Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c1bf5f8a authored by Catherine Vlasov's avatar Catherine Vlasov
Browse files

Read Verified Boot key from system property in default KeyMint implementation. 

Even though this (insecure) implementation technically has access to
the Verified Boot key on unlocked builds, it should only send this
value if the bootloader is locked (in order to pass the VTS-16+ test
that checks that the attested "rootOfTrust.verifiedBootKey" value is
32 bytes of zeroes on unlocked devices).

Bug: 220834466
Test: atest VtsAidlKeyMintTargetTest (uses the KeyMint I'm updating)
Change-Id: I30e82165792facef85e9d66d4e6ebe8f64e1086b
parent 584871b6

security/keymint/aidl/default/hal/lib.rs

+13 −3
Original line number Diff line number Diff line
@@ -47,11 +47,9 @@ pub fn attestation_id_info() -> kmr_wire::AttestationIdInfo { 


/// Get boot information based on system properties.

pub fn get_boot_info() -> kmr_wire::SetBootInfoRequest {

    // No access to a verified boot key.

    let verified_boot_key = vec![0; 32];

    let vbmeta_digest = get_property("ro.boot.vbmeta.digest").unwrap_or_else(|_| "00".repeat(32));

    let verified_boot_hash = hex::decode(&vbmeta_digest).unwrap_or_else(|_e| {

        error!("failed to parse hex data in '{}'", vbmeta_digest);

        error!("failed to parse VBMeta digest hex data in '{vbmeta_digest}': {_e:?}");

        vec![0; 32]

    });

    let device_boot_locked = match get_property("ro.boot.vbmeta.device_state")
@@ -65,6 +63,18 @@ pub fn get_boot_info() -> kmr_wire::SetBootInfoRequest { 
            false

        }

    };

    let verified_boot_key_digest =

        get_property("ro.boot.vbmeta.public_key_digest").unwrap_or_else(|_| "00".repeat(32));

    let verified_boot_key = match device_boot_locked {

        true => hex::decode(&verified_boot_key_digest).unwrap_or_else(|_e| {

            error!("Failed to parse Verified Boot key hex data in '{verified_boot_key_digest}': {_e:?}");

            vec![0; 32]

        }),

        // VTS-16+ requires the attested Verified Boot key to be 32 bytes of zeroes when the

        // bootloader is unlocked, so we ignore the property's value in that case. Behaviour

        // prior to VTS-16 is unspecified, so it's fine to return the same.

        false => vec![0; 32],

    };

    let verified_boot_state = match get_property("ro.boot.verifiedbootstate")

        .unwrap_or_else(|_| "no-prop".to_string())

        .as_str()