The existing name is misleading, because it can be read as requiring
that a trusted user be present, rather than the intended meaning of
requiring trusted proof of user presence. Since this is all about
TEE/SE-based keys, the "trusted" part is implied, so the simple
"userPresenceRequired" name makes more sense.
Bug: 77151288
Test: Keystore CTS tests
Change-Id: If8b533b9f34a1875eaf35cdd1bb8f3709da9761b
The call the framework uses to get the current user ID requires the
INTERACT_ACROSS_USERS permission, which not a lot of apps will have.
Find a better way to do that.
Bug: 76430246
Test: CtsKeystoreTestCases
Change-Id: I8a0637d351fff9cfbf40e02946325f90466b68c5
• WrappedKeyEntry: add doc (based on IKeymasterDevice.hal comments)
• StrongBoxUnavailableException: add public ctors, match superclass
• SecureKeyImportUnavailableException: new first class exception
• ORIGIN_SECURELY_IMPORTED: elaborated on properties
Test: make doc & review output
Bug: b/74218267
Change-Id: Ice9adc60ede618870e57bb58ca66fd0218cd2bf7
Remove the @hide annotations so the SDP asymmetric-write functionality
is included in the public API.
Test: CtsKeystoreTestCases
Bug: 63928827
Change-Id: I8f462b0ebe4d9a7b96b48fa1672dd2ab9140c505
Add a keymaster parameter for keys that should be inaccessible when
the device screen is locked. "Locked" here is a state where the device
can be used or accessed without any further trust factor such as a
PIN, password, fingerprint, or trusted face or voice.
This parameter is added to the Java keystore interface for key
creation and import, as well as enums specified by and for the native
keystore process.
This reverts commit da82e2cb7193032867f86b996467bcd117545616.
Test: CTS tests in I8a5affd1eaed176756175158e3057e44934fffed
Bug: 67752510
Merged-In: Ia162f1db81d050f64995d0360f714e79033ea8a5
Change-Id: Ia162f1db81d050f64995d0360f714e79033ea8a5
(cherry picked from d7c961ee914192e09ec10727da6d31a6b597bf51)
As KeyChain reports detailed error codes about failure to generate keys
or attestation records for them, log these detailed errors and throw an
exception if the hardware does not support Device ID attestation.
Bug: 72642093
Bug: 73448533
Test: cts-tradefed run commandAndExit cts-dev -s 127.0.0.1:50487 -a x86_64 -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement -l DEBUG
Change-Id: Ib12efcf48c158373e1fc28cc51d67e70282d029e
This adds the API methods and values for keyguard-bound keys, but
contains none of the actual functionality.
Test: CTS tests in CtsKeystoreTestCases
Bug: 67752510
Merged-In: Iccd7dafd77258d903d11353e02ba3ab956050c40
Change-Id: Iccd7dafd77258d903d11353e02ba3ab956050c40
(cherry picked from commit fd75c7232aebc8690f004de3486b3b9a44f3e0b0)
Create an interface that encapsulates the common arguments to
AddUserAuthArgs, add that interface to KeyProtection and
KeyGenParameterSpec, and refactor AddUserAuthArgs to accept an
instance of that interface.
Test: CTS Module CtsKeystoreTestCases
Bug: 74017618
Merged-In: I591e34e5d08421ea1c022bbb6e955ee3c01eb435
Change-Id: I591e34e5d08421ea1c022bbb6e955ee3c01eb435
(cherry picked from commit df16c56fbf05908e03f3a95a8a3d981bbc2fdb91)
This change sets LOCAL_SDK_VERSION for all packages where
this is possible without breaking the build, and
LOCAL_PRIVATE_PLATFORM_APIS := true otherwise.
Setting one of these two will be made required soon, and this
is a change in preparation for that. Not setting LOCAL_SDK_VERSION
makes the app implicitly depend on the bootclasspath, which is
often not required. This change effectively makes depending on
private apis opt-in rather than opt-out.
Test: make relevant packages
Bug: 73535841
Change-Id: I4233b9091d9066c4fa69f3d24aaf367ea500f760
Add a keymaster parameter for keys that should be inaccessible when
the device screen is locked. "Locked" here is a state where the device
can be used or accessed without any further trust factor such as a
PIN, password, fingerprint, or trusted face or voice.
