Keystore 2.0: Refactor permissions. 5/5
Now that the implement_class! macro is generic enough, it can replace
implement_permissions_aidl! with minor tweak to the rest of the code.
Test: keystore2_test
Bug: 203555519
Change-Id: Ib339bd0ac0acc27169b9303f50999d552a1aa632
diff --git a/keystore2/src/attestation_key_utils.rs b/keystore2/src/attestation_key_utils.rs
index b6a8e31..a8c1ca9 100644
--- a/keystore2/src/attestation_key_utils.rs
+++ b/keystore2/src/attestation_key_utils.rs
@@ -109,7 +109,7 @@
KeyType::Client,
KeyEntryLoadBits::BOTH,
caller_uid,
- |k, av| check_key_permission(KeyPerm::use_(), k, &av),
+ |k, av| check_key_permission(KeyPerm::Use, k, &av),
)
.context("In load_attest_key_blob_and_cert: Failed to load key.")?;
diff --git a/keystore2/src/database.rs b/keystore2/src/database.rs
index ae2875c..d73cc8b 100644
--- a/keystore2/src/database.rs
+++ b/keystore2/src/database.rs
@@ -3704,8 +3704,8 @@
alias: Some("key".to_string()),
blob: None,
};
- const PVEC1: KeyPermSet = key_perm_set![KeyPerm::use_(), KeyPerm::get_info()];
- const PVEC2: KeyPermSet = key_perm_set![KeyPerm::use_()];
+ const PVEC1: KeyPermSet = key_perm_set![KeyPerm::Use, KeyPerm::GetInfo];
+ const PVEC2: KeyPermSet = key_perm_set![KeyPerm::Use];
// Reset totally predictable random number generator in case we
// are not the first test running on this thread.
@@ -4181,7 +4181,7 @@
},
1,
2,
- key_perm_set![KeyPerm::use_()],
+ key_perm_set![KeyPerm::Use],
|_k, _av| Ok(()),
)
.unwrap();
@@ -4191,7 +4191,7 @@
let (_key_guard, key_entry) = db
.load_key_entry(&granted_key, KeyType::Client, KeyEntryLoadBits::BOTH, 2, |k, av| {
assert_eq!(Domain::GRANT, k.domain);
- assert!(av.unwrap().includes(KeyPerm::use_()));
+ assert!(av.unwrap().includes(KeyPerm::Use));
Ok(())
})
.unwrap();
@@ -4238,7 +4238,7 @@
},
OWNER_UID,
GRANTEE_UID,
- key_perm_set![KeyPerm::use_()],
+ key_perm_set![KeyPerm::Use],
|_k, _av| Ok(()),
)
.unwrap();
@@ -4257,7 +4257,7 @@
|k, av| {
assert_eq!(Domain::APP, k.domain);
assert_eq!(OWNER_UID as i64, k.nspace);
- assert!(av.unwrap().includes(KeyPerm::use_()));
+ assert!(av.unwrap().includes(KeyPerm::Use));
Ok(())
},
)
@@ -5675,7 +5675,7 @@
},
OWNER as u32,
123,
- key_perm_set![KeyPerm::use_()],
+ key_perm_set![KeyPerm::Use],
|_, _| Ok(()),
)?;
diff --git a/keystore2/src/maintenance.rs b/keystore2/src/maintenance.rs
index eb06784..3f6cf36 100644
--- a/keystore2/src/maintenance.rs
+++ b/keystore2/src/maintenance.rs
@@ -227,9 +227,9 @@
KeyEntryLoadBits::NONE,
caller_uid,
|k, av| {
- check_key_permission(KeyPerm::use_(), k, &av)?;
- check_key_permission(KeyPerm::delete(), k, &av)?;
- check_key_permission(KeyPerm::grant(), k, &av)
+ check_key_permission(KeyPerm::Use, k, &av)?;
+ check_key_permission(KeyPerm::Delete, k, &av)?;
+ check_key_permission(KeyPerm::Grant, k, &av)
},
)
})
@@ -245,7 +245,7 @@
};
db.borrow_mut().migrate_key_namespace(key_id_guard, destination, caller_uid, |k| {
- check_key_permission(KeyPerm::rebind(), k, &None)
+ check_key_permission(KeyPerm::Rebind, k, &None)
})
})
}
diff --git a/keystore2/src/permission.rs b/keystore2/src/permission.rs
index 0a8eec7..f280341 100644
--- a/keystore2/src/permission.rs
+++ b/keystore2/src/permission.rs
@@ -47,159 +47,49 @@
KEYSTORE2_KEY_LABEL_BACKEND.lookup(&namespace.to_string())
}
-/// ## Background
-///
-/// AIDL enums are represented as constants of the form:
-/// ```
-/// mod EnumName {
-/// pub type EnumName = i32;
-/// pub const Variant1: EnumName = <value1>;
-/// pub const Variant2: EnumName = <value2>;
-/// ...
