LockSettingsService.java revision 0f06d061256f465a5c789dc173c752787d04faf0
1/* 2 * Copyright (C) 2012 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17package com.android.server.locksettings; 18 19import static android.Manifest.permission.ACCESS_KEYGUARD_SECURE_STORAGE; 20import static android.Manifest.permission.READ_CONTACTS; 21import static android.content.Context.KEYGUARD_SERVICE; 22import static android.content.pm.PackageManager.PERMISSION_GRANTED; 23 24import static com.android.internal.widget.LockPatternUtils.StrongAuthTracker.STRONG_AUTH_REQUIRED_AFTER_LOCKOUT; 25import static com.android.internal.widget.LockPatternUtils.SYNTHETIC_PASSWORD_ENABLED_KEY; 26import static com.android.internal.widget.LockPatternUtils.SYNTHETIC_PASSWORD_HANDLE_KEY; 27import static com.android.internal.widget.LockPatternUtils.USER_FRP; 28import static com.android.internal.widget.LockPatternUtils.frpCredentialEnabled; 29import static com.android.internal.widget.LockPatternUtils.userOwnsFrpCredential; 30 31import android.annotation.NonNull; 32import android.annotation.Nullable; 33import android.annotation.UserIdInt; 34import android.app.ActivityManager; 35import android.app.IActivityManager; 36import android.app.KeyguardManager; 37import android.app.Notification; 38import android.app.NotificationManager; 39import android.app.PendingIntent; 40import android.app.admin.DevicePolicyManager; 41import android.app.admin.DevicePolicyManagerInternal; 42import android.app.admin.PasswordMetrics; 43import android.app.backup.BackupManager; 44import android.app.trust.IStrongAuthTracker; 45import android.app.trust.TrustManager; 46import android.content.BroadcastReceiver; 47import android.content.ContentResolver; 48import android.content.Context; 49import android.content.Intent; 50import android.content.IntentFilter; 51import android.content.pm.PackageManager; 52import android.content.pm.UserInfo; 53import android.content.res.Resources; 54import android.database.ContentObserver; 55import android.database.sqlite.SQLiteDatabase; 56import android.hardware.authsecret.V1_0.IAuthSecret; 57import android.net.Uri; 58import android.os.Binder; 59import android.os.Bundle; 60import android.os.Handler; 61import android.os.IBinder; 62import android.os.IProgressListener; 63import android.os.Process; 64import android.os.RemoteException; 65import android.os.ResultReceiver; 66import android.os.ServiceManager; 67import android.os.ShellCallback; 68import android.os.StrictMode; 69import android.os.SystemProperties; 70import android.os.UserHandle; 71import android.os.UserManager; 72import android.os.storage.IStorageManager; 73import android.os.storage.StorageManager; 74import android.provider.Settings; 75import android.provider.Settings.Secure; 76import android.provider.Settings.SettingNotFoundException; 77import android.security.KeyStore; 78import android.security.keystore.AndroidKeyStoreProvider; 79import android.security.keystore.KeyProperties; 80import android.security.keystore.KeyProtection; 81import android.security.keystore.UserNotAuthenticatedException; 82import android.security.keystore.recovery.KeyChainProtectionParams; 83import android.security.keystore.recovery.WrappedApplicationKey; 84import android.security.keystore.recovery.KeyChainSnapshot; 85import android.service.gatekeeper.GateKeeperResponse; 86import android.service.gatekeeper.IGateKeeperService; 87import android.text.TextUtils; 88import android.util.ArrayMap; 89import android.util.EventLog; 90import android.util.Log; 91import android.util.Slog; 92import android.util.SparseArray; 93 94import com.android.internal.annotations.GuardedBy; 95import com.android.internal.annotations.VisibleForTesting; 96import com.android.internal.messages.nano.SystemMessageProto.SystemMessage; 97import com.android.internal.notification.SystemNotificationChannels; 98import com.android.internal.util.ArrayUtils; 99import com.android.internal.util.DumpUtils; 100import com.android.internal.util.Preconditions; 101import com.android.internal.widget.ICheckCredentialProgressCallback; 102import com.android.internal.widget.ILockSettings; 103import com.android.internal.widget.LockPatternUtils; 104import com.android.internal.widget.VerifyCredentialResponse; 105import com.android.server.LocalServices; 106import com.android.server.SystemService; 107import com.android.server.locksettings.LockSettingsStorage.CredentialHash; 108import com.android.server.locksettings.LockSettingsStorage.PersistentData; 109import com.android.server.locksettings.recoverablekeystore.RecoverableKeyStoreManager; 110import com.android.server.locksettings.SyntheticPasswordManager.AuthenticationResult; 111import com.android.server.locksettings.SyntheticPasswordManager.AuthenticationToken; 112 113import libcore.util.HexEncoding; 114 115import java.io.ByteArrayOutputStream; 116import java.io.FileDescriptor; 117import java.io.FileNotFoundException; 118import java.io.IOException; 119import java.io.PrintWriter; 120import java.nio.charset.StandardCharsets; 121import java.security.InvalidAlgorithmParameterException; 122import java.security.InvalidKeyException; 123import java.security.KeyStoreException; 124import java.security.MessageDigest; 125import java.security.NoSuchAlgorithmException; 126import java.security.SecureRandom; 127import java.security.UnrecoverableKeyException; 128import java.security.cert.CertificateException; 129import java.util.Arrays; 130import java.util.ArrayList; 131import java.util.List; 132import java.util.Map; 133import java.util.NoSuchElementException; 134import java.util.concurrent.CountDownLatch; 135import java.util.concurrent.TimeUnit; 136 137import javax.crypto.BadPaddingException; 138import javax.crypto.Cipher; 139import javax.crypto.IllegalBlockSizeException; 140import javax.crypto.KeyGenerator; 141import javax.crypto.NoSuchPaddingException; 142import javax.crypto.SecretKey; 143import javax.crypto.spec.GCMParameterSpec; 144 145/** 146 * Keeps the lock pattern/password data and related settings for each user. Used by 147 * LockPatternUtils. Needs to be a service because Settings app also needs to be able to save 148 * lockscreen information for secondary users. 149 * 150 * @hide 151 */ 152public class LockSettingsService extends ILockSettings.Stub { 153 private static final String TAG = "LockSettingsService"; 154 private static final String PERMISSION = ACCESS_KEYGUARD_SECURE_STORAGE; 155 private static final boolean DEBUG = false; 156 157 private static final int PROFILE_KEY_IV_SIZE = 12; 158 private static final String SEPARATE_PROFILE_CHALLENGE_KEY = "lockscreen.profilechallenge"; 159 private static final int SYNTHETIC_PASSWORD_ENABLED_BY_DEFAULT = 1; 160 161 // Order of holding lock: mSeparateChallengeLock -> mSpManager -> this 162 // Do not call into ActivityManager while holding mSpManager lock. 163 private final Object mSeparateChallengeLock = new Object(); 164 165 private final DeviceProvisionedObserver mDeviceProvisionedObserver = 166 new DeviceProvisionedObserver(); 167 168 private final Injector mInjector; 169 private final Context mContext; 170 @VisibleForTesting 171 protected final Handler mHandler; 172 @VisibleForTesting 173 protected final LockSettingsStorage mStorage; 174 private final LockSettingsStrongAuth mStrongAuth; 175 private final SynchronizedStrongAuthTracker mStrongAuthTracker; 176 177 private final LockPatternUtils mLockPatternUtils; 178 private final NotificationManager mNotificationManager; 179 private final UserManager mUserManager; 180 private final IActivityManager mActivityManager; 181 private final SyntheticPasswordManager mSpManager; 182 183 private final KeyStore mKeyStore; 184 185 private final RecoverableKeyStoreManager mRecoverableKeyStoreManager; 186 187 private boolean mFirstCallToVold; 188 protected IGateKeeperService mGateKeeperService; 189 protected IAuthSecret mAuthSecretService; 190 191 /** 192 * The UIDs that are used for system credential storage in keystore. 193 */ 194 private static final int[] SYSTEM_CREDENTIAL_UIDS = { 195 Process.WIFI_UID, Process.VPN_UID, 196 Process.ROOT_UID, Process.SYSTEM_UID }; 197 198 // This class manages life cycle events for encrypted users on File Based Encryption (FBE) 199 // devices. The most basic of these is to show/hide notifications about missing features until 200 // the user unlocks the account and credential-encrypted storage is available. 201 public static final class Lifecycle extends SystemService { 202 private LockSettingsService mLockSettingsService; 203 204 public Lifecycle(Context context) { 205 super(context); 206 } 207 208 @Override 209 public void onStart() { 210 AndroidKeyStoreProvider.install(); 211 mLockSettingsService = new LockSettingsService(getContext()); 212 publishBinderService("lock_settings", mLockSettingsService); 213 } 214 215 @Override 216 public void onBootPhase(int phase) { 217 super.onBootPhase(phase); 218 if (phase == PHASE_ACTIVITY_MANAGER_READY) { 219 mLockSettingsService.migrateOldDataAfterSystemReady(); 220 } 221 } 222 223 @Override 224 public void onStartUser(int userHandle) { 225 mLockSettingsService.onStartUser(userHandle); 226 } 227 228 @Override 229 public void onUnlockUser(int userHandle) { 230 mLockSettingsService.onUnlockUser(userHandle); 231 } 232 233 @Override 234 public void onCleanupUser(int userHandle) { 235 mLockSettingsService.onCleanupUser(userHandle); 236 } 237 } 238 239 @VisibleForTesting 240 protected static class SynchronizedStrongAuthTracker 241 extends LockPatternUtils.StrongAuthTracker { 242 public SynchronizedStrongAuthTracker(Context context) { 243 super(context); 244 } 245 246 @Override 247 protected void handleStrongAuthRequiredChanged(int strongAuthFlags, int userId) { 248 synchronized (this) { 249 super.handleStrongAuthRequiredChanged(strongAuthFlags, userId); 250 } 251 } 252 253 @Override 254 public int getStrongAuthForUser(int userId) { 255 synchronized (this) { 256 return super.getStrongAuthForUser(userId); 257 } 258 } 259 260 void register(LockSettingsStrongAuth strongAuth) { 261 strongAuth.registerStrongAuthTracker(this.mStub); 262 } 263 } 264 265 /** 266 * Tie managed profile to primary profile if it is in unified mode and not tied before. 267 * 268 * @param managedUserId Managed profile user Id 269 * @param managedUserPassword Managed profile original password (when it has separated lock). 270 * NULL when it does not have a separated lock before. 271 */ 272 public void tieManagedProfileLockIfNecessary(int managedUserId, String managedUserPassword) { 273 if (DEBUG) Slog.v(TAG, "Check child profile lock for user: " + managedUserId); 274 // Only for managed profile 275 if (!mUserManager.getUserInfo(managedUserId).isManagedProfile()) { 276 return; 277 } 278 // Do not tie managed profile when work challenge is enabled 279 if (mLockPatternUtils.isSeparateProfileChallengeEnabled(managedUserId)) { 280 return; 281 } 282 // Do not tie managed profile to parent when it's done already 283 if (mStorage.hasChildProfileLock(managedUserId)) { 284 return; 285 } 286 // Do not tie it to parent when parent does not have a screen lock 287 final int parentId = mUserManager.getProfileParent(managedUserId).id; 288 if (!isUserSecure(parentId)) { 289 if (DEBUG) Slog.v(TAG, "Parent does not have a screen lock"); 290 return; 291 } 292 // Do not tie when the parent has no SID (but does have a screen lock). 293 // This can only happen during an upgrade path where SID is yet to be 294 // generated when the user unlocks for the first time. 295 try { 296 if (getGateKeeperService().getSecureUserId(parentId) == 0) { 297 return; 298 } 299 } catch (RemoteException e) { 300 Slog.e(TAG, "Failed to talk to GateKeeper service", e); 301 return; 302 } 303 if (DEBUG) Slog.v(TAG, "Tie managed profile to parent now!"); 304 byte[] randomLockSeed = new byte[] {}; 305 try { 306 randomLockSeed = SecureRandom.getInstance("SHA1PRNG").generateSeed(40); 307 String newPassword = String.valueOf(HexEncoding.encode(randomLockSeed)); 308 final int quality = DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC; 309 setLockCredentialInternal(newPassword, LockPatternUtils.CREDENTIAL_TYPE_PASSWORD, 310 managedUserPassword, quality, managedUserId); 311 // We store a private credential for the managed user that's unlocked by the primary 312 // account holder's credential. As such, the user will never be prompted to enter this 313 // password directly, so we always store a password. 