Merge "[Keystore] Use Strict for every call into keystore" into main (250127b2) · Commits · e / os / android_frameworks_base

keystore/java/android/security/AndroidKeyStoreMaintenance.java

+8 −0

Original line number	Diff line number	Diff line
		@@ -20,6 +20,7 @@ import android.annotation.NonNull;
		import android.annotation.Nullable;
		import android.os.ServiceManager;
		import android.os.ServiceSpecificException;
		import android.os.StrictMode;
		import android.security.maintenance.IKeystoreMaintenance;
		import android.system.keystore2.Domain;
		import android.system.keystore2.KeyDescriptor;
		@@ -51,6 +52,7 @@ public class AndroidKeyStoreMaintenance {
		* @hide
		*/
		public static int onUserAdded(@NonNull int userId) {
		StrictMode.noteDiskWrite();
		try {
		getService().onUserAdded(userId);
		return 0;
		@@ -71,6 +73,7 @@ public class AndroidKeyStoreMaintenance {
		* @hide
		*/
		public static int onUserRemoved(int userId) {
		StrictMode.noteDiskWrite();
		try {
		getService().onUserRemoved(userId);
		return 0;
		@@ -93,6 +96,7 @@ public class AndroidKeyStoreMaintenance {
		* @hide
		*/
		public static int onUserPasswordChanged(int userId, @Nullable byte[] password) {
		StrictMode.noteDiskWrite();
		try {
		getService().onUserPasswordChanged(userId, password);
		return 0;
		@@ -110,6 +114,7 @@ public class AndroidKeyStoreMaintenance {
		* be cleared.
		*/
		public static int clearNamespace(@Domain int domain, long namespace) {
		StrictMode.noteDiskWrite();
		try {
		getService().clearNamespace(domain, namespace);
		return 0;
		@@ -129,6 +134,7 @@ public class AndroidKeyStoreMaintenance {
		* @return UserState enum variant as integer if successful or an error
		*/
		public static int getState(int userId) {
		StrictMode.noteDiskRead();
		try {
		return getService().getState(userId);
		} catch (ServiceSpecificException e) {
		@@ -144,6 +150,7 @@ public class AndroidKeyStoreMaintenance {
		* Informs Keystore 2.0 that an off body event was detected.
		*/
		public static void onDeviceOffBody() {
		StrictMode.noteDiskWrite();
		try {
		getService().onDeviceOffBody();
		} catch (Exception e) {
		@@ -172,6 +179,7 @@ public class AndroidKeyStoreMaintenance {
		* * SYSTEM_ERROR if an unexpected error occurred.
		*/
		public static int migrateKeyNamespace(KeyDescriptor source, KeyDescriptor destination) {
		StrictMode.noteDiskWrite();
		try {
		getService().migrateKeyNamespace(source, destination);
		return 0;

keystore/java/android/security/Authorization.java

+3 −0

Original line number	Diff line number	Diff line
		@@ -22,6 +22,7 @@ import android.hardware.security.keymint.HardwareAuthToken;
		import android.os.RemoteException;
		import android.os.ServiceManager;
		import android.os.ServiceSpecificException;
		import android.os.StrictMode;
		import android.security.authorization.IKeystoreAuthorization;
		import android.security.authorization.LockScreenEvent;
		import android.system.keystore2.ResponseCode;
		@@ -48,6 +49,7 @@ public class Authorization {
		* @return 0 if successful or {@code ResponseCode.SYSTEM_ERROR}.
		*/
		public static int addAuthToken(@NonNull HardwareAuthToken authToken) {
		StrictMode.noteSlowCall("addAuthToken");
		try {
		getService().addAuthToken(authToken);
		return 0;
		@@ -81,6 +83,7 @@ public class Authorization {
		*/
		public static int onLockScreenEvent(@NonNull boolean locked, @NonNull int userId,
		@Nullable byte[] syntheticPassword, @Nullable long[] unlockingSids) {
		StrictMode.noteDiskWrite();
		try {
		if (locked) {
		getService().onLockScreenEvent(LockScreenEvent.LOCK, userId, null, unlockingSids);

keystore/java/android/security/KeyStore.java

+3 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ package android.security;

		import android.compat.annotation.UnsupportedAppUsage;
		import android.os.Build;
		import android.os.StrictMode;
		import android.os.UserHandle;
		import android.security.maintenance.UserState;

