Diced: Don't add resettable config
Unless the loader actively ensures the key change on factory reset, omit
the resettable (-70004) property from the config descriptor. By the time
diced gets involved, it's just along for the ride and it was down to the
earlier stages to enforce resetting across factory reset.
Test: atest system/security/diced
Bug: 225177477
Change-Id: I728774843cf0f4468bc7e98ccb29c27c1e808da5
diff --git a/diced/src/lib.rs b/diced/src/lib.rs
index 9594977..50e0e96 100644
--- a/diced/src/lib.rs
+++ b/diced/src/lib.rs
@@ -100,7 +100,7 @@
Ok(BinderInputValues {
codeHash: [0; dice::HASH_SIZE],
config: BinderConfig {
- desc: dice::bcc::format_config_descriptor(Some(&format!("{}", uid)), None, true)
+ desc: dice::bcc::format_config_descriptor(Some(&format!("{}", uid)), None, false)
.context("In client_input_values: failed to format config descriptor")?,
},
authorityHash: [0; dice::HASH_SIZE],