From 008502bf7477f129c8f9b177ceec75eefe43676d Mon Sep 17 00:00:00 2001 From: Janis Danisevskis Date: Tue, 1 Jun 2021 10:37:18 -0700 Subject: [PATCH] Clear WIFI namspace on primary user keystore reset. This patch makes LocksettingsService clear the WIFI namspace when Keystore is reset for the primary user. Test: Using Settings, install a WIFI certificate, tap clear credentials, and check that the certificate was removed from the stored credentials. Bug: 189601008 Merged-In: I9364c860250653e50fa8c92c11c510c864f3c3d8 Change-Id: I9364c860250653e50fa8c92c11c510c864f3c3d8 --- .../server/locksettings/LockSettingsService.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 07ac14f049c2f..aba96153ad4a7 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -105,6 +105,7 @@ import android.security.keystore2.AndroidKeyStoreLoadStoreParameter; import android.security.keystore2.AndroidKeyStoreProvider; import android.service.gatekeeper.GateKeeperResponse; import android.service.gatekeeper.IGateKeeperService; +import android.system.keystore2.Domain; import android.text.TextUtils; import android.util.ArrayMap; import android.util.ArraySet; @@ -253,8 +254,7 @@ public class LockSettingsService extends ILockSettings.Stub { * The UIDs that are used for system credential storage in keystore. */ private static final int[] SYSTEM_CREDENTIAL_UIDS = { - Process.WIFI_UID, Process.VPN_UID, - Process.ROOT_UID, Process.SYSTEM_UID }; + Process.VPN_UID, Process.ROOT_UID, Process.SYSTEM_UID}; // This class manages life cycle events for encrypted users on File Based Encryption (FBE) // devices. The most basic of these is to show/hide notifications about missing features until @@ -1987,9 +1987,14 @@ public class LockSettingsService extends ILockSettings.Stub { // Clear all the users credentials could have been installed in for this user. for (int profileId : mUserManager.getProfileIdsWithDisabled(userId)) { for (int uid : SYSTEM_CREDENTIAL_UIDS) { - mKeyStore.clearUid(UserHandle.getUid(profileId, uid)); + AndroidKeyStoreMaintenance.clearNamespace(Domain.APP, + UserHandle.getUid(profileId, uid)); } } + if (mUserManager.getUserInfo(userId).isPrimary()) { + AndroidKeyStoreMaintenance.clearNamespace(Domain.SELINUX, + KeyProperties.NAMESPACE_WIFI); + } } finally { if (managedUserId != -1 && managedUserDecryptedPassword != null) { if (DEBUG) Slog.v(TAG, "Restore tied profile lock");