Move lockscreen settings to secure table to prevent tampering. b/2343673 (156c4354) · Commits · e / os / android_frameworks_base

api/current.xml

+36 −3

Original line number	Diff line number	Diff line
		@@ -135548,6 +135548,39 @@
		visibility="public"
		>
		</field>
		<field name="LOCK_PATTERN_ENABLED"
		type="java.lang.String"
		transient="false"
		volatile="false"
		value=""lock_pattern_autolock""
		static="true"
		final="true"
		deprecated="not deprecated"
		visibility="public"
		>
		</field>
		<field name="LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED"
		type="java.lang.String"
		transient="false"
		volatile="false"
		value=""lock_pattern_tactile_feedback_enabled""
		static="true"
		final="true"
		deprecated="not deprecated"
		visibility="public"
		>
		</field>
		<field name="LOCK_PATTERN_VISIBLE"
		type="java.lang.String"
		transient="false"
		volatile="false"
		value=""lock_pattern_visible_pattern""
		static="true"
		final="true"
		deprecated="not deprecated"
		visibility="public"
		>
		</field>
		<field name="LOGGING_ID"
		type="java.lang.String"
		transient="false"
		@@ -136525,7 +136558,7 @@
		value=""lock_pattern_autolock""
		static="true"
		final="true"
		deprecated="not deprecated"
		deprecated="deprecated"
		visibility="public"
		>
		</field>
		@@ -136536,7 +136569,7 @@
		value=""lock_pattern_tactile_feedback_enabled""
		static="true"
		final="true"
		deprecated="not deprecated"
		deprecated="deprecated"
		visibility="public"
		>
		</field>
		@@ -136547,7 +136580,7 @@
		value=""lock_pattern_visible_pattern""
		static="true"
		final="true"
		deprecated="not deprecated"
		deprecated="deprecated"
		visibility="public"
		>
		</field>

core/java/android/provider/Settings.java

+30 −4

Original line number	Diff line number	Diff line
		@@ -679,6 +679,9 @@ public final class Settings {
		MOVED_TO_SECURE.add(Secure.HTTP_PROXY);
		MOVED_TO_SECURE.add(Secure.INSTALL_NON_MARKET_APPS);
		MOVED_TO_SECURE.add(Secure.LOCATION_PROVIDERS_ALLOWED);
		MOVED_TO_SECURE.add(Secure.LOCK_PATTERN_ENABLED);
		MOVED_TO_SECURE.add(Secure.LOCK_PATTERN_VISIBLE);
		MOVED_TO_SECURE.add(Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED);
		MOVED_TO_SECURE.add(Secure.LOGGING_ID);
		MOVED_TO_SECURE.add(Secure.PARENTAL_CONTROL_ENABLED);
		MOVED_TO_SECURE.add(Secure.PARENTAL_CONTROL_LAST_UPDATE);
		@@ -1160,18 +1163,25 @@ public final class Settings {
		"bluetooth_discoverability_timeout";

		/**
		* Whether autolock is enabled (0 = false, 1 = true)
		* @deprecated Use {@link android.provider.Settings.Secure#LOCK_PATTERN_ENABLED}
		* instead
		*/
		public static final String LOCK_PATTERN_ENABLED = "lock_pattern_autolock";
		@Deprecated
		public static final String LOCK_PATTERN_ENABLED = Secure.LOCK_PATTERN_ENABLED;

		/**
		* Whether lock pattern is visible as user enters (0 = false, 1 = true)
		* @deprecated Use {@link android.provider.Settings.Secure#LOCK_PATTERN_VISIBLE}
		* instead
		*/
		@Deprecated
		public static final String LOCK_PATTERN_VISIBLE = "lock_pattern_visible_pattern";

		/**
		* Whether lock pattern will vibrate as user enters (0 = false, 1 = true)
		* @deprecated Use
		* {@link android.provider.Settings.Secure#LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED}
		* instead
		*/
		@Deprecated
		public static final String LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED =
		"lock_pattern_tactile_feedback_enabled";

		@@ -2296,6 +2306,22 @@ public final class Settings {
		*/
		public static final String LOCATION_PROVIDERS_ALLOWED = "location_providers_allowed";

		/**
		* Whether autolock is enabled (0 = false, 1 = true)
		*/
		public static final String LOCK_PATTERN_ENABLED = "lock_pattern_autolock";

