Run module code only after KeyMints receive module info
In order to prevent updateable APEX modules from interfering in module
measurement, have `perform_apex_config` wait for the new system
property `keystore.module_hash.sent` to be set to true before running.
Keystore sets `keystore.module_hash.sent` to true after receiving a
non-error response to `setAdditionalAttestationInfo` from all V4+
KeyMints.
Since Keystore waits for `apexd.status` to be set to
`activated` (before calling `setAdditionalAttestationInfo`),
`perform_apex_config` no longer needs to (once flagging is removed).
Note that boot will hang if sending module info fails (as we'll be stuck
on the wait). Preventing boot from continuing is an intended consequence
- an error here likely indicates a more general issue with Keystore or
KeyMint (and one that likely isn't specific to an individual device).
Bug: 369375199
Test: Manual (boots)
Change-Id: Id67c674643762b1fdbba42a407c21756a78ea18d
1 file changed