commit 3361b618e78efe0dd5c66822ef255f4380734f64
author Satya Tangirala <satyat@google.com> Mon Mar 08 14:36:11 2021 -0800
committer Satya Tangirala <satyat@google.com> Mon Mar 22 22:35:34 2021 -0700
tree d3c4deb5580b41dd9452b91fbd617b832b1da9bb
parent 650ca9fed92366c48ba0210bc36307963ba864b4

Keystore 2.0: Implement convertStorageKeyToEphemeral() in security_level.rs

Introduce and implement convertStorageKeyToEphemeral() in
IKeystoreSecurityLevel. The function first checks for the associated
permission before routing the call to
IKeyMintDevice::convertStorageKeyToEphemeral()

Bug: 181806377
Bug: 181910578
Change-Id: I19212b1870f0e19a7125d6144fe43e23fc35d1c5

keystore2/src/permission.rs

diff --git a/keystore2/src/permission.rs b/keystore2/src/permission.rs
index 7f63834..a8753d3 100644
--- a/keystore2/src/permission.rs
+++ b/keystore2/src/permission.rs
@@ -193,6 +193,7 @@
     /// ```
     #[derive(Clone, Copy, Debug, Eq, PartialEq)]
     KeyPerm from KeyPermission with default (NONE, none) {
+        CONVERT_STORAGE_KEY_TO_EPHEMERAL,   selinux name: convert_storage_key_to_ephemeral;
         DELETE,         selinux name: delete;
         GEN_UNIQUE_ID,  selinux name: gen_unique_id;
         GET_INFO,       selinux name: get_info;
@@ -584,6 +585,7 @@
         KeyPerm::rebind(),
         KeyPerm::update(),
         KeyPerm::use_(),
+        KeyPerm::convert_storage_key_to_ephemeral(),
     ];
 
     const SYSTEM_SERVER_PERMISSIONS_NO_GRANT: KeyPermSet = key_perm_set![
@@ -607,6 +609,7 @@
         KeyPerm::rebind(),
         KeyPerm::update(),
         KeyPerm::use_(),
+        KeyPerm::convert_storage_key_to_ephemeral(),
     ];
 
     const UNPRIV_PERMS: KeyPermSet = key_perm_set![