From 1d524e6672b556d3cc9213bbeac2fec6e49835b9 Mon Sep 17 00:00:00 2001 From: Alex Johnston Date: Thu, 4 Mar 2021 10:05:11 +0000 Subject: [PATCH] Unregister cred mng app KeyChain API Bug: 177979648 Test: CTSVerifier CredentialManagementAppActivity Change-Id: I8c9e22b2334e8e060bc00701f1d2bec76950faf3 --- core/api/current.txt | 5 +++-- core/api/test-current.txt | 3 +-- keystore/java/android/security/KeyChain.java | 21 +++++++++++++++----- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/core/api/current.txt b/core/api/current.txt index 57e256142eb09..2ef648ab9726c 100644 --- a/core/api/current.txt +++ b/core/api/current.txt @@ -36838,11 +36838,12 @@ package android.security { method @NonNull public static android.content.Intent createInstallIntent(); method @NonNull public static android.content.Intent createManageCredentialsIntent(@NonNull android.security.AppUriAuthenticationPolicy); method @Nullable @WorkerThread public static java.security.cert.X509Certificate[] getCertificateChain(@NonNull android.content.Context, @NonNull String) throws java.lang.InterruptedException, android.security.KeyChainException; - method @NonNull public static android.security.AppUriAuthenticationPolicy getCredentialManagementAppPolicy(@NonNull android.content.Context) throws java.lang.SecurityException; + method @NonNull @WorkerThread public static android.security.AppUriAuthenticationPolicy getCredentialManagementAppPolicy(@NonNull android.content.Context) throws java.lang.SecurityException; method @Nullable @WorkerThread public static java.security.PrivateKey getPrivateKey(@NonNull android.content.Context, @NonNull String) throws java.lang.InterruptedException, android.security.KeyChainException; method @Deprecated public static boolean isBoundKeyAlgorithm(@NonNull String); - method public static boolean isCredentialManagementApp(@NonNull android.content.Context); + method @WorkerThread public static boolean isCredentialManagementApp(@NonNull android.content.Context); method public static boolean isKeyAlgorithmSupported(@NonNull String); + method @RequiresPermission(value="android.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP", conditional=true) @WorkerThread public static boolean removeCredentialManagementApp(@NonNull android.content.Context); field public static final String ACTION_KEYCHAIN_CHANGED = "android.security.action.KEYCHAIN_CHANGED"; field public static final String ACTION_KEY_ACCESS_CHANGED = "android.security.action.KEY_ACCESS_CHANGED"; field @Deprecated public static final String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED"; diff --git a/core/api/test-current.txt b/core/api/test-current.txt index 75b9525b110c1..a855c83db9f02 100644 --- a/core/api/test-current.txt +++ b/core/api/test-current.txt @@ -1927,8 +1927,7 @@ package android.provider { package android.security { public final class KeyChain { - method @RequiresPermission("android.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP") public static boolean removeCredentialManagementApp(@NonNull android.content.Context); - method @RequiresPermission("android.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP") public static boolean setCredentialManagementApp(@NonNull android.content.Context, @NonNull String, @NonNull android.security.AppUriAuthenticationPolicy); + method @RequiresPermission("android.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP") @WorkerThread public static boolean setCredentialManagementApp(@NonNull android.content.Context, @NonNull String, @NonNull android.security.AppUriAuthenticationPolicy); } public class KeyStoreException extends java.lang.Exception { diff --git a/keystore/java/android/security/KeyChain.java b/keystore/java/android/security/KeyChain.java index 11cb2b7c724b6..7c80f70593df5 100644 --- a/keystore/java/android/security/KeyChain.java +++ b/keystore/java/android/security/KeyChain.java @@ -601,7 +601,7 @@ public final class KeyChain { } /** - * Check whether the caller is the credential management app {@link CredentialManagementApp}. + * Check whether the caller is the credential management app {@code CredentialManagementApp}. * The credential management app has the ability to manage the user's KeyChain credentials * on unmanaged devices. * @@ -611,6 +611,7 @@ public final class KeyChain { * * @return {@code true} if the caller is the credential management app. */ + @WorkerThread public static boolean isCredentialManagementApp(@NonNull Context context) { boolean isCredentialManagementApp = false; try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) { @@ -634,6 +635,7 @@ public final class KeyChain { * @return the credential management app's authentication policy. * @throws SecurityException if the caller is not the credential management app. */ + @WorkerThread @NonNull public static AppUriAuthenticationPolicy getCredentialManagementAppPolicy( @NonNull Context context) throws SecurityException { @@ -665,6 +667,7 @@ public final class KeyChain { * @hide */ @TestApi + @WorkerThread @RequiresPermission(Manifest.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP) public static boolean setCredentialManagementApp(@NonNull Context context, @NonNull String packageName, @NonNull AppUriAuthenticationPolicy authenticationPolicy) { @@ -680,13 +683,21 @@ public final class KeyChain { } /** - * Remove the user's KeyChain credentials on unmanaged devices. + * Called by the credential management app {@code CredentialManagementApp} to unregister as + * the credential management app and stop managing the user's credentials. + * + *

All credentials previously installed by the credential management app will be removed + * from the user's device. + * + *

An app holding {@code MANAGE_CREDENTIAL_MANAGEMENT_APP} permission can also call this + * method to remove the current credential management app, even if it's not the current + * credential management app itself. * * @return {@code true} if the credential management app was successfully removed. - * @hide */ - @TestApi - @RequiresPermission(Manifest.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP) + @WorkerThread + @RequiresPermission(value = Manifest.permission.MANAGE_CREDENTIAL_MANAGEMENT_APP, + conditional = true) public static boolean removeCredentialManagementApp(@NonNull Context context) { try (KeyChainConnection keyChainConnection = KeyChain.bind(context)) { keyChainConnection.getService().removeCredentialManagementApp();