Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd8bf04f authored by Eric Biggers's avatar Eric Biggers Committed by Android (Google) Code Review
Browse files

Merge changes from topic "sps-on-creation" 

* changes:
  Make the CE key always be encrypted by the synthetic password
  Give all users SP-based credentials
  Unlock user keys from LockSettingsService only
parents db97da4f d20b2504

core/java/android/app/IActivityManager.aidl

+21 −0
Original line number Diff line number Diff line
@@ -524,9 +524,30 @@ interface IActivityManager { 


    @UnsupportedAppUsage(maxTargetSdk = 30, trackingBug = 170729553)

    void suppressResizeConfigChanges(boolean suppress);



    /**

     * @deprecated Use {@link #unlockUser2(int, IProgressListener)} instead, since the token and

     * secret arguments no longer do anything.  This method still exists only because it is marked

     * with {@code @UnsupportedAppUsage}, so it might not be safe to remove it or change its

     * signature.

     */

    @UnsupportedAppUsage(maxTargetSdk = 30, trackingBug = 170729553)

    boolean unlockUser(int userid, in byte[] token, in byte[] secret,

            in IProgressListener listener);



    /**

     * Tries to unlock the given user.

     * <p>

     * This will succeed only if the user's CE storage key is already unlocked or if the user

     * doesn't have a lockscreen credential set.

     *

     * @param userId The ID of the user to unlock.

     * @param listener An optional progress listener.

     *

     * @return true if the user was successfully unlocked, otherwise false.

     */

    boolean unlockUser2(int userId, in IProgressListener listener);



    void killPackageDependents(in String packageName, int userId);

    void makePackageIdle(String packageName, int userId);

    int getMemoryTrimLevel();

core/java/android/os/storage/IStorageManager.aidl

+2 −5
Original line number Diff line number Diff line
@@ -137,6 +137,7 @@ interface IStorageManager { 
    void createUserKey(int userId, int serialNumber, boolean ephemeral) = 61;

    @EnforcePermission("STORAGE_INTERNAL")

    void destroyUserKey(int userId) = 62;

    @EnforcePermission("STORAGE_INTERNAL")

    void unlockUserKey(int userId, int serialNumber, in byte[] secret) = 63;

    @EnforcePermission("STORAGE_INTERNAL")

    void lockUserKey(int userId) = 64;
@@ -146,9 +147,7 @@ interface IStorageManager { 
    @EnforcePermission("STORAGE_INTERNAL")

    void destroyUserStorage(in String volumeUuid, int userId, int flags) = 67;

    @EnforcePermission("STORAGE_INTERNAL")

    void addUserKeyAuth(int userId, int serialNumber, in byte[] secret) = 70;

    @EnforcePermission("STORAGE_INTERNAL")

    void fixateNewestUserKeyAuth(int userId) = 71;

    void setUserKeyProtection(int userId, in byte[] secret) = 70;

    @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS")

    void fstrim(int flags, IVoldTaskListener listener) = 72;

    AppFuseMount mountProxyFileDescriptorBridge() = 73;
@@ -165,8 +164,6 @@ interface IStorageManager { 
    @EnforcePermission("MOUNT_FORMAT_FILESYSTEMS")

    boolean needsCheckpoint() = 86;

    void abortChanges(in String message, boolean retry) = 87;

    @EnforcePermission("STORAGE_INTERNAL")

    void clearUserKeyAuth(int userId, int serialNumber, in byte[] secret) = 88;

    void fixupAppDir(in String path) = 89;

    void disableAppDataIsolation(in String pkgName, int pid, int userId) = 90;

    PendingIntent getManageSpaceActivityIntent(in String packageName, int requestCode) = 91;

core/java/android/os/storage/StorageManager.java

+0 −9
Original line number Diff line number Diff line
@@ -1605,15 +1605,6 @@ public class StorageManager { 
        }

    }



    /** {@hide} */

    public void unlockUserKey(int userId, int serialNumber, byte[] secret) {

        try {

            mStorageManager.unlockUserKey(userId, serialNumber, secret);

        } catch (RemoteException e) {

            throw e.rethrowFromSystemServer();

        }

    }



    /** {@hide} */

    public void lockUserKey(int userId) {

        try {

core/java/com/android/internal/widget/LockPatternUtils.java

+13 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ import static android.app.admin.DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED 
import android.annotation.IntDef;

import android.annotation.NonNull;

import android.annotation.Nullable;

import android.annotation.UserIdInt;

import android.app.PropertyInvalidatedCache;

import android.app.admin.DevicePolicyManager;

import android.app.admin.PasswordMetrics;
@@ -1784,4 +1785,16 @@ public class LockPatternUtils { 
            re.rethrowFromSystemServer();

        }

    }



    public void unlockUserKeyIfUnsecured(@UserIdInt int userId) {

        getLockSettingsInternal().unlockUserKeyIfUnsecured(userId);

    }



    public void createNewUser(@UserIdInt int userId, int userSerialNumber) {

        getLockSettingsInternal().createNewUser(userId, userSerialNumber);

    }



    public void removeUser(@UserIdInt int userId) {

        getLockSettingsInternal().removeUser(userId);

    }

}

core/java/com/android/internal/widget/LockSettingsInternal.java

+32 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package com.android.internal.widget; 


import android.annotation.IntDef;

import android.annotation.Nullable;

import android.annotation.UserIdInt;

import android.app.admin.PasswordMetrics;



import java.lang.annotation.Retention;
@@ -52,6 +53,37 @@ public abstract class LockSettingsInternal { 
    public static final int ARM_REBOOT_ERROR_STORE_ESCROW_KEY = 7;

    // TODO(b/183140900) split store escrow key errors into detailed ones.



    /**

     * Unlocks the credential-encrypted storage for the given user if the user is not secured, i.e.

     * doesn't have an LSKF.

     * <p>

     * This doesn't throw an exception on failure; whether the storage has been unlocked can be

     * determined by {@link StorageManager#isUserKeyUnlocked()}.

     *

     * @param userId the ID of the user whose storage to unlock

     */

    public abstract void unlockUserKeyIfUnsecured(@UserIdInt int userId);



    /**

     * Creates the locksettings state for a new user.

     * <p>

     * This includes creating a synthetic password and protecting it with an empty LSKF.

     *

     * @param userId the ID of the new user

     * @param userSerialNumber the serial number of the new user

     */

    public abstract void createNewUser(@UserIdInt int userId, int userSerialNumber);



    /**

     * Removes the locksettings state for the given user.

     * <p>

     * This includes removing the user's synthetic password and any protectors that are protecting

     * it.

     *

     * @param userId the ID of the user being removed

     */

    public abstract void removeUser(@UserIdInt int userId);



    /**

     * Create an escrow token for the current user, which can later be used to unlock FBE

     * or change user password.