From 8d779bf29e99a48c385b9b99d60b705048cc6bef Mon Sep 17 00:00:00 2001 From: Prashant Patil Date: Wed, 28 Sep 2022 16:09:29 +0100 Subject: [PATCH] Keystore: Attestation fix in AOSP builds Alternet device properties used for attestation on AOSP and GSI builds. Attestation ids were different in AOSP/GSI builds than provisioned ids in keymint. Hence additional properties used to make these ids identical to provisioned ids. Bug: 110779648 Bug: 259376922 Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/0_android_hardware_security_keymint_IKeyMintDevice_default Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/1_android_hardware_security_keymint_IKeyMintDevice_strongbox Test: atest CtsKeystoreTestCases:android.keystore.cts.KeyAttestationTest CtsKeystoreTestCases:DeviceOwnerKeyManagementTest Change-Id: I4bb2e2ebba617972e29ad86ea477eb9b6f35d21a --- .../aidl/vts/functional/AttestKeyTest.cpp | 32 +++++++++++++++++-- .../DeviceUniqueAttestationTest.cpp | 32 +++++++++++++++++-- .../aidl/vts/functional/KeyMintTest.cpp | 32 +++++++++++++++++-- 3 files changed, 87 insertions(+), 9 deletions(-) diff --git a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp index ea4ba1811c..85f26525d0 100644 --- a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp +++ b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp @@ -795,13 +795,39 @@ TEST_P(AttestKeyTest, EcdsaAttestationID) { // Collection of valid attestation ID tags. auto attestation_id_tags = AuthorizationSetBuilder(); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + // Use ro.product.brand_for_attestation property for attestation if it is present else fallback + // to ro.product.brand + std::string prop_value = + ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, + "ro.product.brand_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + } add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device"); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + // Use ro.product.name_for_attestation property for attestation if it is present else fallback + // to ro.product.name + prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, + "ro.product.name_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + } add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno"); add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MANUFACTURER, "ro.product.manufacturer"); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + // Use ro.product.model_for_attestation property for attestation if it is present else fallback + // to ro.product.model + prop_value = + ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, + "ro.product.model_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + } for (const KeyParameter& tag : attestation_id_tags) { SCOPED_TRACE(testing::Message() << "+tag-" << tag); diff --git a/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp b/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp index 26dc3f510f..55bb5b4fab 100644 --- a/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp +++ b/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp @@ -249,13 +249,39 @@ TEST_P(DeviceUniqueAttestationTest, EcdsaDeviceUniqueAttestationID) { // Collection of valid attestation ID tags. auto attestation_id_tags = AuthorizationSetBuilder(); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + // Use ro.product.brand_for_attestation property for attestation if it is present else fallback + // to ro.product.brand + std::string prop_value = + ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, + "ro.product.brand_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + } add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device"); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + // Use ro.product.name_for_attestation property for attestation if it is present else fallback + // to ro.product.name + prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, + "ro.product.name_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + } add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno"); add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MANUFACTURER, "ro.product.manufacturer"); - add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + // Use ro.product.model_for_attestation property for attestation if it is present else fallback + // to ro.product.model + prop_value = + ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, + "ro.product.model_for_attestation"); + } else { + add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + } vector key_blob; vector key_characteristics; diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp index 5a86283b1f..dd84cd9606 100644 --- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp +++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp @@ -2080,12 +2080,38 @@ TEST_P(NewKeyGenerationTest, EcdsaAttestationIdTags) { // Various ATTESTATION_ID_* tags that map to fields in the attestation extension ASN.1 schema. auto extra_tags = AuthorizationSetBuilder(); - add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + // Use ro.product.brand_for_attestation property for attestation if it is present else fallback + // to ro.product.brand + std::string prop_value = + ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND, + "ro.product.brand_for_attestation"); + } else { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand"); + } add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device"); - add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + // Use ro.product.name_for_attestation property for attestation if it is present else fallback + // to ro.product.name + prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT, + "ro.product.name_for_attestation"); + } else { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name"); + } add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno"); add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MANUFACTURER, "ro.product.manufacturer"); - add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + // Use ro.product.model_for_attestation property for attestation if it is present else fallback + // to ro.product.model + prop_value = + ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ ""); + if (!prop_value.empty()) { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL, + "ro.product.model_for_attestation"); + } else { + add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model"); + } for (const KeyParameter& tag : extra_tags) { SCOPED_TRACE(testing::Message() << "tag-" << tag);