Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f821a8e authored by Eva Bertels's avatar Eva Bertels
Browse files

Added check for misprovisioned Pixel 2 device. 

Some Pixel devices had a wrong brand value provisioned into keymaster.
Due to this misprovisioning those devices fail device ID attestation because it includes a check for the correct brand value.
This is now solved by re-trying Device ID attestation if we are running on a potentially misprovisioned device, allowing for the known incorrect brand value.

Bug: 69471841
Test: atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testKeyManagement
Change-Id: If715ebdd4ab6d7fcfffab60b40fd2dc8fa1fda44
Merged-In: Ia0da5478d6092c1927d26600a6893ae8ce53da51
parent 5cd354c8

core/res/res/values/config.xml

+7 −0
Original line number Original line Diff line number Diff line
@@ -3504,4 +3504,11 @@ 




    <!-- Whether or not we should show the option to show battery percentage -->

    <!-- Whether or not we should show the option to show battery percentage -->

    <bool name="config_battery_percentage_setting_available">true</bool>

    <bool name="config_battery_percentage_setting_available">true</bool>



    <!-- Model of potentially misprovisioned devices. If none is specified in an overlay, an

         empty string is passed in. -->

    <string name="config_misprovisionedDeviceModel" translatable="false"></string>



    <!-- Brand value for attestation of misprovisioned device. -->

    <string name="config_misprovisionedBrandValue" translatable="false"></string>

</resources>
 
</resources>

core/res/res/values/symbols.xml

+3 −0
Original line number Original line Diff line number Diff line
@@ -3410,4 +3410,7 @@ 




  <java-symbol type="array" name="config_disableApksUnlessMatchedSku_apk_list" />

  <java-symbol type="array" name="config_disableApksUnlessMatchedSku_apk_list" />

  <java-symbol type="array" name="config_disableApkUnlessMatchedSku_skus_list" />

  <java-symbol type="array" name="config_disableApkUnlessMatchedSku_skus_list" />



  <java-symbol type="string" name="config_misprovisionedDeviceModel" />

  <java-symbol type="string" name="config_misprovisionedBrandValue" />

</resources>
 
</resources>

keystore/java/android/security/keystore/AttestationUtils.java

+36 −2
Original line number Original line Diff line number Diff line
@@ -22,9 +22,9 @@ import android.annotation.RequiresPermission; 
import android.annotation.SystemApi;

import android.annotation.SystemApi;

import android.annotation.TestApi;

import android.annotation.TestApi;

import android.content.Context;

import android.content.Context;

import android.content.res.Resources;

import android.os.Build;

import android.os.Build;

import android.security.KeyStore;

import android.security.KeyStore;

import android.security.KeyStoreException;

import android.security.keymaster.KeymasterArguments;

import android.security.keymaster.KeymasterArguments;

import android.security.keymaster.KeymasterCertificateChain;

import android.security.keymaster.KeymasterCertificateChain;

import android.security.keymaster.KeymasterDefs;

import android.security.keymaster.KeymasterDefs;
@@ -117,6 +117,40 @@ public abstract class AttestationUtils { 
    @NonNull public static KeymasterArguments prepareAttestationArguments(Context context,

    @NonNull public static KeymasterArguments prepareAttestationArguments(Context context,

            @NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws

            @NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws

            DeviceIdAttestationException {

            DeviceIdAttestationException {

        return prepareAttestationArguments(context, idTypes,attestationChallenge, Build.BRAND);

    }



    /**

     * Prepares Keymaster Arguments with attestation data for misprovisioned Pixel 2 device.

     * See http://go/keyAttestationFailure and http://b/69471841 for more info.

     * @hide should only be used by KeyChain.

     */

    @NonNull public static KeymasterArguments prepareAttestationArgumentsIfMisprovisioned(

            Context context, @NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws

            DeviceIdAttestationException {

        if (!isPotentiallyMisprovisionedDevice(context)) {

            return null;

        }

        Resources resources = context.getResources();

        String misprovisionedBrand = resources.getString(

                com.android.internal.R.string.config_misprovisionedBrandValue);

        return prepareAttestationArguments(

                    context, idTypes, attestationChallenge, misprovisionedBrand);

    }



    @NonNull private static boolean isPotentiallyMisprovisionedDevice(Context context) {

        Resources resources = context.getResources();

        String misprovisionedModel = resources.getString(

                com.android.internal.R.string.config_misprovisionedDeviceModel);

        String misprovisionedBrand = resources.getString(

                com.android.internal.R.string.config_misprovisionedBrandValue);



        return (Build.MODEL.equals(misprovisionedModel));

    }



    @NonNull private static KeymasterArguments prepareAttestationArguments(Context context,

            @NonNull int[] idTypes, @NonNull byte[] attestationChallenge, String brand) throws

            DeviceIdAttestationException {

        // Check method arguments, retrieve requested device IDs and prepare attestation arguments.

        // Check method arguments, retrieve requested device IDs and prepare attestation arguments.

        if (attestationChallenge == null) {

        if (attestationChallenge == null) {

            throw new NullPointerException("Missing attestation challenge");

            throw new NullPointerException("Missing attestation challenge");
@@ -169,7 +203,7 @@ public abstract class AttestationUtils { 
            }

            }

        }

        }

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND,

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND,

                Build.BRAND.getBytes(StandardCharsets.UTF_8));

                brand.getBytes(StandardCharsets.UTF_8));

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_DEVICE,

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_DEVICE,

                Build.DEVICE.getBytes(StandardCharsets.UTF_8));

                Build.DEVICE.getBytes(StandardCharsets.UTF_8));

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT,

        attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT,