summaryrefslogtreecommitdiff
path: root/src/com/android/se/security/AccessRuleCache.java
AgeCommit message (Collapse)Author
2020-01-08Add Carrier Privilege supportJack Yu
Support Carrier Privilege rules. Bug: 139701995 Test: Check carrier privilege rules could be parsed correctly Change-Id: I2838d335f9993eb7e50323773ed52579f53766a3
2019-08-28Missing APDU access rule attribute shall be solved after the combinationYoshiaki Naka
If the access rules are of different types (i.e. NFC permission, APDU permission), both rules are combined and thus both rules apply. That is the policy of the rules combination process described in the clause 3.4.1 of GP SEAC specification. Interpretation of missing APDU access rule attribute shall be done after all combination process is finished. Bug: 129524272 Test: Confirmed no error with GP SEAC Test Plan v1.0.6 and SEAC CTS TCs Change-Id: I32932b00d0cd4b8df31fb2194b8dd8766f0dd44f
2019-08-23Missing NFC access rule attribute shall be solved after the combinationYoshiaki Naka
If the access rules are of different types (i.e. NFC permission, APDU permission), both rules are combined and thus both rules apply. That is the policy of the rules combination process described in the clause 3.4.1 of GP SEAC specification. Interpretation of missing NFC access rule attribute shall be done after all combination process is finished. Bug: 129524272 Test: Confirmed no error with GP SEAC Test Plan v1.0.6 and SEAC CTS TCs Change-Id: Iea06a4496b7a09a21c10700781f8bf988405592f
2019-08-23Keep the channel access flag UNDEFINED if APDU-AR-DO is missingYoshiaki Naka
ChannelAccess.setAccess() shall not be called with DENIED until the interpretation of the access rules retrieved from ARA is finished, if 'NEVER' is not explicitly specified in APDU-AR-DO. Bug: 129509913 Test: Confirmed no error with GP SEAC Test Plan v1.0.6 and SEAC CTS TCs Change-Id: I0f20baf544f95f7c584ad4c6d752a8d43d8cc195
2019-03-22Differentiate logs output while checking the access rulesYosuke Iwakura
AccessRuleCache.findAccessRule() logs access rule when the appropriate rule is found. The log should clearly state which condition is met. It is helpful to have a log of hash of application. Bug: 128686348 Test: Manually checked the logs. Change-Id: I6cdad43d68a067051a45defd6606ee94e517ada3
2019-03-20Missing NFC access rule shall be ALLOWED if APDU access rule is ALLOWEDYoshiaki Naka
There is a case that missing NFC accees rule is mistakenly treated as DENIED if access rules are retrieved from ARA-M. It shall be interpreted as ALLOWED if relevant APDU access rule, ALLOWED or filter, exists. Bug: 127878096 Test: Confirmed no error with GP SEAC Test Plan v1.0.6 and SEAC CTS TCs Change-Id: I0f86682d95e168e72659af487d0f102a6de79597
2019-03-14Prevent Crashes due to Carrier Privilege RulesRuchi Kandoi
Detect Carrier Privilege Rules and ignore them. Test: None Bug: 127880615 Change-Id: Ia80a8c6abdd12f56c0540d9165eb04b67c63fc22
2019-03-14Add support for SHA-256 Hash_REF_DORuchi Kandoi
Bug: 127536923 Test: run cts CtsSecureElementAccessControlTestCases* Change-Id: Ia76ca7fde4b9bf3fe2f1c0b0cf770910362b6446
2019-03-04Fix mNFCEventAllowed=UNDEFINEDPierre-Yves Marche
When mNFCEventAllowed=UNDEFINED it must be updated according to GP in all search rules. This was already done in A & C but not fixed in B & D. Test: test transaction Event using CTS SIM using AID a000000476416e64726f696443545341 Change-Id: I9b6568965403c0f4c60507a3530537ed6284a62c
2018-03-13Deny access if APDU access is not defined.Ruchi Kandoi
Test: Secure Element initializes Bug: 74536289 Change-Id: Iffe66b42adc21628e3def830579faf553c100ef5
2018-03-06Remove APDU log exchanged in communication with applet in SEYoshiaki Naka
The device must avoid to log any sensitive information such as APDU command or response exchanged in communication with applet located in the secure element. Refer to TS26_NFC_REQ_163 described in TS.26 - NFC Handset Requirements. Bug: 74127314 Test: Confirmed that GSMA TS.27 TC 15.9.3.2.1 does not fail. Change-Id: I62fdf021a2f1be77d2608dae9061c5780ea245f1
2018-03-05Search for rule with specific AID but for other hashYosuke Iwakura
It must be possible to search the access rule cache for a rule that contains the requested AID but with another specific hash value. Global Platform SEAC Device Side Test Plan TC 4.1 (c0-ee-09) fails as no REF_DO is found in the access rule cache if this fix is not applied. Bug: 73786675 Bug: 73133863 Test: Confirmed that the TC 4.1 above can pass with this change. Change-Id: I3965d481d07272c16c86240b901045316847719c
2018-02-01Open Mobile API for packages/apps/SecureElementJeremy O'Donoghue
This contribution is an implementation of the GlobalPlatform Open Mobile API for Android with some modifications to namespaces and packages to make it suitable as a core Android component. This contribution is based on: 0001-Open-Source-Contribution-of-Smartcard-Service-for-fr.patch which can be found in https://portland.source.codeaurora.org/patches/quic/la/PATCH_217881_OpenMobileAPI_20171208.tar.gz and 0001-Code-reorganization-of-Open-Mobile-API-packages-apps.patch which can be found in https://portland.source.codeaurora.org/patches/quic/la/PATCH_217881_OpenMobileAPI_20171206.tar.gz The first patch should be applied, followed by the second. The submitted patchs were originally derived from https://source.codeaurora.org/quic/la/platform/packages/apps/SmartCardService/commit/?h=LA.BF64.1.2.1&id=06ecea9abb8264049f52c7e31c0bc13330a425d5. Test: Basic functionality test on target device - Verify access rules are read from ARF on start-up - Verify that access rules are updated on refresh tag - Verify basic APDU transfer Test performed in conjunction with commit 0269d238c1fc1212c8e7eb1717b47977f8f3b1fa on frameworks/base Change-Id: Ia6c5b3657f83efa1551a067bd6aee03c68876c09 Signed-off-by: Jeremy O'Donoghue <jodonogh@codeaurora.org>
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 12:53:33 +0000