Merge "Credential FRP: keep gatekeeperd credentials after reset" (e1c11252) · Commits · e / os / android_system_core

gatekeeperd/IGateKeeperService.cpp

+6 −0

Original line number	Diff line number	Diff line
		@@ -158,6 +158,12 @@ status_t BnGateKeeperService::onTransact(
		reply->writeNoException();
		return NO_ERROR;
		}
		case REPORT_DEVICE_SETUP_COMPLETE: {
		CHECK_INTERFACE(IGateKeeperService, data, reply);
		reportDeviceSetupComplete();
		reply->writeNoException();
		return NO_ERROR;
		}
		default:
		return BBinder::onTransact(code, data, reply, flags);
		}

gatekeeperd/IGateKeeperService.h

+7 −0

Original line number	Diff line number	Diff line
		@@ -33,6 +33,7 @@ public:
		VERIFY_CHALLENGE = IBinder::FIRST_CALL_TRANSACTION + 2,
		GET_SECURE_USER_ID = IBinder::FIRST_CALL_TRANSACTION + 3,
		CLEAR_SECURE_USER_ID = IBinder::FIRST_CALL_TRANSACTION + 4,
		REPORT_DEVICE_SETUP_COMPLETE = IBinder::FIRST_CALL_TRANSACTION + 5,
		};

		enum {
		@@ -95,6 +96,12 @@ public:
		* Clears the secure user ID associated with the user.
		*/
		virtual void clearSecureUserId(uint32_t uid) = 0;

		/**
		* Notifies gatekeeper that device setup has been completed and any potentially still existing
		* state from before a factory reset can be cleaned up (if it has not been already).
		*/
		virtual void reportDeviceSetupComplete() = 0;
		};

		// ----------------------------------------------------------------------------

gatekeeperd/gatekeeperd.cpp

+34 −7

Original line number	Diff line number	Diff line
		@@ -56,19 +56,13 @@ static const String16 DUMP_PERMISSION("android.permission.DUMP");
		class GateKeeperProxy : public BnGateKeeperService {
		public:
		GateKeeperProxy() {
		clear_state_if_needed_done = false;
		hw_device = IGatekeeper::getService();

		if (hw_device == nullptr) {
		ALOGW("falling back to software GateKeeper");
		soft_device.reset(new SoftGateKeeperDevice());
		}

		if (mark_cold_boot()) {
		ALOGI("cold boot: clearing state");
		if (hw_device != nullptr) {
		hw_device->deleteAllUsers([](const GatekeeperResponse &){});
		}
		}
		}

		virtual ~GateKeeperProxy() {
		@@ -86,6 +80,21 @@ public:
		close(fd);
		}

		void clear_state_if_needed() {
		if (clear_state_if_needed_done) {
		return;
		}

		if (mark_cold_boot()) {
		ALOGI("cold boot: clearing state");
		if (hw_device != nullptr) {
		hw_device->deleteAllUsers([](const GatekeeperResponse &){});
		}
		}

		clear_state_if_needed_done = true;
		}

		bool mark_cold_boot() {
		const char *filename = ".coldboot";
		if (access(filename, F_OK) == -1) {
		@@ -140,6 +149,10 @@ public:
		return PERMISSION_DENIED;
		}

		// Make sure to clear any state from before factory reset as soon as a credential is
		// enrolled (which may happen during device setup).
		clear_state_if_needed();

		// need a desired password to enroll
		if (desired_password_length == 0) return -EINVAL;

		@@ -354,6 +367,18 @@ public:
		}
		}

		virtual void reportDeviceSetupComplete() {
		IPCThreadState* ipc = IPCThreadState::self();
		const int calling_pid = ipc->getCallingPid();
		const int calling_uid = ipc->getCallingUid();
		if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
		ALOGE("%s: permission denied for [%d:%d]", __func__, calling_pid, calling_uid);
		return;
		}

		clear_state_if_needed();
		}

		virtual status_t dump(int fd, const Vector<String16> &) {
		IPCThreadState* ipc = IPCThreadState::self();
		const int pid = ipc->getCallingPid();
		@@ -376,6 +401,8 @@ public:
		private:
		sp<IGatekeeper> hw_device;
		UniquePtr<SoftGateKeeperDevice> soft_device;

		bool clear_state_if_needed_done;
		};
		}// namespace android