commit aef79352008f980047ea897854236e1ef0829a5a
author Alice Wang <aliceywang@google.com> Tue Oct 31 15:01:15 2023 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Oct 31 15:01:22 2023 +0000
tree 1b33be060cceb8540cee69b9ed3bb0be21fb321d
parent fcbf5ff4c5781b9911e538766a494149abcef327

Revert "[rkp] Expose RKP Hal implementation in virtualizationservice"

Revert submission 2778549-expose-avf-rkp-hal

Reason for revert: SELinux denial
avc:  denied  { find } for pid=3400 uid=10085 name=android.hardware.security.keymint.IRemotelyProvisionedComponent/avf scontext=u:r:rkpdapp:s0:c85,c256,c512,c768 tcontext=u:object_r:avf_remotelyprovisionedcomponent_service:s0 tclass=service_manager permissive=0


Reverted changes: /q/submissionid:2778549-expose-avf-rkp-hal

Bug: 308596709
Change-Id: I9c088bb5843433dbf29282f9f48b2d8693b0fedd

virtualizationservice/src/remote_provisioning.rs

diff --git a/virtualizationservice/src/remote_provisioning.rs b/virtualizationservice/src/remote_provisioning.rs
index 40f54db..a9a07a5 100644
--- a/virtualizationservice/src/remote_provisioning.rs
+++ b/virtualizationservice/src/remote_provisioning.rs
@@ -27,11 +27,7 @@
 };
 use anyhow::Context;
 use avflog::LogResult;
-use binder::{
-    BinderFeatures, ExceptionCode, Interface, IntoBinderResult, Result as BinderResult, Status,
-    Strong,
-};
-use hypervisor_props::is_protected_vm_supported;
+use binder::{BinderFeatures, Interface, IntoBinderResult, Result as BinderResult, Status, Strong};
 use service_vm_comm::{RequestProcessingError, Response};
 
 /// Constructs a binder object that implements `IRemotelyProvisionedComponent`.
@@ -49,13 +45,11 @@
 #[allow(non_snake_case)]
 impl IRemotelyProvisionedComponent for AvfRemotelyProvisionedComponent {
     fn getHardwareInfo(&self) -> BinderResult<RpcHardwareInfo> {
-        check_protected_vm_is_supported()?;
-
         Ok(RpcHardwareInfo {
             versionNumber: 3,
             rpcAuthorName: String::from("Android Virtualization Framework"),
             supportedEekCurve: CURVE_NONE,
-            uniqueId: Some(String::from("AVF Remote Provisioning 1")),
+            uniqueId: Some(String::from("Android Virtualization Framework 1")),
             supportedNumKeysInCsr: MIN_SUPPORTED_NUM_KEYS_IN_CSR,
         })
     }
@@ -65,8 +59,6 @@
         testMode: bool,
         macedPublicKey: &mut MacedPublicKey,
     ) -> BinderResult<Vec<u8>> {
-        check_protected_vm_is_supported()?;
-
         if testMode {
             return Err(Status::new_service_specific_error_str(
                 STATUS_REMOVED,
@@ -109,8 +101,6 @@
         keysToSign: &[MacedPublicKey],
         challenge: &[u8],
     ) -> BinderResult<Vec<u8>> {
-        check_protected_vm_is_supported()?;
-
         const MAX_CHALLENGE_SIZE: usize = 64;
         if challenge.len() > MAX_CHALLENGE_SIZE {
             let message = format!(
@@ -133,18 +123,6 @@
     }
 }
 
-fn check_protected_vm_is_supported() -> BinderResult<()> {
-    if is_protected_vm_supported().unwrap_or(false) {
-        Ok(())
-    } else {
-        Err(Status::new_exception_str(
-            ExceptionCode::UNSUPPORTED_OPERATION,
-            Some("Protected VM support is missing for this operation"),
-        ))
-        .with_log()
-    }
-}
-
 fn to_service_specific_error(response: Response) -> Status {
     match response {
         Response::Err(e) => match e {