LockSettingsService.java revision 2c4a573f38a942b75d0321e66da2042753188cb7
1/* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17package com.android.server; 18 19import android.app.admin.DevicePolicyManager; 20import android.app.backup.BackupManager; 21import android.content.BroadcastReceiver; 22import android.content.ContentResolver; 23import android.content.Context; 24import android.content.Intent; 25import android.content.IntentFilter; 26import android.content.pm.PackageManager; 27import android.content.pm.UserInfo; 28import static android.Manifest.permission.ACCESS_KEYGUARD_SECURE_STORAGE; 29import static android.content.Context.USER_SERVICE; 30import static android.Manifest.permission.READ_CONTACTS; 31import android.database.sqlite.SQLiteDatabase; 32import android.os.Binder; 33import android.os.IBinder; 34import android.os.RemoteException; 35import android.os.storage.IMountService; 36import android.os.ServiceManager; 37import android.os.SystemProperties; 38import android.os.UserHandle; 39import android.os.UserManager; 40import android.provider.Settings; 41import android.provider.Settings.Secure; 42import android.provider.Settings.SettingNotFoundException; 43import android.security.KeyStore; 44import android.service.gatekeeper.GateKeeperResponse; 45import android.service.gatekeeper.IGateKeeperService; 46import android.text.TextUtils; 47import android.util.Slog; 48 49import com.android.internal.util.ArrayUtils; 50import com.android.internal.widget.ILockSettings; 51import com.android.internal.widget.LockPatternUtils; 52import com.android.internal.widget.VerifyCredentialResponse; 53import com.android.server.LockSettingsStorage.CredentialHash; 54 55import java.util.Arrays; 56import java.util.List; 57 58/** 59 * Keeps the lock pattern/password data and related settings for each user. 60 * Used by LockPatternUtils. Needs to be a service because Settings app also needs 61 * to be able to save lockscreen information for secondary users. 62 * @hide 63 */ 64public class LockSettingsService extends ILockSettings.Stub { 65 66 private static final String PERMISSION = ACCESS_KEYGUARD_SECURE_STORAGE; 67 68 private static final String TAG = "LockSettingsService"; 69 70 private final Context mContext; 71 72 private final LockSettingsStorage mStorage; 73 74 private LockPatternUtils mLockPatternUtils; 75 private boolean mFirstCallToVold; 76 private IGateKeeperService mGateKeeperService; 77 78 private interface CredentialUtil { 79 void setCredential(String credential, String savedCredential, int userId) 80 throws RemoteException; 81 byte[] toHash(String credential, int userId); 82 String adjustForKeystore(String credential); 83 } 84 85 public LockSettingsService(Context context) { 86 mContext = context; 87 // Open the database 88 89 mLockPatternUtils = new LockPatternUtils(context); 90 mFirstCallToVold = true; 91 92 IntentFilter filter = new IntentFilter(); 93 filter.addAction(Intent.ACTION_USER_ADDED); 94 filter.addAction(Intent.ACTION_USER_STARTING); 95 filter.addAction(Intent.ACTION_USER_REMOVED); 96 mContext.registerReceiverAsUser(mBroadcastReceiver, UserHandle.ALL, filter, null, null); 97 98 mStorage = new LockSettingsStorage(context, new LockSettingsStorage.Callback() { 99 @Override 100 public void initialize(SQLiteDatabase db) { 101 // Get the lockscreen default from a system property, if available 102 boolean lockScreenDisable = SystemProperties.getBoolean( 103 "ro.lockscreen.disable.default", false); 104 if (lockScreenDisable) { 105 mStorage.writeKeyValue(db, LockPatternUtils.DISABLE_LOCKSCREEN_KEY, "1", 0); 106 } 107 } 108 }); 109 } 110 111 private final BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() { 112 @Override 113 public void onReceive(Context context, Intent intent) { 114 if (Intent.ACTION_USER_ADDED.equals(intent.getAction())) { 115 // Notify keystore that a new user was added. 