commit 44c02da3686678646239505c6ddfedb2f5537cbf
author Paul Crowley <paulcrowley@google.com> Thu Apr 08 17:04:43 2021 +0000
committer Paul Crowley <paulcrowley@google.com> Mon Apr 12 11:22:37 2021 -0700
tree 5d1e100fd2eb735f22fca2a86f9d23a50984ee24
parent 8ec84b332bb96bcaf6b8f9bdc8f9bafceec5284f

Revert^2 "Cryptographic security for MAX_BOOT_LEVEL"

Revert submission revert-1660531-max-boot-level-crypto-KFMCEDKSIV

Reason for revert: topic:vold-use-keystore2 has landed fixing the bug

Reverted changes:
Ibf63734a: Revert "Set earlyBootEnded before apex starts"
Id02f63a7: Revert "Expose AID_KEYSTORE"
Ibcedeff4: Revert "Cryptographic security for MAX_BOOT_LEVEL"

Restored changes:
Ia3b968afc:Set earlyBootEnded before apex starts
Ia69891291:Expose AID_KEYSTORE
I12530cd13:Cryptographic security for MAX_BOOT_LEVEL

Reverted-SHA1: 229f2c038c22ee271e06c1f919e2632fa014bc19

Original commit message:
Use a KDF to generate a key for each boot level, anchored in a key
which can only be used once per boot.

Bug: 176450483
Test: atest com.android.tests.odsign.OnDeviceSigningHostTest#verifyArtUpgradeSignsFiles
Change-Id: I62609052647316c5c381e1df12963996aba97f23

keystore2/src/maintenance.rs

diff --git a/keystore2/src/maintenance.rs b/keystore2/src/maintenance.rs
index e059a0b..5c1e82d 100644
--- a/keystore2/src/maintenance.rs
+++ b/keystore2/src/maintenance.rs
@@ -141,6 +141,11 @@
     fn early_boot_ended() -> Result<()> {
         check_keystore_permission(KeystorePerm::early_boot_ended())
             .context("In early_boot_ended. Checking permission")?;
+        log::info!("In early_boot_ended.");
+
+        if let Err(e) = DB.with(|db| SUPER_KEY.set_up_boot_level_cache(&mut db.borrow_mut())) {
+            log::error!("SUPER_KEY.set_up_boot_level_cache failed:\n{:?}\n:(", e);
+        }
 
         let sec_levels = [
             (SecurityLevel::TRUSTED_ENVIRONMENT, "TRUSTED_ENVIRONMENT"),