Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 931bdc34 authored by Dave McCloskey's avatar Dave McCloskey
Browse files

Enforce USE_ATTESTATION_VERIFICATION_SERVICE permission to call APIs. 

Bug: 233223690
Test: atest AttestationVerificationTest
Test: removed permission from test AndroidManifest and verified failure
Change-Id: I6dda91bb0bdf52e8e1456c0a607c224528a6d24a
parent 8890d473

services/core/java/com/android/server/security/AttestationVerificationManagerService.java

+7 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 


package com.android.server.security;



import static android.Manifest.permission.USE_ATTESTATION_VERIFICATION_SERVICE;

import static android.security.attestationverification.AttestationVerificationManager.PROFILE_PEER_DEVICE;

import static android.security.attestationverification.AttestationVerificationManager.PROFILE_SELF_TRUSTED;

import static android.security.attestationverification.AttestationVerificationManager.RESULT_FAILURE;
@@ -60,6 +61,7 @@ public class AttestationVerificationManagerService extends SystemService { 
                Bundle requirements,

                byte[] attestation,

                AndroidFuture resultCallback) throws RemoteException {

            enforceUsePermission();

            try {

                Slog.d(TAG, "verifyAttestation");

                verifyAttestationForAllVerifiers(profile, localBindingType, requirements,
@@ -73,9 +75,14 @@ public class AttestationVerificationManagerService extends SystemService { 
        @Override

        public void verifyToken(VerificationToken token, ParcelDuration parcelDuration,

                AndroidFuture resultCallback) throws RemoteException {

            enforceUsePermission();

            // TODO(b/201696614): Implement

            resultCallback.complete(RESULT_UNKNOWN);

        }



        private void enforceUsePermission() {

            getContext().enforceCallingOrSelfPermission(USE_ATTESTATION_VERIFICATION_SERVICE, null);

        }

    };



    private void verifyAttestationForAllVerifiers(