		/**
		* Whether lock pattern is visible as user enters (0 = false, 1 = true)
		*/
		public static final String LOCK_PATTERN_VISIBLE = "lock_pattern_visible_pattern";

		/**
		* Whether lock pattern will vibrate as user enters (0 = false, 1 = true)
		*/
		public static final String LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED =
		"lock_pattern_tactile_feedback_enabled";

		/**
		* Whether assisted GPS should be enabled or not.
		* @hide

core/java/com/android/internal/widget/LockPatternUtils.java

+15 −23

Original line number	Diff line number	Diff line
		@@ -550,7 +550,7 @@ public class LockPatternUtils {
		* @return Whether the lock pattern is enabled.
		*/
		public boolean isLockPatternEnabled() {
		return getBoolean(Settings.System.LOCK_PATTERN_ENABLED)
		return getBoolean(Settings.Secure.LOCK_PATTERN_ENABLED)
		&& getLong(PASSWORD_TYPE_KEY, MODE_PATTERN) == MODE_PATTERN;
		}

		@@ -558,35 +558,35 @@ public class LockPatternUtils {
		* Set whether the lock pattern is enabled.
		*/
		public void setLockPatternEnabled(boolean enabled) {
		setBoolean(Settings.System.LOCK_PATTERN_ENABLED, enabled);
		setBoolean(Settings.Secure.LOCK_PATTERN_ENABLED, enabled);
		}

		/**
		* @return Whether the visible pattern is enabled.
		*/
		public boolean isVisiblePatternEnabled() {
		return getBoolean(Settings.System.LOCK_PATTERN_VISIBLE);
		return getBoolean(Settings.Secure.LOCK_PATTERN_VISIBLE);
		}

		/**
		* Set whether the visible pattern is enabled.
		*/
		public void setVisiblePatternEnabled(boolean enabled) {
		setBoolean(Settings.System.LOCK_PATTERN_VISIBLE, enabled);
		setBoolean(Settings.Secure.LOCK_PATTERN_VISIBLE, enabled);
		}

		/**
		* @return Whether tactile feedback for the pattern is enabled.
		*/
		public boolean isTactileFeedbackEnabled() {
		return getBoolean(Settings.System.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED);
		return getBoolean(Settings.Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED);
		}

		/**
		* Set whether tactile feedback for the pattern is enabled.
		*/
		public void setTactileFeedbackEnabled(boolean enabled) {
		setBoolean(Settings.System.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED, enabled);
		setBoolean(Settings.Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED, enabled);
		}

		/**
		@@ -648,30 +648,22 @@ public class LockPatternUtils {
		return nextAlarm;
		}

		private boolean getBoolean(String systemSettingKey) {
		// STOPSHIP: these need to be moved to secure settings!
		private boolean getBoolean(String secureSettingKey) {
		return 1 ==
		android.provider.Settings.System.getInt(
		mContentResolver,
		systemSettingKey, 0);
		android.provider.Settings.Secure.getInt(mContentResolver, secureSettingKey, 0);
		}

		private void setBoolean(String systemSettingKey, boolean enabled) {
		// STOPSHIP: these need to be moved to secure settings!
		android.provider.Settings.System.putInt(
		mContentResolver,
		systemSettingKey,
		private void setBoolean(String secureSettingKey, boolean enabled) {
		android.provider.Settings.Secure.putInt(mContentResolver, secureSettingKey,
		enabled ? 1 : 0);
		}

		private long getLong(String systemSettingKey, long def) {
		// STOPSHIP: these need to be moved to secure settings!
		return android.provider.Settings.System.getLong(mContentResolver, systemSettingKey, def);
		private long getLong(String secureSettingKey, long def) {
		return android.provider.Settings.Secure.getLong(mContentResolver, secureSettingKey, def);
		}

		private void setLong(String systemSettingKey, long value) {
		// STOPSHIP: these need to be moved to secure settings!
		android.provider.Settings.System.putLong(mContentResolver, systemSettingKey, value);
		private void setLong(String secureSettingKey, long value) {
		android.provider.Settings.Secure.putLong(mContentResolver, secureSettingKey, value);
		}

		public boolean isSecure() {

packages/SettingsProvider/src/com/android/providers/settings/DatabaseHelper.java

+53 −31

Original line number	Diff line number	Diff line
		@@ -38,6 +38,7 @@ import android.net.ConnectivityManager;
		import android.os.Environment;
		import android.os.SystemProperties;
		import android.provider.Settings;
		import android.provider.Settings.Secure;
		import android.speech.RecognitionService;
		import android.speech.RecognizerIntent;
		import android.text.TextUtils;
		@@ -76,7 +77,7 @@ public class DatabaseHelper extends SQLiteOpenHelper {
		// database gets upgraded properly. At a minimum, please confirm that 'upgradeVersion'
		// is properly propagated through your change. Not doing so will result in a loss of user
		// settings.
		private static final int DATABASE_VERSION = 51;
		private static final int DATABASE_VERSION = 52;

		private Context mContext;