-/// }
-///```
-/// This macro wraps the enum in a new type, e.g., `MyPerm` and maps each variant to an SELinux
-/// permission while providing the following interface:
-/// * From<EnumName> and Into<EnumName> are implemented. Where the implementation of From maps
-/// any variant not specified to the default.
-/// * Every variant has a constructor with a name corresponding to its lower case SELinux string
-/// representation.
-/// * `MyPerm.name()(&self)` returns the SELinux string representation of the
-/// represented permission.
-///
-/// ## Special behavior
-/// If the keyword `use` appears as an selinux name `use_` is used as identifier for the
-/// constructor function (e.g. `MePerm::use_()`) but the string returned by `name()` will
-/// still be `"use"`.
-///
-/// ## Example
-/// ```
-/// implement_permission!(
-/// /// MyPerm documentation.
-/// #[derive(Clone, Copy, Debug, PartialEq)]
-/// MyPerm from EnumName with default (None, none) {}
-/// Variant1, selinux name: variant1;
-/// Variant2, selinux name: variant1;
-/// }
-/// );
-/// ```
-macro_rules! implement_permission_aidl {
- // This rule provides the public interface of the macro. And starts the preprocessing
- // recursion (see below).
- ($(#[$m:meta])* $name:ident from $aidl_name:ident with default ($($def:tt)*)
- { $($element:tt)* })
- => {
- implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*), [],
- $($element)*);
- };
-
- // The following three rules recurse through the elements of the form
- // `<enum variant>, selinux name: <selinux_name>;`
- // preprocessing the input.
-
- // The first rule terminates the recursion and passes the processed arguments to the final
- // rule that spills out the implementation.
- (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*], ) => {
- implement_permission_aidl!(@end $($m)*, $name, $aidl_name, ($($def)*) { $($out)* } );
- };
-
- // The second rule is triggered if the selinux name of an element is literally `use`.
- // It produces the tuple `<enum variant>, use_, use;`
- // and appends it to the out list.
- (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*],
- $e_name:ident, selinux name: use; $($element:tt)*)
- => {
- implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*),
- [$($out)* $e_name, use_, use;], $($element)*);
- };
-
- // The third rule is the default rule which replaces every input tuple with
- // `<enum variant>, <selinux_name>, <selinux_name>;`
- // and appends the result to the out list.
- (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*],
- $e_name:ident, selinux name: $e_str:ident; $($element:tt)*)
- => {
- implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*),
- [$($out)* $e_name, $e_str, $e_str;], $($element)*);
- };
-
- (@end $($m:meta)*, $name:ident, $aidl_name:ident,
- ($def_name:ident, $def_selinux_name:ident) {
- $($element_name:ident, $element_identifier:ident,
- $selinux_name:ident;)*
- })
- =>
- {
- $(#[$m])*
- pub struct $name(pub $aidl_name);
-
- impl From<$aidl_name> for $name {
- fn from (p: $aidl_name) -> Self {
- match p {
- $aidl_name::$def_name => Self($aidl_name::$def_name),
- $($aidl_name::$element_name => Self($aidl_name::$element_name),)*
- _ => Self($aidl_name::$def_name),
- }
- }
- }
-
- impl From<$name> for $aidl_name {
- fn from(p: $name) -> $aidl_name {
- p.0
- }
- }
-
- impl ClassPermission for $name {
- fn name(&self) -> &'static str {
- match self {
- Self($aidl_name::$def_name) => stringify!($def_selinux_name),
- $(Self($aidl_name::$element_name) => stringify!($selinux_name),)*
- _ => stringify!($def_selinux_name),
- }
- }
- fn class_name(&self) -> &'static str {
- "keystore2_key"
- }
- }
-
- impl $name {
- /// Creates an instance representing a permission with the same name.
