From 15258a4d76b836acab9d9992952ac05a426e7e46 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 17 Feb 2023 23:21:11 +0000 Subject: [PATCH 1/5] Remove LockPatternUtils.setVisiblePasswordEnabled() This is no longer used. Bug: 208476087 Change-Id: Ia960160c47700f517a57a25afafd52bfaccfb4dd Merged-In: Ia960160c47700f517a57a25afafd52bfaccfb4dd (cherry picked from commit 90644148fcea17e52c077ef3e1a87e83669a3f8c) (resolved trivial conflict) --- .../java/com/android/internal/widget/LockPatternUtils.java | 7 ------- 1 file changed, 7 deletions(-) diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index 5b2c441f95c9c..c8c3fada61c36 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -1021,13 +1021,6 @@ public class LockPatternUtils { return getString(LOCK_PIN_ENHANCED_PRIVACY, userId) != null; } - /** - * Set whether the visible password is enabled for cryptkeeper screen. - */ - public void setVisiblePasswordEnabled(boolean enabled, int userId) { - // No longer does anything. - } - /** * Set and store the lockout deadline, meaning the user can't attempt their unlock * pattern until the deadline has passed. From 7d4a9fd5022ee7829cd8fc4f598b4507d0a4239b Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sat, 18 Feb 2023 03:23:14 +0000 Subject: [PATCH 2/5] Make locksettings commands go through "cmd lock_settings" This greatly improves the performance of locksettings commands, and it eliminates the need for LockSettingsCmd.java. Bug: 177985929 Test: locksettings command still works Change-Id: I5881fa074681f6bf1ad2f5969a282d928121ddb2 Merged-In: I5881fa074681f6bf1ad2f5969a282d928121ddb2 (cherry picked from commit 4d38b0cdc42a6b289e321facbf992feb898258b7) --- cmds/locksettings/Android.bp | 5 +- cmds/locksettings/locksettings.sh | 6 +-- .../locksettings/LockSettingsCmd.java | 47 ------------------- 3 files changed, 3 insertions(+), 55 deletions(-) delete mode 100644 cmds/locksettings/src/com/android/commands/locksettings/LockSettingsCmd.java diff --git a/cmds/locksettings/Android.bp b/cmds/locksettings/Android.bp index 5ee582450361e..ee31aed14385b 100644 --- a/cmds/locksettings/Android.bp +++ b/cmds/locksettings/Android.bp @@ -21,8 +21,7 @@ package { default_applicable_licenses: ["frameworks_base_license"], } -java_binary { +sh_binary { name: "locksettings", - wrapper: "locksettings.sh", - srcs: ["**/*.java"], + src: "locksettings.sh", } diff --git a/cmds/locksettings/locksettings.sh b/cmds/locksettings/locksettings.sh index 0ef4fa9f67711..2f8d86844eb1c 100755 --- a/cmds/locksettings/locksettings.sh +++ b/cmds/locksettings/locksettings.sh @@ -1,6 +1,2 @@ #!/system/bin/sh -# Script to start "locksettings" on the device -# -base=/system -export CLASSPATH=$base/framework/locksettings.jar -exec app_process $base/bin com.android.commands.locksettings.LockSettingsCmd "$@" +cmd lock_settings "$@" diff --git a/cmds/locksettings/src/com/android/commands/locksettings/LockSettingsCmd.java b/cmds/locksettings/src/com/android/commands/locksettings/LockSettingsCmd.java deleted file mode 100644 index 7d9260a771582..0000000000000 --- a/cmds/locksettings/src/com/android/commands/locksettings/LockSettingsCmd.java +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Copyright (C) 2016 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License - */ - -package com.android.commands.locksettings; - -import android.os.ResultReceiver; -import android.os.ServiceManager; -import android.os.ShellCallback; - -import com.android.internal.os.BaseCommand; -import com.android.internal.widget.ILockSettings; - -import java.io.FileDescriptor; -import java.io.PrintStream; - -public final class LockSettingsCmd extends BaseCommand { - - public static void main(String[] args) { - (new LockSettingsCmd()).run(args); - } - - @Override - public void onShowUsage(PrintStream out) { - main(new String[] { "help" }); - } - - @Override - public void onRun() throws Exception { - ILockSettings lockSettings = ILockSettings.Stub.asInterface( - ServiceManager.getService("lock_settings")); - lockSettings.asBinder().shellCommand(FileDescriptor.in, FileDescriptor.out, - FileDescriptor.err, getRawArgs(), new ShellCallback(), new ResultReceiver(null) {}); - } -} From 7a6cfcc3af84ec10766d764c853dba7a3daaf266 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Thu, 