314 setLong(LockPatternUtils.PASSWORD_TYPE_KEY, quality, managedUserId); 315 tieProfileLockToParent(managedUserId, newPassword); 316 } catch (NoSuchAlgorithmException | RemoteException e) { 317 Slog.e(TAG, "Fail to tie managed profile", e); 318 // Nothing client can do to fix this issue, so we do not throw exception out 319 } 320 } 321 322 static class Injector { 323 324 protected Context mContext; 325 326 public Injector(Context context) { 327 mContext = context; 328 } 329 330 public Context getContext() { 331 return mContext; 332 } 333 334 public Handler getHandler() { 335 return new Handler(); 336 } 337 338 public LockSettingsStorage getStorage() { 339 final LockSettingsStorage storage = new LockSettingsStorage(mContext); 340 storage.setDatabaseOnCreateCallback(new LockSettingsStorage.Callback() { 341 @Override 342 public void initialize(SQLiteDatabase db) { 343 // Get the lockscreen default from a system property, if available 344 boolean lockScreenDisable = SystemProperties.getBoolean( 345 "ro.lockscreen.disable.default", false); 346 if (lockScreenDisable) { 347 storage.writeKeyValue(db, LockPatternUtils.DISABLE_LOCKSCREEN_KEY, "1", 0); 348 } 349 } 350 }); 351 return storage; 352 } 353 354 public LockSettingsStrongAuth getStrongAuth() { 355 return new LockSettingsStrongAuth(mContext); 356 } 357 358 public SynchronizedStrongAuthTracker getStrongAuthTracker() { 359 return new SynchronizedStrongAuthTracker(mContext); 360 } 361 362 public IActivityManager getActivityManager() { 363 return ActivityManager.getService(); 364 } 365 366 public LockPatternUtils getLockPatternUtils() { 367 return new LockPatternUtils(mContext); 368 } 369 370 public NotificationManager getNotificationManager() { 371 return (NotificationManager) mContext.getSystemService(Context.NOTIFICATION_SERVICE); 372 } 373 374 public UserManager getUserManager() { 375 return (UserManager) mContext.getSystemService(Context.USER_SERVICE); 376 } 377 378 public DevicePolicyManager getDevicePolicyManager() { 379 return (DevicePolicyManager) mContext.getSystemService(Context.DEVICE_POLICY_SERVICE); 380 } 381 382 public KeyStore getKeyStore() { 383 return KeyStore.getInstance(); 384 } 385 386 public RecoverableKeyStoreManager getRecoverableKeyStoreManager() { 387 return RecoverableKeyStoreManager.getInstance(mContext); 388 } 389 390 public IStorageManager getStorageManager() { 391 final IBinder service = ServiceManager.getService("mount"); 392 if (service != null) { 393 return IStorageManager.Stub.asInterface(service); 394 } 395 return null; 396 } 397 398 public SyntheticPasswordManager getSyntheticPasswordManager(LockSettingsStorage storage) { 399 return new SyntheticPasswordManager(getContext(), storage, getUserManager()); 400 } 401 402 public int binderGetCallingUid() { 403 return Binder.getCallingUid(); 404 } 405 } 406 407 public LockSettingsService(Context context) { 408 this(new Injector(context)); 409 } 410 411 @VisibleForTesting 412 protected LockSettingsService(Injector injector) { 413 mInjector = injector; 414 mContext = injector.getContext(); 415 mKeyStore = injector.getKeyStore(); 416 mRecoverableKeyStoreManager = injector.getRecoverableKeyStoreManager(); 417 mHandler = injector.getHandler(); 418 mStrongAuth = injector.getStrongAuth(); 419 mActivityManager = injector.getActivityManager(); 420 421 mLockPatternUtils = injector.getLockPatternUtils(); 422 mFirstCallToVold = true; 423 424 IntentFilter filter = new IntentFilter(); 425 filter.addAction(Intent.ACTION_USER_ADDED); 426 filter.addAction(Intent.ACTION_USER_STARTING); 427 filter.addAction(Intent.ACTION_USER_REMOVED); 428 injector.getContext().registerReceiverAsUser(mBroadcastReceiver, UserHandle.ALL, filter, 429 null, null); 430 431 mStorage = injector.getStorage(); 432 mNotificationManager = injector.getNotificationManager(); 433 mUserManager = injector.getUserManager(); 434 mStrongAuthTracker = injector.getStrongAuthTracker(); 435 mStrongAuthTracker.register(mStrongAuth); 436 437 mSpManager = injector.getSyntheticPasswordManager(mStorage); 438 } 439 440 /** 441 * If the account is credential-encrypted, show notification requesting the user to unlock the 442 * device. 443 */ 444 private void maybeShowEncryptionNotificationForUser(@UserIdInt int userId) { 445 final UserInfo user = mUserManager.getUserInfo(userId); 446 if (!user.isManagedProfile()) { 447 // When the user is locked, we communicate it loud-and-clear 448 // on the lockscreen; we only show a notification below for 449 // locked managed profiles. 450 return; 451 } 452 453 final UserHandle userHandle = user.getUserHandle(); 454 final boolean isSecure = isUserSecure(userId); 455 if (isSecure && !mUserManager.isUserUnlockingOrUnlocked(userHandle)) { 456 UserInfo parent = mUserManager.getProfileParent(userId); 457 if (parent != null && 458 mUserManager.isUserUnlockingOrUnlocked(parent.getUserHandle()) && 459 !mUserManager.isQuietModeEnabled(userHandle)) { 460 // Only show notifications for managed profiles once their parent 461 // user is unlocked. 462 showEncryptionNotificationForProfile(userHandle); 463 } 464 } 465 } 466 467 private void showEncryptionNotificationForProfile(UserHandle user) { 468 Resources r = mContext.getResources(); 469 CharSequence title = r.getText( 470 com.android.internal.R.string.user_encrypted_title); 471 CharSequence message = r.getText( 472 com.android.internal.R.string.profile_encrypted_message); 473 CharSequence detail = r.getText( 474 com.android.internal.R.string.profile_encrypted_detail); 475 476 final KeyguardManager km = (KeyguardManager) mContext.getSystemService(KEYGUARD_SERVICE); 477 final Intent unlockIntent = km.createConfirmDeviceCredentialIntent(null, null, 478 user.getIdentifier()); 479 if (unlockIntent == null) { 480 return; 481 } 482 unlockIntent.setFlags( 483 Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS); 484 PendingIntent intent = PendingIntent.getActivity(mContext, 0, unlockIntent, 485 PendingIntent.FLAG_UPDATE_CURRENT); 486 487 showEncryptionNotification(user, title, message, detail, intent); 488 } 489 490 private void showEncryptionNotification(UserHandle user, CharSequence title, 491 CharSequence message, CharSequence detail, PendingIntent intent) { 492 if (DEBUG) Slog.v(TAG, "showing encryption notification, user: " + user.getIdentifier()); 493 494 // Suppress all notifications on non-FBE devices for now 495 if (!StorageManager.isFileEncryptedNativeOrEmulated()) return; 496 497 Notification notification = 498 new Notification.Builder(mContext, SystemNotificationChannels.SECURITY) 499 .setSmallIcon(com.android.internal.R.drawable.ic_user_secure) 500 .setWhen(0) 501 .setOngoing(true) 502 .setTicker(title) 503 .setColor(mContext.getColor( 504 com.android.internal.R.color.system_notification_accent_color)) 505 .setContentTitle(title) 506 .setContentText(message) 507 .setSubText(detail) 508 .setVisibility(Notification.VISIBILITY_PUBLIC) 509 .setContentIntent(intent) 510 .build(); 511 mNotificationManager.notifyAsUser(null, SystemMessage.NOTE_FBE_ENCRYPTED_NOTIFICATION, 512 notification, user); 513 } 514 515 private void hideEncryptionNotification(UserHandle userHandle) { 516 if (DEBUG) Slog.v(TAG, "hide encryption notification, user: " + userHandle.getIdentifier()); 517 mNotificationManager.cancelAsUser(null, SystemMessage.NOTE_FBE_ENCRYPTED_NOTIFICATION, 518 userHandle); 519 } 520 521 public void onCleanupUser(int userId) { 522 hideEncryptionNotification(new UserHandle(userId)); 523 } 524 525 public void onStartUser(final int userId) { 526 maybeShowEncryptionNotificationForUser(userId); 527 } 528 529 /** 530 * Check if profile got unlocked but the keystore is still locked. This happens on full disk 531 * encryption devices since the profile may not yet be running when we consider unlocking it 532 * during the normal flow. In this case unlock the keystore for the profile. 533 */ 534 private void ensureProfileKeystoreUnlocked(int userId) { 535 final KeyStore ks = KeyStore.getInstance(); 536 if (ks.state(userId) == KeyStore.State.LOCKED 537 && tiedManagedProfileReadyToUnlock(mUserManager.getUserInfo(userId))) { 538 Slog.i(TAG, "Managed profile got unlocked, will unlock its keystore"); 539 try { 540 // If boot took too long and the password in vold got expired, parent keystore will 541 // be still locked, we ignore this case since the user will be prompted to unlock 542 // the device after boot. 543 unlockChildProfile(userId, true /* ignoreUserNotAuthenticated */); 544 } catch (RemoteException e) { 545 Slog.e(TAG, "Failed to unlock child profile"); 546 } 547 } 548 } 549 550 public void onUnlockUser(final int userId) { 551 // Perform tasks which require locks in LSS on a handler, as we are callbacks from 552 // ActivityManager.unlockUser() 553 mHandler.post(new Runnable() { 554 @Override 555 public void run() { 556 ensureProfileKeystoreUnlocked(userId); 557 // Hide notification first, as tie managed profile lock takes time 558 hideEncryptionNotification(new UserHandle(userId)); 559 560 // Now we have unlocked the parent user we should show notifications 561 // about any profiles that exist. 562 List<UserInfo> profiles = mUserManager.getProfiles(userId); 563 for (int i = 0; i < profiles.size(); i++) { 564 UserInfo profile = profiles.get(i); 565 final boolean isSecure = isUserSecure(profile.id); 566 if (isSecure && profile.isManagedProfile()) { 567 UserHandle userHandle = profile.getUserHandle(); 568 if (!mUserManager.isUserUnlockingOrUnlocked(userHandle) && 569 !mUserManager.isQuietModeEnabled(userHandle)) { 570 showEncryptionNotificationForProfile(userHandle); 571 } 572 } 573 } 574 575 if (mUserManager.getUserInfo(userId).isManagedProfile()) { 576 tieManagedProfileLockIfNecessary(userId, null); 577 } 578 } 579 }); 580 } 581 582 private final BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() { 583 @Override 584 public void onReceive(Context context, Intent intent) { 585 if (Intent.ACTION_USER_ADDED.equals(intent.getAction())) { 586 // Notify keystore that a new user was added. 587 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 588 if (userHandle > UserHandle.USER_SYSTEM) { 589 removeUser(userHandle, /* unknownUser= */ true); 590 } 591 final KeyStore ks = KeyStore.getInstance(); 592 final UserInfo parentInfo = mUserManager.getProfileParent(userHandle); 593 final int parentHandle = parentInfo != null ? parentInfo.id : -1; 594 ks.onUserAdded(userHandle, parentHandle); 595 } else if (Intent.ACTION_USER_STARTING.equals(intent.getAction())) { 596 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 597 mStorage.prefetchUser(userHandle); 598 } else if (Intent.ACTION_USER_REMOVED.equals(intent.getAction())) { 599 final int userHandle = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, 0); 600 if (userHandle > 0) { 601 removeUser(userHandle, /* unknownUser= */ false); 602 } 603 } 604 } 605 }; 606 607 @Override // binder interface 608 public void systemReady() { 609 if (mContext.checkCallingOrSelfPermission(PERMISSION) != PERMISSION_GRANTED) { 610 EventLog.writeEvent(0x534e4554, "28251513", getCallingUid(), ""); // SafetyNet 611 } 612 checkWritePermission(UserHandle.USER_SYSTEM); 613 migrateOldData(); 614 try { 615 getGateKeeperService(); 616 mSpManager.initWeaverService(); 617 } catch (RemoteException e) { 618 Slog.e(TAG, "Failure retrieving IGateKeeperService", e); 619 } 620 // Find the AuthSecret HAL 621 try { 622 mAuthSecretService = IAuthSecret.getService(); 623 } catch (NoSuchElementException e) { 624 Slog.i(TAG, "Device doesn't implement AuthSecret HAL"); 625 } catch (RemoteException e) { 626 Slog.w(TAG, "Failed to get AuthSecret HAL", e); 627 } 628 mDeviceProvisionedObserver.onSystemReady(); 629 // TODO: maybe skip this for split system user mode. 630 mStorage.prefetchUser(UserHandle.USER_SYSTEM); 631 mStrongAuth.systemReady(); 632 } 633 634 private void migrateOldData() { 635 // These Settings moved before multi-user was enabled, so we only have to do it for the 636 // root user. 637 if (getString("migrated", null, 0) == null) { 638 final ContentResolver cr = mContext.getContentResolver(); 639 for (String validSetting : VALID_SETTINGS) { 640 String value = Settings.Secure.getString(cr, validSetting); 641 if (value != null) { 642 setString(validSetting, value, 0); 643 } 644 } 645 // No need to move the password / pattern files. They're already in the right place. 646 setString("migrated", "true", 0); 647 Slog.i(TAG, "Migrated lock settings to new location"); 648 } 649 650 // These Settings changed after multi-user was enabled, hence need to be moved per user. 651 if (getString("migrated_user_specific", null, 0) == null) { 652 final ContentResolver cr = mContext.getContentResolver(); 653 List<UserInfo> users = mUserManager.getUsers(); 654 for (int user = 0; user < users.size(); user++) { 655 // Migrate owner info 656 final int userId = users.get(user).id; 657 final String OWNER_INFO = Secure.LOCK_SCREEN_OWNER_INFO; 658 String ownerInfo = Settings.Secure.getStringForUser(cr, OWNER_INFO, userId); 659 if (!TextUtils.isEmpty(ownerInfo)) { 660 setString(OWNER_INFO, ownerInfo, userId); 661 Settings.Secure.putStringForUser(cr, OWNER_INFO, "", userId); 662 } 663 664 // Migrate owner info enabled. Note there was a bug where older platforms only 665 // stored this value if the checkbox was toggled at least once. The code detects 666 // this case by handling the exception. 667 final String OWNER_INFO_ENABLED = Secure.LOCK_SCREEN_OWNER_INFO_ENABLED; 668 boolean enabled; 669 try { 670 int ivalue = Settings.Secure.getIntForUser(cr, OWNER_INFO_ENABLED, userId); 671 enabled = ivalue != 0; 672 setLong(OWNER_INFO_ENABLED, enabled ? 1 : 0, userId); 673 } catch (SettingNotFoundException e) { 674 // Setting was never stored. Store it if the string is not empty. 675 if (!TextUtils.isEmpty(ownerInfo)) { 676 setLong(OWNER_INFO_ENABLED, 1, userId); 677 } 678 } 679 Settings.Secure.putIntForUser(cr, OWNER_INFO_ENABLED, 0, userId); 680 } 681 // No need to move the password / pattern files. They're already in the right place. 682 setString("migrated_user_specific", "true", 0); 683 Slog.i(TAG, "Migrated per-user lock settings to new location"); 684 } 685 686 // Migrates biometric weak such that the fallback mechanism becomes the primary. 687 if (getString("migrated_biometric_weak", null, 0) == null) { 688 List<UserInfo> users = mUserManager.getUsers(); 689 for (int i = 0; i < users.size(); i++) { 690 int userId = users.get(i).id; 691 long type = getLong(LockPatternUtils.PASSWORD_TYPE_KEY, 692 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 693 userId); 694 long alternateType = getLong(LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 695 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 696 userId); 697 if (type == DevicePolicyManager.PASSWORD_QUALITY_BIOMETRIC_WEAK) { 698 setLong(LockPatternUtils.PASSWORD_TYPE_KEY, 699 alternateType, 700 userId); 701 } 702 setLong(LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 703 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, 704 userId); 705 } 706 setString("migrated_biometric_weak", "true", 0); 707 Slog.i(TAG, "Migrated biometric weak to use the fallback instead"); 708 } 709 710 // Migrates lockscreen.disabled. Prior to M, the flag was ignored when more than one 711 // user was present on the system, so if we're upgrading to M and there is more than one 712 // user we disable the flag to remain consistent. 