Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cb94dbee authored by Eric Biggers's avatar Eric Biggers
Browse files

locksettings: allow {get,set}-disabled without providing current LSKF 

There is no reason for the get-disabled and set-disabled commands to
require the current LSKF, so remove the requirement that it be provided.
This is safe for set-disabled because the lockscreen isn't actually
disabled until the LSKF is cleared, which must be done separately.

This avoids unlocking screen-lock-bound Keystore keys when not intended.

Bug: 273304787
Change-Id: I6472905c759a0e08e6bb59a59b51c5b40fe830ab
parent 2b03be6c

services/core/java/com/android/server/locksettings/LockSettingsShellCommand.java

+8 −6
Original line number Diff line number Diff line
@@ -106,6 +106,14 @@ class LockSettingsShellCommand extends ShellCommand { 
                case COMMAND_HELP:

                    onHelp();

                    return 0;

                case COMMAND_GET_DISABLED:

                    runGetDisabled();

                    return 0;

                case COMMAND_SET_DISABLED:

                    // Note: if the user has an LSKF, then this has no immediate effect but instead

                    // just ensures the lockscreen will be disabled later when the LSKF is cleared.

                    runSetDisabled();

                    return 0;

            }

            if (!checkCredential()) {

                return -1;
@@ -124,15 +132,9 @@ class LockSettingsShellCommand extends ShellCommand { 
                case COMMAND_CLEAR:

                    success = runClear();

                    break;

                case COMMAND_SET_DISABLED:

                    runSetDisabled();

                    break;

                case COMMAND_VERIFY:

                    runVerify();

                    break;

                case COMMAND_GET_DISABLED:

                    runGetDisabled();

                    break;

                default:

                    getErrPrintWriter().println("Unknown command: " + cmd);

                    break;