This parameter is added to the Java keystore interface for key
creation and import, as well as enums specified by and for the native
keystore process.
Test: CTS tests in I8a5affd1eaed176756175158e3057e44934fffed
Bug: 67752510
Change-Id: I314b848f6971d1849a7a6347d52e41d9604639ae
This CL adds new Framework APIs that can be used for the secure
confirmations. This includes support for configuring a key such that
it can only sign data returned by the confirmation APIs.
Bug: 63928580
Test: Manually tested.
Change-Id: I94c1fc532376bd555b3dc37fc4709469450cfde6
Add a keymaster parameter for keys that should be inaccessible when
the device screen is locked. "Locked" here is a state where the device
can be used or accessed without any further trust factor such as a
PIN, password, fingerprint, or trusted face or voice.
This parameter is added to the Java keystore interface for key
creation and import, as well as enums specified by and for the native
keystore process.
Test: go/asym-write-test-plan
Bug: 67752510
Change-Id: I8b88ff8fceeafe14e7613776c9cf5427752d9172
•Add FLAG_STRONGBOX when the generator spec requires it.
•Throw StrongBoxUnavailableException when the request
fails due to HARDWARE_UNAVAILABLE.
•Add PackageManager.FEATURE_STRONGBOX_KEYSTORE
Test: KeyStore CTS tests under development on an emulator
Bug: 63931634
Change-Id: I42d32b22981e43e504d30e5657d21ac555c71ebe
Import Wrapped Key:
Applications can import keys in a wrapped, encrypted format. Wrapped keys are
unwrapped inside of a Keymaster device.
Strongbox:
Applications can import and generate keys in secure hardware.
3DES:
Add KeyProperties and KeymasterDefs
Add AndroidKeyStore3DESCipherSpi and provider registrations
Bug: 63931634
Test: Keystore CTS tests in progress
Change-Id: I80b6db865b517fa108f14aced7402336212c441b
Remove the duplicate() method from KeyStore.
It is backed by dead code in the Keystore service, which (as far as I
can tell) is not doing the right thing.
Previous conversations with Keystore team members suggested this API
should not be used and it is marked for removal in the Keystore service.
Bug: 72037261
Test: That it compiles.
Change-Id: I7f8af95473c876340cbd5c73dd88c5d0282897b3
Enable requesting inclusion of device identifiers in the attestation
record issued for keys generated by generateKeyPair.
This is done by passing an array of flags with values indicating which
identifiers should be included.
Since the attestation record will include sensitive identifiers, it can
only be requested by the DPC in Device Owner mode or by the Delegated
Cert Installer in Device Owner mode.
Design note:
DevicePolicyManager defines its own set of constants for the different
identifier types (ID_TYPE_*) and prior to calling
DevicePolicyManagerService it translates them to the values defined by
AttestationUtils (which is not a public class).
The reason is to allow re-use of code in AttestationUtils for preparing
the attestation arguments.
In theory, these constants could be moved from AttestationUtils to
DevicePolicyManager, however that would create a dependency on DPM from
Keystore, which logically does not make sense as Keystore is independent
of the DPM (and in a lower level of the system, conceptually).
Bug: 63388672
Test: cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement; runtest frameworks-services -c com.android.server.devicepolicy.DevicePolicyManagerTest#testTranslationOfIdAttestationFlag
Change-Id: Ifb42e8e813fa812a08203b4a81d15b1f91152354
In anticipation of the availability of Keymaster implementations with
multiple security levels this patch adds the additional
keystore flags FLAG_SOFTWARE and FLAG_STROGBOX.
Also, the IKeystore method addRngEntropy got a new flags parameter
for the caller to express which implementation shall be awarded the
precious entropy.
Test: Keystore CTS tests
Bug: 63931634
Change-Id: I4a4eafbdbe1290f0c7bd2bfa2ce3e5fbb06c2dd8
Add a new method in the DevicePolicyManager to associate certificates (and
set the user-visibility) with a given key alias.
Conceptually, the new method, setKeyPairCertificate is very similar to
installKeyPair, except it does not install a key, only certificates.
(The new setKeyPairCertificate, together with generateKeyPair is
functionally equivalent to installKeyPair, except the keys are generated
in hardware rather than supplied externally).