713 if (getString("migrated_lockscreen_disabled", null, 0) == null) { 714 final List<UserInfo> users = mUserManager.getUsers(); 715 final int userCount = users.size(); 716 int switchableUsers = 0; 717 for (int i = 0; i < userCount; i++) { 718 if (users.get(i).supportsSwitchTo()) { 719 switchableUsers++; 720 } 721 } 722 723 if (switchableUsers > 1) { 724 for (int i = 0; i < userCount; i++) { 725 int id = users.get(i).id; 726 727 if (getBoolean(LockPatternUtils.DISABLE_LOCKSCREEN_KEY, false, id)) { 728 setBoolean(LockPatternUtils.DISABLE_LOCKSCREEN_KEY, false, id); 729 } 730 } 731 } 732 733 setString("migrated_lockscreen_disabled", "true", 0); 734 Slog.i(TAG, "Migrated lockscreen disabled flag"); 735 } 736 737 final List<UserInfo> users = mUserManager.getUsers(); 738 for (int i = 0; i < users.size(); i++) { 739 final UserInfo userInfo = users.get(i); 740 if (userInfo.isManagedProfile() && mStorage.hasChildProfileLock(userInfo.id)) { 741 // When managed profile has a unified lock, the password quality stored has 2 742 // possibilities only. 743 // 1). PASSWORD_QUALITY_UNSPECIFIED, which is upgraded from dp2, and we are 744 // going to set it back to PASSWORD_QUALITY_ALPHANUMERIC. 745 // 2). PASSWORD_QUALITY_ALPHANUMERIC, which is the actual password quality for 746 // unified lock. 747 final long quality = getLong(LockPatternUtils.PASSWORD_TYPE_KEY, 748 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, userInfo.id); 749 if (quality == DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED) { 750 // Only possible when it's upgraded from nyc dp3 751 Slog.i(TAG, "Migrated tied profile lock type"); 752 setLong(LockPatternUtils.PASSWORD_TYPE_KEY, 753 DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC, userInfo.id); 754 } else if (quality != DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC) { 755 // It should not happen 756 Slog.e(TAG, "Invalid tied profile lock type: " + quality); 757 } 758 } 759 try { 760 final String alias = LockPatternUtils.PROFILE_KEY_NAME_ENCRYPT + userInfo.id; 761 java.security.KeyStore keyStore = 762 java.security.KeyStore.getInstance("AndroidKeyStore"); 763 keyStore.load(null); 764 if (keyStore.containsAlias(alias)) { 765 keyStore.deleteEntry(alias); 766 } 767 } catch (KeyStoreException | NoSuchAlgorithmException | 768 CertificateException | IOException e) { 769 Slog.e(TAG, "Unable to remove tied profile key", e); 770 } 771 } 772 773 boolean isWatch = mContext.getPackageManager().hasSystemFeature( 774 PackageManager.FEATURE_WATCH); 775 // Wear used to set DISABLE_LOCKSCREEN to 'true', but because Wear now allows accounts 776 // and device management the lockscreen must be re-enabled now for users that upgrade. 777 if (isWatch && getString("migrated_wear_lockscreen_disabled", null, 0) == null) { 778 final int userCount = users.size(); 779 for (int i = 0; i < userCount; i++) { 780 int id = users.get(i).id; 781 setBoolean(LockPatternUtils.DISABLE_LOCKSCREEN_KEY, false, id); 782 } 783 setString("migrated_wear_lockscreen_disabled", "true", 0); 784 Slog.i(TAG, "Migrated lockscreen_disabled for Wear devices"); 785 } 786 } 787 788 private void migrateOldDataAfterSystemReady() { 789 try { 790 // Migrate the FRP credential to the persistent data block 791 if (LockPatternUtils.frpCredentialEnabled(mContext) 792 && !getBoolean("migrated_frp", false, 0)) { 793 migrateFrpCredential(); 794 setBoolean("migrated_frp", true, 0); 795 Slog.i(TAG, "Migrated migrated_frp."); 796 } 797 } catch (RemoteException e) { 798 Slog.e(TAG, "Unable to migrateOldDataAfterSystemReady", e); 799 } 800 } 801 802 /** 803 * Migrate the credential for the FRP credential owner user if the following are satisfied: 804 * - the user has a secure credential 805 * - the FRP credential is not set up 806 * - the credential is based on a synthetic password. 807 */ 808 private void migrateFrpCredential() throws RemoteException { 809 if (mStorage.readPersistentDataBlock() != PersistentData.NONE) { 810 return; 811 } 812 for (UserInfo userInfo : mUserManager.getUsers()) { 813 if (userOwnsFrpCredential(mContext, userInfo) && isUserSecure(userInfo.id)) { 814 synchronized (mSpManager) { 815 if (isSyntheticPasswordBasedCredentialLocked(userInfo.id)) { 816 int actualQuality = (int) getLong(LockPatternUtils.PASSWORD_TYPE_KEY, 817 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, userInfo.id); 818 819 mSpManager.migrateFrpPasswordLocked( 820 getSyntheticPasswordHandleLocked(userInfo.id), 821 userInfo, 822 redactActualQualityToMostLenientEquivalentQuality(actualQuality)); 823 } 824 } 825 return; 826 } 827 } 828 } 829 830 /** 831 * Returns the lowest password quality that still presents the same UI for entering it. 832 * 833 * For the FRP credential, we do not want to leak the actual quality of the password, only what 834 * kind of UI it requires. However, when migrating, we only know the actual quality, not the 835 * originally requested quality; since this is only used to determine what input variant to 836 * present to the user, we just assume the lowest possible quality was requested. 837 */ 838 private int redactActualQualityToMostLenientEquivalentQuality(int quality) { 839 switch (quality) { 840 case DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC: 841 case DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC: 842 case DevicePolicyManager.PASSWORD_QUALITY_COMPLEX: 843 return DevicePolicyManager.PASSWORD_QUALITY_ALPHABETIC; 844 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC: 845 case DevicePolicyManager.PASSWORD_QUALITY_NUMERIC_COMPLEX: 846 return DevicePolicyManager.PASSWORD_QUALITY_NUMERIC; 847 case DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED: 848 case DevicePolicyManager.PASSWORD_QUALITY_SOMETHING: 849 case DevicePolicyManager.PASSWORD_QUALITY_MANAGED: 850 case DevicePolicyManager.PASSWORD_QUALITY_BIOMETRIC_WEAK: 851 default: 852 return quality; 853 } 854 } 855 856 private final void checkWritePermission(int userId) { 857 mContext.enforceCallingOrSelfPermission(PERMISSION, "LockSettingsWrite"); 858 } 859 860 private final void checkPasswordReadPermission(int userId) { 861 mContext.enforceCallingOrSelfPermission(PERMISSION, "LockSettingsRead"); 862 } 863 864 private final void checkPasswordHavePermission(int userId) { 865 if (mContext.checkCallingOrSelfPermission(PERMISSION) != PERMISSION_GRANTED) { 866 EventLog.writeEvent(0x534e4554, "28251513", getCallingUid(), ""); // SafetyNet 867 } 868 mContext.enforceCallingOrSelfPermission(PERMISSION, "LockSettingsHave"); 869 } 870 871 private final void checkReadPermission(String requestedKey, int userId) { 872 final int callingUid = Binder.getCallingUid(); 873 874 for (int i = 0; i < READ_CONTACTS_PROTECTED_SETTINGS.length; i++) { 875 String key = READ_CONTACTS_PROTECTED_SETTINGS[i]; 876 if (key.equals(requestedKey) && mContext.checkCallingOrSelfPermission(READ_CONTACTS) 877 != PackageManager.PERMISSION_GRANTED) { 878 throw new SecurityException("uid=" + callingUid 879 + " needs permission " + READ_CONTACTS + " to read " 880 + requestedKey + " for user " + userId); 881 } 882 } 883 884 for (int i = 0; i < READ_PASSWORD_PROTECTED_SETTINGS.length; i++) { 885 String key = READ_PASSWORD_PROTECTED_SETTINGS[i]; 886 if (key.equals(requestedKey) && mContext.checkCallingOrSelfPermission(PERMISSION) 887 != PackageManager.PERMISSION_GRANTED) { 888 throw new SecurityException("uid=" + callingUid 889 + " needs permission " + PERMISSION + " to read " 890 + requestedKey + " for user " + userId); 891 } 892 } 893 } 894 895 @Override 896 public boolean getSeparateProfileChallengeEnabled(int userId) { 897 checkReadPermission(SEPARATE_PROFILE_CHALLENGE_KEY, userId); 898 synchronized (mSeparateChallengeLock) { 899 return getBoolean(SEPARATE_PROFILE_CHALLENGE_KEY, false, userId); 900 } 901 } 902 903 @Override 904 public void setSeparateProfileChallengeEnabled(int userId, boolean enabled, 905 String managedUserPassword) { 906 checkWritePermission(userId); 907 synchronized (mSeparateChallengeLock) { 908 setSeparateProfileChallengeEnabledLocked(userId, enabled, managedUserPassword); 909 } 910 notifySeparateProfileChallengeChanged(userId); 911 } 912 913 @GuardedBy("mSeparateChallengeLock") 914 private void setSeparateProfileChallengeEnabledLocked(@UserIdInt int userId, boolean enabled, 915 String managedUserPassword) { 916 setBoolean(SEPARATE_PROFILE_CHALLENGE_KEY, enabled, userId); 917 if (enabled) { 918 mStorage.removeChildProfileLock(userId); 919 removeKeystoreProfileKey(userId); 920 } else { 921 tieManagedProfileLockIfNecessary(userId, managedUserPassword); 922 } 923 } 924 925 private void notifySeparateProfileChallengeChanged(int userId) { 926 final DevicePolicyManagerInternal dpmi = LocalServices.getService( 927 DevicePolicyManagerInternal.class); 928 if (dpmi != null) { 929 dpmi.reportSeparateProfileChallengeChanged(userId); 930 } 931 } 932 933 @Override 934 public void setBoolean(String key, boolean value, int userId) { 935 checkWritePermission(userId); 936 setStringUnchecked(key, userId, value ? "1" : "0"); 937 } 938 939 @Override 940 public void setLong(String key, long value, int userId) { 941 checkWritePermission(userId); 942 setStringUnchecked(key, userId, Long.toString(value)); 943 } 944 945 @Override 946 public void setString(String key, String value, int userId) { 947 checkWritePermission(userId); 948 setStringUnchecked(key, userId, value); 949 } 950 951 private void setStringUnchecked(String key, int userId, String value) { 952 Preconditions.checkArgument(userId != USER_FRP, "cannot store lock settings for FRP user"); 953 954 mStorage.writeKeyValue(key, value, userId); 955 if (ArrayUtils.contains(SETTINGS_TO_BACKUP, key)) { 956 BackupManager.dataChanged("com.android.providers.settings"); 957 } 958 } 959 960 @Override 961 public boolean getBoolean(String key, boolean defaultValue, int userId) { 962 checkReadPermission(key, userId); 963 String value = getStringUnchecked(key, null, userId); 964 return TextUtils.isEmpty(value) ? 965 defaultValue : (value.equals("1") || value.equals("true")); 966 } 967 968 @Override 969 public long getLong(String key, long defaultValue, int userId) { 970 checkReadPermission(key, userId); 971 String value = getStringUnchecked(key, null, userId); 972 return TextUtils.isEmpty(value) ? defaultValue : Long.parseLong(value); 973 } 974 975 @Override 976 public String getString(String key, String defaultValue, int userId) { 977 checkReadPermission(key, userId); 978 return getStringUnchecked(key, defaultValue, userId); 979 } 980 981 public String getStringUnchecked(String key, String defaultValue, int userId) { 982 if (Settings.Secure.LOCK_PATTERN_ENABLED.equals(key)) { 983 long ident = Binder.clearCallingIdentity(); 984 try { 985 return mLockPatternUtils.isLockPatternEnabled(userId) ? "1" : "0"; 986 } finally { 987 Binder.restoreCallingIdentity(ident); 988 } 989 } 990 991 if (userId == USER_FRP) { 992 return getFrpStringUnchecked(key); 993 } 994 995 if (LockPatternUtils.LEGACY_LOCK_PATTERN_ENABLED.equals(key)) { 996 key = Settings.Secure.LOCK_PATTERN_ENABLED; 997 } 998 999 return mStorage.readKeyValue(key, defaultValue, userId); 1000 } 1001 1002 private String getFrpStringUnchecked(String key) { 1003 if (LockPatternUtils.PASSWORD_TYPE_KEY.equals(key)) { 1004 return String.valueOf(readFrpPasswordQuality()); 1005 } 1006 return null; 1007 } 1008 1009 private int readFrpPasswordQuality() { 1010 return mStorage.readPersistentDataBlock().qualityForUi; 1011 } 1012 1013 @Override 1014 public boolean havePassword(int userId) throws RemoteException { 1015 checkPasswordHavePermission(userId); 1016 synchronized (mSpManager) { 1017 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 1018 long handle = getSyntheticPasswordHandleLocked(userId); 1019 return mSpManager.getCredentialType(handle, userId) == 1020 LockPatternUtils.CREDENTIAL_TYPE_PASSWORD; 1021 } 1022 } 1023 // Do we need a permissions check here? 1024 return mStorage.hasPassword(userId); 1025 } 1026 1027 @Override 1028 public boolean havePattern(int userId) throws RemoteException { 1029 checkPasswordHavePermission(userId); 1030 synchronized (mSpManager) { 1031 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 1032 long handle = getSyntheticPasswordHandleLocked(userId); 1033 return mSpManager.getCredentialType(handle, userId) == 1034 LockPatternUtils.CREDENTIAL_TYPE_PATTERN; 1035 } 1036 } 1037 // Do we need a permissions check here? 1038 return mStorage.hasPattern(userId); 1039 } 1040 1041 private boolean isUserSecure(int userId) { 1042 synchronized (mSpManager) { 1043 try { 1044 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 1045 long handle = getSyntheticPasswordHandleLocked(userId); 1046 return mSpManager.getCredentialType(handle, userId) != 1047 LockPatternUtils.CREDENTIAL_TYPE_NONE; 1048 } 1049 } catch (RemoteException e) { 1050 // fall through 1051 } 1052 } 1053 return mStorage.hasCredential(userId); 1054 } 1055 1056 private void setKeystorePassword(String password, int userHandle) { 1057 final KeyStore ks = KeyStore.getInstance(); 1058 ks.onUserPasswordChanged(userHandle, password); 1059 } 1060 1061 private void unlockKeystore(String password, int userHandle) { 1062 if (DEBUG) Slog.v(TAG, "Unlock keystore for user: " + userHandle); 1063 final KeyStore ks = KeyStore.getInstance(); 1064 ks.unlock(userHandle, password); 1065 } 1066 1067 @VisibleForTesting 1068 protected String getDecryptedPasswordForTiedProfile(int userId) 1069 throws KeyStoreException, UnrecoverableKeyException, 1070 NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, 1071 InvalidAlgorithmParameterException, IllegalBlockSizeException, BadPaddingException, 1072 CertificateException, IOException { 1073 if (DEBUG) Slog.v(TAG, "Get child profile decrytped key"); 1074 byte[] storedData = mStorage.readChildProfileLock(userId); 1075 if (storedData == null) { 1076 throw new FileNotFoundException("Child profile lock file not found"); 1077 } 1078 byte[] iv = Arrays.copyOfRange(storedData, 0, PROFILE_KEY_IV_SIZE); 1079 byte[] encryptedPassword = Arrays.copyOfRange(storedData, PROFILE_KEY_IV_SIZE, 1080 storedData.length); 1081 byte[] decryptionResult; 1082 java.security.KeyStore keyStore = java.security.KeyStore.getInstance("AndroidKeyStore"); 1083 keyStore.load(null); 1084 SecretKey decryptionKey = (SecretKey) keyStore.getKey( 1085 LockPatternUtils.PROFILE_KEY_NAME_DECRYPT + userId, null); 1086 1087 Cipher cipher = Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/" 1088 + KeyProperties.BLOCK_MODE_GCM + "/" + KeyProperties.ENCRYPTION_PADDING_NONE); 