- pub const fn $def_selinux_name() -> Self { Self($aidl_name::$def_name) }
- $(
- /// Creates an instance representing a permission with the same name.
- pub const fn $element_identifier() -> Self { Self($aidl_name::$element_name) }
- )*
- }
- };
-}
-
-implement_permission_aidl!(
+implement_class!(
/// KeyPerm provides a convenient abstraction from the SELinux class `keystore2_key`.
/// At the same time it maps `KeyPermissions` from the Keystore 2.0 AIDL Grant interface to
- /// the SELinux permissions. With the implement_permission macro, we conveniently
- /// provide mappings between the wire type bit field values, the rust enum and the SELinux
- /// string representation.
- ///
- /// ## Example
- ///
- /// In this access check `KeyPerm::get_info().to_selinux()` would return the SELinux representation
- /// "info".
- /// ```
- /// selinux::check_permission(source_context, target_context, KeyPerm::get_info());
- /// ```
- #[derive(Clone, Copy, Debug, Eq, PartialEq)]
- KeyPerm from KeyPermission with default (NONE, none) {
- CONVERT_STORAGE_KEY_TO_EPHEMERAL, selinux name: convert_storage_key_to_ephemeral;
- DELETE, selinux name: delete;
- GEN_UNIQUE_ID, selinux name: gen_unique_id;
- GET_INFO, selinux name: get_info;
- GRANT, selinux name: grant;
- MANAGE_BLOB, selinux name: manage_blob;
- REBIND, selinux name: rebind;
- REQ_FORCED_OP, selinux name: req_forced_op;
- UPDATE, selinux name: update;
- USE, selinux name: use;
- USE_DEV_ID, selinux name: use_dev_id;
+ /// the SELinux permissions.
+ #[repr(i32)]
+ #[selinux(class_name = keystore2_key)]
+ #[derive(Clone, Copy, Debug, PartialEq)]
+ pub enum KeyPerm {
+ /// Checked when convert_storage_key_to_ephemeral is called.
+ #[selinux(name = convert_storage_key_to_ephemeral)]
+ ConvertStorageKeyToEphemeral = KeyPermission::CONVERT_STORAGE_KEY_TO_EPHEMERAL.0,
+ /// Checked when the caller tries do delete a key.
+ #[selinux(name = delete)]
+ Delete = KeyPermission::DELETE.0,
+ /// Checked when the caller tries to use a unique id.
+ #[selinux(name = gen_unique_id)]
+ GenUniqueId = KeyPermission::GEN_UNIQUE_ID.0,
+ /// Checked when the caller tries to load a key.
+ #[selinux(name = get_info)]
+ GetInfo = KeyPermission::GET_INFO.0,
+ /// Checked when the caller attempts to grant a key to another uid.
+ /// Also used for gating key migration attempts.
+ #[selinux(name = grant)]
+ Grant = KeyPermission::GRANT.0,
+ /// Checked when the caller attempts to use Domain::BLOB.
+ #[selinux(name = manage_blob)]
+ ManageBlob = KeyPermission::MANAGE_BLOB.0,
+ /// Checked when the caller tries to create a key which implies rebinding
+ /// an alias to the new key.
+ #[selinux(name = rebind)]
+ Rebind = KeyPermission::REBIND.0,
+ /// Checked when the caller attempts to create a forced operation.
+ #[selinux(name = req_forced_op)]
+ ReqForcedOp = KeyPermission::REQ_FORCED_OP.0,
+ /// Checked when the caller attempts to update public key artifacts.
+ #[selinux(name = update)]
+ Update = KeyPermission::UPDATE.0,
+ /// Checked when the caller attempts to use a private or public key.
+ #[selinux(name = use)]
+ Use = KeyPermission::USE.0,
+ /// Checked when the caller attempts to use device ids for attestation.
+ #[selinux(name = use_dev_id)]
+ UseDevId = KeyPermission::USE_DEV_ID.0,
}
);
@@ -268,17 +158,17 @@
///
/// ## Example
/// ```
-/// let perms1 = key_perm_set![KeyPerm::use_(), KeyPerm::manage_blob(), KeyPerm::grant()];
-/// let perms2 = key_perm_set![KeyPerm::use_(), KeyPerm::manage_blob()];
+/// let perms1 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob, KeyPerm::Grant];
+/// let perms2 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob];
///
/// assert!(perms1.includes(perms2))
/// assert!(!perms2.includes(perms1))
///
/// let i = perms1.into_iter();
/// // iteration in ascending order of the permission's numeric representation.