27 Apr 2023 18:46:20 +0000 Subject: [PATCH 3/5] Enable visual feedback when entering FRP pattern When the original lock pattern is verified for Factory Reset Protection (FRP), the original setting of LOCK_PATTERN_VISIBLE is unknown. However, it's likely to be true, since that is the value that gets set automatically when a pattern is first set. It would only be false if the user went into Settings and disabled "Make pattern visible". So, to be consistent with this, fix the low-level default to be true instead of false. This enables visual feedback when entering the FRP pattern. Bug: 270013005 Change-Id: If295999da34510c17ebfb323dd5215418eaa0852 Merged-In: If295999da34510c17ebfb323dd5215418eaa0852 (cherry picked from commit 5162566c0fae79d7e6afd7348100a39296d3ec37) --- core/java/com/android/internal/widget/LockPatternUtils.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index c8c3fada61c36..98652c2e1c449 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -986,7 +986,10 @@ public class LockPatternUtils { */ @UnsupportedAppUsage public boolean isVisiblePatternEnabled(int userId) { - return getBoolean(Settings.Secure.LOCK_PATTERN_VISIBLE, false, userId); + // Default to true, since this gets explicitly set to true when a pattern is first set + // anyway, which makes true the user-visible default. The low-level default should be the + // same, in order for FRP credential verification to get the same default. + return getBoolean(Settings.Secure.LOCK_PATTERN_VISIBLE, true, userId); } /** From d3252e4e7669ae18970251378706a224b2fcbd3a Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 5 May 2023 18:37:05 +0000 Subject: [PATCH 4/5] Remove obsolete comment about isVisiblePatternEnabled() The comment in LockPatternUtils#isVisiblePatternEnabled() was only needed because there were two sources of truth for the default value. Now that there is only one source of truth, it is not needed. Bug: 270013005 Change-Id: Ia531f84bcedc957393f93222679efae848a82822 Merged-In: Ia531f84bcedc957393f93222679efae848a82822 (cherry picked from commit f62c4d38b3a1446368fbda3d253b3e41cc8b500f) --- core/java/com/android/internal/widget/LockPatternUtils.java | 3 --- 1 file changed, 3 deletions(-) diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index 98652c2e1c449..30a3e118c528f 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -986,9 +986,6 @@ public class LockPatternUtils { */ @UnsupportedAppUsage public boolean isVisiblePatternEnabled(int userId) { - // Default to true, since this gets explicitly set to true when a pattern is first set - // anyway, which makes true the user-visible default. The low-level default should be the - // same, in order for FRP credential verification to get the same default. return getBoolean(Settings.Secure.LOCK_PATTERN_VISIBLE, true, userId); } From aa19b22208e11335fda6efea13402b55bec1921f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Mon, 22 May 2023 17:41:04 +0000 Subject: [PATCH 5/5] Log errors in verifyChallengeInternal() It is unexpected for verifyChallengeInternal() to fail, since the Gatekeeper enrollment of the synthetic password (more specifically, the Gatekeeper password derived from the synthetic password) should always be valid. Therefore, ensure that an error message is logged in all failure cases. Bug: 282947979 Change-Id: Ic8d0134bc4f3e0979bf500ffb5a99f2522251d39 Merged-In: Ic8d0134bc4f3e0979bf500ffb5a99f2522251d39 (cherry picked from commit b60583c3b12864e69f10dc01046d898d85b2083a) --- .../android/server/locksettings/SyntheticPasswordManager.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java b/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java index 3f66fee2f86b8..f27b913585fd6 100644 --- a/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java +++ b/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java @@ -1327,8 +1327,10 @@ public class SyntheticPasswordManager { } return result; } else if (responseCode == GateKeeperResponse.RESPONSE_RETRY) { + Slog.e(TAG, "Gatekeeper verification of synthetic password failed with RESPONSE_RETRY"); return VerifyCredentialResponse.fromTimeout(response.getTimeout()); } else { + Slog.e(TAG, "Gatekeeper verification of synthetic password failed with RESPONSE_ERROR"); return VerifyCredentialResponse.ERROR; } }