Use CompOsKeyService as compsvc factory.
Define a Signer trait to encapsulate what we need to do to sign a
digest.
Modify compsvc to hold a signer.
Modify CompOsKeyService to be able to take in a keyblob and produce a
signer, then return a compsvc instance holding that signer.
This doesn't yet do anything with the signer. Eventually we will want
to use it to generate signatures on output artifacts.
Bug: 194267113
Test: atest ComposHostTestCases (with testOdrefesh un-ignored)
Change-Id: I72aead0280914987f7c8d1721c1e12ee0fad1af4
diff --git a/compos/src/compos_key_service.rs b/compos/src/compos_key_service.rs
index 66451b3..40d0f48 100644
--- a/compos/src/compos_key_service.rs
+++ b/compos/src/compos_key_service.rs
@@ -16,6 +16,8 @@
//! access to Keystore in the VM, but not persistent storage; instead the host stores the key
//! on our behalf via this service.
+use crate::compsvc;
+use crate::signer::Signer;
use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
Algorithm::Algorithm, Digest::Digest, KeyParameter::KeyParameter,
KeyParameterValue::KeyParameterValue, KeyPurpose::KeyPurpose, PaddingMode::PaddingMode,
@@ -27,10 +29,12 @@
};
use anyhow::{anyhow, Context, Result};
use compos_aidl_interface::aidl::com::android::compos::{
- CompOsKeyData::CompOsKeyData, ICompOsKeyService::ICompOsKeyService,
+ CompOsKeyData::CompOsKeyData,
+ ICompOsKeyService::{BnCompOsKeyService, ICompOsKeyService},
+ ICompService::ICompService,
};
use compos_aidl_interface::binder::{
- self, wait_for_interface, ExceptionCode, Interface, Status, Strong,
+ self, wait_for_interface, BinderFeatures, ExceptionCode, Interface, Status, Strong,
};
use log::warn;
use ring::rand::{SecureRandom, SystemRandom};
@@ -48,6 +52,23 @@
VmPayload = 140,
}
+/// Constructs a binder object that implements ICompOsKeyService. namespace is the Keystore2 namespace to
+/// use for the keys.
+pub fn new(namespace: KeystoreNamespace) -> Result<Strong<dyn ICompOsKeyService>> {
+ let keystore_service = wait_for_interface::<dyn IKeystoreService>(KEYSTORE_SERVICE_NAME)
+ .context("No Keystore service")?;
+
+ let service = CompOsKeyService {
+ namespace,
+ random: SystemRandom::new(),
+ security_level: keystore_service
+ .getSecurityLevel(SecurityLevel::TRUSTED_ENVIRONMENT)
+ .context("Getting SecurityLevel failed")?,
+ };
+
+ Ok(BnCompOsKeyService::new_binder(service, BinderFeatures::default()))
+}
+
const KEYSTORE_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
const PURPOSE_SIGN: KeyParameter =
KeyParameter { tag: Tag::PURPOSE, value: KeyParameterValue::KeyPurpose(KeyPurpose::SIGN) };
@@ -69,7 +90,8 @@
const BLOB_KEY_DESCRIPTOR: KeyDescriptor =
KeyDescriptor { domain: Domain::BLOB, nspace: 0, alias: None, blob: None };
-pub struct CompOsKeyService {
+#[derive(Clone)]
+struct CompOsKeyService {
namespace: KeystoreNamespace,
random: SystemRandom,
security_level: Strong<dyn IKeystoreSecurityLevel>,
@@ -96,6 +118,17 @@
self.do_sign(key_blob, data)
.map_err(|e| new_binder_exception(ExceptionCode::ILLEGAL_STATE, e.to_string()))
}
+
+ fn getCompService(&self, key_blob: &[u8]) -> binder::Result<Strong<dyn ICompService>> {
+ let signer =
+ Box::new(CompOsSigner { key_blob: key_blob.to_owned(), key_service: self.clone() });
+ let debuggable = true;
+ Ok(compsvc::new_binder(
+ "/apex/com.android.art/bin/dex2oat64".to_owned(),
+ debuggable,
+ Some(signer),
+ ))
+ }
}
/// Constructs a new Binder error `Status` with the given `ExceptionCode` and message.
@@ -103,20 +136,18 @@
Status::new_exception(exception, CString::new(message.as_ref()).ok().as_deref())
}
-impl CompOsKeyService {
- pub fn new(namespace: KeystoreNamespace) -> Result<Self> {
- let keystore_service = wait_for_interface::<dyn IKeystoreService>(KEYSTORE_SERVICE_NAME)
- .context("No Keystore service")?;
+struct CompOsSigner {
+ key_blob: Vec<u8>,
+ key_service: CompOsKeyService,
+}
- Ok(Self {
- namespace,
- random: SystemRandom::new(),
- security_level: keystore_service
- .getSecurityLevel(SecurityLevel::TRUSTED_ENVIRONMENT)
- .context("Getting SecurityLevel failed")?,
- })
+impl Signer for CompOsSigner {
+ fn sign(&self, data: &[u8]) -> Result<Vec<u8>> {
+ self.key_service.do_sign(&self.key_blob, data)
}
+}
+impl CompOsKeyService {
fn do_generate(&self) -> Result<CompOsKeyData> {
let key_descriptor = KeyDescriptor { nspace: self.namespace as i64, ..BLOB_KEY_DESCRIPTOR };
let key_parameters =