Merge "Rename flag wal_db_journalmode" into main
diff --git a/keystore2/src/remote_provisioning.rs b/keystore2/src/remote_provisioning.rs
index a386d96..0ef8c95 100644
--- a/keystore2/src/remote_provisioning.rs
+++ b/keystore2/src/remote_provisioning.rs
@@ -24,6 +24,7 @@
KeyParameter::KeyParameter, KeyParameterValue::KeyParameterValue, SecurityLevel::SecurityLevel,
Tag::Tag,
};
+use android_security_rkp_aidl::aidl::android::security::rkp::RemotelyProvisionedKey::RemotelyProvisionedKey;
use android_system_keystore2::aidl::android::system::keystore2::{
Domain::Domain, KeyDescriptor::KeyDescriptor,
};
@@ -37,7 +38,6 @@
use crate::metrics_store::log_rkp_error_stats;
use crate::watchdog_helper::watchdog as wd;
use android_security_metrics::aidl::android::security::metrics::RkpError::RkpError as MetricsRkpError;
-use rkpd_client::get_rkpd_attestation_key;
/// Contains helper functions to check if remote provisioning is enabled on the system and, if so,
/// to assign and retrieve attestation keys and certificate chains.
@@ -96,10 +96,7 @@
if !self.is_asymmetric_key(params) || key.domain != Domain::APP {
Ok(None)
} else {
- let rpc_name = get_remotely_provisioned_component_name(&self.security_level)
- .context(ks_err!("Trying to get IRPC name."))?;
- let _wd = wd::watch_millis("Calling get_rkpd_attestation_key()", 500);
- match get_rkpd_attestation_key(&rpc_name, caller_uid) {
+ match get_rkpd_attestation_key(&self.security_level, caller_uid) {
Err(e) => {
if self.is_rkp_only() {
log::error!("Error occurred: {:?}", e);
@@ -128,3 +125,17 @@
}
}
}
+
+fn get_rkpd_attestation_key(
+ security_level: &SecurityLevel,
+ caller_uid: u32,
+) -> Result<RemotelyProvisionedKey> {
+ // Depending on the Android release, RKP may not have been mandatory for the
+ // TEE or StrongBox KM instances. In such cases, lookup failure for the IRPC
+ // HAL service is WAI and should not cause a failure. The error should be caught
+ // by the calling function and allow for natural fallback to the factory key.
+ let rpc_name = get_remotely_provisioned_component_name(security_level)
+ .context(ks_err!("Trying to get IRPC name."))?;
+ let _wd = wd::watch_millis("Calling get_rkpd_attestation_key()", 500);
+ rkpd_client::get_rkpd_attestation_key(&rpc_name, caller_uid)
+}