tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "KeyMint: check length of verified boot key" into main am: 2ae2061864

Browse source 
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2786465

Change-Id: I72ade4eebca23fecabeca1f83246b9735dc3f254
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
David Drysdale 2023-11-29 11:32:52 +00:00 committed by Automerger Merge Worker
commit 25a8c389cc
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
View file

@ -1792,6 +1792,12 @@ void verify_root_of_trust(const vector<uint8_t>& verified_boot_key, bool device_
std::string empty_boot_key(32, '\0');
std::string verified_boot_key_str((const char*)verified_boot_key.data(),
verified_boot_key.size());
if (get_vsr_api_level() >= __ANDROID_API_V__) {
// The attestation should contain the SHA-256 hash of the verified boot
// key. However, this was not checked for earlier versions of the KeyMint
// HAL so only be strict for VSR-V and above.
EXPECT_LE(verified_boot_key.size(), 32);
}
EXPECT_NE(property_get("ro.boot.verifiedbootstate", property_value, ""), 0);
if (!strcmp(property_value, "green")) {
EXPECT_EQ(verified_boot_state, VerifiedBoot::VERIFIED);

6
security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp
View file

@ -114,6 +114,12 @@ class SecureElementProvisioningTest : public testing::Test {
const auto& vbKey = rot->asArray()->get(pos++);
ASSERT_TRUE(vbKey);
ASSERT_TRUE(vbKey->asBstr());
if (get_vsr_api_level() >= __ANDROID_API_V__) {
// The attestation should contain the SHA-256 hash of the verified boot
// key. However, this not was checked for earlier versions of the KeyMint
// HAL so only be strict for VSR-V and above.
ASSERT_LE(vbKey->asBstr()->value().size(), 32);
}
const auto& deviceLocked = rot->asArray()->get(pos++);
ASSERT_TRUE(deviceLocked);