Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e031a40c authored by Grace Cheng's avatar Grace Cheng
Browse files

Add test API for AuthenticationPolicyManager CTS tests 

Adding test API for AuthenticationPolicyManager to skip security
features that interfere with tests (disabling USB/ADB)

Flag: android.security.secure_lock_device
Flag: android.security.secure_lockdown
Fixes: 376456619
Bug: 401645997
Test: atest CtsSecurityTestCases:android.security.cts.authenticationpolicy.AuthenticationPolicyManagerTest
Change-Id: I30fd5a2ea2ace957f85ad2d9000ca2c9c9ae857d
parent 5675016b

core/api/test-current.txt

+8 −0
Original line number Diff line number Diff line
@@ -3139,6 +3139,14 @@ package android.security { 


}



package android.security.authenticationpolicy {



  @FlaggedApi("android.security.secure_lockdown") public final class AuthenticationPolicyManager {

    method @FlaggedApi("android.security.secure_lock_device") @RequiresPermission(android.Manifest.permission.TEST_BIOMETRIC) public void setSecureLockDeviceTestStatus(boolean);

  }



}



package android.security.keystore {



  public static final class KeyGenParameterSpec.Builder {

core/java/android/security/authenticationpolicy/AuthenticationPolicyManager.java

+19 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package android.security.authenticationpolicy; 
import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;

import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;

import static android.hardware.biometrics.Flags.FLAG_IDENTITY_CHECK_WATCH;

import static android.Manifest.permission.TEST_BIOMETRIC;

import static android.security.Flags.FLAG_SECURE_LOCKDOWN;

import static android.security.Flags.FLAG_SECURE_LOCK_DEVICE;
@@ -28,6 +29,7 @@ import android.annotation.NonNull; 
import android.annotation.RequiresPermission;

import android.annotation.SystemApi;

import android.annotation.SystemService;

import android.annotation.TestApi;

import android.content.Context;

import android.os.Binder;

import android.os.Build;
@@ -503,6 +505,23 @@ public final class AuthenticationPolicyManager { 
        }

    }



    /**

     * Sets test mode for Secure Lock Device. This allows tests to indicate that security features

     * that would interfere with testing (disabling ADB, USB) should be skipped.

     * @hide

     */

    @TestApi

    @RequiresPermission(TEST_BIOMETRIC)

    @FlaggedApi(FLAG_SECURE_LOCK_DEVICE)

    public void setSecureLockDeviceTestStatus(boolean isTestMode) {

        try {

            Slog.d(TAG, "#setTestModeForSecureLockDevice(isTestMode=" + isTestMode + ")");

            mAuthenticationPolicyService.setSecureLockDeviceTestStatus(isTestMode);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

    }



    /**

     * This function will start watch ranging for Identity Check. We will remove specific

     * Identity Check implementation when this is generalized.

core/java/android/security/authenticationpolicy/IAuthenticationPolicyService.aidl

+3 −0
Original line number Diff line number Diff line
@@ -46,6 +46,9 @@ interface IAuthenticationPolicyService { 
    @EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")

    void unregisterSecureLockDeviceStatusListener(in ISecureLockDeviceStatusListener listener);



    @EnforcePermission("TEST_BIOMETRIC")

    void setSecureLockDeviceTestStatus(boolean isTestMode);



    @EnforcePermission("USE_BIOMETRIC_INTERNAL")

    void startWatchRangingForIdentityCheck(in long authenticationRequestId, in IProximityResultCallback resultCallback);

core/res/AndroidManifest.xml

+4 −1
Original line number Diff line number Diff line
@@ -7551,7 +7551,10 @@ 














    <!-- Allows access to TestApis for various components in the biometric stack, including















         FingerprintService, FaceService, BiometricService. Used by com.android.server.biometrics













         CTS tests. @hide @TestApi -->













         CTS tests. Also allows access to TestApis for Secure Lock Device, which are used by













         android.security.authenticationpolicy CTS tests.













         @hide @TestApi













     -->















    <permission android:name="android.permission.TEST_BIOMETRIC"















        android:protectionLevel="signature" />















































services/core/java/com/android/server/security/authenticationpolicy/AuthenticationPolicyService.java



+12
−0




























Original line number
Diff line number
Diff line








@@ -18,6 +18,7 @@ package com.android.server.security.authenticationpolicy;





























import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;















import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;













import static android.Manifest.permission.TEST_BIOMETRIC;















import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;















import static android.security.Flags.disableAdaptiveAuthCounterLock;















import static android.security.Flags.failedAuthLockToggle;










@@ -540,6 +541,17 @@ public class AuthenticationPolicyService extends SystemService {













            }















        }





























        /**













         * @see AuthenticationPolicyManager#setSecureLockDeviceTestStatus(boolean)













         * @param isTestMode boolean indicating whether to enable test mode for secure lock device













         */













        @Override













        @EnforcePermission(TEST_BIOMETRIC)













        public void setSecureLockDeviceTestStatus(boolean isTestMode) {













            setSecureLockDeviceTestStatus_enforcePermission();













            mSecureLockDeviceService.setSecureLockDeviceTestStatus(isTestMode);













        }





























        @Override















        @EnforcePermission(USE_BIOMETRIC_INTERNAL)















        public void startWatchRangingForIdentityCheck(long authenticationRequestId,