		@@ -232,17 +233,6 @@ public class DatabaseHelper extends SQLiteOpenHelper {
		}

		if (upgradeVersion == 27) {
		// Copy settings values from 'system' to 'secure' and delete them from 'system'
		SQLiteStatement insertStmt = null;
		SQLiteStatement deleteStmt = null;

		db.beginTransaction();
		try {
		insertStmt =
		db.compileStatement("INSERT INTO secure (name,value) SELECT name,value FROM "
		+ "system WHERE name=?");
		deleteStmt = db.compileStatement("DELETE FROM system WHERE name=?");

		String[] settingsToMove = {
		Settings.Secure.ADB_ENABLED,
		Settings.Secure.ANDROID_ID,
		@@ -276,24 +266,7 @@ public class DatabaseHelper extends SQLiteOpenHelper {
		Settings.Secure.WIFI_WATCHDOG_PING_DELAY_MS,
		Settings.Secure.WIFI_WATCHDOG_PING_TIMEOUT_MS,
		};

		for (String setting : settingsToMove) {
		insertStmt.bindString(1, setting);
		insertStmt.execute();

		deleteStmt.bindString(1, setting);
		deleteStmt.execute();
		}
		db.setTransactionSuccessful();
		} finally {
		db.endTransaction();
		if (insertStmt != null) {
		insertStmt.close();
		}
		if (deleteStmt != null) {
		deleteStmt.close();
		}
		}
		moveFromSystemToSecure(db, settingsToMove);
		upgradeVersion = 28;
		}

		@@ -661,6 +634,23 @@ public class DatabaseHelper extends SQLiteOpenHelper {
		upgradeVersion = 51;
		}

		if (upgradeVersion == 51) {
		/* Move the lockscreen related settings to Secure, including some private ones. */
		String[] settingsToMove = {
		Secure.LOCK_PATTERN_ENABLED,
		Secure.LOCK_PATTERN_VISIBLE,
		Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED,
		"lockscreen.password_type",
		"lockscreen.lockoutattemptdeadline",
		"lockscreen.patterneverchosen",
		"lock_pattern_autolock",
		"lockscreen.lockedoutpermanently",
		"lockscreen.password_salt"
		};
		moveFromSystemToSecure(db, settingsToMove);
		upgradeVersion = 52;
		}

		if (upgradeVersion != currentVersion) {
		Log.w(TAG, "Got stuck trying to upgrade from version " + upgradeVersion
		+ ", must wipe the settings provider");
		@@ -684,6 +674,38 @@ public class DatabaseHelper extends SQLiteOpenHelper {
		}
		}

		private void moveFromSystemToSecure(SQLiteDatabase db, String [] settingsToMove) {
		// Copy settings values from 'system' to 'secure' and delete them from 'system'
		SQLiteStatement insertStmt = null;
		SQLiteStatement deleteStmt = null;

		db.beginTransaction();
		try {
		insertStmt =
		db.compileStatement("INSERT INTO secure (name,value) SELECT name,value FROM "
		+ "system WHERE name=?");
		deleteStmt = db.compileStatement("DELETE FROM system WHERE name=?");


		for (String setting : settingsToMove) {
		insertStmt.bindString(1, setting);
		insertStmt.execute();

		deleteStmt.bindString(1, setting);
		deleteStmt.execute();
		}
		db.setTransactionSuccessful();
		} finally {
		db.endTransaction();
		if (insertStmt != null) {
		insertStmt.close();
		}
		if (deleteStmt != null) {
		deleteStmt.close();
		}
		}
		}

		private void upgradeLockPatternLocation(SQLiteDatabase db) {
		Cursor c = db.query("system", new String[] {"_id", "value"}, "name='lock_pattern'",
		null, null, null, null);