Merge "Add test API for AuthenticationPolicyManager CTS tests" into main (cba207c4) · Commits · e / os / android_frameworks_base

core/api/test-current.txt

+8 −0

Original line number	Diff line number	Diff line
		@@ -3139,6 +3139,14 @@ package android.security {

		}

		package android.security.authenticationpolicy {

		@FlaggedApi("android.security.secure_lockdown") public final class AuthenticationPolicyManager {
		method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.TEST_BIOMETRIC) public void setSecureLockDeviceTestStatus(boolean);
		}

		}

		package android.security.keystore {

		public static final class KeyGenParameterSpec.Builder {

core/java/android/security/authenticationpolicy/AuthenticationPolicyManager.java

+19 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ package android.security.authenticationpolicy;
		import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;
		import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
		import static android.hardware.biometrics.Flags.FLAG_IDENTITY_CHECK_WATCH;
		import static android.Manifest.permission.TEST_BIOMETRIC;
		import static android.security.Flags.FLAG_SECURE_LOCKDOWN;
		import static android.security.Flags.FLAG_SECURE_LOCK_DEVICE;

		@@ -28,6 +29,7 @@ import android.annotation.NonNull;
		import android.annotation.RequiresPermission;
		import android.annotation.SystemApi;
		import android.annotation.SystemService;
		import android.annotation.TestApi;
		import android.content.Context;
		import android.os.Binder;
		import android.os.Build;
		@@ -503,6 +505,23 @@ public final class AuthenticationPolicyManager {
		}
		}

		/**
		* Sets test mode for Secure Lock Device. This allows tests to indicate that security features
		* that would interfere with testing (disabling ADB, USB) should be skipped.
		* @hide
		*/
		@TestApi
		@RequiresPermission(TEST_BIOMETRIC)
		@FlaggedApi(FLAG_SECURE_LOCK_DEVICE)
		public void setSecureLockDeviceTestStatus(boolean isTestMode) {
		try {
		Slog.d(TAG, "#setTestModeForSecureLockDevice(isTestMode=" + isTestMode + ")");
		mAuthenticationPolicyService.setSecureLockDeviceTestStatus(isTestMode);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}

		/**
		* This function will start watch ranging for Identity Check. We will remove specific
		* Identity Check implementation when this is generalized.

core/java/android/security/authenticationpolicy/IAuthenticationPolicyService.aidl

+3 −0

Original line number	Diff line number	Diff line
		@@ -46,6 +46,9 @@ interface IAuthenticationPolicyService {
		@EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")
		void unregisterSecureLockDeviceStatusListener(in ISecureLockDeviceStatusListener listener);

		@EnforcePermission("TEST_BIOMETRIC")
		void setSecureLockDeviceTestStatus(boolean isTestMode);

		@EnforcePermission("USE_BIOMETRIC_INTERNAL")
		void startWatchRangingForIdentityCheck(in long authenticationRequestId, in IProximityResultCallback resultCallback);

core/res/AndroidManifest.xml

+4 −1

Original line number	Diff line number	Diff line
		@@ -7551,7 +7551,10 @@

		<!-- Allows access to TestApis for various components in the biometric stack, including
		FingerprintService, FaceService, BiometricService. Used by com.android.server.biometrics
		CTS tests. @hide @TestApi -->
		CTS tests. Also allows access to TestApis for Secure Lock Device, which are used by
		android.security.authenticationpolicy CTS tests.
		@hide @TestApi
		-->
		<permission android:name="android.permission.TEST_BIOMETRIC"
		android:protectionLevel="signature" />

services/core/java/com/android/server/security/authenticationpolicy/AuthenticationPolicyService.java

+12 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ package com.android.server.security.authenticationpolicy;

		import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
		import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;
		import static android.Manifest.permission.TEST_BIOMETRIC;
		import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
		import static android.security.Flags.disableAdaptiveAuthCounterLock;
		import static android.security.Flags.failedAuthLockToggle;
		@@ -540,6 +541,17 @@ public class AuthenticationPolicyService extends SystemService {
		}
		}

		/**
		* @see AuthenticationPolicyManager#setSecureLockDeviceTestStatus(boolean)
		* @param isTestMode boolean indicating whether to enable test mode for secure lock device
		*/
		@Override
		@EnforcePermission(TEST_BIOMETRIC)
		public void setSecureLockDeviceTestStatus(boolean isTestMode) {
		setSecureLockDeviceTestStatus_enforcePermission();
		mSecureLockDeviceService.setSecureLockDeviceTestStatus(isTestMode);
		}

		@Override
		@EnforcePermission(USE_BIOMETRIC_INTERNAL)
		public void startWatchRangingForIdentityCheck(long authenticationRequestId,