Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

locksettings: allow {get,set}-disabled without providing current LSKF

Browse Source 
There is no reason for the get-disabled and set-disabled commands to
require the current LSKF, so remove the requirement that it be provided.
This is safe for set-disabled because the lockscreen isn't actually
disabled until the LSKF is cleared, which must be done separately.

This avoids unlocking screen-lock-bound Keystore keys when not intended.

Bug: 273304787
Change-Id: I6472905c759a0e08e6bb59a59b51c5b40fe830ab
This commit is contained in:
Eric Biggers
2023-03-20 18:32:52 +00:00
parent 2b03be6c6d
commit cb94dbee93
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java
View File

@@ -106,6 +106,14 @@ class LockSettingsShellCommand extends ShellCommand {
case COMMAND_HELP:
onHelp();
return 0;
case COMMAND_GET_DISABLED:
runGetDisabled();
return 0;
case COMMAND_SET_DISABLED:
// Note: if the user has an LSKF, then this has no immediate effect but instead
// just ensures the lockscreen will be disabled later when the LSKF is cleared.
runSetDisabled();
return 0;
}
if (!checkCredential()) {
return -1;
@@ -124,15 +132,9 @@ class LockSettingsShellCommand extends ShellCommand {
case COMMAND_CLEAR:
success = runClear();
break;
case COMMAND_SET_DISABLED:
runSetDisabled();
break;
case COMMAND_VERIFY:
runVerify();
break;
case COMMAND_GET_DISABLED:
runGetDisabled();
break;
default:
getErrPrintWriter().println("Unknown command: " + cmd);
break;