tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

hidl2aidl: conversion of gatekeeper hidl to aidl am: 82599ddafa am: caf275b15b am: f55dd8e1b6 am: 92edeedf74 am: eb60a3f6f5

Browse source 
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2161976

Change-Id: Ieff3524414a560c3758cf2f59b5ad127988bbd0f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Subrahmanyaman 2022-09-22 03:18:44 +00:00 committed by Automerger Merge Worker
commit 9281ae50ed
9 changed files with 395 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
compatibility_matrices/compatibility_matrix.current.xml
View file

@ -222,7 +222,7 @@
<instance>default</instance>
</interface>
</hal>
<hal format="hidl" optional="false">
<hal format="hidl" optional="true">
<name>android.hardware.gatekeeper</name>
<version>1.0</version>
<interface>
@ -230,6 +230,14 @@
<instance>default</instance>
</interface>
</hal>
<hal format="aidl" optional="true">
<name>android.hardware.gatekeeper</name>
<version>1</version>
<interface>
<name>IGatekeeper</name>
<instance>default</instance>
</interface>
</hal>
<hal format="aidl" optional="true">
<name>android.hardware.gnss</name>
<version>2</version>

2
gatekeeper/OWNERS Normal file
View file

@ -0,0 +1,2 @@
swillden@google.com
guangzhu@google.com

29
gatekeeper/aidl/Android.bp Normal file
View file

@ -0,0 +1,29 @@
package {
// See: http://go/android-license-faq
// A large-scale-change added 'default_applicable_licenses' to import
// all of the 'license_kinds' from "hardware_interfaces_license"
// to get the below license kinds:
// SPDX-license-identifier-Apache-2.0
default_applicable_licenses: ["hardware_interfaces_license"],
}
aidl_interface {
name: "android.hardware.gatekeeper",
vendor_available: true,
imports: [
"android.hardware.security.keymint-V2",
],
srcs: ["android/hardware/gatekeeper/*.aidl"],
stability: "vintf",
backend: {
java: {
platform_apis: true,
},
ndk: {
apps_enabled: false,
},
cpp: {
enabled: false,
},
},
}

41
gatekeeper/aidl/aidl_api/android.hardware.gatekeeper/current/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
///////////////////////////////////////////////////////////////////////////////
// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. //
///////////////////////////////////////////////////////////////////////////////
// This file is a snapshot of an AIDL file. Do not edit it manually. There are
// two cases:
// 1). this is a frozen version file - do not edit this in any case.
// 2). this is a 'current' file. If you make a backwards compatible change to
// the interface (from the latest frozen version), the build system will
// prompt you to update this file with `m <name>-update-api`.
//
// You must not make a backward incompatible change to any AIDL file built
// with the aidl_interface module type with versions property set. The module
// type is used to build AIDL files in a way that they can be used across
// independently updatable components of the system. If a device is shipped
// with such a backward incompatible change, it has a high risk of breaking
// later when a module using the interface is updated, e.g., Mainline modules.
package android.hardware.gatekeeper;
@VintfStability
parcelable GatekeeperEnrollResponse {
int statusCode;
int timeoutMs;
long secureUserId;
byte[] data;
}

40
gatekeeper/aidl/aidl_api/android.hardware.gatekeeper/current/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl Normal file
View file

@ -0,0 +1,40 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
///////////////////////////////////////////////////////////////////////////////
// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. //
///////////////////////////////////////////////////////////////////////////////
// This file is a snapshot of an AIDL file. Do not edit it manually. There are
// two cases:
// 1). this is a frozen version file - do not edit this in any case.
// 2). this is a 'current' file. If you make a backwards compatible change to
// the interface (from the latest frozen version), the build system will
// prompt you to update this file with `m <name>-update-api`.
//
// You must not make a backward incompatible change to any AIDL file built
// with the aidl_interface module type with versions property set. The module
// type is used to build AIDL files in a way that they can be used across
// independently updatable components of the system. If a device is shipped
// with such a backward incompatible change, it has a high risk of breaking
// later when a module using the interface is updated, e.g., Mainline modules.
package android.hardware.gatekeeper;
@VintfStability
parcelable GatekeeperVerifyResponse {
int statusCode;
int timeoutMs;
android.hardware.security.keymint.HardwareAuthToken hardwareAuthToken;
}