1089 1090 cipher.init(Cipher.DECRYPT_MODE, decryptionKey, new GCMParameterSpec(128, iv)); 1091 decryptionResult = cipher.doFinal(encryptedPassword); 1092 return new String(decryptionResult, StandardCharsets.UTF_8); 1093 } 1094 1095 private void unlockChildProfile(int profileHandle, boolean ignoreUserNotAuthenticated) 1096 throws RemoteException { 1097 try { 1098 doVerifyCredential(getDecryptedPasswordForTiedProfile(profileHandle), 1099 LockPatternUtils.CREDENTIAL_TYPE_PASSWORD, 1100 false, 0 /* no challenge */, profileHandle, null /* progressCallback */); 1101 } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException 1102 | NoSuchAlgorithmException | NoSuchPaddingException 1103 | InvalidAlgorithmParameterException | IllegalBlockSizeException 1104 | BadPaddingException | CertificateException | IOException e) { 1105 if (e instanceof FileNotFoundException) { 1106 Slog.i(TAG, "Child profile key not found"); 1107 } else if (ignoreUserNotAuthenticated && e instanceof UserNotAuthenticatedException) { 1108 Slog.i(TAG, "Parent keystore seems locked, ignoring"); 1109 } else { 1110 Slog.e(TAG, "Failed to decrypt child profile key", e); 1111 } 1112 } 1113 } 1114 1115 private void unlockUser(int userId, byte[] token, byte[] secret) { 1116 // TODO: make this method fully async so we can update UI with progress strings 1117 final CountDownLatch latch = new CountDownLatch(1); 1118 final IProgressListener listener = new IProgressListener.Stub() { 1119 @Override 1120 public void onStarted(int id, Bundle extras) throws RemoteException { 1121 Log.d(TAG, "unlockUser started"); 1122 } 1123 1124 @Override 1125 public void onProgress(int id, int progress, Bundle extras) throws RemoteException { 1126 Log.d(TAG, "unlockUser progress " + progress); 1127 } 1128 1129 @Override 1130 public void onFinished(int id, Bundle extras) throws RemoteException { 1131 Log.d(TAG, "unlockUser finished"); 1132 latch.countDown(); 1133 } 1134 }; 1135 1136 try { 1137 mActivityManager.unlockUser(userId, token, secret, listener); 1138 } catch (RemoteException e) { 1139 throw e.rethrowAsRuntimeException(); 1140 } 1141 1142 try { 1143 latch.await(15, TimeUnit.SECONDS); 1144 } catch (InterruptedException e) { 1145 Thread.currentThread().interrupt(); 1146 } 1147 try { 1148 if (!mUserManager.getUserInfo(userId).isManagedProfile()) { 1149 final List<UserInfo> profiles = mUserManager.getProfiles(userId); 1150 for (UserInfo pi : profiles) { 1151 // Unlock managed profile with unified lock 1152 if (tiedManagedProfileReadyToUnlock(pi)) { 1153 unlockChildProfile(pi.id, false /* ignoreUserNotAuthenticated */); 1154 } 1155 } 1156 } 1157 } catch (RemoteException e) { 1158 Log.d(TAG, "Failed to unlock child profile", e); 1159 } 1160 } 1161 1162 private boolean tiedManagedProfileReadyToUnlock(UserInfo userInfo) { 1163 return userInfo.isManagedProfile() 1164 && !mLockPatternUtils.isSeparateProfileChallengeEnabled(userInfo.id) 1165 && mStorage.hasChildProfileLock(userInfo.id) 1166 && mUserManager.isUserRunning(userInfo.id); 1167 } 1168 1169 private Map<Integer, String> getDecryptedPasswordsForAllTiedProfiles(int userId) { 1170 if (mUserManager.getUserInfo(userId).isManagedProfile()) { 1171 return null; 1172 } 1173 Map<Integer, String> result = new ArrayMap<Integer, String>(); 1174 final List<UserInfo> profiles = mUserManager.getProfiles(userId); 1175 final int size = profiles.size(); 1176 for (int i = 0; i < size; i++) { 1177 final UserInfo profile = profiles.get(i); 1178 if (!profile.isManagedProfile()) { 1179 continue; 1180 } 1181 final int managedUserId = profile.id; 1182 if (mLockPatternUtils.isSeparateProfileChallengeEnabled(managedUserId)) { 1183 continue; 1184 } 1185 try { 1186 result.put(managedUserId, getDecryptedPasswordForTiedProfile(managedUserId)); 1187 } catch (KeyStoreException | UnrecoverableKeyException | NoSuchAlgorithmException 1188 | NoSuchPaddingException | InvalidKeyException 1189 | InvalidAlgorithmParameterException | IllegalBlockSizeException 1190 | BadPaddingException | CertificateException | IOException e) { 1191 Slog.e(TAG, "getDecryptedPasswordsForAllTiedProfiles failed for user " + 1192 managedUserId, e); 1193 } 1194 } 1195 return result; 1196 } 1197 1198 /** 1199 * Synchronize all profile's work challenge of the given user if it's unified: tie or clear them 1200 * depending on the parent user's secure state. 1201 * 1202 * When clearing tied work challenges, a pre-computed password table for profiles are required, 1203 * since changing password for profiles requires existing password, and existing passwords can 1204 * only be computed before the parent user's password is cleared. 1205 * 1206 * Strictly this is a recursive function, since setLockCredentialInternal ends up calling this 1207 * method again on profiles. However the recursion is guaranteed to terminate as this method 1208 * terminates when the user is a managed profile. 1209 */ 1210 private void synchronizeUnifiedWorkChallengeForProfiles(int userId, 1211 Map<Integer, String> profilePasswordMap) throws RemoteException { 1212 if (mUserManager.getUserInfo(userId).isManagedProfile()) { 1213 return; 1214 } 1215 final boolean isSecure = isUserSecure(userId); 1216 final List<UserInfo> profiles = mUserManager.getProfiles(userId); 1217 final int size = profiles.size(); 1218 for (int i = 0; i < size; i++) { 1219 final UserInfo profile = profiles.get(i); 1220 if (profile.isManagedProfile()) { 1221 final int managedUserId = profile.id; 1222 if (mLockPatternUtils.isSeparateProfileChallengeEnabled(managedUserId)) { 1223 continue; 1224 } 1225 if (isSecure) { 1226 tieManagedProfileLockIfNecessary(managedUserId, null); 1227 } else { 1228 // We use cached work profile password computed before clearing the parent's 1229 // credential, otherwise they get lost 1230 if (profilePasswordMap != null && profilePasswordMap.containsKey(managedUserId)) { 1231 setLockCredentialInternal(null, LockPatternUtils.CREDENTIAL_TYPE_NONE, 1232 profilePasswordMap.get(managedUserId), 1233 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, managedUserId); 1234 } else { 1235 Slog.wtf(TAG, "clear tied profile challenges, but no password supplied."); 1236 // Supplying null here would lead to untrusted credential change 1237 setLockCredentialInternal(null, LockPatternUtils.CREDENTIAL_TYPE_NONE, null, 1238 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, managedUserId); 1239 } 1240 mStorage.removeChildProfileLock(managedUserId); 1241 removeKeystoreProfileKey(managedUserId); 1242 } 1243 } 1244 } 1245 } 1246 1247 private boolean isManagedProfileWithUnifiedLock(int userId) { 1248 return mUserManager.getUserInfo(userId).isManagedProfile() 1249 && !mLockPatternUtils.isSeparateProfileChallengeEnabled(userId); 1250 } 1251 1252 private boolean isManagedProfileWithSeparatedLock(int userId) { 1253 return mUserManager.getUserInfo(userId).isManagedProfile() 1254 && mLockPatternUtils.isSeparateProfileChallengeEnabled(userId); 1255 } 1256 1257 // This method should be called by LockPatternUtil only, all internal methods in this class 1258 // should call setLockCredentialInternal. 1259 @Override 1260 public void setLockCredential(String credential, int type, String savedCredential, 1261 int requestedQuality, int userId) 1262 throws RemoteException { 1263 checkWritePermission(userId); 1264 synchronized (mSeparateChallengeLock) { 1265 setLockCredentialInternal(credential, type, savedCredential, requestedQuality, userId); 1266 setSeparateProfileChallengeEnabledLocked(userId, true, null); 1267 notifyPasswordChanged(userId); 1268 } 1269 notifySeparateProfileChallengeChanged(userId); 1270 } 1271 1272 private void setLockCredentialInternal(String credential, int credentialType, 1273 String savedCredential, int requestedQuality, int userId) throws RemoteException { 1274 // Normalize savedCredential and credential such that empty string is always represented 1275 // as null. 1276 if (TextUtils.isEmpty(savedCredential)) { 1277 savedCredential = null; 1278 } 1279 if (TextUtils.isEmpty(credential)) { 1280 credential = null; 1281 } 1282 synchronized (mSpManager) { 1283 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 1284 spBasedSetLockCredentialInternalLocked(credential, credentialType, savedCredential, 1285 requestedQuality, userId); 1286 return; 1287 } 1288 } 1289 1290 if (credentialType == LockPatternUtils.CREDENTIAL_TYPE_NONE) { 1291 if (credential != null) { 1292 Slog.wtf(TAG, "CredentialType is none, but credential is non-null."); 1293 } 1294 clearUserKeyProtection(userId); 1295 getGateKeeperService().clearSecureUserId(userId); 1296 mStorage.writeCredentialHash(CredentialHash.createEmptyHash(), userId); 1297 setKeystorePassword(null, userId); 1298 fixateNewestUserKeyAuth(userId); 1299 synchronizeUnifiedWorkChallengeForProfiles(userId, null); 1300 notifyActivePasswordMetricsAvailable(null, userId); 1301 mRecoverableKeyStoreManager.lockScreenSecretChanged(credentialType, credential, userId); 1302 return; 1303 } 1304 if (credential == null) { 1305 throw new RemoteException("Null credential with mismatched credential type"); 1306 } 1307 1308 CredentialHash currentHandle = mStorage.readCredentialHash(userId); 1309 if (isManagedProfileWithUnifiedLock(userId)) { 1310 // get credential from keystore when managed profile has unified lock 1311 if (savedCredential == null) { 1312 try { 1313 savedCredential = getDecryptedPasswordForTiedProfile(userId); 1314 } catch (FileNotFoundException e) { 1315 Slog.i(TAG, "Child profile key not found"); 1316 } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException 1317 | NoSuchAlgorithmException | NoSuchPaddingException 1318 | InvalidAlgorithmParameterException | IllegalBlockSizeException 1319 | BadPaddingException | CertificateException | IOException e) { 1320 Slog.e(TAG, "Failed to decrypt child profile key", e); 1321 } 1322 } 1323 } else { 1324 if (currentHandle.hash == null) { 1325 if (savedCredential != null) { 1326 Slog.w(TAG, "Saved credential provided, but none stored"); 1327 } 1328 savedCredential = null; 1329 } 1330 } 1331 synchronized (mSpManager) { 1332 if (shouldMigrateToSyntheticPasswordLocked(userId)) { 1333 initializeSyntheticPasswordLocked(currentHandle.hash, savedCredential, 1334 currentHandle.type, requestedQuality, userId); 1335 spBasedSetLockCredentialInternalLocked(credential, credentialType, savedCredential, 1336 requestedQuality, userId); 1337 return; 1338 } 1339 } 1340 if (DEBUG) Slog.d(TAG, "setLockCredentialInternal: user=" + userId); 1341 byte[] enrolledHandle = enrollCredential(currentHandle.hash, savedCredential, credential, 1342 userId); 1343 if (enrolledHandle != null) { 1344 CredentialHash willStore = CredentialHash.create(enrolledHandle, credentialType); 1345 mStorage.writeCredentialHash(willStore, userId); 1346 // push new secret and auth token to vold 1347 GateKeeperResponse gkResponse = getGateKeeperService() 1348 .verifyChallenge(userId, 0, willStore.hash, credential.getBytes()); 1349 setUserKeyProtection(userId, credential, convertResponse(gkResponse)); 1350 fixateNewestUserKeyAuth(userId); 1351 // Refresh the auth token 1352 doVerifyCredential(credential, credentialType, true, 0, userId, null /* progressCallback */); 1353 synchronizeUnifiedWorkChallengeForProfiles(userId, null); 1354 mRecoverableKeyStoreManager.lockScreenSecretChanged(credentialType, credential, 1355 userId); 1356 } else { 1357 throw new RemoteException("Failed to enroll " + 1358 (credentialType == LockPatternUtils.CREDENTIAL_TYPE_PASSWORD ? "password" 1359 : "pattern")); 1360 } 1361 } 1362 1363 private VerifyCredentialResponse convertResponse(GateKeeperResponse gateKeeperResponse) { 1364 return VerifyCredentialResponse.fromGateKeeperResponse(gateKeeperResponse); 1365 } 1366 1367 @VisibleForTesting 1368 protected void tieProfileLockToParent(int userId, String password) { 1369 if (DEBUG) Slog.v(TAG, "tieProfileLockToParent for user: " + userId); 1370 byte[] randomLockSeed = password.getBytes(StandardCharsets.UTF_8); 1371 byte[] encryptionResult; 1372 byte[] iv; 1373 try { 1374 KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES); 1375 keyGenerator.init(new SecureRandom()); 1376 SecretKey secretKey = keyGenerator.generateKey(); 1377 java.security.KeyStore keyStore = java.security.KeyStore.getInstance("AndroidKeyStore"); 1378 keyStore.load(null); 1379 try { 1380 keyStore.setEntry( 1381 LockPatternUtils.PROFILE_KEY_NAME_ENCRYPT + userId, 1382 new java.security.KeyStore.SecretKeyEntry(secretKey), 1383 new KeyProtection.Builder(KeyProperties.PURPOSE_ENCRYPT) 1384 .setBlockModes(KeyProperties.BLOCK_MODE_GCM) 1385 .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) 1386 .build()); 1387 keyStore.setEntry( 1388 LockPatternUtils.PROFILE_KEY_NAME_DECRYPT + userId, 1389 new java.security.KeyStore.SecretKeyEntry(secretKey), 1390 new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT) 1391 .setBlockModes(KeyProperties.BLOCK_MODE_GCM) 1392 .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) 1393 .setUserAuthenticationRequired(true) 1394 .setUserAuthenticationValidityDurationSeconds(30) 1395 .setCriticalToDeviceEncryption(true) 1396 .build()); 1397 // Key imported, obtain a reference to it. 1398 SecretKey keyStoreEncryptionKey = (SecretKey) keyStore.getKey( 1399 LockPatternUtils.PROFILE_KEY_NAME_ENCRYPT + userId, null); 1400 Cipher cipher = Cipher.getInstance( 1401 KeyProperties.KEY_ALGORITHM_AES + "/" + KeyProperties.BLOCK_MODE_GCM + "/" 1402 + KeyProperties.ENCRYPTION_PADDING_NONE); 1403 cipher.init(Cipher.ENCRYPT_MODE, keyStoreEncryptionKey); 1404 encryptionResult = cipher.doFinal(randomLockSeed); 1405 iv = cipher.getIV(); 1406 } finally { 1407 // The original key can now be discarded. 