Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b4b9da4 authored by Diya Bera's avatar Diya Bera
Browse files

[1/N] Skeleton for watch ranging for Identity Check 

Bug: 397954948
Test: N/A
Flag: android.hardware.biometrics.identity_check_watch
Change-Id: Icab7894c1af37e4b0261c762017ed2b7d13bfb52
parent 951c20e0

core/java/android/hardware/biometrics/flags.aconfig

+7 −0
Original line number Diff line number Diff line
@@ -93,3 +93,10 @@ flag { 
  description: "This flag applies Identity Check to all biometric prompt requests"

  bug: "402534668"

}



flag {

  name: "identity_check_watch"

  namespace: "biometrics_framework"

  description: "This flag is for the integration of Identity Check with Watch"

  bug: "397954948"

}

core/java/android/security/authenticationpolicy/AuthenticationPolicyManager.java

+27 −0
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 
package android.security.authenticationpolicy;



import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;

import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;

import static android.hardware.biometrics.Flags.FLAG_IDENTITY_CHECK_WATCH;

import static android.security.Flags.FLAG_SECURE_LOCKDOWN;

import static android.security.Flags.FLAG_SECURE_LOCK_DEVICE;
@@ -29,7 +31,9 @@ import android.annotation.SystemService; 
import android.content.Context;

import android.os.Binder;

import android.os.Build;

import android.os.Handler;

import android.os.RemoteException;

import android.proximity.IProximityResultCallback;

import android.util.Log;



import java.lang.annotation.Retention;
@@ -495,4 +499,27 @@ public final class AuthenticationPolicyManager { 
            throw e.rethrowFromSystemServer();

        }

    }



    /**

     * This function will start watch ranging for Identity Check. We will remove specific

     * Identity Check implementation when this is generalized.

     *

     * @param resultCallback callback used to return the ranging result

     * @param handler handler to start the ranging request

     *

     * @hide

     */

    @RequiresPermission(USE_BIOMETRIC_INTERNAL)

    @FlaggedApi(FLAG_IDENTITY_CHECK_WATCH)

    public void startWatchRangingForIdentityCheck(

            @NonNull IProximityResultCallback resultCallback, Handler handler) {

        //TODO (b/397954948) : Update callback results to trigger in the handler

        handler.post(() -> {

            try {

                mAuthenticationPolicyService.startWatchRangingForIdentityCheck(resultCallback);

            } catch (RemoteException e) {

                throw e.rethrowFromSystemServer();

            }

        });

    }

}

core/java/android/security/authenticationpolicy/IAuthenticationPolicyService.aidl

+4 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
package android.security.authenticationpolicy;



import android.os.UserHandle;

import android.proximity.IProximityResultCallback;

import android.security.authenticationpolicy.EnableSecureLockDeviceParams;

import android.security.authenticationpolicy.DisableSecureLockDeviceParams;

import android.security.authenticationpolicy.ISecureLockDeviceStatusListener;
@@ -44,4 +45,7 @@ interface IAuthenticationPolicyService { 


    @EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")

    void unregisterSecureLockDeviceStatusListener(in ISecureLockDeviceStatusListener listener);



    @EnforcePermission("USE_BIOMETRIC_INTERNAL")

    void startWatchRangingForIdentityCheck(in IProximityResultCallback resultCallback);

}
 
 No newline at end of file

services/core/java/com/android/server/biometrics/BiometricService.java

+48 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ import static com.android.server.biometrics.BiometricServiceStateProto.STATE_AUT 


import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.SuppressLint;

import android.app.ActivityManager;

import android.app.IActivityManager;

import android.app.UserSwitchObserver;
@@ -75,8 +76,10 @@ import android.os.ServiceManager; 
import android.os.UserHandle;

import android.os.UserManager;

import android.provider.Settings;

import android.proximity.IProximityResultCallback;

import android.security.GateKeeper;

import android.security.KeyStoreAuthorization;

import android.security.authenticationpolicy.AuthenticationPolicyManager;

import android.service.gatekeeper.IGateKeeperService;

import android.text.TextUtils;

import android.util.ArraySet;
@@ -124,6 +127,7 @@ public class BiometricService extends SystemService { 
    @NonNull private final Supplier<Long> mRequestCounter;

    @NonNull private final BiometricContext mBiometricContext;

    private final UserManager mUserManager;

    private final AuthenticationPolicyManager mAuthenticationPolicyManager;