116 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 117 final KeyStore ks = KeyStore.getInstance(); 118 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 119 final UserInfo parentInfo = um.getProfileParent(userHandle); 120 final int parentHandle = parentInfo != null ? parentInfo.id : -1; 121 ks.onUserAdded(userHandle, parentHandle); 122 } else if (Intent.ACTION_USER_STARTING.equals(intent.getAction())) { 123 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 124 mStorage.prefetchUser(userHandle); 125 } else if (Intent.ACTION_USER_REMOVED.equals(intent.getAction())) { 126 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 127 if (userHandle > 0) { 128 removeUser(userHandle); 129 } 130 } 131 } 132 }; 133 134 public void systemReady() { 135 migrateOldData(); 136 try { 137 getGateKeeperService(); 138 } catch (RemoteException e) { 139 Slog.e(TAG, "Failure retrieving IGateKeeperService", e); 140 } 141 mStorage.prefetchUser(UserHandle.USER_OWNER); 142 } 143 144 private void migrateOldData() { 145 try { 146 // These Settings moved before multi-user was enabled, so we only have to do it for the 147 // root user. 148 if (getString("migrated", null, 0) == null) { 149 final ContentResolver cr = mContext.getContentResolver(); 150 for (String validSetting : VALID_SETTINGS) { 151 String value = Settings.Secure.getString(cr, validSetting); 152 if (value != null) { 153 setString(validSetting, value, 0); 154 } 155 } 156 // No need to move the password / pattern files. They're already in the right place. 157 setString("migrated", "true", 0); 158 Slog.i(TAG, "Migrated lock settings to new location"); 159 } 160 161 // These Settings changed after multi-user was enabled, hence need to be moved per user. 162 if (getString("migrated_user_specific", null, 0) == null) { 163 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 164 final ContentResolver cr = mContext.getContentResolver(); 165 List<UserInfo> users = um.getUsers(); 166 for (int user = 0; user < users.size(); user++) { 167 // Migrate owner info 168 final int userId = users.get(user).id; 169 final String OWNER_INFO = Secure.LOCK_SCREEN_OWNER_INFO; 170 String ownerInfo = Settings.Secure.getStringForUser(cr, OWNER_INFO, userId); 171 if (ownerInfo != null) { 172 setString(OWNER_INFO, ownerInfo, userId); 173 Settings.Secure.putStringForUser(cr, ownerInfo, "", userId); 174 } 175 176 // Migrate owner info enabled. Note there was a bug where older platforms only 177 // stored this value if the checkbox was toggled at least once. The code detects 178 // this case by handling the exception. 179 final String OWNER_INFO_ENABLED = Secure.LOCK_SCREEN_OWNER_INFO_ENABLED; 180 boolean enabled; 181 try { 182 int ivalue = Settings.Secure.getIntForUser(cr, OWNER_INFO_ENABLED, userId); 183 enabled = ivalue != 0; 184 setLong(OWNER_INFO_ENABLED, enabled ? 1 : 0, userId); 185 } catch (SettingNotFoundException e) { 186 // Setting was never stored. Store it if the string is not empty. 187 if (!TextUtils.isEmpty(ownerInfo)) { 188 setLong(OWNER_INFO_ENABLED, 1, userId); 189 } 190 } 191 Settings.Secure.putIntForUser(cr, OWNER_INFO_ENABLED, 0, userId); 192 } 193 // No need to move the password / pattern files. They're already in the right place. 194 setString("migrated_user_specific", "true", 0); 195 Slog.i(TAG, "Migrated per-user lock settings to new location"); 196 } 197 198 // Migrates biometric weak such that the fallback mechanism becomes the primary. 