Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stop loading fs-verity certificate from keystore

Browse Source 
We've decided to punt this feature to S.

Test: boot
Bug: 112038744
Bug: 150250739
Change-Id: I496ea9fc389de321cb7a687e086341545917efd9
This commit is contained in:
Victor Hsieh
2020-02-26 10:44:42 -08:00
parent fd2f367df6
commit bd3d30b26d
1 changed files with 0 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
services/core/java/com/android/server/security/FileIntegrityService.java
View File

@@ -22,11 +22,8 @@ import android.content.Context;
import android.content.pm.PackageManager;
import android.os.Build;
import android.os.IBinder;
import android.os.Process;
import android.os.SystemProperties;
import android.security.Credentials;
import android.security.IFileIntegrityService;
import android.security.KeyStore;
import android.util.Slog;
import com.android.server.SystemService;
@@ -114,9 +111,6 @@ public class FileIntegrityService extends SystemService {
// Load certificates trusted by the device manufacturer.
loadCertificatesFromDirectory("/product/etc/security/fsverity");
// Load certificates trusted by the device owner.
loadCertificatesFromKeystore(KeyStore.getInstance());
}
private void loadCertificatesFromDirectory(String path) {
@@ -139,19 +133,6 @@ public class FileIntegrityService extends SystemService {
}
}
private void loadCertificatesFromKeystore(KeyStore keystore) {
for (final String alias : keystore.list(Credentials.APP_SOURCE_CERTIFICATE,
Process.FSVERITY_CERT_UID)) {
byte[] certificateBytes = keystore.get(Credentials.APP_SOURCE_CERTIFICATE + alias,
Process.FSVERITY_CERT_UID, false /* suppressKeyNotFoundWarning */);
if (certificateBytes == null) {
Slog.w(TAG, "The retrieved fs-verity certificate is null, ignored " + alias);
continue;
}
collectCertificate(certificateBytes);
}
}
/**
* Tries to convert {@code bytes} into an X.509 certificate and store in memory.
* Errors need to be surpressed in order fo the next certificates to still be collected.