1408 keyStore.deleteEntry(LockPatternUtils.PROFILE_KEY_NAME_ENCRYPT + userId); 1409 } 1410 } catch (CertificateException | UnrecoverableKeyException 1411 | IOException | BadPaddingException | IllegalBlockSizeException | KeyStoreException 1412 | NoSuchPaddingException | NoSuchAlgorithmException | InvalidKeyException e) { 1413 throw new RuntimeException("Failed to encrypt key", e); 1414 } 1415 ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); 1416 try { 1417 if (iv.length != PROFILE_KEY_IV_SIZE) { 1418 throw new RuntimeException("Invalid iv length: " + iv.length); 1419 } 1420 outputStream.write(iv); 1421 outputStream.write(encryptionResult); 1422 } catch (IOException e) { 1423 throw new RuntimeException("Failed to concatenate byte arrays", e); 1424 } 1425 mStorage.writeChildProfileLock(userId, outputStream.toByteArray()); 1426 } 1427 1428 private byte[] enrollCredential(byte[] enrolledHandle, 1429 String enrolledCredential, String toEnroll, int userId) 1430 throws RemoteException { 1431 checkWritePermission(userId); 1432 byte[] enrolledCredentialBytes = enrolledCredential == null 1433 ? null 1434 : enrolledCredential.getBytes(); 1435 byte[] toEnrollBytes = toEnroll == null 1436 ? null 1437 : toEnroll.getBytes(); 1438 GateKeeperResponse response = getGateKeeperService().enroll(userId, enrolledHandle, 1439 enrolledCredentialBytes, toEnrollBytes); 1440 1441 if (response == null) { 1442 return null; 1443 } 1444 1445 byte[] hash = response.getPayload(); 1446 if (hash != null) { 1447 setKeystorePassword(toEnroll, userId); 1448 } else { 1449 // Should not happen 1450 Slog.e(TAG, "Throttled while enrolling a password"); 1451 } 1452 return hash; 1453 } 1454 1455 private void setAuthlessUserKeyProtection(int userId, byte[] key) throws RemoteException { 1456 if (DEBUG) Slog.d(TAG, "setAuthlessUserKeyProtectiond: user=" + userId); 1457 addUserKeyAuth(userId, null, key); 1458 } 1459 1460 private void setUserKeyProtection(int userId, String credential, VerifyCredentialResponse vcr) 1461 throws RemoteException { 1462 if (DEBUG) Slog.d(TAG, "setUserKeyProtection: user=" + userId); 1463 if (vcr == null) { 1464 throw new RemoteException("Null response verifying a credential we just set"); 1465 } 1466 if (vcr.getResponseCode() != VerifyCredentialResponse.RESPONSE_OK) { 1467 throw new RemoteException("Non-OK response verifying a credential we just set: " 1468 + vcr.getResponseCode()); 1469 } 1470 byte[] token = vcr.getPayload(); 1471 if (token == null) { 1472 throw new RemoteException("Empty payload verifying a credential we just set"); 1473 } 1474 addUserKeyAuth(userId, token, secretFromCredential(credential)); 1475 } 1476 1477 private void clearUserKeyProtection(int userId) throws RemoteException { 1478 if (DEBUG) Slog.d(TAG, "clearUserKeyProtection user=" + userId); 1479 addUserKeyAuth(userId, null, null); 1480 } 1481 1482 private static byte[] secretFromCredential(String credential) throws RemoteException { 1483 try { 1484 MessageDigest digest = MessageDigest.getInstance("SHA-512"); 1485 // Personalize the hash 1486 byte[] personalization = "Android FBE credential hash" 1487 .getBytes(StandardCharsets.UTF_8); 1488 // Pad it to the block size of the hash function 1489 personalization = Arrays.copyOf(personalization, 128); 1490 digest.update(personalization); 1491 digest.update(credential.getBytes(StandardCharsets.UTF_8)); 1492 return digest.digest(); 1493 } catch (NoSuchAlgorithmException e) { 1494 throw new RuntimeException("NoSuchAlgorithmException for SHA-512"); 1495 } 1496 } 1497 1498 private void addUserKeyAuth(int userId, byte[] token, byte[] secret) 1499 throws RemoteException { 1500 final UserInfo userInfo = mUserManager.getUserInfo(userId); 1501 final IStorageManager storageManager = mInjector.getStorageManager(); 1502 final long callingId = Binder.clearCallingIdentity(); 1503 try { 1504 storageManager.addUserKeyAuth(userId, userInfo.serialNumber, token, secret); 1505 } finally { 1506 Binder.restoreCallingIdentity(callingId); 1507 } 1508 } 1509 1510 private void fixateNewestUserKeyAuth(int userId) 1511 throws RemoteException { 1512 if (DEBUG) Slog.d(TAG, "fixateNewestUserKeyAuth: user=" + userId); 1513 final IStorageManager storageManager = mInjector.getStorageManager(); 1514 final long callingId = Binder.clearCallingIdentity(); 1515 try { 1516 storageManager.fixateNewestUserKeyAuth(userId); 1517 } finally { 1518 Binder.restoreCallingIdentity(callingId); 1519 } 1520 } 1521 1522 @Override 1523 public void resetKeyStore(int userId) throws RemoteException { 1524 checkWritePermission(userId); 1525 if (DEBUG) Slog.v(TAG, "Reset keystore for user: " + userId); 1526 int managedUserId = -1; 1527 String managedUserDecryptedPassword = null; 1528 final List<UserInfo> profiles = mUserManager.getProfiles(userId); 1529 for (UserInfo pi : profiles) { 1530 // Unlock managed profile with unified lock 1531 if (pi.isManagedProfile() 1532 && !mLockPatternUtils.isSeparateProfileChallengeEnabled(pi.id) 1533 && mStorage.hasChildProfileLock(pi.id)) { 1534 try { 1535 if (managedUserId == -1) { 1536 managedUserDecryptedPassword = getDecryptedPasswordForTiedProfile(pi.id); 1537 managedUserId = pi.id; 1538 } else { 1539 // Should not happen 1540 Slog.e(TAG, "More than one managed profile, uid1:" + managedUserId 1541 + ", uid2:" + pi.id); 1542 } 1543 } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException 1544 | NoSuchAlgorithmException | NoSuchPaddingException 1545 | InvalidAlgorithmParameterException | IllegalBlockSizeException 1546 | BadPaddingException | CertificateException | IOException e) { 1547 Slog.e(TAG, "Failed to decrypt child profile key", e); 1548 } 1549 } 1550 } 1551 try { 1552 // Clear all the users credentials could have been installed in for this user. 1553 for (int profileId : mUserManager.getProfileIdsWithDisabled(userId)) { 1554 for (int uid : SYSTEM_CREDENTIAL_UIDS) { 1555 mKeyStore.clearUid(UserHandle.getUid(profileId, uid)); 1556 } 1557 } 1558 } finally { 1559 if (managedUserId != -1 && managedUserDecryptedPassword != null) { 1560 if (DEBUG) Slog.v(TAG, "Restore tied profile lock"); 1561 tieProfileLockToParent(managedUserId, managedUserDecryptedPassword); 1562 } 1563 } 1564 } 1565 1566 @Override 1567 public VerifyCredentialResponse checkCredential(String credential, int type, int userId, 1568 ICheckCredentialProgressCallback progressCallback) throws RemoteException { 1569 checkPasswordReadPermission(userId); 1570 return doVerifyCredential(credential, type, false, 0, userId, progressCallback); 1571 } 1572 1573 @Override 1574 public VerifyCredentialResponse verifyCredential(String credential, int type, long challenge, 1575 int userId) throws RemoteException { 1576 checkPasswordReadPermission(userId); 1577 return doVerifyCredential(credential, type, true, challenge, userId, 1578 null /* progressCallback */); 1579 } 1580 1581 /** 1582 * Verify user credential and unlock the user. Fix pattern bug by deprecating the old base zero 1583 * format. 1584 */ 1585 private VerifyCredentialResponse doVerifyCredential(String credential, int credentialType, 1586 boolean hasChallenge, long challenge, int userId, 1587 ICheckCredentialProgressCallback progressCallback) throws RemoteException { 1588 if (TextUtils.isEmpty(credential)) { 1589 throw new IllegalArgumentException("Credential can't be null or empty"); 1590 } 1591 if (userId == USER_FRP && Settings.Global.getInt(mContext.getContentResolver(), 1592 Settings.Global.DEVICE_PROVISIONED, 0) != 0) { 1593 Slog.e(TAG, "FRP credential can only be verified prior to provisioning."); 1594 return VerifyCredentialResponse.ERROR; 1595 } 1596 VerifyCredentialResponse response = null; 1597 response = spBasedDoVerifyCredential(credential, credentialType, hasChallenge, challenge, 1598 userId, progressCallback); 1599 // The user employs synthetic password based credential. 1600 if (response != null) { 1601 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 1602 mRecoverableKeyStoreManager.lockScreenSecretAvailable(credentialType, credential, 1603 userId); 1604 } 1605 return response; 1606 } 1607 1608 if (userId == USER_FRP) { 1609 Slog.wtf(TAG, "Unexpected FRP credential type, should be SP based."); 1610 return VerifyCredentialResponse.ERROR; 1611 } 1612 1613 final CredentialHash storedHash = mStorage.readCredentialHash(userId); 1614 if (storedHash.type != credentialType) { 1615 Slog.wtf(TAG, "doVerifyCredential type mismatch with stored credential??" 1616 + " stored: " + storedHash.type + " passed in: " + credentialType); 1617 return VerifyCredentialResponse.ERROR; 1618 } 1619 1620 boolean shouldReEnrollBaseZero = storedHash.type == LockPatternUtils.CREDENTIAL_TYPE_PATTERN 1621 && storedHash.isBaseZeroPattern; 1622 1623 String credentialToVerify; 1624 if (shouldReEnrollBaseZero) { 1625 credentialToVerify = LockPatternUtils.patternStringToBaseZero(credential); 1626 } else { 1627 credentialToVerify = credential; 1628 } 1629 1630 response = verifyCredential(userId, storedHash, credentialToVerify, 1631 hasChallenge, challenge, progressCallback); 1632 1633 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 1634 mStrongAuth.reportSuccessfulStrongAuthUnlock(userId); 1635 if (shouldReEnrollBaseZero) { 1636 setLockCredentialInternal(credential, storedHash.type, credentialToVerify, 1637 DevicePolicyManager.PASSWORD_QUALITY_SOMETHING, userId); 1638 } 1639 } 1640 1641 return response; 1642 } 1643 1644 @Override 1645 public VerifyCredentialResponse verifyTiedProfileChallenge(String credential, int type, 1646 long challenge, int userId) throws RemoteException { 1647 checkPasswordReadPermission(userId); 1648 if (!isManagedProfileWithUnifiedLock(userId)) { 1649 throw new RemoteException("User id must be managed profile with unified lock"); 1650 } 1651 final int parentProfileId = mUserManager.getProfileParent(userId).id; 1652 // Unlock parent by using parent's challenge 1653 final VerifyCredentialResponse parentResponse = doVerifyCredential( 1654 credential, 1655 type, 1656 true /* hasChallenge */, 1657 challenge, 1658 parentProfileId, 1659 null /* progressCallback */); 1660 if (parentResponse.getResponseCode() != VerifyCredentialResponse.RESPONSE_OK) { 1661 // Failed, just return parent's response 1662 return parentResponse; 1663 } 1664 1665 try { 1666 // Unlock work profile, and work profile with unified lock must use password only 1667 return doVerifyCredential(getDecryptedPasswordForTiedProfile(userId), 1668 LockPatternUtils.CREDENTIAL_TYPE_PASSWORD, 1669 true, 1670 challenge, 1671 userId, null /* progressCallback */); 1672 } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException 1673 | NoSuchAlgorithmException | NoSuchPaddingException 1674 | InvalidAlgorithmParameterException | IllegalBlockSizeException 1675 | BadPaddingException | CertificateException | IOException e) { 1676 Slog.e(TAG, "Failed to decrypt child profile key", e); 1677 throw new RemoteException("Unable to get tied profile token"); 1678 } 1679 } 1680 1681 /** 1682 * Lowest-level credential verification routine that talks to GateKeeper. If verification 1683 * passes, unlock the corresponding user and keystore. Also handles the migration from legacy 1684 * hash to GK. 1685 */ 1686 private VerifyCredentialResponse verifyCredential(int userId, CredentialHash storedHash, 1687 String credential, boolean hasChallenge, long challenge, 1688 ICheckCredentialProgressCallback progressCallback) throws RemoteException { 1689 if ((storedHash == null || storedHash.hash.length == 0) && TextUtils.isEmpty(credential)) { 1690 // don't need to pass empty credentials to GateKeeper 1691 return VerifyCredentialResponse.OK; 1692 } 1693 1694 if (storedHash == null || TextUtils.isEmpty(credential)) { 1695 return VerifyCredentialResponse.ERROR; 1696 } 1697 1698 // We're potentially going to be doing a bunch of disk I/O below as part 1699 // of unlocking the user, so yell if calling from the main thread. 1700 StrictMode.noteDiskRead(); 1701 1702 if (storedHash.version == CredentialHash.VERSION_LEGACY) { 1703 final byte[] hash; 1704 if (storedHash.type == LockPatternUtils.CREDENTIAL_TYPE_PATTERN) { 1705 hash = LockPatternUtils.patternToHash(LockPatternUtils.stringToPattern(credential)); 1706 } else { 1707 hash = mLockPatternUtils.passwordToHash(credential, userId); 1708 } 1709 if (Arrays.equals(hash, storedHash.hash)) { 1710 if (storedHash.type == LockPatternUtils.CREDENTIAL_TYPE_PATTERN) { 1711 unlockKeystore(LockPatternUtils.patternStringToBaseZero(credential), userId); 1712 } else { 1713 unlockKeystore(credential, userId); 1714 } 1715 // Users with legacy credentials don't have credential-backed 1716 // FBE keys, so just pass through a fake token/secret 1717 Slog.i(TAG, "Unlocking user with fake token: " + userId); 1718 final byte[] fakeToken = String.valueOf(userId).getBytes(); 1719 unlockUser(userId, fakeToken, fakeToken); 1720 1721 // migrate credential to GateKeeper 1722 setLockCredentialInternal(credential, storedHash.type, null, 1723 storedHash.type == LockPatternUtils.CREDENTIAL_TYPE_PATTERN 1724 ? DevicePolicyManager.PASSWORD_QUALITY_SOMETHING 1725 : DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC 1726 /* TODO(roosa): keep the same password quality */, userId); 1727 if (!hasChallenge) { 1728 notifyActivePasswordMetricsAvailable(credential, userId); 1729 // Use credentials to create recoverable keystore snapshot. 1730 mRecoverableKeyStoreManager.lockScreenSecretAvailable( 1731 storedHash.type, credential, userId); 1732 return VerifyCredentialResponse.OK; 1733 } 1734 // Fall through to get the auth token. Technically this should never happen, 1735 // as a user that had a legacy credential would have to unlock their device 1736 // before getting to a flow with a challenge, but supporting for consistency. 