From e9b69111b203bec8266f096a0fec942b570da97a Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Wed, 26 Jan 2022 05:13:46 +0000 Subject: [PATCH] Stop checking FDE password cache Now that FDE is no longer supported, checking the FDE password cache will never accomplish anything. Remove this check from Keyguard, and remove the supporting code from LockSettingsService. Bug: 208476087 Change-Id: If1bb80dfcc015aeea19916a88c89a4067e6ada32 --- .../internal/widget/ILockSettings.aidl | 1 - .../internal/widget/LockPatternUtils.java | 14 ---- .../keyguard/KeyguardViewMediator.java | 8 -- .../locksettings/LockSettingsService.java | 75 ------------------- 4 files changed, 98 deletions(-) diff --git a/core/java/com/android/internal/widget/ILockSettings.aidl b/core/java/com/android/internal/widget/ILockSettings.aidl index db4bc2c7e24a8..e64d2783f88ac 100644 --- a/core/java/com/android/internal/widget/ILockSettings.aidl +++ b/core/java/com/android/internal/widget/ILockSettings.aidl @@ -53,7 +53,6 @@ interface ILockSettings { VerifyCredentialResponse verifyTiedProfileChallenge(in LockscreenCredential credential, int userId, int flags); VerifyCredentialResponse verifyGatekeeperPasswordHandle(long gatekeeperPasswordHandle, long challenge, int userId); void removeGatekeeperPasswordHandle(long gatekeeperPasswordHandle); - boolean checkVoldPassword(int userId); int getCredentialType(int userId); byte[] getHashFactor(in LockscreenCredential currentCredential, int userId); void setSeparateProfileChallengeEnabled(int userId, boolean enabled, in LockscreenCredential managedUserPassword); diff --git a/core/java/com/android/internal/widget/LockPatternUtils.java b/core/java/com/android/internal/widget/LockPatternUtils.java index 1e11c6d1fddb9..5019c81aa8434 100644 --- a/core/java/com/android/internal/widget/LockPatternUtils.java +++ b/core/java/com/android/internal/widget/LockPatternUtils.java @@ -525,20 +525,6 @@ public class LockPatternUtils { } } - /** - * Check to see if vold already has the password. - * Note that this also clears vold's copy of the password. - * @return Whether the vold password matches or not. - */ - public boolean checkVoldPassword(int userId) { - try { - return getLockSettings().checkVoldPassword(userId); - } catch (RemoteException re) { - Log.e(TAG, "failed to check vold password", re); - return false; - } - } - /** * Returns the password history hash factor, needed to check new password against password * history with {@link #checkPasswordHistory(byte[], byte[], int)} diff --git a/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java b/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java index ae7147ecae039..9fb1fe400225f 100644 --- a/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java +++ b/packages/SystemUI/src/com/android/systemui/keyguard/KeyguardViewMediator.java @@ -1701,14 +1701,6 @@ public class KeyguardViewMediator extends CoreStartable implements Dumpable, if (DEBUG) Log.d(TAG, "doKeyguard: not showing because lockscreen is off"); return; } - - if (mLockPatternUtils.checkVoldPassword(KeyguardUpdateMonitor.getCurrentUser())) { - if (DEBUG) Log.d(TAG, "Not showing lock screen since just decrypted"); - // Without this, settings is not enabled until the lock screen first appears - setShowingLocked(false); - hideLocked(); - return; - } } if (DEBUG) Log.d(TAG, "doKeyguard: showing the lock screen"); diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 0f4648a3f0f80..906910a8fb9b7 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -252,8 +252,6 @@ public class LockSettingsService extends ILockSettings.Stub { private final RebootEscrowManager mRebootEscrowManager; - private boolean mFirstCallToVold; - // Current password metric for all users on the device. Updated when user unlocks // the device or changes password. Removed when user is stopped. @GuardedBy("this") @@ -597,8 +595,6 @@ public class LockSettingsService extends ILockSettings.Stub { mStrongAuth = injector.getStrongAuth(); mActivityManager = injector.getActivityManager(); - mFirstCallToVold = true; - IntentFilter filter = new IntentFilter(); filter.addAction(Intent.ACTION_USER_ADDED); filter.addAction(Intent.ACTION_USER_STARTING); @@ -2519,77 +2515,6 @@ public class LockSettingsService extends ILockSettings.Stub { }); } - private LockscreenCredential createPattern(String patternString) { - final byte[] patternBytes = patternString.getBytes(); - LockscreenCredential pattern = LockscreenCredential.createPattern( - LockPatternUtils.byteArrayToPattern(patternBytes)); - Arrays.fill(patternBytes, (byte) 0); - return pattern; - } - - @Override - public boolean checkVoldPassword(int userId) { - if (!mFirstCallToVold) { - return false; - } - mFirstCallToVold = false; - - checkPasswordReadPermission(); - - // There's no guarantee that this will safely connect, but if it fails - // we will simply show the lock screen when we shouldn't, so relatively - // benign. There is an outside chance something nasty would happen if - // this service restarted before vold stales out the password in this - // case. The nastiness is limited to not showing the lock screen when - // we should, within the first minute of decrypting the phone if this - // service can't connect to vold, it restarts, and then the new instance - // does successfully connect. - final IStorageManager service = mInjector.getStorageManager(); - // TODO(b/120484642): Update vold to return a password as a byte array - String password; - final long identity = Binder.clearCallingIdentity(); - try { - password = service.getPassword(); - service.clearPassword(); - } catch (RemoteException e) { - Slog.w(TAG, "vold getPassword() failed", e); - return false; - } finally { - Binder.restoreCallingIdentity(identity); - } - if (TextUtils.isEmpty(password)) { - return false; - } - - try { - final LockscreenCredential credential; - switch (getCredentialTypeInternal(userId)) { - case CREDENTIAL_TYPE_PATTERN: - credential = createPattern(password); - break; - case CREDENTIAL_TYPE_PIN: - credential = LockscreenCredential.createPin(password); - break; - case CREDENTIAL_TYPE_PASSWORD: - credential = LockscreenCredential.createPassword(password); - break; - default: - credential = null; - Slog.e(TAG, "Unknown credential type"); - } - - if (credential != null - && checkCredential(credential, userId, null /* progressCallback */) - .getResponseCode() == GateKeeperResponse.RESPONSE_OK) { - return true; - } - } catch (Exception e) { - Slog.e(TAG, "checkVoldPassword failed: ", e); - } - - return false; - } - private void removeUser(int userId, boolean unknownUser) { Slog.i(TAG, "RemoveUser: " + userId); removeBiometricsForUser(userId);