Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f7bd978 authored by Eric Biggers's avatar Eric Biggers
Browse files

Zeroize keystore password in unlockKeystore() 

Secrets derived from or unlocked by the LSKF need to be zeroized as soon
as they are no longer needed.

Bug: 320392352
Test: atest FrameworksServicesTests:com.android.server.locksettings
Flag: EXEMPT bugfix
Change-Id: I82deeeb5aeaea5a83a0d6a0475a5df9d813764eb
parent ca54ddd7

services/core/java/com/android/server/locksettings/LockSettingsService.java

+6 −1
Original line number Diff line number Diff line
@@ -1514,7 +1514,12 @@ public class LockSettingsService extends ILockSettings.Stub { 
    }



    private void unlockKeystore(int userId, SyntheticPassword sp) {

        mKeyStoreAuthorization.onDeviceUnlocked(userId, sp.deriveKeyStorePassword());

        final byte[] password = sp.deriveKeyStorePassword();

        try {

            mKeyStoreAuthorization.onDeviceUnlocked(userId, password);

        } finally {

            ArrayUtils.zeroize(password);

        }

    }



    @VisibleForTesting /** Note: this method is overridden in unit tests */