Bug: 63388672
Test: cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement -l DEBUG
Change-Id: Idbfe151f6e5311766decbc1a010bff78dc60249f
Currently, the keystore SPI assigns different prefixes to user key
entries depending on the algorithm. Symmetric keys (secret keys) get
the prefix USERSKEY_ and asymmetric keys (private keys) get the
prefix USERPKEY_. This distinction is superfluous, as the information
can always be retrieved from the key characteristics. Also moving
forward it is desirable to be able to import keys the nature
of which is not known a priori. In these cases the prefix cannot be
chosen meaningfully.
This patch deprecates one of the prefixes (i.e. USERSKEY_) and uses
the other for both types of keys. Legacy keys with the old prefix
can still be used, but all new keys will have the prefix USERPKEY_.
Bug: 63931634
Test: CTS test and Manual upgrade test with KeyStoreTool app
Also performed upgrade test with device PIN set
Change-Id: I5b4bb0b0d2b82c276659d55b862150326bb68d5d
If the KeyGenParameterSpec passed into
DevicePolicyManager.generateKeyPair contains an attestation challenge,
request an attestation record for the newly-generated key with the
challenge provided.
This particular implementation was chosen, rather than letting the
attestation record be generated at the same time as key generation, to
avoid having the attestation chain stored in Keystore and associated
with the generated alias.
The rationale is that this is a key that is potentially accessible by
multiple applications and the attestation chain may end up being sent
as a TLS client certificate chain, for example.
As the attestation challenge should be unique per device, to avoid
the potential of sending / sharing unique device information, by
explicitly requesting an attestation record after key generation, the
attestation record is only returned to the generateKeyPair client and
not persistend in Keystore.
Bug: 63388672
Test: New CTS test to be run with: 'cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement -l DEBUG'
Change-Id: I95a9aef179173b571b533301ac438c675e8fe702
Fix the way KeyGenParameterSpec is parceled, by correctly handling
default and null values for some of the fields.
A recent CL added the ability to parcel/unparcel KeyGenParameterSpec (by
a separate class).
Due to refactoring late in the CL review cycle, the parceling code did
not take into account a few edge cases.
Unit tests:
m -j KeystoreTests && adb install -r out/target/product/marlin/data/app/KeystoreTests/KeystoreTests.apk
adb shell am instrument 'android.security.tests/android.support.test.runner.AndroidJUnitRunner'
CTS tests:
cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement -l DEBUG
Bug: 69337278
Test: Keystore unit tets (see instructions above) and cts Key Management test.
Change-Id: Ie08f42b07fb55b6fa1d8fb73c89d69687c97e214
Behaves pretty much the same as @IntDef, but now supports "suffix"
in addition to "prefix" when matching constants.
Test: manual docs output looks sane
Bug: 70406696
Change-Id: I35064b0f9f36f1f13ccdb40302d818a004014f15
Statically including legacy-android-test leads to duplicate classes
which causes build time problems (with Proguard) and runtime problems on
older SDK versions. This change:
* Stops statically including legacy-android-test.
* Adds compile time dependencies on andoid.test.base, android.test.mock
and android.test.runner where necessary.
* Adds <uses-library android:name="android.test.runner"/> to any
affected package to ensure that the classes that were included by
legacy-android-test are still available at runtime. That also adds a
dependency on android.test.base and android.test.mock.
The following change descriptions were generated automatically and so
may be a little repetitive. They are provided to give the reviewer
enough information to check the comments match what has actually been
changed and check the reasoning behind the changes.
* apct-tests/perftests/core/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CorePerfTests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CorePerfTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* core/tests/ConnectivityManagerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ConnectivityManagerTest's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ConnectivityManagerTest
results in duplicate classes which leads to build time and compile
time issues.
* core/tests/bandwidthtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BandwidthTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BandwidthTests results
in duplicate classes which leads to build time and compile time
issues.
* core/tests/bluetoothtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BluetoothTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BluetoothTests results
in duplicate classes which leads to build time and compile time
issues.
* core/tests/hosttests/test-apps/DownloadManagerTestApp/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in DownloadManagerTestApp
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
DownloadManagerTestApp's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
* core/tests/hosttests/test-apps/ExternalSharedPerms/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsTestApp results in duplicate classes which leads
to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsBT/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsBTTestApp results in duplicate classes which
leads to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsDiffKey/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsDiffKeyTestApp results in duplicate classes
which leads to build time and compile time issues.
