View File

@@ -289,7 +289,7 @@ public class AuthService extends SystemService {
}
@Override
public long[] getAuthenticatorIds() throws RemoteException {
public long[] getAuthenticatorIds(int userId) throws RemoteException {
// In this method, we're not checking whether the caller is permitted to use face
// API because current authenticator ID is leaked (in a more contrived way) via Android
// Keystore (android.security.keystore package): the user of that API can create a key
@@ -307,9 +307,13 @@ public class AuthService extends SystemService {
// method from inside app processes.
final int callingUserId = UserHandle.getCallingUserId();
if (userId != callingUserId) {
getContext().enforceCallingOrSelfPermission(USE_BIOMETRIC_INTERNAL,
"Must have " + USE_BIOMETRIC_INTERNAL + " permission.");
}
final long identity = Binder.clearCallingIdentity();
try {
return mBiometricService.getAuthenticatorIds(callingUserId);
return mBiometricService.getAuthenticatorIds(userId);
} finally {
Binder.restoreCallingIdentity(identity);
}