-/// assert_eq(Some(KeyPerm::manage_blob()), i.next());
-/// assert_eq(Some(KeyPerm::grant()), i.next());
-/// assert_eq(Some(KeyPerm::use_()), i.next());
+/// assert_eq(Some(KeyPerm::ManageBlob), i.next());
+/// assert_eq(Some(KeyPerm::Grant), i.next());
+/// assert_eq(Some(KeyPerm::Use), i.next());
/// assert_eq(None, i.next());
/// ```
#[derive(Copy, Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
@@ -309,7 +199,7 @@
let p = self.vec.0 & (1 << self.pos);
self.pos += 1;
if p != 0 {
- return Some(KeyPerm::from(KeyPermission(p)));
+ return Some(KeyPerm::from(p));
}
}
}
@@ -318,7 +208,7 @@
impl From<KeyPerm> for KeyPermSet {
fn from(p: KeyPerm) -> Self {
- Self((p.0).0 as i32)
+ Self(p as i32)
}
}
@@ -353,7 +243,7 @@
macro_rules! key_perm_set {
() => { KeyPermSet(0) };
($head:expr $(, $tail:expr)* $(,)?) => {
- KeyPermSet(($head.0).0 $(| ($tail.0).0)*)
+ KeyPermSet($head as i32 $(| $tail as i32)*)
};
}
@@ -398,10 +288,10 @@
_ => return Err(KsError::sys()).context(format!("Cannot grant {:?}.", key.domain)),
};
- selinux::check_permission(caller_ctx, &target_context, KeyPerm::grant())
+ selinux::check_permission(caller_ctx, &target_context, KeyPerm::Grant)
.context("Grant permission is required when granting.")?;
- if access_vec.includes(KeyPerm::grant()) {
+ if access_vec.includes(KeyPerm::Grant) {
return Err(selinux::Error::perm()).context("Grant permission cannot be granted.");
}
@@ -490,7 +380,7 @@
.context("Domain::BLOB: Failed to lookup namespace.")?;
// If DOMAIN_KEY_BLOB was specified, we check for the "manage_blob"
// permission in addition to the requested permission.
- selinux::check_permission(caller_ctx, &tctx, KeyPerm::manage_blob())?;
+ selinux::check_permission(caller_ctx, &tctx, KeyPerm::ManageBlob)?;
tctx
}
@@ -511,49 +401,49 @@
use keystore2_selinux::*;
const ALL_PERMS: KeyPermSet = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::use_dev_id(),
- KeyPerm::req_forced_op(),
- KeyPerm::gen_unique_id(),
- KeyPerm::grant(),
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
- KeyPerm::convert_storage_key_to_ephemeral(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::UseDevId,
+ KeyPerm::ReqForcedOp,
+ KeyPerm::GenUniqueId,
+ KeyPerm::Grant,
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
+ KeyPerm::ConvertStorageKeyToEphemeral,
];
const SYSTEM_SERVER_PERMISSIONS_NO_GRANT: KeyPermSet = key_perm_set![
- KeyPerm::delete(),
- KeyPerm::use_dev_id(),
- // No KeyPerm::grant()
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::Delete,
+ KeyPerm::UseDevId,
+ // No KeyPerm::Grant
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
const NOT_GRANT_PERMS: KeyPermSet = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::use_dev_id(),
- KeyPerm::req_forced_op(),
- KeyPerm::gen_unique_id(),
- // No KeyPerm::grant()
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
- KeyPerm::convert_storage_key_to_ephemeral(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::UseDevId,
+ KeyPerm::ReqForcedOp,
+ KeyPerm::GenUniqueId,
+ // No KeyPerm::Grant
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
+ KeyPerm::ConvertStorageKeyToEphemeral,
];
const UNPRIV_PERMS: KeyPermSet = key_perm_set![
- KeyPerm::delete(),
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::Delete,
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
/// The su_key namespace as defined in su.te and keystore_key_contexts of the
@@ -634,7 +524,7 @@
// attempts to grant the grant permission must always fail even when privileged.
assert_perm_failed!(check_grant_permission(
&system_server_ctx,
- KeyPerm::grant().into(),
+ KeyPerm::Grant.into(),
&key
));
// unprivileged grant attempts always fail. shell does not have the grant permission.
