commit bf29c3a2dcc5c264761cbe2e551ac55c9408dccc
author Paul Crowley <paulcrowley@google.com> Fri Aug 06 15:11:53 2021 -0700
committer Paul Crowley <paulcrowley@google.com> Tue Aug 10 21:51:09 2021 -0700
tree 9e2c180a89f4cecb6f9cda05e0098ff4a895c4ed
parent 6e9494af085beffa6bcee10b0e2c03dc7a3ade7b

Allow vold to deleteAllKeys in Keystore

Add deleteAllKeys to IKeystoreMaintenance and allow vold to call it.
Allow vold to read the property
`ro.crypto.metadata_init_delete_all_keys.enabled`

Bug: 187105270
Test: booted twice on Cuttlefish
Change-Id: I2fb0e94db9d35c1f19ca7acb2f541cfb13c23524

private/vold.te

diff --git a/private/vold.te b/private/vold.te
index a802bdb..de0fde4 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -53,8 +53,9 @@
 allow vold keystore_service:service_manager find;
 allow vold keystore_maintenance_service:service_manager find;
 
-# vold needs to be able to call earlyBootEnded()
+# vold needs to be able to call earlyBootEnded() and deleteAllKeys()
 allow vold keystore:keystore2 early_boot_ended;
+allow vold keystore:keystore2 delete_all_keys;
 
 neverallow {
     domain