Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b0f4fa18 authored by Rubin Xu's avatar Rubin Xu Committed by Automerger Merge Worker
Browse files

Merge "Fix work profile with unified challenge in HSUM" into udc-dev am: 15dc084b 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/21590160



Change-Id: Id3cca4f826419978197b191f956591e8ea3d1de4
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 846e9cfd 15dc084b

services/core/java/com/android/server/locksettings/LockSettingsService.java

+18 −9
Original line number Diff line number Diff line
@@ -420,7 +420,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
        try (LockscreenCredential unifiedProfilePassword = generateRandomProfilePassword()) {

            setLockCredentialInternal(unifiedProfilePassword, profileUserPassword, profileUserId,

                    /* isLockTiedToParent= */ true);

            tieProfileLockToParent(profileUserId, unifiedProfilePassword);

            tieProfileLockToParent(profileUserId, parentId, unifiedProfilePassword);

            mManagedProfilePasswordCache.storePassword(profileUserId, unifiedProfilePassword);

        }

    }
@@ -1887,34 +1887,43 @@ public class LockSettingsService extends ILockSettings.Stub { 
    }



    @VisibleForTesting /** Note: this method is overridden in unit tests */

    protected void tieProfileLockToParent(int userId, LockscreenCredential password) {

        if (DEBUG) Slog.v(TAG, "tieProfileLockToParent for user: " + userId);

    protected void tieProfileLockToParent(int profileUserId, int parentUserId,

            LockscreenCredential password) {

        if (DEBUG) Slog.v(TAG, "tieProfileLockToParent for user: " + profileUserId);

        final byte[] iv;

        final byte[] ciphertext;

        final long parentSid;

        try {

            parentSid = getGateKeeperService().getSecureUserId(parentUserId);

        } catch (RemoteException e) {

            throw new IllegalStateException("Failed to talk to GateKeeper service", e);

        }



        try {

            KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES);

            keyGenerator.init(new SecureRandom());

            SecretKey secretKey = keyGenerator.generateKey();

            try {

                mJavaKeyStore.setEntry(

                        PROFILE_KEY_NAME_ENCRYPT + userId,

                        PROFILE_KEY_NAME_ENCRYPT + profileUserId,

                        new java.security.KeyStore.SecretKeyEntry(secretKey),

                        new KeyProtection.Builder(KeyProperties.PURPOSE_ENCRYPT)

                                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

                                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

                                .build());

                mJavaKeyStore.setEntry(

                        PROFILE_KEY_NAME_DECRYPT + userId,

                        PROFILE_KEY_NAME_DECRYPT + profileUserId,

                        new java.security.KeyStore.SecretKeyEntry(secretKey),

                        new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT)

                                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

                                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

                                .setUserAuthenticationRequired(true)

                                .setBoundToSpecificSecureUserId(parentSid)

                                .setUserAuthenticationValidityDurationSeconds(30)

                                .build());

                // Key imported, obtain a reference to it.

                SecretKey keyStoreEncryptionKey = (SecretKey) mJavaKeyStore.getKey(

                        PROFILE_KEY_NAME_ENCRYPT + userId, null);

                        PROFILE_KEY_NAME_ENCRYPT + profileUserId, null);

                Cipher cipher = Cipher.getInstance(

                        KeyProperties.KEY_ALGORITHM_AES + "/" + KeyProperties.BLOCK_MODE_GCM + "/"

                                + KeyProperties.ENCRYPTION_PADDING_NONE);
@@ -1923,7 +1932,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
                iv = cipher.getIV();

            } finally {

                // The original key can now be discarded.

                mJavaKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + userId);

                mJavaKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + profileUserId);

            }

        } catch (UnrecoverableKeyException

                | BadPaddingException | IllegalBlockSizeException | KeyStoreException
@@ -1933,7 +1942,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
        if (iv.length != PROFILE_KEY_IV_SIZE) {

            throw new IllegalArgumentException("Invalid iv length: " + iv.length);

        }

        mStorage.writeChildProfileLock(userId, ArrayUtils.concat(iv, ciphertext));

        mStorage.writeChildProfileLock(profileUserId, ArrayUtils.concat(iv, ciphertext));

    }



    private void setUserKeyProtection(@UserIdInt int userId, byte[] secret) {
@@ -2045,7 +2054,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
                LockscreenCredential piUserDecryptedPassword = profileUserDecryptedPasswords.get(i);

                if (piUserId != -1 && piUserDecryptedPassword != null) {

                    if (DEBUG) Slog.v(TAG, "Restore tied profile lock");

                    tieProfileLockToParent(piUserId, piUserDecryptedPassword);

                    tieProfileLockToParent(piUserId, userId, piUserDecryptedPassword);

                }

                if (piUserDecryptedPassword != null) {

                    piUserDecryptedPassword.zeroize();

services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java

+3 −2
Original line number Diff line number Diff line
@@ -165,10 +165,11 @@ public class LockSettingsServiceTestable extends LockSettingsService { 
    }



    @Override

    protected void tieProfileLockToParent(int userId, LockscreenCredential password) {

    protected void tieProfileLockToParent(int profileUserId, int parentUserId,

            LockscreenCredential password) {

        Parcel parcel = Parcel.obtain();

        parcel.writeParcelable(password, 0);

        mStorage.writeChildProfileLock(userId, parcel.marshall());

        mStorage.writeChildProfileLock(profileUserId, parcel.marshall());

        parcel.recycle();

    }