    @VisibleForTesting

    IStatusBarService mStatusBarService;
@@ -1434,6 +1438,11 @@ public class BiometricService extends SystemService { 
        public BiometricNotificationLogger getNotificationLogger() {

            return new BiometricNotificationLogger();

        }



        public AuthenticationPolicyManager getAuthenticationPolicyManager(Context context) {

            return (AuthenticationPolicyManager)

                    context.getSystemService(Context.AUTHENTICATION_POLICY_SERVICE);

        }

    }



    /**
@@ -1468,6 +1477,7 @@ public class BiometricService extends SystemService { 
        mKeyStoreAuthorization = injector.getKeyStoreAuthorization();

        mGateKeeper = injector.getGateKeeperService();

        mBiometricNotificationLogger = injector.getNotificationLogger();

        mAuthenticationPolicyManager = mInjector.getAuthenticationPolicyManager(context);



        try {

            injector.getActivityManagerService().registerUserSwitchObserver(
@@ -1820,6 +1830,8 @@ public class BiometricService extends SystemService { 
                operationId, userId, createBiometricSensorReceiver(requestId), receiver,

                opPackageName, promptInfo, debugEnabled,

                mInjector.getFingerprintSensorProperties(getContext()));

        startWatchRangingIfIdentityCheckActive(promptInfo);



        try {

            mAuthSession.goToInitialState();

        } catch (RemoteException e) {
@@ -1827,6 +1839,42 @@ public class BiometricService extends SystemService { 
        }

    }



    /**

     * This is invoked only if Identity Check is active and the device is considered at risk. If the

     * watch is in range, it will re-enable device credential if it was originally requested.

     *

     * @param promptInfo biometric prompt info

     */

    @SuppressLint("MissingPermission")

    private void startWatchRangingIfIdentityCheckActive(PromptInfo promptInfo) {

        if (android.hardware.biometrics.Flags.identityCheckWatch()

                && promptInfo.isIdentityCheckActive() && promptInfo.isDeviceCredentialAllowed()) {

            if (mAuthenticationPolicyManager == null) {

                Slog.e(TAG, "Authentication policy manager is null. Skipping watch ranging");

                return;

            }



            //TODO (b/397954948) : Update callback results to handle System UI changes

            mAuthenticationPolicyManager.startWatchRangingForIdentityCheck(

                    new IProximityResultCallback() {

                        @Override

                        public void onError(int error) throws RemoteException {



                        }



                        @Override

                        public void onSuccess(int result) throws RemoteException {



                        }



                        @Override

                        public IBinder asBinder() {

                            return null;

                        }

                    }, mHandler);

        }

    }



    private void handleCancelAuthentication(long requestId) {

        final AuthSession session = getAuthSessionIfCurrent(requestId);

        if (session == null) {

services/core/java/com/android/server/security/authenticationpolicy/AuthenticationPolicyService.java

+11 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package com.android.server.security.authenticationpolicy; 


import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;

import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;

import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;

import static android.security.Flags.disableAdaptiveAuthCounterLock;



import static com.android.internal.widget.LockPatternUtils.StrongAuthTracker.SOME_AUTH_REQUIRED_AFTER_ADAPTIVE_AUTH_REQUEST;
@@ -44,6 +45,7 @@ import android.os.Message; 
import android.os.SystemClock;

import android.os.UserHandle;

import android.provider.Settings;

import android.proximity.IProximityResultCallback;

import android.security.authenticationpolicy.AuthenticationPolicyManager;

import android.security.authenticationpolicy.AuthenticationPolicyManager.DisableSecureLockDeviceRequestStatus;

import android.security.authenticationpolicy.AuthenticationPolicyManager.EnableSecureLockDeviceRequestStatus;
@@ -482,5 +484,14 @@ public class AuthenticationPolicyService extends SystemService { 
                Binder.restoreCallingIdentity(identity);

            }

        }



        @Override

        @EnforcePermission(USE_BIOMETRIC_INTERNAL)

        public void startWatchRangingForIdentityCheck(

                IProximityResultCallback resultCallback) {

            startWatchRangingForIdentityCheck_enforcePermission();

            Slog.d(TAG, "startWatchRangingForIdentityCheck");

            //TODO (b/397954948) : Bind to IProximityProviderService and start ranging

        }

    };

}
 
 No newline at end of file