1737 } else { 1738 return VerifyCredentialResponse.ERROR; 1739 } 1740 } 1741 GateKeeperResponse gateKeeperResponse = getGateKeeperService() 1742 .verifyChallenge(userId, challenge, storedHash.hash, credential.getBytes()); 1743 VerifyCredentialResponse response = convertResponse(gateKeeperResponse); 1744 boolean shouldReEnroll = gateKeeperResponse.getShouldReEnroll(); 1745 1746 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 1747 1748 // credential has matched 1749 1750 if (progressCallback != null) { 1751 progressCallback.onCredentialVerified(); 1752 } 1753 notifyActivePasswordMetricsAvailable(credential, userId); 1754 unlockKeystore(credential, userId); 1755 1756 Slog.i(TAG, "Unlocking user " + userId + " with token length " 1757 + response.getPayload().length); 1758 unlockUser(userId, response.getPayload(), secretFromCredential(credential)); 1759 1760 if (isManagedProfileWithSeparatedLock(userId)) { 1761 TrustManager trustManager = 1762 (TrustManager) mContext.getSystemService(Context.TRUST_SERVICE); 1763 trustManager.setDeviceLockedForUser(userId, false); 1764 } 1765 int reEnrollQuality = storedHash.type == LockPatternUtils.CREDENTIAL_TYPE_PATTERN 1766 ? DevicePolicyManager.PASSWORD_QUALITY_SOMETHING 1767 : DevicePolicyManager.PASSWORD_QUALITY_ALPHANUMERIC 1768 /* TODO(roosa): keep the same password quality */; 1769 if (shouldReEnroll) { 1770 setLockCredentialInternal(credential, storedHash.type, credential, 1771 reEnrollQuality, userId); 1772 } else { 1773 // Now that we've cleared of all required GK migration, let's do the final 1774 // migration to synthetic password. 1775 synchronized (mSpManager) { 1776 if (shouldMigrateToSyntheticPasswordLocked(userId)) { 1777 AuthenticationToken auth = initializeSyntheticPasswordLocked( 1778 storedHash.hash, credential, storedHash.type, reEnrollQuality, 1779 userId); 1780 activateEscrowTokens(auth, userId); 1781 } 1782 } 1783 } 1784 // Use credentials to create recoverable keystore snapshot. 1785 mRecoverableKeyStoreManager.lockScreenSecretAvailable(storedHash.type, credential, 1786 userId); 1787 1788 } else if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_RETRY) { 1789 if (response.getTimeout() > 0) { 1790 requireStrongAuth(STRONG_AUTH_REQUIRED_AFTER_LOCKOUT, userId); 1791 } 1792 } 1793 1794 return response; 1795 } 1796 1797 /** 1798 * Call this method to notify DPMS regarding the latest password metric. This should be called 1799 * when the user is authenticating or when a new password is being set. 1800 */ 1801 private void notifyActivePasswordMetricsAvailable(String password, @UserIdInt int userId) { 1802 final PasswordMetrics metrics; 1803 if (password == null) { 1804 metrics = new PasswordMetrics(); 1805 } else { 1806 metrics = PasswordMetrics.computeForPassword(password); 1807 metrics.quality = mLockPatternUtils.getKeyguardStoredPasswordQuality(userId); 1808 } 1809 1810 // Asynchronous to avoid dead lock 1811 mHandler.post(() -> { 1812 DevicePolicyManager dpm = (DevicePolicyManager) 1813 mContext.getSystemService(Context.DEVICE_POLICY_SERVICE); 1814 dpm.setActivePasswordState(metrics, userId); 1815 }); 1816 } 1817 1818 /** 1819 * Call after {@link #notifyActivePasswordMetricsAvailable} so metrics are updated before 1820 * reporting the password changed. 1821 */ 1822 private void notifyPasswordChanged(@UserIdInt int userId) { 1823 // Same handler as notifyActivePasswordMetricsAvailable to ensure correct ordering 1824 mHandler.post(() -> { 1825 DevicePolicyManager dpm = (DevicePolicyManager) 1826 mContext.getSystemService(Context.DEVICE_POLICY_SERVICE); 1827 dpm.reportPasswordChanged(userId); 1828 }); 1829 } 1830 1831 @Override 1832 public boolean checkVoldPassword(int userId) throws RemoteException { 1833 if (!mFirstCallToVold) { 1834 return false; 1835 } 1836 mFirstCallToVold = false; 1837 1838 checkPasswordReadPermission(userId); 1839 1840 // There's no guarantee that this will safely connect, but if it fails 1841 // we will simply show the lock screen when we shouldn't, so relatively 1842 // benign. There is an outside chance something nasty would happen if 1843 // this service restarted before vold stales out the password in this 1844 // case. The nastiness is limited to not showing the lock screen when 1845 // we should, within the first minute of decrypting the phone if this 1846 // service can't connect to vold, it restarts, and then the new instance 1847 // does successfully connect. 1848 final IStorageManager service = mInjector.getStorageManager(); 1849 String password; 1850 long identity = Binder.clearCallingIdentity(); 1851 try { 1852 password = service.getPassword(); 1853 service.clearPassword(); 1854 } finally { 1855 Binder.restoreCallingIdentity(identity); 1856 } 1857 if (password == null) { 1858 return false; 1859 } 1860 1861 try { 1862 if (mLockPatternUtils.isLockPatternEnabled(userId)) { 1863 if (checkCredential(password, LockPatternUtils.CREDENTIAL_TYPE_PATTERN, userId, 1864 null /* progressCallback */) 1865 .getResponseCode() == GateKeeperResponse.RESPONSE_OK) { 1866 return true; 1867 } 1868 } 1869 } catch (Exception e) { 1870 } 1871 1872 try { 1873 if (mLockPatternUtils.isLockPasswordEnabled(userId)) { 1874 if (checkCredential(password, LockPatternUtils.CREDENTIAL_TYPE_PASSWORD, userId, 1875 null /* progressCallback */) 1876 .getResponseCode() == GateKeeperResponse.RESPONSE_OK) { 1877 return true; 1878 } 1879 } 1880 } catch (Exception e) { 1881 } 1882 1883 return false; 1884 } 1885 1886 private void removeUser(int userId, boolean unknownUser) { 1887 mSpManager.removeUser(userId); 1888 mStorage.removeUser(userId); 1889 mStrongAuth.removeUser(userId); 1890 cleanSpCache(); 1891 1892 final KeyStore ks = KeyStore.getInstance(); 1893 ks.onUserRemoved(userId); 1894 1895 try { 1896 final IGateKeeperService gk = getGateKeeperService(); 1897 if (gk != null) { 1898 gk.clearSecureUserId(userId); 1899 } 1900 } catch (RemoteException ex) { 1901 Slog.w(TAG, "unable to clear GK secure user id"); 1902 } 1903 if (unknownUser || mUserManager.getUserInfo(userId).isManagedProfile()) { 1904 removeKeystoreProfileKey(userId); 1905 } 1906 } 1907 1908 private void removeKeystoreProfileKey(int targetUserId) { 1909 if (DEBUG) Slog.v(TAG, "Remove keystore profile key for user: " + targetUserId); 1910 try { 1911 java.security.KeyStore keyStore = java.security.KeyStore.getInstance("AndroidKeyStore"); 1912 keyStore.load(null); 1913 keyStore.deleteEntry(LockPatternUtils.PROFILE_KEY_NAME_ENCRYPT + targetUserId); 1914 keyStore.deleteEntry(LockPatternUtils.PROFILE_KEY_NAME_DECRYPT + targetUserId); 1915 } catch (KeyStoreException | NoSuchAlgorithmException | CertificateException 1916 | IOException e) { 1917 // We have tried our best to remove all keys 1918 Slog.e(TAG, "Unable to remove keystore profile key for user:" + targetUserId, e); 1919 } 1920 } 1921 1922 @Override 1923 public void registerStrongAuthTracker(IStrongAuthTracker tracker) { 1924 checkPasswordReadPermission(UserHandle.USER_ALL); 1925 mStrongAuth.registerStrongAuthTracker(tracker); 1926 } 1927 1928 @Override 1929 public void unregisterStrongAuthTracker(IStrongAuthTracker tracker) { 1930 checkPasswordReadPermission(UserHandle.USER_ALL); 1931 mStrongAuth.unregisterStrongAuthTracker(tracker); 1932 } 1933 1934 @Override 1935 public void requireStrongAuth(int strongAuthReason, int userId) { 1936 checkWritePermission(userId); 1937 mStrongAuth.requireStrongAuth(strongAuthReason, userId); 1938 } 1939 1940 @Override 1941 public void userPresent(int userId) { 1942 checkWritePermission(userId); 1943 mStrongAuth.reportUnlock(userId); 1944 } 1945 1946 @Override 1947 public int getStrongAuthForUser(int userId) { 1948 checkPasswordReadPermission(userId); 1949 return mStrongAuthTracker.getStrongAuthForUser(userId); 1950 } 1951 1952 private boolean isCallerShell() { 1953 final int callingUid = Binder.getCallingUid(); 1954 return callingUid == Process.SHELL_UID || callingUid == Process.ROOT_UID; 1955 } 1956 1957 private void enforceShell() { 1958 if (!isCallerShell()) { 1959 throw new SecurityException("Caller must be shell"); 1960 } 1961 } 1962 1963 @Override 1964 public void onShellCommand(FileDescriptor in, FileDescriptor out, FileDescriptor err, 1965 String[] args, ShellCallback callback, ResultReceiver resultReceiver) 1966 throws RemoteException { 1967 enforceShell(); 1968 final long origId = Binder.clearCallingIdentity(); 1969 try { 1970 (new LockSettingsShellCommand(mContext, new LockPatternUtils(mContext))).exec( 1971 this, in, out, err, args, callback, resultReceiver); 1972 } finally { 1973 Binder.restoreCallingIdentity(origId); 1974 } 1975 } 1976 1977 @Override 1978 public void initRecoveryService(@NonNull String rootCertificateAlias, 1979 @NonNull byte[] signedPublicKeyList) throws RemoteException { 1980 mRecoverableKeyStoreManager.initRecoveryService(rootCertificateAlias, 1981 signedPublicKeyList); 1982 } 1983 1984 @Override 1985 public KeyChainSnapshot getKeyChainSnapshot() throws RemoteException { 1986 return mRecoverableKeyStoreManager.getKeyChainSnapshot(); 1987 } 1988 1989 public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent) 1990 throws RemoteException { 1991 mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent); 1992 } 1993 1994 public Map getRecoverySnapshotVersions() throws RemoteException { 1995 return mRecoverableKeyStoreManager.getRecoverySnapshotVersions(); 1996 } 1997 1998 @Override 1999 public void setServerParams(byte[] serverParams) throws RemoteException { 2000 mRecoverableKeyStoreManager.setServerParams(serverParams); 2001 } 2002 2003 @Override 2004 public void setRecoveryStatus(@NonNull String packageName, @Nullable String[] aliases, 2005 int status) throws RemoteException { 2006 mRecoverableKeyStoreManager.setRecoveryStatus(packageName, aliases, status); 2007 } 2008 2009 public Map getRecoveryStatus(@Nullable String packageName) throws RemoteException { 2010 return mRecoverableKeyStoreManager.getRecoveryStatus(packageName); 2011 } 2012 2013 @Override 2014 public void setRecoverySecretTypes(@NonNull @KeyChainProtectionParams.UserSecretType 2015 int[] secretTypes) throws RemoteException { 2016 mRecoverableKeyStoreManager.setRecoverySecretTypes(secretTypes); 2017 } 2018 2019 @Override 2020 public int[] getRecoverySecretTypes() throws RemoteException { 2021 return mRecoverableKeyStoreManager.getRecoverySecretTypes(); 2022 2023 } 2024 2025 @Override 2026 public int[] getPendingRecoverySecretTypes() throws RemoteException { 2027 throw new SecurityException("Not implemented"); 2028 } 2029 2030 @Override 2031 public void recoverySecretAvailable(@NonNull KeyChainProtectionParams recoverySecret) 2032 throws RemoteException { 2033 mRecoverableKeyStoreManager.recoverySecretAvailable(recoverySecret); 2034 } 2035 2036 @Override 2037 public byte[] startRecoverySession(@NonNull String sessionId, 2038 @NonNull byte[] verifierPublicKey, @NonNull byte[] vaultParams, 2039 @NonNull byte[] vaultChallenge, @NonNull List<KeyChainProtectionParams> secrets) 2040 throws RemoteException { 2041 return mRecoverableKeyStoreManager.startRecoverySession(sessionId, verifierPublicKey, 2042 vaultParams, vaultChallenge, secrets); 2043 } 2044 2045 public void closeSession(@NonNull String sessionId) throws RemoteException { 2046 mRecoverableKeyStoreManager.closeSession(sessionId); 2047 } 2048 2049 @Override 2050 public Map<String, byte[]> recoverKeys(@NonNull String sessionId, 2051 @NonNull byte[] recoveryKeyBlob, @NonNull List<WrappedApplicationKey> applicationKeys) 2052 throws RemoteException { 2053 return mRecoverableKeyStoreManager.recoverKeys( 2054 sessionId, recoveryKeyBlob, applicationKeys); 2055 } 2056 2057 @Override 2058 public void removeKey(@NonNull String alias) throws RemoteException { 2059 mRecoverableKeyStoreManager.removeKey(alias); 2060 } 2061 2062 @Override 2063 public byte[] generateAndStoreKey(@NonNull String alias) throws RemoteException { 2064 return mRecoverableKeyStoreManager.generateAndStoreKey(alias); 2065 } 2066 2067 private static final String[] VALID_SETTINGS = new String[] { 2068 LockPatternUtils.LOCKOUT_PERMANENT_KEY, 2069 LockPatternUtils.LOCKOUT_ATTEMPT_DEADLINE, 2070 LockPatternUtils.PATTERN_EVER_CHOSEN_KEY, 2071 LockPatternUtils.PASSWORD_TYPE_KEY, 2072 LockPatternUtils.PASSWORD_TYPE_ALTERNATE_KEY, 2073 LockPatternUtils.LOCK_PASSWORD_SALT_KEY, 2074 LockPatternUtils.DISABLE_LOCKSCREEN_KEY, 2075 LockPatternUtils.LOCKSCREEN_OPTIONS, 2076 LockPatternUtils.LOCKSCREEN_BIOMETRIC_WEAK_FALLBACK, 2077 LockPatternUtils.BIOMETRIC_WEAK_EVER_CHOSEN_KEY, 2078 LockPatternUtils.LOCKSCREEN_POWER_BUTTON_INSTANTLY_LOCKS, 2079 LockPatternUtils.PASSWORD_HISTORY_KEY, 2080 Secure.LOCK_PATTERN_ENABLED, 2081 Secure.LOCK_BIOMETRIC_WEAK_FLAGS, 2082 Secure.LOCK_PATTERN_VISIBLE, 2083 Secure.LOCK_PATTERN_TACTILE_FEEDBACK_ENABLED 2084 }; 2085 2086 // Reading these settings needs the contacts permission 2087 private static final String[] READ_CONTACTS_PROTECTED_SETTINGS = new String[] { 2088 Secure.LOCK_SCREEN_OWNER_INFO_ENABLED, 2089 Secure.LOCK_SCREEN_OWNER_INFO 2090 }; 2091 2092 // Reading these settings needs the same permission as checking the password 2093 private static final String[] READ_PASSWORD_PROTECTED_SETTINGS = new String[] { 2094 LockPatternUtils.LOCK_PASSWORD_SALT_KEY, 2095 LockPatternUtils.PASSWORD_HISTORY_KEY, 2096 LockPatternUtils.PASSWORD_TYPE_KEY, 2097 SEPARATE_PROFILE_CHALLENGE_KEY 2098 }; 2099 2100 private static final String[] SETTINGS_TO_BACKUP = new String[] { 2101 Secure.LOCK_SCREEN_OWNER_INFO_ENABLED, 2102 Secure.LOCK_SCREEN_OWNER_INFO, 2103 Secure.LOCK_PATTERN_VISIBLE, 2104 LockPatternUtils.LOCKSCREEN_POWER_BUTTON_INSTANTLY_LOCKS 2105 }; 2106 2107 private class GateKeeperDiedRecipient implements IBinder.DeathRecipient { 2108 @Override 2109 public void binderDied() { 2110 mGateKeeperService.asBinder().unlinkToDeath(this, 0); 2111 mGateKeeperService = null; 2112 } 2113 } 2114 2115 protected synchronized IGateKeeperService getGateKeeperService() 2116 throws RemoteException { 2117 if (mGateKeeperService != null) { 2118 return mGateKeeperService; 2119 } 2120 2121 final IBinder service = ServiceManager.getService(Context.GATEKEEPER_SERVICE); 2122 if (service != null) { 2123 service.linkToDeath(new GateKeeperDiedRecipient(), 0); 2124 mGateKeeperService = IGateKeeperService.Stub.asInterface(service); 2125 return mGateKeeperService; 2126 } 2127 2128 Slog.e(TAG, "Unable to acquire GateKeeperService"); 2129 return null; 2130 } 2131 2132 /** 2133 * A user's synthetic password does not change so it must be cached in certain circumstances to 2134 * enable untrusted credential reset. 2135 * 2136 * Untrusted credential reset will be removed in a future version (b/68036371) at which point 2137 * this cache is no longer needed as the SP will always be known when changing the user's 2138 * credential. 