Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Keystore: Attestation fix in AOSP builds" am: ecb4b6d158

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2237500

Change-Id: I1317f2c69bfa97e189d522548596a57a6b2f2586
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Eran Messeri
2023-01-31 16:59:07 +00:00
committed by Automerger Merge Worker
parent 9e0210622d ecb4b6d158
commit c17512848d
3 changed files with 46 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/api/test-current.txt
View File

@@ -1697,7 +1697,10 @@ package android.os {
public class Build {
method public static boolean is64BitAbi(String);
method public static boolean isDebuggable();
field @Nullable public static final String BRAND_FOR_ATTESTATION;
field public static final boolean IS_EMULATOR;
field @Nullable public static final String MODEL_FOR_ATTESTATION;
field @Nullable public static final String PRODUCT_FOR_ATTESTATION;
}
public static class Build.VERSION {

33
core/java/android/os/Build.java
View File

@@ -61,6 +61,17 @@ public class Build {
/** The name of the overall product. */
public static final String PRODUCT = getString("ro.product.name");
/**
* The product name for attestation. In non-default builds (like the AOSP build) the value of
* the 'PRODUCT' system property may be different to the one provisioned to KeyMint,
* and Keymint attestation would still attest to the product name, it's running on.
* @hide
*/
@Nullable
@TestApi
public static final String PRODUCT_FOR_ATTESTATION =
getString("ro.product.name_for_attestation");
/** The name of the industrial design. */
public static final String DEVICE = getString("ro.product.device");
@@ -89,9 +100,31 @@ public class Build {
/** The consumer-visible brand with which the product/hardware will be associated, if any. */
public static final String BRAND = getString("ro.product.brand");
/**
* The product brand for attestation. In non-default builds (like the AOSP build) the value of
* the 'BRAND' system property may be different to the one provisioned to KeyMint,
* and Keymint attestation would still attest to the product brand, it's running on.
* @hide
*/
@Nullable
@TestApi
public static final String BRAND_FOR_ATTESTATION =
getString("ro.product.brand_for_attestation");
/** The end-user-visible name for the end product. */
public static final String MODEL = getString("ro.product.model");
/**
* The product model for attestation. In non-default builds (like the AOSP build) the value of
* the 'MODEL' system property may be different to the one provisioned to KeyMint,
* and Keymint attestation would still attest to the product model, it's running on.
* @hide
*/
@Nullable
@TestApi
public static final String MODEL_FOR_ATTESTATION =
getString("ro.product.model_for_attestation");
/** The manufacturer of the device's primary system-on-chip. */
@NonNull
public static final String SOC_MANUFACTURER = SocProperties.soc_manufacturer().orElse(UNKNOWN);

13
keystore/java/android/security/keystore2/AndroidKeyStoreKeyPairGeneratorSpi.java
View File

@@ -801,25 +801,32 @@ public abstract class AndroidKeyStoreKeyPairGeneratorSpi extends KeyPairGenerato
));
if (mSpec.isDevicePropertiesAttestationIncluded()) {
final String platformReportedBrand = TextUtils.isEmpty(Build.BRAND_FOR_ATTESTATION)
? Build.BRAND : Build.BRAND_FOR_ATTESTATION;
params.add(KeyStore2ParameterUtils.makeBytes(
KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND,
Build.BRAND.getBytes(StandardCharsets.UTF_8)
platformReportedBrand.getBytes(StandardCharsets.UTF_8)
));
params.add(KeyStore2ParameterUtils.makeBytes(
KeymasterDefs.KM_TAG_ATTESTATION_ID_DEVICE,
Build.DEVICE.getBytes(StandardCharsets.UTF_8)
));
final String platformReportedProduct =
TextUtils.isEmpty(Build.PRODUCT_FOR_ATTESTATION) ? Build.PRODUCT :
Build.PRODUCT_FOR_ATTESTATION;
params.add(KeyStore2ParameterUtils.makeBytes(
KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT,
Build.PRODUCT.getBytes(StandardCharsets.UTF_8)
platformReportedProduct.getBytes(StandardCharsets.UTF_8)
));
params.add(KeyStore2ParameterUtils.makeBytes(
KeymasterDefs.KM_TAG_ATTESTATION_ID_MANUFACTURER,
Build.MANUFACTURER.getBytes(StandardCharsets.UTF_8)
));
final String platformReportedModel = TextUtils.isEmpty(Build.MODEL_FOR_ATTESTATION)
? Build.MODEL : Build.MODEL_FOR_ATTESTATION;
params.add(KeyStore2ParameterUtils.makeBytes(
KeymasterDefs.KM_TAG_ATTESTATION_ID_MODEL,
Build.MODEL.getBytes(StandardCharsets.UTF_8)
platformReportedModel.getBytes(StandardCharsets.UTF_8)
));
}