199 if (getString("migrated_biometric_weak", null, 0) == null) { 200 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 201 List<UserInfo> users = um.getUsers(); 202 for (int i = 0; i < users.size(); i++) { 203 int userId = users.get(i).id; 204 long type = getLong(LockPatternUtils.PASSWORD_TYPE_KEY, 205 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 206 userId); 207 long alternateType = getLong(LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 208 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 209 userId); 210 if (type == DevicePolicyManager.PASSWORD_QUALITY_BIOMETRIC_WEAK) { 211 setLong(LockPatternUtils.PASSWORD_TYPE_KEY, 212 alternateType, 213 userId); 214 } 215 setLong(LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 216 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 217 userId); 218 } 219 setString("migrated_biometric_weak", "true", 0); 220 Slog.i(TAG, "Migrated biometric weak to use the fallback instead"); 221 } 222 223 // Migrates lockscreen.disabled. Prior to M, the flag was ignored when more than one 224 // user was present on the system, so if we're upgrading to M and there is more than one 225 // user we disable the flag to remain consistent. 226 if (getString("migrated_lockscreen_disabled", null, 0) == null) { 227 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 228 229 final List<UserInfo> users = um.getUsers(); 230 final int userCount = users.size(); 231 int switchableUsers = 0; 232 for (int i = 0; i < userCount; i++) { 233 if (users.get(i).supportsSwitchTo()) { 234 switchableUsers++; 235 } 236 } 237 238 if (switchableUsers > 1) { 239 for (int i = 0; i < userCount; i++) { 240 int id = users.get(i).id; 241 242 if (getBoolean(LockPatternUtils.DISABLE_LOCKSCREEN_KEY, false, id)) { 243 setBoolean(LockPatternUtils.DISABLE_LOCKSCREEN_KEY, false, id); 244 } 245 } 246 } 247 248 setString("migrated_lockscreen_disabled", "true", 0); 249 Slog.i(TAG, "Migrated lockscreen disabled flag"); 250 } 251 } catch (RemoteException re) { 252 Slog.e(TAG, "Unable to migrate old data", re); 253 } 254 } 255 256 private final void checkWritePermission(int userId) { 257 mContext.enforceCallingOrSelfPermission(PERMISSION, "LockSettingsWrite"); 258 } 259 260 private final void checkPasswordReadPermission(int userId) { 261 mContext.enforceCallingOrSelfPermission(PERMISSION, "LockSettingsRead"); 262 } 263 264 private final void checkReadPermission(String requestedKey, int userId) { 265 final int callingUid = Binder.getCallingUid(); 266 267 for (int i = 0; i < READ_CONTACTS_PROTECTED_SETTINGS.length; i++) { 268 String key = READ_CONTACTS_PROTECTED_SETTINGS[i]; 269 if (key.equals(requestedKey) && mContext.checkCallingOrSelfPermission(READ_CONTACTS) 270 != PackageManager.PERMISSION_GRANTED) { 271 throw new SecurityException("uid=" + callingUid 272 + " needs permission " + READ_CONTACTS + " to read " 273 + requestedKey + " for user " + userId); 274 } 275 } 276 277 for (int i = 0; i < READ_PASSWORD_PROTECTED_SETTINGS.length; i++) { 278 String key = READ_PASSWORD_PROTECTED_SETTINGS[i]; 279 if (key.equals(requestedKey) && mContext.checkCallingOrSelfPermission(PERMISSION) 280 != PackageManager.PERMISSION_GRANTED) { 281 throw new SecurityException("uid=" + callingUid 282 + " needs permission " + PERMISSION + " to read " 283 + requestedKey + " for user " + userId); 284 } 285 } 286 } 287 288 @Override 289 public void setBoolean(String key, boolean value, int userId) throws RemoteException { 290 checkWritePermission(userId); 291 setStringUnchecked(key, userId, value ? "1" : "0"); 292 } 293 294 @Override 295 public void setLong(String key, long value, int userId) throws RemoteException { 296 checkWritePermission(userId); 297 setStringUnchecked(key, userId, Long.toString(value)); 298 } 299 300 @Override 301 public void setString(String key, String value, int userId) throws RemoteException { 302 checkWritePermission(userId); 303 setStringUnchecked(key, userId, value); 304 } 305 306 private void setStringUnchecked(String key, int userId, String value) { 307 mStorage.writeKeyValue(key, value, userId); 308 if (ArrayUtils.contains(SETTINGS_TO_BACKUP, key)) { 309 BackupManager.dataChanged("com.android.providers.settings"); 310 } 311 } 312 313 @Override 314 public boolean getBoolean(String key, boolean defaultValue, int userId) throws RemoteException { 315 checkReadPermission(key, userId); 316 String value = getStringUnchecked(key, null, userId); 317 return TextUtils.isEmpty(value) ? 