Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4c81883 authored by Pawan Wagh's avatar Pawan Wagh Committed by Automerger Merge Worker
Browse files

Separating GateKeeperProxy declaration in header am: c5c0c302 

Original change: https://android-review.googlesource.com/c/platform/system/core/+/2555911



Change-Id: I5f804b923bfa487a9f884af90a834340a99cc7b7
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents a0653510 c5c0c302

gatekeeperd/Android.bp

+12 −2
Original line number Diff line number Diff line
@@ -18,8 +18,8 @@ package { 
    default_applicable_licenses: ["Android-Apache-2.0"],

}



cc_binary {

    name: "gatekeeperd",

cc_defaults {

    name: "gatekeeperd_defaults",

    cflags: [

        "-Wall",

        "-Wextra",
@@ -52,6 +52,16 @@ cc_binary { 


    static_libs: ["libscrypt_static"],

    include_dirs: ["external/scrypt/lib/crypto"],

}



cc_binary {

    name: "gatekeeperd",

    defaults: [

        "gatekeeperd_defaults",

    ],

    srcs: [

        "main.cpp",

    ],

    init_rc: ["gatekeeperd.rc"],

}

gatekeeperd/gatekeeperd.cpp

+297 −350
Original line number Diff line number Diff line
@@ -13,11 +13,9 @@ 
 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#define LOG_TAG "gatekeeperd"



#include <android/service/gatekeeper/BnGateKeeperService.h>

#include <gatekeeper/GateKeeperResponse.h>

#include "gatekeeperd.h"



#include <endian.h>

#include <errno.h>
@@ -39,25 +37,18 @@ 
#include <log/log.h>

#include <utils/String16.h>



#include <aidl/android/hardware/gatekeeper/IGatekeeper.h>

#include <aidl/android/hardware/security/keymint/HardwareAuthToken.h>

#include <aidl/android/security/authorization/IKeystoreAuthorization.h>

#include <android/hardware/gatekeeper/1.0/IGatekeeper.h>

#include <hidl/HidlSupport.h>



using android::sp;

using android::hardware::Return;

using android::hardware::gatekeeper::V1_0::GatekeeperResponse;

using android::hardware::gatekeeper::V1_0::GatekeeperStatusCode;

using android::hardware::gatekeeper::V1_0::IGatekeeper;



using AidlGatekeeperEnrollResp = aidl::android::hardware::gatekeeper::GatekeeperEnrollResponse;

using AidlGatekeeperVerifyResp = aidl::android::hardware::gatekeeper::GatekeeperVerifyResponse;

using AidlIGatekeeper = aidl::android::hardware::gatekeeper::IGatekeeper;



using ::android::binder::Status;

using ::android::service::gatekeeper::BnGateKeeperService;

using GKResponse = ::android::service::gatekeeper::GateKeeperResponse;

using GKResponseCode = ::android::service::gatekeeper::ResponseCode;

using ::aidl::android::hardware::security::keymint::HardwareAuthenticatorType;

using ::aidl::android::hardware::security::keymint::HardwareAuthToken;
@@ -70,9 +61,7 @@ static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SE 
static const String16 DUMP_PERMISSION("android.permission.DUMP");

constexpr const char gatekeeperServiceName[] = "android.hardware.gatekeeper.IGatekeeper/default";



class GateKeeperProxy : public BnGateKeeperService {

  public:

    GateKeeperProxy() {

GateKeeperProxy::GateKeeperProxy() {

    clear_state_if_needed_done = false;

    hw_device = IGatekeeper::getService();

    ::ndk::SpAIBinder ks2Binder(AServiceManager_getService(gatekeeperServiceName));
@@ -84,9 +73,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    }

}



    virtual ~GateKeeperProxy() {}



    void store_sid(uint32_t userId, uint64_t sid) {

void GateKeeperProxy::store_sid(uint32_t userId, uint64_t sid) {

    char filename[21];

    snprintf(filename, sizeof(filename), "%u", userId);

    int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
@@ -98,7 +85,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    close(fd);

}



    void clear_state_if_needed() {

void GateKeeperProxy::clear_state_if_needed() {

    if (clear_state_if_needed_done) {

        return;

    }
@@ -115,7 +102,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    clear_state_if_needed_done = true;