46
gatekeeper/aidl/aidl_api/android.hardware.gatekeeper/current/android/hardware/gatekeeper/IGatekeeper.aidl Normal file
View file

@ -0,0 +1,46 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
///////////////////////////////////////////////////////////////////////////////
// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE. //
///////////////////////////////////////////////////////////////////////////////
// This file is a snapshot of an AIDL file. Do not edit it manually. There are
// two cases:
// 1). this is a frozen version file - do not edit this in any case.
// 2). this is a 'current' file. If you make a backwards compatible change to
// the interface (from the latest frozen version), the build system will
// prompt you to update this file with `m <name>-update-api`.
//
// You must not make a backward incompatible change to any AIDL file built
// with the aidl_interface module type with versions property set. The module
// type is used to build AIDL files in a way that they can be used across
// independently updatable components of the system. If a device is shipped
// with such a backward incompatible change, it has a high risk of breaking
// later when a module using the interface is updated, e.g., Mainline modules.
package android.hardware.gatekeeper;
@SensitiveData @VintfStability
interface IGatekeeper {
void deleteAllUsers();
void deleteUser(in int uid);
android.hardware.gatekeeper.GatekeeperEnrollResponse enroll(in int uid, in byte[] currentPasswordHandle, in byte[] currentPassword, in byte[] desiredPassword);
android.hardware.gatekeeper.GatekeeperVerifyResponse verify(in int uid, in long challenge, in byte[] enrolledPasswordHandle, in byte[] providedPassword);
const int STATUS_REENROLL = 1;
const int STATUS_OK = 0;
const int ERROR_GENERAL_FAILURE = -1;
const int ERROR_RETRY_TIMEOUT = -2;
const int ERROR_NOT_IMPLEMENTED = -3;
}

41
gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.gatekeeper;
/**
* Gatekeeper response to enroll requests has this structure as mandatory part
*/
@VintfStability
parcelable GatekeeperEnrollResponse {
/**
* Request completion status
*/
int statusCode;
/**
* Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
* otherwise unused (0)
*/
int timeoutMs;
/**
* secure user id.
*/
long secureUserId;
/**
* optional crypto blob. Opaque to Android system.
*/
byte[] data;
}

41
gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.gatekeeper;
import android.hardware.security.keymint.HardwareAuthToken;
/**
* Gatekeeper response to verify requests has this structure as mandatory part
*/
@VintfStability
parcelable GatekeeperVerifyResponse {
/**
* Request completion status
*/
int statusCode;
/**
* Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
* otherwise unused (0)
*/
int timeoutMs;
/**
* On successful verification of the password,
* IGatekeeper implementations must return hardware auth token
* in the response.
*/
HardwareAuthToken hardwareAuthToken;
}

146
gatekeeper/aidl/android/hardware/gatekeeper/IGatekeeper.aidl Normal file
View file