318 defaultValue : (value.equals("1") || value.equals("true")); 319 } 320 321 @Override 322 public long getLong(String key, long defaultValue, int userId) throws RemoteException { 323 checkReadPermission(key, userId); 324 325 String value = getStringUnchecked(key, null, userId); 326 return TextUtils.isEmpty(value) ? defaultValue : Long.parseLong(value); 327 } 328 329 @Override 330 public String getString(String key, String defaultValue, int userId) throws RemoteException { 331 checkReadPermission(key, userId); 332 333 return getStringUnchecked(key, defaultValue, userId); 334 } 335 336 public String getStringUnchecked(String key, String defaultValue, int userId) { 337 if (Settings.Secure.LOCK_PATTERN_ENABLED.equals(key)) { 338 return mLockPatternUtils.isLockPatternEnabled(userId) ? "1" : "0"; 339 } 340 341 return mStorage.readKeyValue(key, defaultValue, userId); 342 } 343 344 @Override 345 public boolean havePassword(int userId) throws RemoteException { 346 // Do we need a permissions check here? 347 348 return mStorage.hasPassword(userId); 349 } 350 351 @Override 352 public boolean havePattern(int userId) throws RemoteException { 353 // Do we need a permissions check here? 354 355 return mStorage.hasPattern(userId); 356 } 357 358 private void setKeystorePassword(String password, int userHandle) { 359 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 360 final KeyStore ks = KeyStore.getInstance(); 361 362 final List<UserInfo> profiles = um.getProfiles(userHandle); 363 for (UserInfo pi : profiles) { 364 ks.onUserPasswordChanged(pi.id, password); 365 } 366 } 367 368 private void unlockKeystore(String password, int userHandle) { 369 final UserManager um = (UserManager) mContext.getSystemService(USER_SERVICE); 370 final KeyStore ks = KeyStore.getInstance(); 371 372 final List<UserInfo> profiles = um.getProfiles(userHandle); 373 for (UserInfo pi : profiles) { 374 ks.unlock(pi.id, password); 375 } 376 } 377 378 379 private byte[] getCurrentHandle(int userId) { 380 CredentialHash credential; 381 byte[] currentHandle; 382 383 int currentHandleType = mStorage.getStoredCredentialType(userId); 384 switch (currentHandleType) { 385 case CredentialHash.TYPE_PATTERN: 386 credential = mStorage.readPatternHash(userId); 387 currentHandle = credential != null 388 ? credential.hash 389 : null; 390 break; 391 case CredentialHash.TYPE_PASSWORD: 392 credential = mStorage.readPasswordHash(userId); 393 currentHandle = credential != null 394 ? credential.hash 395 : null; 396 break; 397 case CredentialHash.TYPE_NONE: 398 default: 399 currentHandle = null; 400 break; 401 } 402 403 // sanity check 404 if (currentHandleType != CredentialHash.TYPE_NONE && currentHandle == null) { 405 Slog.e(TAG, "Stored handle type [" + currentHandleType + "] but no handle available"); 406 } 407 408 return currentHandle; 409 } 410 411 412 @Override 413 public void setLockPattern(String pattern, String savedCredential, int userId) 414 throws RemoteException { 415 byte[] currentHandle = getCurrentHandle(userId); 416 417 if (pattern == null) { 418 getGateKeeperService().clearSecureUserId(userId); 419 mStorage.writePatternHash(null, userId); 420 setKeystorePassword(null, userId); 421 return; 422 } 423 424 if (currentHandle == null) { 425 if (savedCredential != null) { 426 Slog.w(TAG, "Saved credential provided, but none stored"); 427 } 428 savedCredential = null; 429 } 430 431 byte[] enrolledHandle = enrollCredential(currentHandle, savedCredential, pattern, userId); 432 if (enrolledHandle != null) { 433 mStorage.writePatternHash(enrolledHandle, userId); 434 } else { 435 throw new RemoteException("Failed to enroll pattern"); 436 } 437 } 438 439 440 @Override 441 public void setLockPassword(String password, String savedCredential, int userId) 442 throws RemoteException { 443 byte[] currentHandle = getCurrentHandle(userId); 444 445 if (password == null) { 446 getGateKeeperService().clearSecureUserId(userId); 447 mStorage.writePasswordHash(null, userId); 