2139 */ 2140 @GuardedBy("mSpManager") 2141 private SparseArray<AuthenticationToken> mSpCache = new SparseArray(); 2142 2143 private void onAuthTokenKnownForUser(@UserIdInt int userId, AuthenticationToken auth) { 2144 // Pass the primary user's auth secret to the HAL 2145 if (mAuthSecretService != null && mUserManager.getUserInfo(userId).isPrimary()) { 2146 try { 2147 final byte[] rawSecret = auth.deriveVendorAuthSecret(); 2148 final ArrayList<Byte> secret = new ArrayList<>(rawSecret.length); 2149 for (int i = 0; i < rawSecret.length; ++i) { 2150 secret.add(rawSecret[i]); 2151 } 2152 mAuthSecretService.primaryUserCredential(secret); 2153 } catch (RemoteException e) { 2154 Slog.w(TAG, "Failed to pass primary user secret to AuthSecret HAL", e); 2155 } 2156 } 2157 2158 // Update the SP cache, removing the entry when allowed 2159 synchronized (mSpManager) { 2160 if (shouldCacheSpForUser(userId)) { 2161 Slog.i(TAG, "Caching SP for user " + userId); 2162 mSpCache.put(userId, auth); 2163 } else { 2164 Slog.i(TAG, "Not caching SP for user " + userId); 2165 mSpCache.delete(userId); 2166 } 2167 } 2168 } 2169 2170 /** Clean up the SP cache by removing unneeded entries. */ 2171 private void cleanSpCache() { 2172 synchronized (mSpManager) { 2173 // Preserve indicies after removal by iterating backwards 2174 for (int i = mSpCache.size() - 1; i >= 0; --i) { 2175 final int userId = mSpCache.keyAt(i); 2176 if (!shouldCacheSpForUser(userId)) { 2177 Slog.i(TAG, "Uncaching SP for user " + userId); 2178 mSpCache.removeAt(i); 2179 } 2180 } 2181 } 2182 } 2183 2184 private boolean shouldCacheSpForUser(@UserIdInt int userId) { 2185 // Before the user setup has completed, an admin could be installed that requires the SP to 2186 // be cached (see below). 2187 if (Settings.Secure.getIntForUser(mContext.getContentResolver(), 2188 Settings.Secure.USER_SETUP_COMPLETE, 0, userId) == 0) { 2189 return true; 2190 } 2191 2192 // If the user has an admin which can perform an untrusted credential reset, the SP needs to 2193 // be cached. If there isn't a DevicePolicyManager then there can't be an admin in the first 2194 // place so caching is not necessary. 2195 final DevicePolicyManagerInternal dpmi = LocalServices.getService( 2196 DevicePolicyManagerInternal.class); 2197 if (dpmi == null) { 2198 return false; 2199 } 2200 return dpmi.canUserHaveUntrustedCredentialReset(userId); 2201 } 2202 2203 /** 2204 * Precondition: vold and keystore unlocked. 2205 * 2206 * Create new synthetic password, set up synthetic password blob protected by the supplied 2207 * user credential, and make the newly-created SP blob active. 2208 * 2209 * The invariant under a synthetic password is: 2210 * 1. If user credential exists, then both vold and keystore and protected with keys derived 2211 * from the synthetic password. 2212 * 2. If user credential does not exist, vold and keystore protection are cleared. This is to 2213 * make it consistent with current behaviour. It also allows ActivityManager to call 2214 * unlockUser() with empty secret. 2215 * 3. Once a user is migrated to have synthetic password, its value will never change, no matter 2216 * whether the user changes his lockscreen PIN or clear/reset it. When the user clears its 2217 * lockscreen PIN, we still maintain the existing synthetic password in a password blob 2218 * protected by a default PIN. 2219 * 4. The user SID is linked with synthetic password, but its cleared/re-created when the user 2220 * clears/re-creates his lockscreen PIN. 2221 * 2222 * 2223 * Different cases of calling this method: 2224 * 1. credentialHash != null 2225 * This implies credential != null, a new SP blob will be provisioned, and existing SID 2226 * migrated to associate with the new SP. 2227 * This happens during a normal migration case when the user currently has password. 2228 * 2229 * 2. credentialhash == null and credential == null 2230 * A new SP blob and a new SID will be created, while the user has no credentials. 2231 * This can happens when we are activating an escrow token on a unsecured device, during 2232 * which we want to create the SP structure with an empty user credential. 2233 * 2234 * 3. credentialhash == null and credential != null 2235 * This is the untrusted credential reset, OR the user sets a new lockscreen password 2236 * FOR THE FIRST TIME on a SP-enabled device. New credential and new SID will be created 2237 */ 2238 @GuardedBy("mSpManager") 2239 @VisibleForTesting 2240 protected AuthenticationToken initializeSyntheticPasswordLocked(byte[] credentialHash, 2241 String credential, int credentialType, int requestedQuality, 2242 int userId) throws RemoteException { 2243 Slog.i(TAG, "Initialize SyntheticPassword for user: " + userId); 2244 // Load from the cache or a make a new one 2245 AuthenticationToken auth = mSpCache.get(userId); 2246 if (auth != null) { 2247 // If the synthetic password has been cached, we can only be in case 3., described 2248 // above, for an untrusted credential reset so a new SID is still needed. 2249 mSpManager.newSidForUser(getGateKeeperService(), auth, userId); 2250 } else { 2251 auth = mSpManager.newSyntheticPasswordAndSid(getGateKeeperService(), 2252 credentialHash, credential, userId); 2253 } 2254 onAuthTokenKnownForUser(userId, auth); 2255 if (auth == null) { 2256 Slog.wtf(TAG, "initializeSyntheticPasswordLocked returns null auth token"); 2257 return null; 2258 } 2259 long handle = mSpManager.createPasswordBasedSyntheticPassword(getGateKeeperService(), 2260 credential, credentialType, auth, requestedQuality, userId); 2261 if (credential != null) { 2262 if (credentialHash == null) { 2263 // Since when initializing SP, we didn't provide an existing password handle 2264 // for it to migrate SID, we need to create a new SID for the user. 2265 mSpManager.newSidForUser(getGateKeeperService(), auth, userId); 2266 } 2267 mSpManager.verifyChallenge(getGateKeeperService(), auth, 0L, userId); 2268 setAuthlessUserKeyProtection(userId, auth.deriveDiskEncryptionKey()); 2269 setKeystorePassword(auth.deriveKeyStorePassword(), userId); 2270 } else { 2271 clearUserKeyProtection(userId); 2272 setKeystorePassword(null, userId); 2273 getGateKeeperService().clearSecureUserId(userId); 2274 } 2275 fixateNewestUserKeyAuth(userId); 2276 setLong(SYNTHETIC_PASSWORD_HANDLE_KEY, handle, userId); 2277 return auth; 2278 } 2279 2280 private long getSyntheticPasswordHandleLocked(int userId) { 2281 return getLong(SYNTHETIC_PASSWORD_HANDLE_KEY, 2282 SyntheticPasswordManager.DEFAULT_HANDLE, userId); 2283 } 2284 2285 private boolean isSyntheticPasswordBasedCredentialLocked(int userId) throws RemoteException { 2286 if (userId == USER_FRP) { 2287 final int type = mStorage.readPersistentDataBlock().type; 2288 return type == PersistentData.TYPE_SP || type == PersistentData.TYPE_SP_WEAVER; 2289 } 2290 long handle = getSyntheticPasswordHandleLocked(userId); 2291 // This is a global setting 2292 long enabled = getLong(SYNTHETIC_PASSWORD_ENABLED_KEY, 2293 SYNTHETIC_PASSWORD_ENABLED_BY_DEFAULT, UserHandle.USER_SYSTEM); 2294 return enabled != 0 && handle != SyntheticPasswordManager.DEFAULT_HANDLE; 2295 } 2296 2297 @VisibleForTesting 2298 protected boolean shouldMigrateToSyntheticPasswordLocked(int userId) throws RemoteException { 2299 long handle = getSyntheticPasswordHandleLocked(userId); 2300 // This is a global setting 2301 long enabled = getLong(SYNTHETIC_PASSWORD_ENABLED_KEY, 2302 SYNTHETIC_PASSWORD_ENABLED_BY_DEFAULT, UserHandle.USER_SYSTEM); 2303 return enabled != 0 && handle == SyntheticPasswordManager.DEFAULT_HANDLE; 2304 } 2305 2306 private void enableSyntheticPasswordLocked() throws RemoteException { 2307 setLong(SYNTHETIC_PASSWORD_ENABLED_KEY, 1, UserHandle.USER_SYSTEM); 2308 } 2309 2310 private VerifyCredentialResponse spBasedDoVerifyCredential(String userCredential, int 2311 credentialType, boolean hasChallenge, long challenge, int userId, 2312 ICheckCredentialProgressCallback progressCallback) throws RemoteException { 2313 if (DEBUG) Slog.d(TAG, "spBasedDoVerifyCredential: user=" + userId); 2314 if (credentialType == LockPatternUtils.CREDENTIAL_TYPE_NONE) { 2315 userCredential = null; 2316 } 2317 2318 final AuthenticationResult authResult; 2319 VerifyCredentialResponse response; 2320 synchronized (mSpManager) { 2321 if (!isSyntheticPasswordBasedCredentialLocked(userId)) { 2322 return null; 2323 } 2324 if (userId == USER_FRP) { 2325 return mSpManager.verifyFrpCredential(getGateKeeperService(), 2326 userCredential, credentialType, progressCallback); 2327 } 2328 2329 long handle = getSyntheticPasswordHandleLocked(userId); 2330 authResult = mSpManager.unwrapPasswordBasedSyntheticPassword( 2331 getGateKeeperService(), handle, userCredential, userId, progressCallback); 2332 2333 if (authResult.credentialType != credentialType) { 2334 Slog.e(TAG, "Credential type mismatch."); 2335 return VerifyCredentialResponse.ERROR; 2336 } 2337 response = authResult.gkResponse; 2338 // credential has matched 2339 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 2340 // perform verifyChallenge with synthetic password which generates the real GK auth 2341 // token and response for the current user 2342 response = mSpManager.verifyChallenge(getGateKeeperService(), authResult.authToken, 2343 challenge, userId); 2344 if (response.getResponseCode() != VerifyCredentialResponse.RESPONSE_OK) { 2345 // This shouldn't really happen: the unwrapping of SP succeeds, but SP doesn't 2346 // match the recorded GK password handle. 2347 Slog.wtf(TAG, "verifyChallenge with SP failed."); 2348 return VerifyCredentialResponse.ERROR; 2349 } 2350 } 2351 } 2352 2353 if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_OK) { 2354 notifyActivePasswordMetricsAvailable(userCredential, userId); 2355 unlockKeystore(authResult.authToken.deriveKeyStorePassword(), userId); 2356 2357 final byte[] secret = authResult.authToken.deriveDiskEncryptionKey(); 2358 Slog.i(TAG, "Unlocking user " + userId + " with secret only, length " + secret.length); 2359 unlockUser(userId, null, secret); 2360 2361 activateEscrowTokens(authResult.authToken, userId); 2362 2363 if (isManagedProfileWithSeparatedLock(userId)) { 2364 TrustManager trustManager = 2365 (TrustManager) mContext.getSystemService(Context.TRUST_SERVICE); 2366 trustManager.setDeviceLockedForUser(userId, false); 2367 } 2368 mStrongAuth.reportSuccessfulStrongAuthUnlock(userId); 2369 2370 onAuthTokenKnownForUser(userId, authResult.authToken); 2371 } else if (response.getResponseCode() == VerifyCredentialResponse.RESPONSE_RETRY) { 2372 if (response.getTimeout() > 0) { 2373 requireStrongAuth(STRONG_AUTH_REQUIRED_AFTER_LOCKOUT, userId); 2374 } 2375 } 2376 2377 return response; 2378 } 2379 2380 /** 2381 * Change the user's lockscreen password by creating a new SP blob and update the handle, based 2382 * on an existing authentication token. Even though a new SP blob is created, the underlying 2383 * synthetic password is never changed. 2384 * 2385 * When clearing credential, we keep the SP unchanged, but clear its password handle so its 2386 * SID is gone. We also clear password from (software-based) keystore and vold, which will be 2387 * added back when new password is set in future. 2388 */ 2389 @GuardedBy("mSpManager") 2390 private long setLockCredentialWithAuthTokenLocked(String credential, int credentialType, 2391 AuthenticationToken auth, int requestedQuality, int userId) throws RemoteException { 2392 if (DEBUG) Slog.d(TAG, "setLockCredentialWithAuthTokenLocked: user=" + userId); 2393 long newHandle = mSpManager.createPasswordBasedSyntheticPassword(getGateKeeperService(), 2394 credential, credentialType, auth, requestedQuality, userId); 2395 final Map<Integer, String> profilePasswords; 2396 if (credential != null) { 2397 // // not needed by synchronizeUnifiedWorkChallengeForProfiles() 2398 profilePasswords = null; 2399 2400 if (mSpManager.hasSidForUser(userId)) { 2401 // We are changing password of a secured device, nothing more needed as 2402 // createPasswordBasedSyntheticPassword has already taken care of maintaining 2403 // the password handle and SID unchanged. 2404 2405 //refresh auth token 2406 mSpManager.verifyChallenge(getGateKeeperService(), auth, 0L, userId); 2407 } else { 2408 // A new password is set on a previously-unsecured device, we need to generate 2409 // a new SID, and re-add keys to vold and keystore. 2410 mSpManager.newSidForUser(getGateKeeperService(), auth, userId); 2411 mSpManager.verifyChallenge(getGateKeeperService(), auth, 0L, userId); 2412 setAuthlessUserKeyProtection(userId, auth.deriveDiskEncryptionKey()); 2413 fixateNewestUserKeyAuth(userId); 2414 setKeystorePassword(auth.deriveKeyStorePassword(), userId); 2415 } 2416 } else { 2417 // Cache all profile password if they use unified work challenge. This will later be 2418 // used to clear the profile's password in synchronizeUnifiedWorkChallengeForProfiles() 2419 profilePasswords = getDecryptedPasswordsForAllTiedProfiles(userId); 2420 2421 // we are clearing password of a secured device, so need to nuke SID as well. 2422 mSpManager.clearSidForUser(userId); 2423 getGateKeeperService().clearSecureUserId(userId); 2424 // Clear key from vold so ActivityManager can just unlock the user with empty secret 2425 // during boot. 2426 clearUserKeyProtection(userId); 2427 fixateNewestUserKeyAuth(userId); 2428 setKeystorePassword(null, userId); 2429 } 2430 setLong(SYNTHETIC_PASSWORD_HANDLE_KEY, newHandle, userId); 2431 synchronizeUnifiedWorkChallengeForProfiles(userId, profilePasswords); 2432 2433 notifyActivePasswordMetricsAvailable(credential, userId); 2434 return newHandle; 2435 } 2436 2437 @GuardedBy("mSpManager") 2438 private void spBasedSetLockCredentialInternalLocked(String credential, int credentialType, 2439 String savedCredential, int requestedQuality, int userId) throws RemoteException { 2440 if (DEBUG) Slog.d(TAG, "spBasedSetLockCredentialInternalLocked: user=" + userId); 2441 if (isManagedProfileWithUnifiedLock(userId)) { 2442 // get credential from keystore when managed profile has unified lock 2443 try { 2444 savedCredential = getDecryptedPasswordForTiedProfile(userId); 2445 } catch (FileNotFoundException e) { 2446 Slog.i(TAG, "Child profile key not found"); 2447 } catch (UnrecoverableKeyException | InvalidKeyException | KeyStoreException 2448 | NoSuchAlgorithmException | NoSuchPaddingException 2449 | InvalidAlgorithmParameterException | IllegalBlockSizeException 2450 | BadPaddingException | CertificateException | IOException e) { 2451 Slog.e(TAG, "Failed to decrypt child profile key", e); 2452 } 2453 } 2454 long handle = getSyntheticPasswordHandleLocked(userId); 2455 AuthenticationResult authResult = mSpManager.unwrapPasswordBasedSyntheticPassword( 2456 getGateKeeperService(), handle, savedCredential, userId, null); 2457 VerifyCredentialResponse response = authResult.gkResponse; 2458 AuthenticationToken auth = authResult.authToken; 2459 2460 // If existing credential is provided, then it must match. 