diff options
Diffstat (limited to 'keystore/java/android/security')
4 files changed, 52 insertions, 2 deletions
diff --git a/keystore/java/android/security/AndroidKeyStore.java b/keystore/java/android/security/AndroidKeyStore.java index 1c068be..c259c25 100644 --- a/keystore/java/android/security/AndroidKeyStore.java +++ b/keystore/java/android/security/AndroidKeyStore.java @@ -535,6 +535,12 @@ public class AndroidKeyStore extends KeyStoreSpi { args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, KeyStoreKeyProperties.UserAuthenticator.allToKeymaster( params.getUserAuthenticators())); + long secureUserId = GateKeeper.getSecureUserId(); + if (secureUserId == 0) { + throw new IllegalStateException("Secure lock screen must be enabled" + + " to import keys requiring user authentication"); + } + args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, secureUserId); } if (params.isInvalidatedOnNewFingerprintEnrolled()) { // TODO: Add the invalidate on fingerprint enrolled constraint once Keymaster supports diff --git a/keystore/java/android/security/GateKeeper.java b/keystore/java/android/security/GateKeeper.java new file mode 100644 index 0000000..c9f06e9 --- /dev/null +++ b/keystore/java/android/security/GateKeeper.java @@ -0,0 +1,30 @@ +package android.security; + +import android.os.RemoteException; +import android.os.ServiceManager; +import android.os.UserHandle; +import android.service.gatekeeper.IGateKeeperService; + +/** + * Convenience class for accessing the gatekeeper service. + * + * @hide + */ +public abstract class GateKeeper { + + private GateKeeper() {} + + public static IGateKeeperService getService() { + return IGateKeeperService.Stub.asInterface( + ServiceManager.getService("android.service.gatekeeper.IGateKeeperService")); + } + + public static long getSecureUserId() throws IllegalStateException { + try { + return GateKeeper.getService().getSecureUserId(UserHandle.myUserId()); + } catch (RemoteException e) { + throw new IllegalStateException( + "Failed to obtain secure user ID from gatekeeper", e); + } + } +} diff --git a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java index 72c485a..d1abe12 100644 --- a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java +++ b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java @@ -167,6 +167,12 @@ public abstract class KeyStoreKeyGeneratorSpi extends KeyGeneratorSpi { args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, KeyStoreKeyProperties.UserAuthenticator.allToKeymaster( spec.getUserAuthenticators())); + long secureUserId = GateKeeper.getSecureUserId(); + if (secureUserId == 0) { + throw new IllegalStateException("Secure lock screen must be enabled" + + " to generate keys requiring user authentication"); + } + args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, secureUserId); } if (spec.isInvalidatedOnNewFingerprintEnrolled()) { // TODO: Add the invalidate on fingerprint enrolled constraint once Keymaster supports diff --git a/keystore/java/android/security/KeyStoreKeyProperties.java b/keystore/java/android/security/KeyStoreKeyProperties.java index b1f330f..206103f 100644 --- a/keystore/java/android/security/KeyStoreKeyProperties.java +++ b/keystore/java/android/security/KeyStoreKeyProperties.java @@ -217,7 +217,7 @@ public abstract class KeyStoreKeyProperties { } @Retention(RetentionPolicy.SOURCE) - @IntDef({Origin.GENERATED, Origin.IMPORTED}) + @IntDef({Origin.GENERATED, Origin.IMPORTED, Origin.UNKNOWN}) public @interface OriginEnum {} /** @@ -233,14 +233,22 @@ public abstract class KeyStoreKeyProperties { public static final int IMPORTED = 1 << 1; /** + * Origin of the key is unknown. This can occur only for keys backed by an old TEE + * implementation which does not record origin information. + */ + public static final int UNKNOWN = 1 << 2; + + /** * @hide */ public static @OriginEnum int fromKeymaster(int origin) { switch (origin) { - case KeymasterDefs.KM_ORIGIN_HARDWARE: + case KeymasterDefs.KM_ORIGIN_GENERATED: return GENERATED; case KeymasterDefs.KM_ORIGIN_IMPORTED: return IMPORTED; + case KeymasterDefs.KM_ORIGIN_UNKNOWN: + return UNKNOWN; default: throw new IllegalArgumentException("Unknown origin: " + origin); } |