448 setKeystorePassword(null, userId); 449 return; 450 } 451 452 if (currentHandle == null) { 453 if (savedCredential != null) { 454 Slog.w(TAG, "Saved credential provided, but none stored"); 455 } 456 savedCredential = null; 457 } 458 459 byte[] enrolledHandle = enrollCredential(currentHandle, savedCredential, password, userId); 460 if (enrolledHandle != null) { 461 mStorage.writePasswordHash(enrolledHandle, userId); 462 } else { 463 throw new RemoteException("Failed to enroll password"); 464 } 465 } 466 467 private byte[] enrollCredential(byte[] enrolledHandle, 468 String enrolledCredential, String toEnroll, int userId) 469 throws RemoteException { 470 checkWritePermission(userId); 471 byte[] enrolledCredentialBytes = enrolledCredential == null 472 ? null 473 : enrolledCredential.getBytes(); 474 byte[] toEnrollBytes = toEnroll == null 475 ? null 476 : toEnroll.getBytes(); 477 GateKeeperResponse response = getGateKeeperService().enroll(userId, enrolledHandle, 478 enrolledCredentialBytes, toEnrollBytes); 479 480 if (response == null) { 481 return null; 482 } 483 484 byte[] hash = response.getPayload(); 485 if (hash != null) { 486 setKeystorePassword(toEnroll, userId); 487 } else { 488 // Should not happen 489 Slog.e(TAG, "Throttled while enrolling a password"); 490 } 491 return hash; 492 } 493 494 @Override 495 public VerifyCredentialResponse checkPattern(String pattern, int userId) throws RemoteException { 496 return doVerifyPattern(pattern, false, 0, userId); 497 } 498 499 @Override 500 public VerifyCredentialResponse verifyPattern(String pattern, long challenge, int userId) 501 throws RemoteException { 502 return doVerifyPattern(pattern, true, challenge, userId); 503 } 504 505 private VerifyCredentialResponse doVerifyPattern(String pattern, boolean hasChallenge, 506 long challenge, int userId) throws RemoteException { 507 checkPasswordReadPermission(userId); 508 CredentialHash storedHash = mStorage.readPatternHash(userId); 509 boolean shouldReEnrollBaseZero = storedHash != null && storedHash.isBaseZeroPattern; 510 511 String patternToVerify; 512 if (shouldReEnrollBaseZero) { 513 patternToVerify = LockPatternUtils.patternStringToBaseZero(pattern); 514 } else { 515 patternToVerify = pattern; 516 } 517 518 VerifyCredentialResponse response = verifyCredential(userId, storedHash, patternToVerify, 519 hasChallenge, challenge, 520 new CredentialUtil() { 521 @Override 522 public void setCredential(String pattern, String oldPattern, int userId) 523 throws RemoteException { 524 setLockPattern(pattern, oldPattern, userId); 525 } 526 527 @Override 528 public byte[] toHash(String pattern, int userId) { 529 return LockPatternUtils.patternToHash( 530 LockPatternUtils.stringToPattern(pattern)); 531 } 532 533 @Override 534 public String adjustForKeystore(String pattern) { 535 return LockPatternUtils.patternStringToBaseZero(pattern); 536 } 537 } 538 ); 539 540 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK 541 && shouldReEnrollBaseZero) { 542 setLockPattern(pattern, patternToVerify, userId); 543 } 544 545 return response; 546 547 } 548 549 @Override 550 public VerifyCredentialResponse checkPassword(String password, int userId) 551 throws RemoteException { 552 return doVerifyPassword(password, false, 0, userId); 553 } 554 555 @Override 556 public VerifyCredentialResponse verifyPassword(String password, long challenge, int userId) 557 throws RemoteException { 558 return doVerifyPassword(password, true, challenge, userId); 559 } 560 561 private VerifyCredentialResponse doVerifyPassword(String password, boolean hasChallenge, 562 long challenge, int userId) throws RemoteException { 563 checkPasswordReadPermission(userId); 564 CredentialHash storedHash = mStorage.readPasswordHash(userId); 565 return verifyCredential(userId, storedHash, password, hasChallenge, challenge, 566 new CredentialUtil() { 567 @Override 568 public void setCredential(String