system_core/gatekeeperd, branch replicant-10 Fork of system/core HACK: gatekeeperd: force software imeplementation 2020-06-25T11:57:45+00:00 Denis 'GNUtoo' Carikli GNUtoo@cyberdimension.org 2019-06-09T14:02:02+00:00 c92720b38d68913f61f1419c8bf910a09aba9e1d Without that hack, IGatekeeper::getService() will try to get a service implementing the Gatekeeper HAL. The HAL is supposed to talk to a component that resides in a Trusted Execution Environment (TEE) such as MobiCore. On many Android device, the Trusted Execution Environment is not free software, nor under the control of the user, so it cannot be trusted by the user, and in fact it's better, if possible, to make sure that it does not to run at all in that case. Because of that the proper fix would be either to implement a Gatekeeper HAL that would not depend on nonfree software that cannot be trusted. This could for instance be implemented by: * Using a simple software implementation. * Using the linux kernel keyring for that which can provide good resilience against userspace trying to get key material. See man 7 keyrings for more information on that. * Have a free software Trusted Execution Environment like Google's Trusty or other implementations. See the following documentation for more background information: https://source.android.com/security/authentication/gatekeeper Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org> Rebased and adapted for Replicant 10 Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi> 
Without that hack, IGatekeeper::getService() will try to get
a service implementing the Gatekeeper HAL. The HAL is supposed
to talk to a component that resides in a Trusted Execution
Environment (TEE) such as MobiCore.

On many Android device, the Trusted Execution Environment
is not free software, nor under the control of the user, so it
cannot be trusted by the user, and in fact it's better, if possible,
to make sure that it does not to run at all in that case.

Because of that the proper fix would be either to implement
a Gatekeeper HAL that would not depend on nonfree software that
cannot be trusted.

This could for instance be implemented by:
* Using a simple software implementation.
* Using the linux kernel keyring for that which can
  provide good resilience against userspace trying to get key
  material. See man 7 keyrings for more information on that.
* Have a free software Trusted Execution Environment like
  Google's Trusty or other implementations.

See the following documentation for more background information:
https://source.android.com/security/authentication/gatekeeper

Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
Rebased and adapted for Replicant 10
Signed-off-by: Joonas Kylmälä <joonas.kylmala@iki.fi>
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 am: 4ae4ad8e5b am: b25983460c am: 20e73e23c4 am: ca662c7118 2019-06-21T20:52:15+00:00 Janis Danisevskis jdanis@google.com 2019-06-21T20:52:15+00:00 4ea7584d34ebf9d5892e57f5df7deb56a7312961 am: 14d1d6add8 Change-Id: I6dfe27acaeba2ce4bc55169dcdccd14a7b9ee358 
am: 14d1d6add8

Change-Id: I6dfe27acaeba2ce4bc55169dcdccd14a7b9ee358
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 am: 4ae4ad8e5b am: b25983460c am: 20e73e23c4 2019-06-21T20:48:16+00:00 Janis Danisevskis jdanis@google.com 2019-06-21T20:48:16+00:00 14d1d6add83f19c63d9a9e9ec9f6d8938b44f80d am: ca662c7118 Change-Id: I07e889d6ed94901f2bf70f90c995873cc58d3bf4 
am: ca662c7118

Change-Id: I07e889d6ed94901f2bf70f90c995873cc58d3bf4
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 am: 4ae4ad8e5b am: b25983460c 2019-06-21T20:38:10+00:00 Janis Danisevskis jdanis@google.com 2019-06-21T20:38:10+00:00 ca662c71185e94bfe43a3a0c73cd78f6113fc98e am: 20e73e23c4 Change-Id: I026aa5ddb79cd10146924fd6625816782645f660 
am: 20e73e23c4

Change-Id: I026aa5ddb79cd10146924fd6625816782645f660
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 am: 4ae4ad8e5b 2019-06-21T20:33:05+00:00 Janis Danisevskis jdanis@google.com 2019-06-21T20:33:05+00:00 20e73e23c4e58cfaf71348110bbecf470c02e1a7 am: b25983460c Change-Id: Ie7a02bb3c7b283f3497a469e0cd3b2b69792d2f6 
am: b25983460c

