Add ro.keystore.boot_level_key.strategy
Bug: 241241178
Test: set property on Cuttlefish, check logs for strategy used.
Change-Id: Ifaaec811316c43fdae232f9a08c5d862011ccc71
diff --git a/private/compat/33.0/33.0.ignore.cil b/private/compat/33.0/33.0.ignore.cil
index a032401..40c035e 100644
--- a/private/compat/33.0/33.0.ignore.cil
+++ b/private/compat/33.0/33.0.ignore.cil
@@ -9,6 +9,7 @@
device_config_memory_safety_native_prop
device_config_vendor_system_native_prop
hal_bootctl_service
+ keystore_config_prop
permissive_mte_prop
servicemanager_prop
system_net_netd_service
diff --git a/private/keystore.te b/private/keystore.te
index 78c0198..8e681b1 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -26,6 +26,7 @@
# Keystore need access to the keystore_key context files to load the keystore key backend.
allow keystore keystore2_key_contexts_file:file r_file_perms;
+# Allow keystore to listen to changing boot levels
get_prop(keystore, keystore_listen_prop)
# Keystore needs to transfer binder references to vold so that it
diff --git a/private/property_contexts b/private/property_contexts
index 5cf27aa..ed9de36 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1323,6 +1323,9 @@
# Property that tracks keystore crash counts during a boot cycle.
keystore.crash_count u:object_r:keystore_crash_prop:s0 exact int
+# Configure the means by which we protect the L0 key from the future
+ro.keystore.boot_level_key.strategy u:object_r:keystore_config_prop:s0 exact string
+
partition.system.verified u:object_r:verity_status_prop:s0 exact string
partition.system_ext.verified u:object_r:verity_status_prop:s0 exact string
partition.product.verified u:object_r:verity_status_prop:s0 exact string
diff --git a/public/keystore.te b/public/keystore.te
index e1c58a4..8ac503e 100644
--- a/public/keystore.te
+++ b/public/keystore.te
@@ -48,3 +48,6 @@
# The software KeyMint implementation used in km_compat needs
# to read the vendor security patch level.
get_prop(keystore, vendor_security_patch_level_prop);
+
+# Allow keystore to read its vendor configuration
+get_prop(keystore, keystore_config_prop)
diff --git a/public/property.te b/public/property.te
index 4bdf74f..1688b54 100644
--- a/public/property.te
+++ b/public/property.te
@@ -151,6 +151,7 @@
system_vendor_config_prop(hw_timeout_multiplier_prop)
system_vendor_config_prop(incremental_prop)
system_vendor_config_prop(keyguard_config_prop)
+system_vendor_config_prop(keystore_config_prop)
system_vendor_config_prop(lmkd_config_prop)
system_vendor_config_prop(media_config_prop)
system_vendor_config_prop(media_variant_prop)
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 57df54c..c8ddfb9 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -253,6 +253,7 @@
set_prop(vendor_init, userspace_reboot_config_prop)
set_prop(vendor_init, vehicle_hal_prop)
set_prop(vendor_init, vendor_default_prop)
+set_prop(vendor_init, keystore_config_prop)
set_prop(vendor_init, vendor_security_patch_level_prop)
set_prop(vendor_init, vndk_prop)
set_prop(vendor_init, virtual_ab_prop)