2461 if (savedCredential != null && auth == null) { 2462 throw new RemoteException("Failed to enroll " + 2463 (credentialType == LockPatternUtils.CREDENTIAL_TYPE_PASSWORD ? "password" 2464 : "pattern")); 2465 } 2466 2467 if (auth != null) { 2468 // We are performing a trusted credential change i.e. a correct existing credential 2469 // is provided 2470 setLockCredentialWithAuthTokenLocked(credential, credentialType, auth, requestedQuality, 2471 userId); 2472 mSpManager.destroyPasswordBasedSyntheticPassword(handle, userId); 2473 onAuthTokenKnownForUser(userId, auth); 2474 } else if (response != null 2475 && response.getResponseCode() == VerifyCredentialResponse.RESPONSE_ERROR) { 2476 // We are performing an untrusted credential change i.e. by DevicePolicyManager. 2477 // So provision a new SP and SID. This would invalidate existing escrow tokens. 2478 // Still support this for now but this flow will be removed in the next release. 2479 Slog.w(TAG, "Untrusted credential change invoked"); 2480 2481 if (mSpCache.get(userId) == null) { 2482 throw new IllegalStateException( 2483 "Untrusted credential reset not possible without cached SP"); 2484 } 2485 2486 initializeSyntheticPasswordLocked(null, credential, credentialType, requestedQuality, 2487 userId); 2488 synchronizeUnifiedWorkChallengeForProfiles(userId, null); 2489 mSpManager.destroyPasswordBasedSyntheticPassword(handle, userId); 2490 2491 notifyActivePasswordMetricsAvailable(credential, userId); 2492 } else /* response == null || responseCode == VerifyCredentialResponse.RESPONSE_RETRY */ { 2493 Slog.w(TAG, "spBasedSetLockCredentialInternalLocked: " + 2494 (response != null ? "rate limit exceeded" : "failed")); 2495 return; 2496 } 2497 mRecoverableKeyStoreManager.lockScreenSecretChanged(credentialType, credential, userId); 2498 } 2499 2500 @Override 2501 public long addEscrowToken(byte[] token, int userId) throws RemoteException { 2502 ensureCallerSystemUid(); 2503 if (DEBUG) Slog.d(TAG, "addEscrowToken: user=" + userId); 2504 synchronized (mSpManager) { 2505 enableSyntheticPasswordLocked(); 2506 // Migrate to synthetic password based credentials if the user has no password, 2507 // the token can then be activated immediately. 2508 AuthenticationToken auth = null; 2509 if (!isUserSecure(userId)) { 2510 if (shouldMigrateToSyntheticPasswordLocked(userId)) { 2511 auth = initializeSyntheticPasswordLocked(null, null, 2512 LockPatternUtils.CREDENTIAL_TYPE_NONE, 2513 DevicePolicyManager.PASSWORD_QUALITY_UNSPECIFIED, userId); 2514 } else /* isSyntheticPasswordBasedCredentialLocked(userId) */ { 2515 long pwdHandle = getSyntheticPasswordHandleLocked(userId); 2516 auth = mSpManager.unwrapPasswordBasedSyntheticPassword(getGateKeeperService(), 2517 pwdHandle, null, userId, null).authToken; 2518 } 2519 } 2520 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 2521 disableEscrowTokenOnNonManagedDevicesIfNeeded(userId); 2522 if (!mSpManager.hasEscrowData(userId)) { 2523 throw new SecurityException("Escrow token is disabled on the current user"); 2524 } 2525 } 2526 long handle = mSpManager.createTokenBasedSyntheticPassword(token, userId); 2527 if (auth != null) { 2528 mSpManager.activateTokenBasedSyntheticPassword(handle, auth, userId); 2529 } 2530 return handle; 2531 } 2532 } 2533 2534 private void activateEscrowTokens(AuthenticationToken auth, int userId) throws RemoteException { 2535 if (DEBUG) Slog.d(TAG, "activateEscrowTokens: user=" + userId); 2536 synchronized (mSpManager) { 2537 disableEscrowTokenOnNonManagedDevicesIfNeeded(userId); 2538 for (long handle : mSpManager.getPendingTokensForUser(userId)) { 2539 Slog.i(TAG, String.format("activateEscrowTokens: %x %d ", handle, userId)); 2540 mSpManager.activateTokenBasedSyntheticPassword(handle, auth, userId); 2541 } 2542 } 2543 } 2544 2545 @Override 2546 public boolean isEscrowTokenActive(long handle, int userId) throws RemoteException { 2547 ensureCallerSystemUid(); 2548 synchronized (mSpManager) { 2549 return mSpManager.existsHandle(handle, userId); 2550 } 2551 } 2552 2553 @Override 2554 public boolean removeEscrowToken(long handle, int userId) throws RemoteException { 2555 ensureCallerSystemUid(); 2556 synchronized (mSpManager) { 2557 if (handle == getSyntheticPasswordHandleLocked(userId)) { 2558 Slog.w(TAG, "Cannot remove password handle"); 2559 return false; 2560 } 2561 if (mSpManager.removePendingToken(handle, userId)) { 2562 return true; 2563 } 2564 if (mSpManager.existsHandle(handle, userId)) { 2565 mSpManager.destroyTokenBasedSyntheticPassword(handle, userId); 2566 return true; 2567 } else { 2568 return false; 2569 } 2570 } 2571 } 2572 2573 @Override 2574 public boolean setLockCredentialWithToken(String credential, int type, long tokenHandle, 2575 byte[] token, int requestedQuality, int userId) throws RemoteException { 2576 ensureCallerSystemUid(); 2577 boolean result; 2578 synchronized (mSpManager) { 2579 if (!mSpManager.hasEscrowData(userId)) { 2580 throw new SecurityException("Escrow token is disabled on the current user"); 2581 } 2582 result = setLockCredentialWithTokenInternal(credential, type, tokenHandle, token, 2583 requestedQuality, userId); 2584 } 2585 if (result) { 2586 synchronized (mSeparateChallengeLock) { 2587 setSeparateProfileChallengeEnabledLocked(userId, true, null); 2588 } 2589 notifyPasswordChanged(userId); 2590 notifySeparateProfileChallengeChanged(userId); 2591 } 2592 return result; 2593 } 2594 2595 private boolean setLockCredentialWithTokenInternal(String credential, int type, 2596 long tokenHandle, byte[] token, int requestedQuality, int userId) throws RemoteException { 2597 final AuthenticationResult result; 2598 synchronized (mSpManager) { 2599 result = mSpManager.unwrapTokenBasedSyntheticPassword( 2600 getGateKeeperService(), tokenHandle, token, userId); 2601 if (result.authToken == null) { 2602 Slog.w(TAG, "Invalid escrow token supplied"); 2603 return false; 2604 } 2605 if (result.gkResponse.getResponseCode() != VerifyCredentialResponse.RESPONSE_OK) { 2606 // Most likely, an untrusted credential reset happened in the past which 2607 // changed the synthetic password 2608 Slog.e(TAG, "Obsolete token: synthetic password derived but it fails GK " 2609 + "verification."); 2610 return false; 2611 } 2612 // Update PASSWORD_TYPE_KEY since it's needed by notifyActivePasswordMetricsAvailable() 2613 // called by setLockCredentialWithAuthTokenLocked(). 2614 // TODO: refactor usage of PASSWORD_TYPE_KEY b/65239740 2615 setLong(LockPatternUtils.PASSWORD_TYPE_KEY, requestedQuality, userId); 2616 long oldHandle = getSyntheticPasswordHandleLocked(userId); 2617 setLockCredentialWithAuthTokenLocked(credential, type, result.authToken, 2618 requestedQuality, userId); 2619 mSpManager.destroyPasswordBasedSyntheticPassword(oldHandle, userId); 2620 } 2621 onAuthTokenKnownForUser(userId, result.authToken); 2622 return true; 2623 } 2624 2625 @Override 2626 public void unlockUserWithToken(long tokenHandle, byte[] token, int userId) 2627 throws RemoteException { 2628 ensureCallerSystemUid(); 2629 AuthenticationResult authResult; 2630 synchronized (mSpManager) { 2631 if (!mSpManager.hasEscrowData(userId)) { 2632 throw new SecurityException("Escrow token is disabled on the current user"); 2633 } 2634 authResult = mSpManager.unwrapTokenBasedSyntheticPassword(getGateKeeperService(), 2635 tokenHandle, token, userId); 2636 if (authResult.authToken == null) { 2637 Slog.w(TAG, "Invalid escrow token supplied"); 2638 return; 2639 } 2640 } 2641 unlockUser(userId, null, authResult.authToken.deriveDiskEncryptionKey()); 2642 onAuthTokenKnownForUser(userId, authResult.authToken); 2643 } 2644 2645 @Override 2646 protected void dump(FileDescriptor fd, PrintWriter pw, String[] args){ 2647 if (!DumpUtils.checkDumpPermission(mContext, TAG, pw)) return; 2648 2649 pw.println("Current lock settings service state:"); 2650 pw.println(String.format("SP Enabled = %b", 2651 mLockPatternUtils.isSyntheticPasswordEnabled())); 2652 2653 List<UserInfo> users = mUserManager.getUsers(); 2654 for (int user = 0; user < users.size(); user++) { 2655 final int userId = users.get(user).id; 2656 pw.println(" User " + userId); 2657 synchronized (mSpManager) { 2658 pw.println(String.format(" SP Handle = %x", 2659 getSyntheticPasswordHandleLocked(userId))); 2660 } 2661 try { 2662 pw.println(String.format(" SID = %x", 2663 getGateKeeperService().getSecureUserId(userId))); 2664 } catch (RemoteException e) { 2665 // ignore. 2666 } 2667 } 2668 } 2669 2670 private void disableEscrowTokenOnNonManagedDevicesIfNeeded(int userId) { 2671 long ident = Binder.clearCallingIdentity(); 2672 try { 2673 // Managed profile should have escrow enabled 2674 if (mUserManager.getUserInfo(userId).isManagedProfile()) { 2675 Slog.i(TAG, "Managed profile can have escrow token"); 2676 return; 2677 } 2678 DevicePolicyManager dpm = mInjector.getDevicePolicyManager(); 2679 // Devices with Device Owner should have escrow enabled on all users. 2680 if (dpm.getDeviceOwnerComponentOnAnyUser() != null) { 2681 Slog.i(TAG, "Corp-owned device can have escrow token"); 2682 return; 2683 } 2684 // We could also have a profile owner on the given (non-managed) user for unicorn cases 2685 if (dpm.getProfileOwnerAsUser(userId) != null) { 2686 Slog.i(TAG, "User with profile owner can have escrow token"); 2687 return; 2688 } 2689 // If the device is yet to be provisioned (still in SUW), there is still 2690 // a chance that Device Owner will be set on the device later, so postpone 2691 // disabling escrow token for now. 2692 if (!dpm.isDeviceProvisioned()) { 2693 Slog.i(TAG, "Postpone disabling escrow tokens until device is provisioned"); 2694 return; 2695 } 2696 2697 // Escrow tokens are enabled on automotive builds. 2698 if (mContext.getPackageManager().hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE)) { 2699 return; 2700 } 2701 2702 // Disable escrow token permanently on all other device/user types. 2703 Slog.i(TAG, "Disabling escrow token on user " + userId); 2704 if (isSyntheticPasswordBasedCredentialLocked(userId)) { 2705 mSpManager.destroyEscrowData(userId); 2706 } 2707 } catch (RemoteException e) { 2708 Slog.e(TAG, "disableEscrowTokenOnNonManagedDevices", e); 2709 } finally { 2710 Binder.restoreCallingIdentity(ident); 2711 } 2712 } 2713 2714 private void ensureCallerSystemUid() throws SecurityException { 2715 final int callingUid = mInjector.binderGetCallingUid(); 2716 if (callingUid != Process.SYSTEM_UID) { 2717 throw new SecurityException("Only system can call this API."); 2718 } 2719 } 2720 2721 private class DeviceProvisionedObserver extends ContentObserver { 2722 private final Uri mDeviceProvisionedUri = Settings.Global.getUriFor( 2723 Settings.Global.DEVICE_PROVISIONED); 2724 private final Uri mUserSetupCompleteUri = Settings.Secure.getUriFor( 2725 Settings.Secure.USER_SETUP_COMPLETE); 2726 2727 private boolean mRegistered; 2728 2729 public DeviceProvisionedObserver() { 2730 super(null); 2731 } 2732 2733 @Override 2734 public void onChange(boolean selfChange, Uri uri) { 2735 if (mDeviceProvisionedUri.equals(uri)) { 2736 updateRegistration(); 2737 2738 if (isProvisioned()) { 2739 Slog.i(TAG, "Reporting device setup complete to IGateKeeperService"); 2740 reportDeviceSetupComplete(); 2741 clearFrpCredentialIfOwnerNotSecure(); 2742 } 2743 } else if (mUserSetupCompleteUri.equals(uri)) { 2744 cleanSpCache(); 2745 } 2746 } 2747 2748 public void onSystemReady() { 2749 if (frpCredentialEnabled(mContext)) { 2750 updateRegistration(); 2751 } else { 2752 // If we don't intend to use frpCredentials and we're not provisioned yet, send 2753 // deviceSetupComplete immediately, so gatekeeper can discard any lingering 2754 // credentials immediately. 2755 if (!isProvisioned()) { 2756 Slog.i(TAG, "FRP credential disabled, reporting device setup complete " 2757 + "to Gatekeeper immediately"); 2758 reportDeviceSetupComplete(); 2759 } 2760 } 2761 } 2762 2763 private void reportDeviceSetupComplete() { 2764 try { 2765 getGateKeeperService().reportDeviceSetupComplete(); 2766 } catch (RemoteException e) { 2767 Slog.e(TAG, "Failure reporting to IGateKeeperService", e); 2768 } 2769 } 2770 2771 /** 2772 * Clears the FRP credential if the user that controls it does not have a secure 2773 * lockscreen. 2774 */ 2775 private void clearFrpCredentialIfOwnerNotSecure() { 2776 List<UserInfo> users = mUserManager.getUsers(); 2777 for (UserInfo user : users) { 2778 if (userOwnsFrpCredential(mContext, user)) { 2779 if (!isUserSecure(user.id)) { 2780 mStorage.writePersistentDataBlock(PersistentData.TYPE_NONE, user.id, 2781 0, null); 2782 } 2783 return; 2784 } 2785 } 2786 } 2787 2788 private void updateRegistration() { 2789 boolean register = !isProvisioned(); 2790 if (register == mRegistered) { 2791 return; 2792 } 2793 if (register) { 2794 mContext.getContentResolver().registerContentObserver(mDeviceProvisionedUri, 2795 false, this); 2796 mContext.getContentResolver().registerContentObserver(mUserSetupCompleteUri, 2797 false, this, UserHandle.USER_ALL); 2798 } else { 2799 mContext.getContentResolver().unregisterContentObserver(this); 2800 } 2801 mRegistered = register; 2802 } 2803 2804 private boolean isProvisioned() { 2805 return Settings.Global.getInt(mContext.getContentResolver(), 2806 Settings.Global.DEVICE_PROVISIONED, 0) != 0; 2807 } 2808 } 2809} 2810