@@ -654,7 +544,7 @@
if is_su {
assert!(check_grant_permission(&sctx, NOT_GRANT_PERMS, &key).is_ok());
// attempts to grant the grant permission must always fail even when privileged.
- assert_perm_failed!(check_grant_permission(&sctx, KeyPerm::grant().into(), &key));
+ assert_perm_failed!(check_grant_permission(&sctx, KeyPerm::Grant.into(), &key));
} else {
// unprivileged grant attempts always fail. shell does not have the grant permission.
assert_perm_failed!(check_grant_permission(&sctx, UNPRIV_PERMS, &key));
@@ -669,7 +559,7 @@
assert_perm_failed!(check_key_permission(
0,
&selinux::Context::new("ignored").unwrap(),
- KeyPerm::grant(),
+ KeyPerm::Grant,
&key,
&Some(UNPRIV_PERMS)
));
@@ -677,7 +567,7 @@
check_key_permission(
0,
&selinux::Context::new("ignored").unwrap(),
- KeyPerm::use_(),
+ KeyPerm::Use,
&key,
&Some(ALL_PERMS),
)
@@ -691,61 +581,31 @@
let key = KeyDescriptor { domain: Domain::APP, nspace: 0, alias: None, blob: None };
- assert!(check_key_permission(0, &system_server_ctx, KeyPerm::use_(), &key, &None).is_ok());
- assert!(check_key_permission(0, &system_server_ctx, KeyPerm::delete(), &key, &None).is_ok());
- assert!(
- check_key_permission(0, &system_server_ctx, KeyPerm::get_info(), &key, &None).is_ok()
- );
- assert!(check_key_permission(0, &system_server_ctx, KeyPerm::rebind(), &key, &None).is_ok());
- assert!(check_key_permission(0, &system_server_ctx, KeyPerm::update(), &key, &None).is_ok());
- assert!(check_key_permission(0, &system_server_ctx, KeyPerm::grant(), &key, &None).is_ok());
- assert!(
- check_key_permission(0, &system_server_ctx, KeyPerm::use_dev_id(), &key, &None).is_ok()
- );
- assert!(
- check_key_permission(0, &gmscore_app, KeyPerm::gen_unique_id(), &key, &None).is_ok()
- );
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Use, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Delete, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Rebind, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Update, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Grant, &key, &None).is_ok());
+ assert!(check_key_permission(0, &system_server_ctx, KeyPerm::UseDevId, &key, &None).is_ok());
+ assert!(check_key_permission(0, &gmscore_app, KeyPerm::GenUniqueId, &key, &None).is_ok());
- assert!(check_key_permission(0, &shell_ctx, KeyPerm::use_(), &key, &None).is_ok());
- assert!(check_key_permission(0, &shell_ctx, KeyPerm::delete(), &key, &None).is_ok());
- assert!(check_key_permission(0, &shell_ctx, KeyPerm::get_info(), &key, &None).is_ok());
- assert!(check_key_permission(0, &shell_ctx, KeyPerm::rebind(), &key, &None).is_ok());
- assert!(check_key_permission(0, &shell_ctx, KeyPerm::update(), &key, &None).is_ok());
- assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::grant(), &key, &None));
- assert_perm_failed!(check_key_permission(
- 0,
- &shell_ctx,
- KeyPerm::req_forced_op(),
- &key,
- &None
- ));
- assert_perm_failed!(check_key_permission(
- 0,
- &shell_ctx,
- KeyPerm::manage_blob(),
- &key,
- &None
- ));
- assert_perm_failed!(check_key_permission(
- 0,
- &shell_ctx,
- KeyPerm::use_dev_id(),
- &key,
- &None
- ));
- assert_perm_failed!(check_key_permission(
- 0,
- &shell_ctx,
- KeyPerm::gen_unique_id(),
- &key,
- &None
- ));
+ assert!(check_key_permission(0, &shell_ctx, KeyPerm::Use, &key, &None).is_ok());
+ assert!(check_key_permission(0, &shell_ctx, KeyPerm::Delete, &key, &None).is_ok());
+ assert!(check_key_permission(0, &shell_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
+ assert!(check_key_permission(0, &shell_ctx, KeyPerm::Rebind, &key, &None).is_ok());
+ assert!(check_key_permission(0, &shell_ctx, KeyPerm::Update, &key, &None).is_ok());
+ assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::Grant, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ReqForcedOp, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ManageBlob, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::UseDevId, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::GenUniqueId, &key, &None));
// Also make sure that the permission fails if the caller is not the owner.
