commit da895556c347b3f1f8cb19690977dceb2ebf1851
author Hasini Gunasinghe <hasinitg@google.com> Wed Jan 27 19:34:37 2021 +0000
committer Janis Danisevskis <jdanis@google.com> Wed Feb 17 08:50:43 2021 -0800
tree fe56619c56f18db2555655dfd8b5a003060bf9a4
parent 0e16145678a24cacc4d83e5abbe1facae657fbd1

Implement user manager AIDL.

This CL implements add/remove user and onPasswordChanged.
clearUID functionality, which is also part of this API will be added in
a separate upcoming CL.

Bug: 176123105
Test: TBD
Change-Id: I610441b0aac225740e09039958542dcf2f4fe0b6

keystore2/src/authorization.rs

diff --git a/keystore2/src/authorization.rs b/keystore2/src/authorization.rs
index ad86625..fbaa9eb 100644
--- a/keystore2/src/authorization.rs
+++ b/keystore2/src/authorization.rs
@@ -20,10 +20,7 @@
 use crate::permission::KeystorePerm;
 use crate::utils::check_keystore_permission;
 use android_hardware_security_keymint::aidl::android::hardware::security::keymint::{
-    HardwareAuthToken::HardwareAuthToken, HardwareAuthenticatorType::HardwareAuthenticatorType,
-};
-use android_hardware_security_secureclock::aidl::android::hardware::security::secureclock::{
-    Timestamp::Timestamp,
+    HardwareAuthToken::HardwareAuthToken,
 };
 use android_security_authorization::binder::{Interface, Result as BinderResult, Strong};
 use android_security_authorization::aidl::android::security::authorization::IKeystoreAuthorization::{
@@ -50,16 +47,7 @@
         //check keystore permission
         check_keystore_permission(KeystorePerm::add_auth()).context("In add_auth_token.")?;
 
-        //TODO: Keymint's HardwareAuthToken aidl needs to implement Copy/Clone
-        let auth_token_copy = HardwareAuthToken {
-            challenge: auth_token.challenge,
-            userId: auth_token.userId,
-            authenticatorId: auth_token.authenticatorId,
-            authenticatorType: HardwareAuthenticatorType(auth_token.authenticatorType.0),
-            timestamp: Timestamp { milliSeconds: auth_token.timestamp.milliSeconds },
-            mac: auth_token.mac.clone(),
-        };
-        ENFORCEMENTS.add_auth_token(auth_token_copy)?;
+        ENFORCEMENTS.add_auth_token(auth_token.clone())?;
         Ok(())
     }
 
@@ -85,9 +73,9 @@
                     //method is used as it is, which created a super key for the user if one does
                     //not exists, in addition to unlocking the existing super key of the user/
                     SUPER_KEY.unlock_user_key(
+                        &mut db,
                         user_id as u32,
                         user_password,
-                        &mut db,
                         &LEGACY_BLOB_LOADER,
                     )?;
                     Ok(())