}



    bool mark_cold_boot() {

bool GateKeeperProxy::mark_cold_boot() {

    const char* filename = ".coldboot";

    if (access(filename, F_OK) == -1) {

        int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
@@ -129,7 +116,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return false;

}



    void maybe_store_sid(uint32_t userId, uint64_t sid) {

void GateKeeperProxy::maybe_store_sid(uint32_t userId, uint64_t sid) {

    char filename[21];

    snprintf(filename, sizeof(filename), "%u", userId);

    if (access(filename, F_OK) == -1) {
@@ -137,7 +124,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    }

}



    uint64_t read_sid(uint32_t userId) {

uint64_t GateKeeperProxy::read_sid(uint32_t userId) {

    char filename[21];

    uint64_t sid;

    snprintf(filename, sizeof(filename), "%u", userId);
@@ -148,7 +135,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return sid;

}



    void clear_sid(uint32_t userId) {

void GateKeeperProxy::clear_sid(uint32_t userId) {

    char filename[21];

    snprintf(filename, sizeof(filename), "%u", userId);

    if (remove(filename) < 0 && errno != ENOENT) {
@@ -157,9 +144,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    }

}



    // This should only be called on userIds being passed to the GateKeeper HAL. It ensures that

    // secure storage shared across a GSI image and a host image will not overlap.

    uint32_t adjust_userId(uint32_t userId) {

uint32_t GateKeeperProxy::adjust_userId(uint32_t userId) {

    static constexpr uint32_t kGsiOffset = 1000000;

    CHECK(userId < kGsiOffset);

    CHECK((aidl_hw_device != nullptr) || (hw_device != nullptr));
@@ -171,9 +156,11 @@ class GateKeeperProxy : public BnGateKeeperService { 


#define GK_ERROR *gkResponse = GKResponse::error(), Status::ok()



    Status enroll(int32_t userId, const std::optional<std::vector<uint8_t>>& currentPasswordHandle,

Status GateKeeperProxy::enroll(int32_t userId,

                               const std::optional<std::vector<uint8_t>>& currentPasswordHandle,

                               const std::optional<std::vector<uint8_t>>& currentPassword,

                  const std::vector<uint8_t>& desiredPassword, GKResponse* gkResponse) override {

                               const std::vector<uint8_t>& desiredPassword,

                               GKResponse* gkResponse) {

    IPCThreadState* ipc = IPCThreadState::self();

    const int calling_pid = ipc->getCallingPid();

    const int calling_uid = ipc->getCallingUid();
@@ -227,8 +214,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
        if (rsp.statusCode >= AidlIGatekeeper::STATUS_OK) {

            *gkResponse = GKResponse::ok({rsp.data.begin(), rsp.data.end()});

            secureUserId = static_cast<uint64_t>(rsp.secureUserId);

            } else if (rsp.statusCode == AidlIGatekeeper::ERROR_RETRY_TIMEOUT &&

                       rsp.timeoutMs > 0) {

        } else if (rsp.statusCode == AidlIGatekeeper::ERROR_RETRY_TIMEOUT && rsp.timeoutMs > 0) {

            *gkResponse = GKResponse::retry(rsp.timeoutMs);

        } else {

            *gkResponse = GKResponse::error();
@@ -280,16 +266,17 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return Status::ok();

}



    Status verify(int32_t userId, const ::std::vector<uint8_t>& enrolledPasswordHandle,

                  const ::std::vector<uint8_t>& providedPassword, GKResponse* gkResponse) override {

Status GateKeeperProxy::verify(int32_t userId, const ::std::vector<uint8_t>& enrolledPasswordHandle,

                               const ::std::vector<uint8_t>& providedPassword,

                               GKResponse* gkResponse) {

    return verifyChallenge(userId, 0 /* challenge */, enrolledPasswordHandle, providedPassword,

                           gkResponse);

}



    Status verifyChallenge(int32_t userId, int64_t challenge,

Status GateKeeperProxy::verifyChallenge(int32_t userId, int64_t challenge,

                                        const std::vector<uint8_t>& enrolledPasswordHandle,

                                        const std::vector<uint8_t>& providedPassword,

                           GKResponse* gkResponse) override {

                                        GKResponse* gkResponse) {

    IPCThreadState* ipc = IPCThreadState::self();

    const int calling_pid = ipc->getCallingPid();

    const int calling_uid = ipc->getCallingUid();
@@ -325,8 +312,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    if (aidl_hw_device) {