assert_perm_failed!(check_key_permission(
1, // the owner is 0
&system_server_ctx,
- KeyPerm::use_(),
+ KeyPerm::Use,
&key,
&None
));
@@ -753,18 +613,18 @@
assert!(check_key_permission(
1,
&system_server_ctx,
- KeyPerm::use_(),
+ KeyPerm::Use,
&key,
- &Some(key_perm_set![KeyPerm::use_()])
+ &Some(key_perm_set![KeyPerm::Use])
)
.is_ok());
// But fail if the grant did not cover the requested permission.
assert_perm_failed!(check_key_permission(
1,
&system_server_ctx,
- KeyPerm::use_(),
+ KeyPerm::Use,
&key,
- &Some(key_perm_set![KeyPerm::get_info()])
+ &Some(key_perm_set![KeyPerm::GetInfo])
));
Ok(())
@@ -780,42 +640,24 @@
blob: None,
};
- assert!(check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::delete(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::get_info(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::rebind(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::update(), &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::Delete, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::GetInfo, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::Rebind, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::Update, &key, &None).is_ok());
if is_su {
- assert!(check_key_permission(0, &sctx, KeyPerm::grant(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::manage_blob(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::use_dev_id(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::gen_unique_id(), &key, &None).is_ok());
- assert!(check_key_permission(0, &sctx, KeyPerm::req_forced_op(), &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None).is_ok());
+ assert!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None).is_ok());
} else {
- assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::grant(), &key, &None));
- assert_perm_failed!(check_key_permission(
- 0,
- &sctx,
- KeyPerm::req_forced_op(),
- &key,
- &None
- ));
- assert_perm_failed!(check_key_permission(
- 0,
- &sctx,
- KeyPerm::manage_blob(),
- &key,
- &None
- ));
- assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::use_dev_id(), &key, &None));
- assert_perm_failed!(check_key_permission(
- 0,
- &sctx,
- KeyPerm::gen_unique_id(),
- &key,
- &None
- ));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None));
}
Ok(())
}
@@ -831,9 +673,9 @@
};
if is_su {
- check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None)
+ check_key_permission(0, &sctx, KeyPerm::Use, &key, &None)
} else {
- assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None));
+ assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None));
Ok(())
}
}
@@ -847,7 +689,7 @@
check_key_permission(
0,
&selinux::Context::new("ignored").unwrap(),
- KeyPerm::use_(),
+ KeyPerm::Use,
&key,
&None
)
@@ -862,16 +704,16 @@
#[test]
fn key_perm_set_all_test() {
let v = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::use_dev_id(),
- KeyPerm::req_forced_op(),
- KeyPerm::gen_unique_id(),
- KeyPerm::grant(),
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_() // Test if the macro accepts missing comma at the end of the list.
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::UseDevId,
+ KeyPerm::ReqForcedOp,
+ KeyPerm::GenUniqueId,
+ KeyPerm::Grant,
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use // Test if the macro accepts missing comma at the end of the list.
];
let mut i = v.into_iter();
assert_eq!(i.next().unwrap().name(), "delete");
@@ -889,11 +731,11 @@
#[test]
fn key_perm_set_sparse_test() {
let v = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::req_forced_op(),
- KeyPerm::gen_unique_id(),
- KeyPerm::update(),
- KeyPerm::use_(), // Test if macro accepts the comma at the end of the list.
+ KeyPerm::ManageBlob,
+ KeyPerm::ReqForcedOp,
+ KeyPerm::GenUniqueId,
+ KeyPerm::Update,
+ KeyPerm::Use, // Test if macro accepts the comma at the end of the list.