password, String oldPassword, int userId) 569 throws RemoteException { 570 setLockPassword(password, oldPassword, userId); 571 } 572 573 @Override 574 public byte[] toHash(String password, int userId) { 575 return mLockPatternUtils.passwordToHash(password, userId); 576 } 577 578 @Override 579 public String adjustForKeystore(String password) { 580 return password; 581 } 582 } 583 ); 584 } 585 586 private VerifyCredentialResponse verifyCredential(int userId, CredentialHash storedHash, 587 String credential, boolean hasChallenge, long challenge, CredentialUtil credentialUtil) 588 throws RemoteException { 589 if ((storedHash == null || storedHash.hash.length == 0) && TextUtils.isEmpty(credential)) { 590 // don't need to pass empty credentials to GateKeeper 591 return VerifyCredentialResponse.OK; 592 } 593 594 if (TextUtils.isEmpty(credential)) { 595 return VerifyCredentialResponse.ERROR; 596 } 597 598 if (storedHash.version == CredentialHash.VERSION_LEGACY) { 599 byte[] hash = credentialUtil.toHash(credential, userId); 600 if (Arrays.equals(hash, storedHash.hash)) { 601 unlockKeystore(credentialUtil.adjustForKeystore(credential), userId); 602 // migrate credential to GateKeeper 603 credentialUtil.setCredential(credential, null, userId); 604 if (!hasChallenge) { 605 return VerifyCredentialResponse.OK; 606 } 607 // Fall through to get the auth token. Technically this should never happen, 608 // as a user that had a legacy credential would have to unlock their device 609 // before getting to a flow with a challenge, but supporting for consistency. 610 } else { 611 return VerifyCredentialResponse.ERROR; 612 } 613 } 614 615 VerifyCredentialResponse response; 616 boolean shouldReEnroll = false;; 617 if (hasChallenge) { 618 byte[] token = null; 619 GateKeeperResponse gateKeeperResponse = getGateKeeperService() 620 .verifyChallenge(userId, challenge, storedHash.hash, credential.getBytes()); 621 int responseCode = gateKeeperResponse.getResponseCode(); 622 if (responseCode == GateKeeperResponse.RESPONSE_RETRY) { 623 response = new VerifyCredentialResponse(gateKeeperResponse.getTimeout()); 624 } else if (responseCode == GateKeeperResponse.RESPONSE_OK) { 625 token = gateKeeperResponse.getPayload(); 626 if (token == null) { 627 // something's wrong if there's no payload with a challenge 628 Slog.e(TAG, "verifyChallenge response had no associated payload"); 629 response = VerifyCredentialResponse.ERROR; 630 } else { 631 shouldReEnroll = gateKeeperResponse.getShouldReEnroll(); 632 response = new VerifyCredentialResponse(token); 633 } 634 } else { 635 response = VerifyCredentialResponse.ERROR; 636 } 637 } else { 638 GateKeeperResponse gateKeeperResponse = getGateKeeperService().verify( 639 userId, storedHash.hash, credential.getBytes()); 640 int responseCode = gateKeeperResponse.getResponseCode(); 641 if (responseCode == GateKeeperResponse.RESPONSE_RETRY) { 642 response = new VerifyCredentialResponse(gateKeeperResponse.getTimeout()); 643 } else if (responseCode == GateKeeperResponse.RESPONSE_OK) { 644 shouldReEnroll = gateKeeperResponse.getShouldReEnroll(); 645 response = VerifyCredentialResponse.OK; 646 } else { 647 response = VerifyCredentialResponse.ERROR; 648 } 649 } 650 651 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 652 // credential has matched 653 unlockKeystore(credential, userId); 654 if (shouldReEnroll) { 655 credentialUtil.setCredential(credential, credential, userId); 656 } 657 } 658 659 return response; 660 } 661 662 @Override 663 public boolean checkVoldPassword(int userId) throws RemoteException { 664 if (!mFirstCallToVold) { 665 return false; 666 } 667 mFirstCallToVold = false; 668 669 checkPasswordReadPermission(userId); 670 671 // There's no guarantee that this will safely connect, but if it fails 672 // we will simply show the lock screen when we shouldn't, so relatively 673 // benign. There is an outside chance something nasty would happen if 674 // this service restarted before vold stales out the password in this 675 // case. The nastiness is limited to not showing the lock screen when 676 // we should, within the first minute of decrypting the phone if this 677 // service can't connect to vold, it restarts, and then the new instance 678 // does successfully connect. 