* core/tests/hosttests/test-apps/ExternalSharedPermsFL/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
ExternalSharedPermsFLTestApp results in duplicate classes which
leads to build time and compile time issues.
* core/tests/notificationtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
NotificationStressTests's source depends on its classes and because
of these changes they are no longer present on the compilation
path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in NotificationStressTests
results in duplicate classes which leads to build time and compile
time issues.
* keystore/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in KeystoreTests results
in duplicate classes which leads to build time and compile time
issues.
* media/mca/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CameraEffectsTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CameraEffectsTests
results in duplicate classes which leads to build time and compile
time issues.
* media/tests/MediaFrameworkTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
mediaframeworktest's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in mediaframeworktest
results in duplicate classes which leads to build time and compile
time issues.
* nfc-extras/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in NfcExtrasTests results
in duplicate classes which leads to build time and compile time
issues.
* packages/CarrierDefaultApp/tests/unit/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CarrierDefaultAppUnitTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
CarrierDefaultAppUnitTests results in duplicate classes which leads
to build time and compile time issues.
* packages/ExtServices/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ExtServicesUnitTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ExtServicesUnitTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/MtpDocumentsProvider/tests/Android.mk
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because MtpDocumentsProviderTests's source
depends on their classes and because of these changes they are no
longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
MtpDocumentsProviderTests results in duplicate classes which leads
to build time and compile time issues.
* packages/SettingsLib/tests/integ/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SettingsLibTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SettingsLibTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/SettingsProvider/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SettingsProvider
results in duplicate classes which leads to build time and compile
time issues.
* packages/SettingsProvider/AndroidManifest.xml
Add uses-library for android.test.runner because otherwise this
change would change the set of files available to SettingsProvider
at runtime.
* packages/Shell/tests/Android.mk
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because ShellTests's source depends on their
classes and because of these changes they are no longer present on
the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ShellTests results in
duplicate classes which leads to build time and compile time
issues.
* packages/SystemUI/shared/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SystemUISharedLibTests
results in duplicate classes which leads to build time and compile
time issues.
* packages/SystemUI/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SystemUITests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SystemUITests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* packages/WAPPushManager/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
WAPPushManagerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in WAPPushManagerTests
results in duplicate classes which leads to build time and compile
time issues.
* sax/tests/saxtests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworksSaxTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in FrameworksSaxTests
results in duplicate classes which leads to build time and compile
time issues.
* tests/BrowserPowerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
BrowserPowerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in BrowserPowerTests
results in duplicate classes which leads to build time and compile
time issues.
* tests/CanvasCompare/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CanvasCompare's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CanvasCompare results
in duplicate classes which leads to build time and compile time
issues.
* tests/CoreTests/android/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
CoreTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in CoreTests results in
duplicate classes which leads to build time and compile time
issues.
* tests/DataIdleTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
DataIdleTest's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in DataIdleTest results in
duplicate classes which leads to build time and compile time
issues.
* tests/FrameworkPerf/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworkPerf's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in FrameworkPerf results
in duplicate classes which leads to build time and compile time
issues.
* tests/HierarchyViewerTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
HierarchyViewerTest's source depends on its classes and because of
these changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in HierarchyViewerTest
results in duplicate classes which leads to build time and compile
time issues.
* tests/ImfTest/tests/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
ImfTestTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in ImfTestTests results in
duplicate classes which leads to build time and compile time
issues.
* tests/Internal/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in InternalTests results
in duplicate classes which leads to build time and compile time
issues.
* tests/MemoryUsage/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
MemoryUsage's source depends on its classes and because of these
changes they are no longer present on the compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in MemoryUsage results in
duplicate classes which leads to build time and compile time
issues.
* tests/NetworkSecurityConfigTest/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
NetworkSecurityConfigTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
NetworkSecurityConfigTests results in duplicate classes which leads
to build time and compile time issues.
* tests/SoundTriggerTests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SoundTriggerTests
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
SoundTriggerTests's source depends on its classes and because of
these changes they are no longer present on the compilation path.