];
let mut i = v.into_iter();
assert_eq!(i.next().unwrap().name(), "gen_unique_id");
@@ -912,23 +754,23 @@
#[test]
fn key_perm_set_include_subset_test() {
let v1 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::use_dev_id(),
- KeyPerm::req_forced_op(),
- KeyPerm::gen_unique_id(),
- KeyPerm::grant(),
- KeyPerm::get_info(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::UseDevId,
+ KeyPerm::ReqForcedOp,
+ KeyPerm::GenUniqueId,
+ KeyPerm::Grant,
+ KeyPerm::GetInfo,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
let v2 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
assert!(v1.includes(v2));
assert!(!v2.includes(v1));
@@ -936,18 +778,18 @@
#[test]
fn key_perm_set_include_equal_test() {
let v1 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
let v2 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
assert!(v1.includes(v2));
assert!(v2.includes(v1));
@@ -955,33 +797,29 @@
#[test]
fn key_perm_set_include_overlap_test() {
let v1 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::grant(), // only in v1
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::Grant, // only in v1
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
let v2 = key_perm_set![
- KeyPerm::manage_blob(),
- KeyPerm::delete(),
- KeyPerm::req_forced_op(), // only in v2
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
+ KeyPerm::ManageBlob,
+ KeyPerm::Delete,
+ KeyPerm::ReqForcedOp, // only in v2
+ KeyPerm::Rebind,
+ KeyPerm::Update,
+ KeyPerm::Use,
];
assert!(!v1.includes(v2));
assert!(!v2.includes(v1));
}
#[test]
fn key_perm_set_include_no_overlap_test() {
- let v1 = key_perm_set![KeyPerm::manage_blob(), KeyPerm::delete(), KeyPerm::grant(),];
- let v2 = key_perm_set![
- KeyPerm::req_forced_op(),
- KeyPerm::rebind(),
- KeyPerm::update(),
- KeyPerm::use_(),
- ];
+ let v1 = key_perm_set![KeyPerm::ManageBlob, KeyPerm::Delete, KeyPerm::Grant,];
+ let v2 =
+ key_perm_set![KeyPerm::ReqForcedOp, KeyPerm::Rebind, KeyPerm::Update, KeyPerm::Use,];
assert!(!v1.includes(v2));
assert!(!v2.includes(v1));
}
diff --git a/keystore2/src/security_level.rs b/keystore2/src/security_level.rs
index 74aba3c..ee725eb 100644
--- a/keystore2/src/security_level.rs
+++ b/keystore2/src/security_level.rs
@@ -216,10 +216,10 @@
let scoping_blob: Vec<u8>;
let (km_blob, key_properties, key_id_guard, blob_metadata) = match key.domain {
Domain::BLOB => {
- check_key_permission(KeyPerm::use_(), key, &None)
+ check_key_permission(KeyPerm::Use, key, &None)
.context("In create_operation: checking use permission for Domain::BLOB.")?;
if forced {
- check_key_permission(KeyPerm::req_forced_op(), key, &None).context(
+ check_key_permission(KeyPerm::ReqForcedOp, key, &None).context(
"In create_operation: checking forced permission for Domain::BLOB.",
)?;
}
@@ -248,9 +248,9 @@
KeyEntryLoadBits::KM,
caller_uid,
|k, av| {
- check_key_permission(KeyPerm::use_(), k, &av)?;
+ check_key_permission(KeyPerm::Use, k, &av)?;
if forced {
- check_key_permission(KeyPerm::req_forced_op(), k, &av)?;
+ check_key_permission(KeyPerm::ReqForcedOp, k, &av)?;
}
Ok(())
},
@@ -415,7 +415,7 @@
}
if params.iter().any(|kp| kp.tag == Tag::INCLUDE_UNIQUE_ID) {
- check_key_permission(KeyPerm::gen_unique_id(), key, &None).context(concat!(
+ check_key_permission(KeyPerm::GenUniqueId, key, &None).context(concat!(
"In add_certificate_parameters: ",
"Caller does not have the permission to generate a unique ID"
))?;
@@ -487,7 +487,7 @@
// generate_key requires the rebind permission.
// Must return on error for security reasons.
- check_key_permission(KeyPerm::rebind(), &key, &None).context("In generate_key.")?;
+ check_key_permission(KeyPerm::Rebind, &key, &None).context("In generate_key.")?;
let attestation_key_info = match (key.domain, attest_key_descriptor) {
(Domain::BLOB, _) => None,
@@ -601,7 +601,7 @@
};
// import_key requires the rebind permission.