679 final IMountService service = getMountService(); 680 String password = service.getPassword(); 681 service.clearPassword(); 682 if (password == null) { 683 return false; 684 } 685 686 try { 687 if (mLockPatternUtils.isLockPatternEnabled(userId)) { 688 if (checkPattern(password, userId).getResponseCode() 689 == GateKeeperResponse.RESPONSE_OK) { 690 return true; 691 } 692 } 693 } catch (Exception e) { 694 } 695 696 try { 697 if (mLockPatternUtils.isLockPasswordEnabled(userId)) { 698 if (checkPassword(password, userId).getResponseCode() 699 == GateKeeperResponse.RESPONSE_OK) { 700 return true; 701 } 702 } 703 } catch (Exception e) { 704 } 705 706 return false; 707 } 708 709 private void removeUser(int userId) { 710 mStorage.removeUser(userId); 711 712 final KeyStore ks = KeyStore.getInstance(); 713 ks.onUserRemoved(userId); 714 715 try { 716 final IGateKeeperService gk = getGateKeeperService(); 717 if (gk != null) { 718 gk.clearSecureUserId(userId); 719 } 720 } catch (RemoteException ex) { 721 Slog.w(TAG, "unable to clear GK secure user id"); 722 } 723 } 724 725 private static final String[] VALID_SETTINGS = new String[] { 726 LockPatternUtils.LOCKOUT_PERMANENT_KEY, 727 LockPatternUtils.LOCKOUT_ATTEMPT_DEADLINE, 728 LockPatternUtils.PATTERN_EVER_CHOSEN_KEY, 729 LockPatternUtils.PASSWORD_TYPE_KEY, 730 LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 731 LockPatternUtils.LOCK_PASSWORD_SALT_KEY, 732 LockPatternUtils.DISABLE_LOCKSCREEN_KEY, 733 LockPatternUtils.LOCKSCREEN_OPTIONS, 734 LockPatternUtils.LOCKSCREEN_BIOMETRIC_WEAK_FALLBACK, 735 LockPatternUtils.BIOMETRIC_WEAK_EVER_CHOSEN_KEY, 736 LockPatternUtils.LOCKSCREEN_POWER_BUTTON_INSTANTLY_LOCKS, 737 LockPatternUtils.PASSWORD_HISTORY_KEY, 738 Secure.LOCK_PATTERN_ENABLED, 739 Secure.LOCK_BIOMETRIC_WEAK_FLAGS, 740 Secure.LOCK_PATTERN_VISIBLE, 741 Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED 742 }; 743 744 // Reading these settings needs the contacts permission 745 private static final String[] READ_CONTACTS_PROTECTED_SETTINGS = new String[] { 746 Secure.LOCK_SCREEN_OWNER_INFO_ENABLED, 747 Secure.LOCK_SCREEN_OWNER_INFO 748 }; 749 750 // Reading these settings needs the same permission as checking the password 751 private static final String[] READ_PASSWORD_PROTECTED_SETTINGS = new String[] { 752 LockPatternUtils.LOCK_PASSWORD_SALT_KEY, 753 LockPatternUtils.PASSWORD_HISTORY_KEY, 754 LockPatternUtils.PASSWORD_TYPE_KEY, 755 }; 756 757 private static final String[] SETTINGS_TO_BACKUP = new String[] { 758 Secure.LOCK_SCREEN_OWNER_INFO_ENABLED, 759 Secure.LOCK_SCREEN_OWNER_INFO 760 }; 761 762 private IMountService getMountService() { 763 final IBinder service = ServiceManager.getService("mount"); 764 if (service != null) { 765 return IMountService.Stub.asInterface(service); 766 } 767 return null; 768 } 769 770 private class GateKeeperDiedRecipient implements IBinder.DeathRecipient { 771 @Override 772 public void binderDied() { 773 mGateKeeperService.asBinder().unlinkToDeath(this, 0); 774 mGateKeeperService = null; 775 } 776 } 777 778 private synchronized IGateKeeperService getGateKeeperService() 779 throws RemoteException { 780 if (mGateKeeperService != null) { 781 return mGateKeeperService; 782 } 783 784 final IBinder service = 785 ServiceManager.getService("android.service.gatekeeper.IGateKeeperService"); 786 if (service != null) { 787 service.linkToDeath(new GateKeeperDiedRecipient(), 0); 788 mGateKeeperService = IGateKeeperService.Stub.asInterface(service); 789 return mGateKeeperService; 790 } 791 792 Slog.e(TAG, "Unable to acquire GateKeeperService"); 793 return null; 794 } 795 796} 797