* tests/SurfaceComposition/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in SurfaceComposition
results in duplicate classes which leads to build time and compile
time issues.
Added 'android.test.runner.stubs' to LOCAL_JAVA_LIBRARIES because
SurfaceComposition's source depends on its classes and because of
these changes they are no longer present on the compilation path.
* tests/TtsTests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in TtsTests results in
duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
TtsTests's source depends on its classes and because of these
changes they are no longer present on the compilation path.
* tests/WindowAnimationJank/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in WindowAnimationJank
results in duplicate classes which leads to build time and compile
time issues.
* tests/permission/Android.mk
Added 'android.test.base' to LOCAL_JAVA_LIBRARIES because
FrameworkPermissionTests's source depends on its classes and
because of these changes they are no longer present on the
compilation path.
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in
FrameworkPermissionTests results in duplicate classes which leads
to build time and compile time issues.
* tests/testables/tests/Android.mk
Removed legacy-android-test from LOCAL_STATIC_JAVA_LIBRARIES
because statically including the classes in TestablesTests results
in duplicate classes which leads to build time and compile time
issues.
Added 'android.test.base' and 'android.test.mock' to
LOCAL_JAVA_LIBRARIES because TestablesTests's source depends on
their classes and because of these changes they are no longer
present on the compilation path.
Bug: 30188076
Test: make checkbuild
Change-Id: Iacfc939c97415314366ed61c5f3b7aa1a40f0ec9
This is the crux of the Verified Access feature implementation:
Adding the ability to generate KeyChain keys directly by the
secure hardware, rather than installing software-generated keys
into KeyChain.
Add generateKeyPair to the DevicePolicyManager, which delegates key
generation (via the DevicePolicyManagerService) to the KeyChainService.
Design highlights:
* The key generation is delegated via the DevicePolicyManagerService to
check that only authorized callers request key generation in KeyChain.
* KeyChainService performs the actual key generation so it owns the key
in Keystore outright.
* DevicePolicyManagerService then grants the calling app access to the
Keystore key, so it can actually be used.
* Loading the public/private key pair, as well as attestation
certificate chain, is done in the client code (DevicePolicyManager)
to save parceling / unparceling those objects across process
boundaries twice (for no good reason).
NOTE: The key attestation functionality (that includes Device ID) is
missing/untested. Will be added in a follow-up CL as this one is quite
big already.
HIGHLIGHT FOR REVIEWERS:
* API: New API in DevicePolicyManager.
Bug: 63388672
Test: cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement -l DEBUG; adb shell am instrument 'android.security.tests/android.support.test.runner.AndroidJUnitRunner' (After building the KeystoreTests target and installing the apk)
Change-Id: I73762c9123f32a94d454ba4f8b533883b55c44cc
The guide within the KeyGenParameterSpec class now uses the correct
method (init() instead of initialize()) to initialize the key
generator in the examples that show how to create AES and HMAC keys.
Test: make ds-docs -j8
Bug: 69093664
Change-Id: I6a9cbe6decd895c2505538f6ad4be91cd9133714
In order for the DevicePolicyManager to provide key generation
functionality, it has to return both the private and public keys
in form of a KeyPair.
Since the KeyChainService will perform the key generation on behalf
of the DevicePolicyManager (so that KeyChain will be the owner of
the generated keys outright), the DevicePolicyManager needs a way
to get both the private and public key representations from KeyChain.
A getKeyPair method is added that gets the private and public
key pair associated with a given alias from Keystore.
The getPrivateKey now delegates to the getKeyPair method and returns
only the private key.
Tested using existing CTS tests.
Bug: 63388672
Test: cts-tradefed run commandAndExit cts-dev -a armeabi-v7a -m CtsDevicePolicyManagerTestCases -t com.android.cts.devicepolicy.DeviceOwnerTest#testKeyManagement
Change-Id: I06b8511acd2049a0053ec8893de6de7429f7c92e
Java/aidl side changes necessary to generate IKeystoreService.cpp
Generated C++ service currently doesn't support null parameters, so lots
of parameters were updated to pass default value instead of null.
Test: cts-tradefed run cts -m CtsKeystoreTestCases
Bug: 68389643
Change-Id: Ifaf2ab48b2bcd7b081e4b336aa279fa8ba4fbbbf
