From d0d0a1c62e1b6d3d0d022bee9d760009d06d3ca4 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 26 Sep 2022 21:59:19 +0000
Subject: [PATCH] Add permission checks to unified challenge cache APIs

While it shouldn't be possible to do anything "bad" with these APIs,
they should require the ACCESS_KEYGUARD_SECURE_STORAGE permission just
like most other APIs in LockSettingsService.  This doesn't break the
legitimate users, both of which use Binder.clearCallingIdentity():

- tryUnlockWithCachedUnifiedChallenge() is only called by
  UserManagerService.requestQuietModeEnabled().

- removeCachedUnifiedChallenge() is only called by
  LockSettingsShellCommand ('locksettings remove-cache').

Bug: 239050838
Change-Id: Ib7224729c3e110aa44f0416f72063b38517ed089
---
 .../com/android/server/locksettings/LockSettingsService.java    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java
index 8ab3a949dda7b..533d1b0c70349 100644
--- a/services/core/java/com/android/server/locksettings/LockSettingsService.java
+++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java
@@ -2940,6 +2940,7 @@ public class LockSettingsService extends ILockSettings.Stub {
 
     @Override
     public boolean tryUnlockWithCachedUnifiedChallenge(int userId) {
+        checkPasswordReadPermission();
         try (LockscreenCredential cred = mManagedProfilePasswordCache.retrievePassword(userId)) {
             if (cred == null) {
                 return false;
@@ -2951,6 +2952,7 @@ public class LockSettingsService extends ILockSettings.Stub {
 
     @Override
     public void removeCachedUnifiedChallenge(int userId) {
+        checkWritePermission();
         mManagedProfilePasswordCache.removePassword(userId);
     }