tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Model KeyStore security level in keymaster worker" am: ae73ca248e am: e18c228d11

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/security/+/1418729

Change-Id: Ieff7339d64a7542d3a2bee1db671e9c9942157f1
This commit is contained in:
Edman Anjos 2020-09-08 14:01:53 +00:00 committed by Automerger Merge Worker
commit d6f7f93eb0
3 changed files with 24 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
keystore/KeyStore.cpp
View file

@ -60,8 +60,8 @@ KeyStore::KeyStore(const KeymasterDevices& kmDevices,
"KmasterDevices and KeymasterWorkers must have the same size");
for (size_t i = 0; i < kmDevices.size(); ++i) {
if (kmDevices[SecurityLevel(i)]) {
mKmDevices[SecurityLevel(i)] =
std::make_shared<KeymasterWorker>(kmDevices[SecurityLevel(i)], this);
mKmDevices[SecurityLevel(i)] = std::make_shared<KeymasterWorker>(
kmDevices[SecurityLevel(i)], this, SecurityLevel(i));
}
}
}

14
keystore/keymaster_worker.cpp
View file

@ -83,8 +83,10 @@ void Worker::addRequest(WorkerTask request) {
}
}
KeymasterWorker::KeymasterWorker(sp<Keymaster> keymasterDevice, KeyStore* keyStore)
: keymasterDevice_(std::move(keymasterDevice)), operationMap_(keyStore), keyStore_(keyStore) {
KeymasterWorker::KeymasterWorker(sp<Keymaster> keymasterDevice, KeyStore* keyStore,
SecurityLevel internalSecurityLevel)
: keymasterDevice_(std::move(keymasterDevice)), operationMap_(keyStore), keyStore_(keyStore),
internalSecurityLevel_(internalSecurityLevel) {
// make sure that hal version is cached.
if (keymasterDevice_) keymasterDevice_->halVersion();
}
@ -821,7 +823,7 @@ void KeymasterWorker::generateKey(LockedKeyBlobEntry lockedEntry, hidl_vec<KeyPa
outCharacteristics = keyCharacteristics;
Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
keyBlob.setSecurityLevel(securityLevel);
keyBlob.setSecurityLevel(internalSecurityLevel_);
keyBlob.setCriticalToDeviceEncryption(flags &
KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
if (isAuthenticationBound(keyParams) && !keyBlob.isCriticalToDeviceEncryption()) {
@ -929,7 +931,7 @@ void KeymasterWorker::importKey(LockedKeyBlobEntry lockedEntry, hidl_vec<KeyPara
outCharacteristics = keyCharacteristics;
Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
keyBlob.setSecurityLevel(securityLevel);
keyBlob.setSecurityLevel(internalSecurityLevel_);
keyBlob.setCriticalToDeviceEncryption(flags &
KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
if (isAuthenticationBound(keyParams) && !keyBlob.isCriticalToDeviceEncryption()) {
@ -1004,8 +1006,6 @@ void KeymasterWorker::importWrappedKey(LockedKeyBlobEntry wrappingLockedEntry,
CAPTURE_MOVE(worker_cb)]() mutable {
auto hidlWrappingKey = blob2hidlVec(wrappingBlob);
SecurityLevel securityLevel = keymasterDevice_->halVersion().securityLevel;
KeyCharacteristics outCharacteristics;
KeyStoreServiceReturnCode error;
@ -1019,7 +1019,7 @@ void KeymasterWorker::importWrappedKey(LockedKeyBlobEntry wrappingLockedEntry,
outCharacteristics = keyCharacteristics;
Blob keyBlob(hidlKeyBlob.data(), hidlKeyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
keyBlob.setSecurityLevel(securityLevel);
keyBlob.setSecurityLevel(internalSecurityLevel_);
if (isAuthenticationBound(keyCharacteristics.hardwareEnforced)) {
keyBlob.setSuperEncrypted(true);
}

16
keystore/keymaster_worker.h
View file

@ -135,6 +135,19 @@ class KeymasterWorker : protected Worker {
OperationMap operationMap_;
KeyStore* keyStore_;
/**
* Models the security level of this worker internal to KeyStore.
*
* When the device has only a software Keymaster, KeyStore will set it on the TEE slot and
* instantiate a new in-process software Keymaster. In that case there is a mismatch between the
* security level used by KeyStore and what is reported from the HAL. This represents the level
* used internally by KeyStore.
*
* This value is used to associate blobs to the corresponding Keymaster backend. It does not
* indicate an actual Keymaster HAL security level and should never be exposed to users.
*/
SecurityLevel internalSecurityLevel_;
template <typename KMFn, typename ErrorType, typename... Args, size_t... I>
void unwrap_tuple(KMFn kmfn, std::function<void(ErrorType)> cb,
const std::tuple<Args...>& tuple, std::index_sequence<I...>) {
@ -200,7 +213,8 @@ class KeymasterWorker : protected Worker {
hidl_vec<KeyParameter>* params);
public:
KeymasterWorker(sp<Keymaster> keymasterDevice, KeyStore* keyStore);
KeymasterWorker(sp<Keymaster> keymasterDevice, KeyStore* keyStore,
SecurityLevel internalSecurityLevel);
void logIfKeymasterVendorError(ErrorCode ec) const;