Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Tell KeyStore to ignore caller uid for PlatformKeyManager's keys." into qt-r1-dev

Browse Source
This commit is contained in:
Dmitry Dementyev
2019-07-23 23:24:28 +00:00
committed by Android (Google) Code Review
parent 21de89ccc6 80f5f1bfc3
commit f7ed4da59c
1 changed files with 20 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
services/core/java/com/android/server/locksettings/recoverablekeystore/PlatformKeyManager.java
View File

@@ -19,6 +19,7 @@ package com.android.server.locksettings.recoverablekeystore;
import android.app.KeyguardManager; import android.app.KeyguardManager;
import android.content.Context; import android.content.Context;
import android.os.RemoteException; import android.os.RemoteException;
import android.os.UserHandle;
import android.security.GateKeeper; import android.security.GateKeeper;
import android.security.keystore.AndroidKeyStoreSecretKey; import android.security.keystore.AndroidKeyStoreSecretKey;
import android.security.keystore.KeyPermanentlyInvalidatedException; import android.security.keystore.KeyPermanentlyInvalidatedException;
@@ -437,25 +438,31 @@ public class PlatformKeyManager {
// so it may live in memory for some time. // so it may live in memory for some time.
SecretKey secretKey = generateAesKey(); SecretKey secretKey = generateAesKey();
long secureUserId = getGateKeeperService().getSecureUserId(userId); KeyProtection.Builder decryptionKeyProtection =
// TODO(b/124095438): Propagate this failure instead of silently failing.
if (secureUserId == GateKeeper.INVALID_SECURE_USER_ID) {
Log.e(TAG, "No SID available for user " + userId);
return;
}
// Store decryption key first since it is more likely to fail.
mKeyStore.setEntry(
decryptAlias,
new KeyStore.SecretKeyEntry(secretKey),
new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT) new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT)
.setUserAuthenticationRequired(true) .setUserAuthenticationRequired(true)
.setUserAuthenticationValidityDurationSeconds( .setUserAuthenticationValidityDurationSeconds(
USER_AUTHENTICATION_VALIDITY_DURATION_SECONDS) USER_AUTHENTICATION_VALIDITY_DURATION_SECONDS)
.setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE);
if (userId != UserHandle.USER_SYSTEM) {
// Bind decryption key to secondary profile lock screen secret.
long secureUserId = getGateKeeperService().getSecureUserId(userId);
// TODO(b/124095438): Propagate this failure instead of silently failing.
if (secureUserId == GateKeeper.INVALID_SECURE_USER_ID) {
Log.e(TAG, "No SID available for user " + userId);
return;
}
decryptionKeyProtection
.setBoundToSpecificSecureUserId(secureUserId) .setBoundToSpecificSecureUserId(secureUserId)
.build()); // Ignore caller uid which always belongs to the primary profile.
.setCriticalToDeviceEncryption(true);
}
// Store decryption key first since it is more likely to fail.
mKeyStore.setEntry(
decryptAlias,
new KeyStore.SecretKeyEntry(secretKey),
decryptionKeyProtection.build());
mKeyStore.setEntry( mKeyStore.setEntry(
encryptAlias, encryptAlias,
new KeyStore.SecretKeyEntry(secretKey), new KeyStore.SecretKeyEntry(secretKey),