		@@ -126,6 +127,8 @@ public class KeyStore {
		* a {@code KeymasterDefs.KM_ERROR_} value or {@code KeyStore} ResponseCode.
		*/
		public int addAuthToken(byte[] authToken) {
		StrictMode.noteDiskWrite();

		return Authorization.addAuthToken(authToken);
		}

keystore/java/android/security/KeyStore2.java

+19 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,7 @@ import android.os.Binder;
		import android.os.RemoteException;
		import android.os.ServiceManager;
		import android.os.ServiceSpecificException;
		import android.os.StrictMode;
		import android.security.keymaster.KeymasterDefs;
		import android.system.keystore2.Domain;
		import android.system.keystore2.IKeystoreService;
		@@ -147,6 +148,8 @@ public class KeyStore2 {
		}

		void delete(KeyDescriptor descriptor) throws KeyStoreException {
		StrictMode.noteDiskWrite();

		handleRemoteExceptionWithRetry((service) -> {
		service.deleteKey(descriptor);
		return 0;
		@@ -157,6 +160,8 @@ public class KeyStore2 {
		* List all entries in the keystore for in the given namespace.
		*/
		public KeyDescriptor[] list(int domain, long namespace) throws KeyStoreException {
		StrictMode.noteDiskRead();

		return handleRemoteExceptionWithRetry((service) -> service.listEntries(domain, namespace));
		}

		@@ -165,6 +170,8 @@ public class KeyStore2 {
		*/
		public KeyDescriptor[] listBatch(int domain, long namespace, String startPastAlias)
		throws KeyStoreException {
		StrictMode.noteDiskRead();

		return handleRemoteExceptionWithRetry(
		(service) -> service.listEntriesBatched(domain, namespace, startPastAlias));
		}
		@@ -227,6 +234,8 @@ public class KeyStore2 {
		*/
		public KeyDescriptor grant(KeyDescriptor descriptor, int granteeUid, int accessVector)
		throws KeyStoreException {
		StrictMode.noteDiskWrite();

		return handleRemoteExceptionWithRetry(
		(service) -> service.grant(descriptor, granteeUid, accessVector)
		);
		@@ -242,6 +251,8 @@ public class KeyStore2 {
		*/
		public void ungrant(KeyDescriptor descriptor, int granteeUid)
		throws KeyStoreException {
		StrictMode.noteDiskWrite();

		handleRemoteExceptionWithRetry((service) -> {
		service.ungrant(descriptor, granteeUid);
		return 0;
		@@ -258,6 +269,8 @@ public class KeyStore2 {
		*/
		public KeyEntryResponse getKeyEntry(@NonNull KeyDescriptor descriptor)
		throws KeyStoreException {
		StrictMode.noteDiskRead();

		return handleRemoteExceptionWithRetry((service) -> service.getKeyEntry(descriptor));
		}

		@@ -289,6 +302,8 @@ public class KeyStore2 {
		*/
		public void updateSubcomponents(@NonNull KeyDescriptor key, byte[] publicCert,
		byte[] publicCertChain) throws KeyStoreException {
		StrictMode.noteDiskWrite();

		handleRemoteExceptionWithRetry((service) -> {
		service.updateSubcomponent(key, publicCert, publicCertChain);
		return 0;
		@@ -304,6 +319,8 @@ public class KeyStore2 {
		*/
		public void deleteKey(@NonNull KeyDescriptor descriptor)
		throws KeyStoreException {
		StrictMode.noteDiskWrite();

		handleRemoteExceptionWithRetry((service) -> {
		service.deleteKey(descriptor);
		return 0;
		@@ -314,6 +331,8 @@ public class KeyStore2 {
		* Returns the number of Keystore entries for a given domain and namespace.
		*/
		public int getNumberOfEntries(int domain, long namespace) throws KeyStoreException {
		StrictMode.noteDiskRead();

		return handleRemoteExceptionWithRetry((service)
		-> service.getNumberOfEntries(domain, namespace));
		}

keystore/java/android/security/KeyStoreOperation.java

+5 −0

Original line number	Diff line number	Diff line
		@@ -21,6 +21,7 @@ import android.hardware.security.keymint.KeyParameter;
		import android.os.Binder;
		import android.os.RemoteException;
		import android.os.ServiceSpecificException;
		import android.os.StrictMode;
		import android.security.keymaster.KeymasterDefs;
		import android.system.keystore2.IKeystoreOperation;
		import android.system.keystore2.ResponseCode;
		@@ -97,6 +98,7 @@ public class KeyStoreOperation {
		* @throws KeyStoreException
		*/
		public void updateAad(@NonNull byte[] input) throws KeyStoreException {
		StrictMode.noteSlowCall("updateAad");
		handleExceptions(() -> {
		mOperation.updateAad(input);
		return 0;
		@@ -112,6 +114,7 @@ public class KeyStoreOperation {
		* @hide
		*/
		public byte[] update(@NonNull byte[] input) throws KeyStoreException {
		StrictMode.noteSlowCall("update");
		return handleExceptions(() -> mOperation.update(input));
		}

		@@ -125,6 +128,7 @@ public class KeyStoreOperation {
		* @hide
		*/
		public byte[] finish(byte[] input, byte[] signature) throws KeyStoreException {
		StrictMode.noteSlowCall("finish");
		return handleExceptions(() -> mOperation.finish(input, signature));
		}

		@@ -135,6 +139,7 @@ public class KeyStoreOperation {
		* @hide
		*/
		public void abort() throws KeyStoreException {
		StrictMode.noteSlowCall("abort");
		handleExceptions(() -> {
		mOperation.abort();
		return 0;