Merge "Ensure that "rkp only" forces checks for rkp keys" am: cd6b6a7ff8 am: f16fb9f3a8
Original change: https://android-review.googlesource.com/c/platform/system/security/+/2066831
Change-Id: Ida19f5b72990311f8bfe1d19a765f1539804017c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/keystore2/src/remote_provisioning.rs b/keystore2/src/remote_provisioning.rs
index afbf475..8837d1c 100644
--- a/keystore2/src/remote_provisioning.rs
+++ b/keystore2/src/remote_provisioning.rs
@@ -102,6 +102,9 @@
/// server, so unfortunately caching the presence or absence of the HAL is not enough to fully
/// make decisions about the state of remote provisioning during runtime.
fn check_rem_prov_enabled(&self, db: &mut KeystoreDB) -> Result<bool> {
+ if self.is_rkp_only {
+ return Ok(true);
+ }
if !self.is_hal_present.load(Ordering::Relaxed)
|| get_remotely_provisioned_component(&self.security_level).is_err()
{