        // AIDL gatekeeper service

        AidlGatekeeperVerifyResp rsp;

            auto result =

                aidl_hw_device->verify(hw_userId, challenge, curPwdHandle, enteredPwd, &rsp);

        auto result = aidl_hw_device->verify(hw_userId, challenge, curPwdHandle, enteredPwd, &rsp);

        if (!result.isOk()) {

            LOG(ERROR) << "verify transaction failed";

            return GK_ERROR;
@@ -334,9 +320,9 @@ class GateKeeperProxy : public BnGateKeeperService { 
        if (rsp.statusCode >= AidlIGatekeeper::STATUS_OK) {

            secureUserId = rsp.hardwareAuthToken.userId;

            // Serialize HardwareAuthToken to a vector as hw_auth_token_t.

                *gkResponse = GKResponse::ok(authToken2AidlVec(rsp.hardwareAuthToken),

                                             rsp.statusCode ==

                                                 AidlIGatekeeper::STATUS_REENROLL /* reenroll */);

            *gkResponse = GKResponse::ok(

                    authToken2AidlVec(rsp.hardwareAuthToken),

                    rsp.statusCode == AidlIGatekeeper::STATUS_REENROLL /* reenroll */);

        } else if (rsp.statusCode == AidlIGatekeeper::ERROR_RETRY_TIMEOUT) {

            *gkResponse = GKResponse::retry(rsp.timeoutMs);

        } else {
@@ -371,8 +357,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    if (gkResponse->response_code() == GKResponseCode::OK) {

        if (gkResponse->payload().size() != 0) {

            // try to connect to IKeystoreAuthorization AIDL service first.

                AIBinder* authzAIBinder =

                        AServiceManager_getService("android.security.authorization");

            AIBinder* authzAIBinder = AServiceManager_getService("android.security.authorization");

            ::ndk::SpAIBinder authzBinder(authzAIBinder);

            auto authzService = IKeystoreAuthorization::fromBinder(authzBinder);

            if (authzService) {
@@ -410,12 +395,12 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return Status::ok();

}



    Status getSecureUserId(int32_t userId, int64_t* sid) override {

Status GateKeeperProxy::getSecureUserId(int32_t userId, int64_t* sid) {

    *sid = read_sid(userId);

    return Status::ok();

}



    Status clearSecureUserId(int32_t userId) override {

Status GateKeeperProxy::clearSecureUserId(int32_t userId) {

    IPCThreadState* ipc = IPCThreadState::self();

    const int calling_pid = ipc->getCallingPid();

    const int calling_uid = ipc->getCallingUid();
@@ -434,7 +419,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return Status::ok();

}



    Status reportDeviceSetupComplete() override {

Status GateKeeperProxy::reportDeviceSetupComplete() {

    IPCThreadState* ipc = IPCThreadState::self();

    const int calling_pid = ipc->getCallingPid();

    const int calling_uid = ipc->getCallingUid();
@@ -447,7 +432,7 @@ class GateKeeperProxy : public BnGateKeeperService { 
    return Status::ok();

}



    status_t dump(int fd, const Vector<String16>&) override {

status_t GateKeeperProxy::dump(int fd, const Vector<String16>&) {

    IPCThreadState* ipc = IPCThreadState::self();

    const int pid = ipc->getCallingPid();

    const int uid = ipc->getCallingUid();
@@ -465,42 +450,4 @@ class GateKeeperProxy : public BnGateKeeperService { 


    return OK;

}



  private:

    // AIDL gatekeeper service.

    std::shared_ptr<AidlIGatekeeper> aidl_hw_device;

    // HIDL gatekeeper service.

    sp<IGatekeeper> hw_device;



    bool clear_state_if_needed_done;

    bool is_running_gsi;

};

}  // namespace android
 


int main(int argc, char* argv[]) {

    ALOGI("Starting gatekeeperd...");

    if (argc < 2) {

        ALOGE("A directory must be specified!");

        return 1;

    }

    if (chdir(argv[1]) == -1) {

        ALOGE("chdir: %s: %s", argv[1], strerror(errno));

        return 1;

    }



    android::sp<android::IServiceManager> sm = android::defaultServiceManager();

    android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy();

    android::status_t ret =

        sm->addService(android::String16("android.service.gatekeeper.IGateKeeperService"), proxy);

    if (ret != android::OK) {

        ALOGE("Couldn't register binder service!");

        return -1;

    }



    /*

     * We're the only thread in existence, so we're just going to process

     * Binder transaction as a single-threaded program.

