Evolution-x/hardware_interfaces
1
0
Fork 0
mirror of https://github.com/Evolution-X/hardware_interfaces synced 2026-02-01 16:09:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "KeyMint: check length of verified boot key" into main am: 2ae2061864

Browse Source 
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/2786465

Change-Id: I0c7ab3c6a0c5d01328466f54e5acc4991b2ab71a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
David Drysdale
2023-11-29 11:46:32 +00:00
committed by Automerger Merge Worker
parent bac3fc05df 2ae2061864
commit b415119cad
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
View File

@@ -1792,6 +1792,12 @@ void verify_root_of_trust(const vector<uint8_t>& verified_boot_key, bool device_
std::string empty_boot_key(32, '\0');
std::string verified_boot_key_str((const char*)verified_boot_key.data(),
verified_boot_key.size());
if (get_vsr_api_level() >= __ANDROID_API_V__) {
// The attestation should contain the SHA-256 hash of the verified boot
// key. However, this was not checked for earlier versions of the KeyMint
// HAL so only be strict for VSR-V and above.
EXPECT_LE(verified_boot_key.size(), 32);
}
EXPECT_NE(property_get("ro.boot.verifiedbootstate", property_value, ""), 0);
if (!strcmp(property_value, "green")) {
EXPECT_EQ(verified_boot_state, VerifiedBoot::VERIFIED);

6
security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp
View File

@@ -114,6 +114,12 @@ class SecureElementProvisioningTest : public testing::Test {
const auto& vbKey = rot->asArray()->get(pos++);
ASSERT_TRUE(vbKey);
ASSERT_TRUE(vbKey->asBstr());
if (get_vsr_api_level() >= __ANDROID_API_V__) {
// The attestation should contain the SHA-256 hash of the verified boot
// key. However, this not was checked for earlier versions of the KeyMint
// HAL so only be strict for VSR-V and above.
ASSERT_LE(vbKey->asBstr()->value().size(), 32);
}
const auto& deviceLocked = rot->asArray()->get(pos++);
ASSERT_TRUE(deviceLocked);