- check_key_permission(KeyPerm::rebind(), &key, &None).context("In import_key.")?;
+ check_key_permission(KeyPerm::Rebind, &key, &None).context("In import_key.")?;
let params = self
.add_certificate_parameters(caller_uid, params, &key)
@@ -685,7 +685,7 @@
};
// Import_wrapped_key requires the rebind permission for the new key.
- check_key_permission(KeyPerm::rebind(), &key, &None).context("In import_wrapped_key.")?;
+ check_key_permission(KeyPerm::Rebind, &key, &None).context("In import_wrapped_key.")?;
let (wrapping_key_id_guard, mut wrapping_key_entry) = DB
.with(|db| {
@@ -695,7 +695,7 @@
KeyType::Client,
KeyEntryLoadBits::KM,
caller_uid,
- |k, av| check_key_permission(KeyPerm::use_(), k, &av),
+ |k, av| check_key_permission(KeyPerm::Use, k, &av),
)
})
})
@@ -876,7 +876,7 @@
)?;
// convert_storage_key_to_ephemeral requires the associated permission
- check_key_permission(KeyPerm::convert_storage_key_to_ephemeral(), storage_key, &None)
+ check_key_permission(KeyPerm::ConvertStorageKeyToEphemeral, storage_key, &None)
.context("In convert_storage_key_to_ephemeral: Check permission")?;
let km_dev = &self.keymint;
@@ -935,7 +935,7 @@
.ok_or(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
.context("In IKeystoreSecurityLevel delete_key: No key blob specified")?;
- check_key_permission(KeyPerm::delete(), key, &None)
+ check_key_permission(KeyPerm::Delete, key, &None)
.context("In IKeystoreSecurityLevel delete_key: Checking delete permissions")?;
let km_dev = &self.keymint;
diff --git a/keystore2/src/service.rs b/keystore2/src/service.rs
index c6d466d..70f5c71 100644
--- a/keystore2/src/service.rs
+++ b/keystore2/src/service.rs
@@ -138,7 +138,7 @@
KeyType::Client,
KeyEntryLoadBits::PUBLIC,
caller_uid,
- |k, av| check_key_permission(KeyPerm::get_info(), k, &av),
+ |k, av| check_key_permission(KeyPerm::GetInfo, k, &av),
)
})
})
@@ -190,7 +190,7 @@
KeyEntryLoadBits::NONE,
caller_uid,
|k, av| {
- check_key_permission(KeyPerm::update(), k, &av)
+ check_key_permission(KeyPerm::Update, k, &av)
.context("In update_subcomponent.")
},
)
@@ -236,7 +236,7 @@
};
// Security critical: This must return on failure. Do not remove the `?`;
- check_key_permission(KeyPerm::rebind(), &key, &None)
+ check_key_permission(KeyPerm::Rebind, &key, &None)
.context("Caller does not have permission to insert this certificate.")?;
db.store_new_certificate(
@@ -269,7 +269,7 @@
// If the first check fails we check if the caller has the list permission allowing to list
// any namespace. In that case we also adjust the queried namespace if a specific uid was
// selected.
- match check_key_permission(KeyPerm::get_info(), &k, &None) {
+ match check_key_permission(KeyPerm::GetInfo, &k, &None) {
Err(e) => {
if let Some(selinux::Error::PermissionDenied) =
e.root_cause().downcast_ref::<selinux::Error>()
@@ -309,7 +309,7 @@
DB.with(|db| {
LEGACY_MIGRATOR.with_try_migrate(key, caller_uid, || {
db.borrow_mut().unbind_key(key, KeyType::Client, caller_uid, |k, av| {
- check_key_permission(KeyPerm::delete(), k, &av).context("During delete_key.")
+ check_key_permission(KeyPerm::Delete, k, &av).context("During delete_key.")
})
})
})
@@ -341,7 +341,7 @@
fn ungrant(&self, key: &KeyDescriptor, grantee_uid: i32) -> Result<()> {
DB.with(|db| {
db.borrow_mut().ungrant(key, ThreadState::get_calling_uid(), grantee_uid as u32, |k| {
- check_key_permission(KeyPerm::grant(), k, &None)
+ check_key_permission(KeyPerm::Grant, k, &None)
})
})
.context("In KeystoreService::ungrant.")