@ -0,0 +1,146 @@
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.hardware.gatekeeper;
import android.hardware.gatekeeper.GatekeeperEnrollResponse;
import android.hardware.gatekeeper.GatekeeperVerifyResponse;
@VintfStability
@SensitiveData
interface IGatekeeper {
/**
* enroll and verify binder calls may return a ServiceSpecificException
* with the following error codes.
*/
/* Success, but upper layers should re-enroll the verified password due to a version change. */
const int STATUS_REENROLL = 1;
/* operation is successful */
const int STATUS_OK = 0;
/* operation is successful. */
const int ERROR_GENERAL_FAILURE = -1;
/* operation should be retried after timeout. */
const int ERROR_RETRY_TIMEOUT = -2;
/* operation is not implemented. */
const int ERROR_NOT_IMPLEMENTED = -3;
/**
* Deletes all the enrolled_password_handles for all uid's. Once called,
* no users must be enrolled on the device.
* This is an optional method.
*
* Service status return:
*
* OK if all the users are deleted successfully.
* ERROR_GENERAL_FAILURE on failure.
* ERROR_NOT_IMPLEMENTED if not implemented.
*/
void deleteAllUsers();
/**
* Deletes the enrolledPasswordHandle associated with the uid. Once deleted
* the user cannot be verified anymore.
* This is an optional method.
*
* Service status return:
*
* OK if user is deleted successfully.
* ERROR_GENERAL_FAILURE on failure.
* ERROR_NOT_IMPLEMENTED if not implemented.
*
* @param uid The Android user identifier
*/
void deleteUser(in int uid);
/**
* Enrolls desiredPassword, which may be derived from a user selected pin
* or password, with the private key used only for enrolling authentication
* factor data.
*
* If there was already a password enrolled, current password handle must be
* passed in currentPasswordHandle, and current password must be passed in
* currentPassword. Valid currentPassword must verify() against
* currentPasswordHandle.
*
* Service status return:
*
* OK if password is enrolled successfully.
* ERROR_GENERAL_FAILURE on failure.
* ERROR_NOT_IMPLEMENTED if not implemented.
*
* @param uid The Android user identifier
*
* @param currentPasswordHandle The currently enrolled password handle the user
* wants to replace. May be empty only if there's no currently enrolled
* password. Otherwise must be non-empty.
*
* @param currentPassword The user's current password in plain text.
* it MUST verify against current_password_handle if the latter is not-empty
*
* @param desiredPassword The new password the user wishes to enroll in
* plaintext.
*
* @return
* On success, data buffer must contain the new password handle referencing
* the password provided in desiredPassword.
* This buffer can be used on subsequent calls to enroll or
* verify. response.statusCode must contain either ERROR_RETRY_TIMEOUT or
* STATUS_OK. On error, this buffer must be empty. This method may return
* ERROR_GENERAL_FAILURE on failure.
* If ERROR_RETRY_TIMEOUT is returned, response.timeout must be non-zero.
*/
GatekeeperEnrollResponse enroll(in int uid, in byte[] currentPasswordHandle,
in byte[] currentPassword, in byte[] desiredPassword);
/**
* Verifies that providedPassword matches enrolledPasswordHandle.
*
* Implementations of this module may retain the result of this call
* to attest to the recency of authentication.
*
* On success, returns verification token in response.data, which shall be
* usable to attest password verification to other trusted services.
*
* Service status return:
*
* OK if password is enrolled successfully.
* ERROR_GENERAL_FAILURE on failure.
* ERROR_NOT_IMPLEMENTED if not implemented.
*
* @param uid The Android user identifier
*
* @param challenge An optional challenge to authenticate against, or 0.
* Used when a separate authenticator requests password verification,
* or for transactional password authentication.
*
* @param enrolledPasswordHandle The currently enrolled password handle that
* user wishes to verify against. Must be non-empty.
*
* @param providedPassword The plaintext password to be verified against the
* enrolledPasswordHandle
*
* @return
* On success, a HardwareAuthToken resulting from this verification is returned.
* response.statusCode must contain either ERROR_RETRY_TIMEOUT or
* or STATUS_REENROLL or STATUS_OK.
* On error, data buffer must be empty.
* This method may return ERROR_GENERAL_FAILURE on failure.
* If password re-enrollment is necessary, it must return STATUS_REENROLL.
* If ERROR_RETRY_TIMEOUT is returned, response.timeout must be non-zero.
*/
GatekeeperVerifyResponse verify(in int uid, in long challenge, in byte[] enrolledPasswordHandle,
in byte[] providedPassword);
}