Change-Id: Ie7a02bb3c7b283f3497a469e0cd3b2b69792d2f6
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 am: 4ae4ad8e5b 2019-06-20T22:31:20+00:00 Android Build Merger (Role) noreply-android-build-merger@google.com 2019-06-20T22:31:20+00:00 b25983460c6df5fa467beebc972da76fd51db6ef Change-Id: I3fb4fc631eccd68a8f4468363d841855f94187f9 
Change-Id: I3fb4fc631eccd68a8f4468363d841855f94187f9
[automerger] Fix a memory leak in gatekeeper. am: 6a9c4e7968 am: bdc924f31d am: 7535975701 am: e126026c02 2019-06-20T22:31:18+00:00 Android Build Merger (Role) noreply-android-build-merger@google.com 2019-06-20T22:31:18+00:00 4ae4ad8e5b15451b346cb4f7df6af3afc89b9805 Change-Id: I98df60cfed36c714dae1fa4218d3c5ef23c4035c 
Change-Id: I98df60cfed36c714dae1fa4218d3c5ef23c4035c
Fix a memory leak in gatekeeper. 2019-06-20T22:31:06+00:00 Janis Danisevskis jdanis@google.com 2019-06-05T23:42:12+00:00 6a9c4e7968e73393110b169b33fb636531fe7fc2 In violation to the documentation of GateKeeper::GetAuthTokenKey and GateKeeper::GetPasswordKey, the implementations in SoftGateKeeper allocate and return buffers and relinquish ownership causing a memory leak, because the caller expects the implementation to retain ownership. Bug: 129768470 Bug: 134557251 Test: gatekeeper-unit-tests Change-Id: I0af9539d3dcd47dfd1e7d80cdee700ea0c2d6d0f Merged-In: I0af9539d3dcd47dfd1e7d80cdee700ea0c2d6d0f 
In violation to the documentation of GateKeeper::GetAuthTokenKey and
GateKeeper::GetPasswordKey, the implementations in SoftGateKeeper
allocate and return buffers and relinquish ownership causing a memory
leak, because the caller expects the implementation to retain ownership.

Bug: 129768470
Bug: 134557251
Test: gatekeeper-unit-tests
Change-Id: I0af9539d3dcd47dfd1e7d80cdee700ea0c2d6d0f
Merged-In: I0af9539d3dcd47dfd1e7d80cdee700ea0c2d6d0f
gatekeeperd: fixed potential nullptr deref 2019-03-14T20:51:50+00:00 Janis Danisevskis jdanis@google.com 2019-03-14T20:48:30+00:00 e8d2835d8ddb980eb8fd52e36bc8507f802fccba gatekeeperd verifyChallenge may use several pointer parameters unchecked. Also fixed broken length parameter check. Bug: 127909982 Test: Not yet Change-Id: I708bdc8afcb30f252385e51c4aa4bcefe1ef1045 
gatekeeperd verifyChallenge may use several pointer parameters
unchecked.

Also fixed broken length parameter check.

Bug: 127909982
Test: Not yet
Change-Id: I708bdc8afcb30f252385e51c4aa4bcefe1ef1045
Use distinct GateKeeper userids when running a GSI. 2019-02-28T16:56:30+00:00 David Anderson dvander@google.com 2019-02-15T23:59:39+00:00 97400bd86535f2b4ce337c0b160c799c1afeca57 GateKeeper uses userids to key authentication data. This poses a problem for GSIs, since both the GSI and the host image will be storing separate authentication data for the same userids. To account for this, we add a large offset (1000000) to GSI userids before handing them off to the GateKeeper HAL. Note that SyntheticPasswordManager uses a similar trick to store Weaver data in GateKeeper (when a Weaver HAL is not available). Bug: 123716647 Test: PIN authentication works after booting into a GSI Change-Id: I714368919f8e46ff1931f350342f09fa09225a35 
GateKeeper uses userids to key authentication data. This poses a problem
for GSIs, since both the GSI and the host image will be storing separate
authentication data for the same userids.

To account for this, we add a large offset (1000000) to GSI userids
before handing them off to the GateKeeper HAL. Note that
SyntheticPasswordManager uses a similar trick to store Weaver data in
GateKeeper (when a Weaver HAL is not available).

Bug: 123716647
Test: PIN authentication works after booting into a GSI
Change-Id: I714368919f8e46ff1931f350342f09fa09225a35