     */

    android::IPCThreadState::self()->joinThreadPool();

    return 0;

}

gatekeeperd/gatekeeperd.h

0 → 100644
+83 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2023 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <aidl/android/hardware/gatekeeper/IGatekeeper.h>

#include <android/hardware/gatekeeper/1.0/IGatekeeper.h>

#include <android/service/gatekeeper/BnGateKeeperService.h>

#include <gatekeeper/GateKeeperResponse.h>



using ::android::hardware::gatekeeper::V1_0::IGatekeeper;

using AidlIGatekeeper = ::aidl::android::hardware::gatekeeper::IGatekeeper;

using ::android::binder::Status;

using ::android::service::gatekeeper::BnGateKeeperService;

using GKResponse = ::android::service::gatekeeper::GateKeeperResponse;



namespace android {



class GateKeeperProxy : public BnGateKeeperService {

  public:

    GateKeeperProxy();



    virtual ~GateKeeperProxy() {}



    void store_sid(uint32_t userId, uint64_t sid);



    void clear_state_if_needed();



    bool mark_cold_boot();



    void maybe_store_sid(uint32_t userId, uint64_t sid);



    uint64_t read_sid(uint32_t userId);



    void clear_sid(uint32_t userId);



    // This should only be called on userIds being passed to the GateKeeper HAL. It ensures that

    // secure storage shared across a GSI image and a host image will not overlap.

    uint32_t adjust_userId(uint32_t userId);



#define GK_ERROR *gkResponse = GKResponse::error(), Status::ok()



    Status enroll(int32_t userId, const std::optional<std::vector<uint8_t>>& currentPasswordHandle,

                  const std::optional<std::vector<uint8_t>>& currentPassword,

                  const std::vector<uint8_t>& desiredPassword, GKResponse* gkResponse) override;



    Status verify(int32_t userId, const ::std::vector<uint8_t>& enrolledPasswordHandle,

                  const ::std::vector<uint8_t>& providedPassword, GKResponse* gkResponse) override;



    Status verifyChallenge(int32_t userId, int64_t challenge,

                           const std::vector<uint8_t>& enrolledPasswordHandle,

                           const std::vector<uint8_t>& providedPassword,

                           GKResponse* gkResponse) override;



    Status getSecureUserId(int32_t userId, int64_t* sid) override;



    Status clearSecureUserId(int32_t userId) override;



    Status reportDeviceSetupComplete() override;



    status_t dump(int fd, const Vector<String16>&) override;



  private:

    // AIDL gatekeeper service.

    std::shared_ptr<AidlIGatekeeper> aidl_hw_device;

    // HIDL gatekeeper service.

    sp<IGatekeeper> hw_device;



    bool clear_state_if_needed_done;

    bool is_running_gsi;

};

}  // namespace android

gatekeeperd/main.cpp

0 → 100644
+50 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2023 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <binder/IPCThreadState.h>

#include <binder/IServiceManager.h>



#include <log/log.h>



#include "gatekeeperd.h"



int main(int argc, char* argv[]) {

    ALOGI("Starting gatekeeperd...");

    if (argc < 2) {

        ALOGE("A directory must be specified!");

        return 1;

    }

    if (chdir(argv[1]) == -1) {

        ALOGE("chdir: %s: %s", argv[1], strerror(errno));

        return 1;

    }



    android::sp<android::IServiceManager> sm = android::defaultServiceManager();

    android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy();

    android::status_t ret = sm->addService(

            android::String16("android.service.gatekeeper.IGateKeeperService"), proxy);

    if (ret != android::OK) {

        ALOGE("Couldn't register binder service!");

        return -1;

    }



    /*

     * We're the only thread in existence, so we're just going to process

     * Binder transaction as a single-threaded program.

     */

    android::IPCThreadState::self()->joinThreadPool();

    return 0;

}