diff options
| -rw-r--r-- | gatekeeperd/Android.bp | 3 | ||||
| -rw-r--r-- | gatekeeperd/gatekeeperd.cpp | 73 |
2 files changed, 21 insertions, 55 deletions
diff --git a/gatekeeperd/Android.bp b/gatekeeperd/Android.bp index 2d9a82025..27a645288 100644 --- a/gatekeeperd/Android.bp +++ b/gatekeeperd/Android.bp @@ -28,7 +28,6 @@ cc_binary { shared_libs: [ "libbinder", - "libbinder_ndk", "libgatekeeper", "libgsi", "liblog", @@ -41,8 +40,6 @@ cc_binary { "libhidlbase", "android.hardware.gatekeeper@1.0", "libgatekeeper_aidl", - "android.hardware.security.keymint-unstable-ndk_platform", - "android.security.authorization-ndk_platform", ], static_libs: ["libscrypt_static"], diff --git a/gatekeeperd/gatekeeperd.cpp b/gatekeeperd/gatekeeperd.cpp index ced757345..b982dbcf6 100644 --- a/gatekeeperd/gatekeeperd.cpp +++ b/gatekeeperd/gatekeeperd.cpp @@ -19,44 +19,42 @@ #include <android/service/gatekeeper/BnGateKeeperService.h> #include <gatekeeper/GateKeeperResponse.h> -#include <endian.h> #include <errno.h> #include <fcntl.h> +#include <inttypes.h> +#include <stdint.h> #include <unistd.h> #include <memory> +#include <android/security/keystore/IKeystoreService.h> #include <android-base/logging.h> #include <android-base/properties.h> -#include <android/binder_manager.h> -#include <android/security/keystore/IKeystoreService.h> #include <binder/IPCThreadState.h> #include <binder/IServiceManager.h> #include <binder/PermissionCache.h> -#include <gatekeeper/password_handle.h> // for password_handle_t +#include <gatekeeper/password_handle.h> // for password_handle_t +#include <hardware/gatekeeper.h> #include <hardware/hw_auth_token.h> +#include <keystore/keystore.h> // For error code #include <keystore/keystore_return_types.h> #include <libgsi/libgsi.h> #include <log/log.h> +#include <utils/Log.h> #include <utils/String16.h> -#include <aidl/android/hardware/security/keymint/HardwareAuthToken.h> -#include <aidl/android/security/authorization/IKeystoreAuthorization.h> -#include <android/hardware/gatekeeper/1.0/IGatekeeper.h> #include <hidl/HidlSupport.h> +#include <android/hardware/gatekeeper/1.0/IGatekeeper.h> using android::sp; -using android::hardware::Return; -using android::hardware::gatekeeper::V1_0::GatekeeperResponse; -using android::hardware::gatekeeper::V1_0::GatekeeperStatusCode; using android::hardware::gatekeeper::V1_0::IGatekeeper; +using android::hardware::gatekeeper::V1_0::GatekeeperStatusCode; +using android::hardware::gatekeeper::V1_0::GatekeeperResponse; +using android::hardware::Return; using ::android::binder::Status; using ::android::service::gatekeeper::BnGateKeeperService; using GKResponse = ::android::service::gatekeeper::GateKeeperResponse; using GKResponseCode = ::android::service::gatekeeper::ResponseCode; -using ::aidl::android::hardware::security::keymint::HardwareAuthenticatorType; -using ::aidl::android::hardware::security::keymint::HardwareAuthToken; -using ::aidl::android::security::authorization::IKeystoreAuthorization; namespace android { @@ -64,7 +62,7 @@ static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SE static const String16 DUMP_PERMISSION("android.permission.DUMP"); class GateKeeperProxy : public BnGateKeeperService { - public: +public: GateKeeperProxy() { clear_state_if_needed_done = false; hw_device = IGatekeeper::getService(); @@ -75,7 +73,8 @@ class GateKeeperProxy : public BnGateKeeperService { } } - virtual ~GateKeeperProxy() {} + virtual ~GateKeeperProxy() { + } void store_sid(uint32_t userId, uint64_t sid) { char filename[21]; @@ -97,7 +96,7 @@ class GateKeeperProxy : public BnGateKeeperService { if (mark_cold_boot() && !is_running_gsi) { ALOGI("cold boot: clearing state"); if (hw_device) { - hw_device->deleteAllUsers([](const GatekeeperResponse&) {}); + hw_device->deleteAllUsers([](const GatekeeperResponse &){}); } } @@ -105,7 +104,7 @@ class GateKeeperProxy : public BnGateKeeperService { } bool mark_cold_boot() { - const char* filename = ".coldboot"; + const char *filename = ".coldboot"; if (access(filename, F_OK) == -1) { int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR); if (fd < 0) { @@ -300,34 +299,7 @@ class GateKeeperProxy : public BnGateKeeperService { if (gkResponse->response_code() == GKResponseCode::OK) { if (gkResponse->payload().size() != 0) { - // try to connect to IKeystoreAuthorization AIDL service first. - ::ndk::SpAIBinder authzBinder( - AServiceManager_getService("android.security.authorization")); - auto authzService = IKeystoreAuthorization::fromBinder(authzBinder); - if (authzService) { - if (gkResponse->payload().size() != sizeof(hw_auth_token_t)) { - LOG(ERROR) << "Incorrect size of AuthToken payload."; - return GK_ERROR; - } - - const hw_auth_token_t* hwAuthToken = - reinterpret_cast<const hw_auth_token_t*>(gkResponse->payload().data()); - HardwareAuthToken authToken; - - authToken.timestamp.milliSeconds = betoh64(hwAuthToken->timestamp); - authToken.challenge = hwAuthToken->challenge; - authToken.authenticatorId = hwAuthToken->authenticator_id; - authToken.authenticatorType = static_cast<HardwareAuthenticatorType>( - betoh32(hwAuthToken->authenticator_type)); - authToken.mac.assign(&hwAuthToken->hmac[0], &hwAuthToken->hmac[32]); - auto result = authzService->addAuthToken(authToken); - if (!result.isOk()) { - LOG(ERROR) << "Failure in sending AuthToken to AuthorizationService."; - return GK_ERROR; - } - } sp<IServiceManager> sm = defaultServiceManager(); - sp<IBinder> binder = sm->getService(String16("android.security.keystore")); sp<security::keystore::IKeystoreService> service = interface_cast<security::keystore::IKeystoreService>(binder); @@ -338,12 +310,9 @@ class GateKeeperProxy : public BnGateKeeperService { if (!binder_result.isOk() || !keystore::KeyStoreServiceReturnCode(result).isOk()) { LOG(ERROR) << "Failure sending auth token to KeyStore: " << result; - return GK_ERROR; } } else { - LOG(ERROR) << "Cannot deliver auth token. Unable to communicate with " - "Keystore."; - return GK_ERROR; + LOG(ERROR) << "Cannot deliver auth token. Unable to communicate with Keystore."; } } @@ -397,23 +366,23 @@ class GateKeeperProxy : public BnGateKeeperService { } if (hw_device == NULL) { - const char* result = "Device not available"; + const char *result = "Device not available"; write(fd, result, strlen(result) + 1); } else { - const char* result = "OK"; + const char *result = "OK"; write(fd, result, strlen(result) + 1); } return OK; } - private: +private: sp<IGatekeeper> hw_device; bool clear_state_if_needed_done; bool is_running_gsi; }; -} // namespace android +}// namespace android int main(int argc, char* argv[]) { ALOGI("Starting gatekeeperd..."); |