Merge "Parse manifest rules for integrity component."
diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index 3ca8f49..11fecca 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -5061,12 +5061,17 @@
* owner. If Device ID attestation is requested (using {@link #ID_TYPE_SERIAL},
* {@link #ID_TYPE_IMEI} or {@link #ID_TYPE_MEID}), the caller must be the Device Owner
* or the Certificate Installer delegate.
- * @throws IllegalArgumentException if the alias in {@code keySpec} is empty, if the
- * algorithm specification in {@code keySpec} is not {@code RSAKeyGenParameterSpec}
- * or {@code ECGenParameterSpec}, or if Device ID attestation was requested but the
- * {@code keySpec} does not contain an attestation challenge.
- * @throws UnsupportedOperationException if Device ID attestation was requested but the
- * underlying hardware does not support it.
+ * @throws IllegalArgumentException in the following cases:
+ * <p>
+ * <ul>
+ * <li>The alias in {@code keySpec} is empty.</li>
+ * <li>The algorithm specification in {@code keySpec} is not
+ * {@code RSAKeyGenParameterSpec} or {@code ECGenParameterSpec}.</li>
+ * <li>Device ID attestation was requested but the {@code keySpec} does not contain an
+ * attestation challenge.</li>
+ * </ul>
+ * @throws UnsupportedOperationException if Device ID attestation or individual attestation
+ * was requested but the underlying hardware does not support it.
* @throws StrongBoxUnavailableException if the use of StrongBox for key generation was
* specified in {@code keySpec} but the device does not have one.
* @see KeyGenParameterSpec.Builder#setAttestationChallenge(byte[])
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index eda69a9..1536816 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -84,6 +84,7 @@
import static android.provider.Telephony.Carriers.DPC_URI;
import static android.provider.Telephony.Carriers.ENFORCE_KEY;
import static android.provider.Telephony.Carriers.ENFORCE_MANAGED_URI;
+import static android.security.keystore.AttestationUtils.USE_INDIVIDUAL_ATTESTATION;
import static com.android.internal.logging.nano.MetricsProto.MetricsEvent.PROVISIONING_ENTRY_POINT_ADB;
import static com.android.internal.widget.LockPatternUtils.CREDENTIAL_TYPE_NONE;
@@ -5825,7 +5826,7 @@
idTypeToAttestationFlag.put(ID_TYPE_IMEI, AttestationUtils.ID_TYPE_IMEI);
idTypeToAttestationFlag.put(ID_TYPE_MEID, AttestationUtils.ID_TYPE_MEID);
idTypeToAttestationFlag.put(
- ID_TYPE_INDIVIDUAL_ATTESTATION, AttestationUtils.USE_INDIVIDUAL_ATTESTATION);
+ ID_TYPE_INDIVIDUAL_ATTESTATION, USE_INDIVIDUAL_ATTESTATION);
int numFlagsSet = Integer.bitCount(idAttestationFlags);
// No flags are set - return null to indicate no device ID attestation information should
@@ -5865,6 +5866,7 @@
if (deviceIdAttestationRequired && attestationUtilsFlags.length > 0) {
enforceCallerCanRequestDeviceIdAttestation(who, callerPackage, callingUid);
+ enforceIndividualAttestationSupportedIfRequested(attestationUtilsFlags);
} else {
enforceCanManageScope(who, callerPackage, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER,
DELEGATION_CERT_INSTALL);
@@ -5959,6 +5961,17 @@
return false;
}
+ private void enforceIndividualAttestationSupportedIfRequested(int[] attestationUtilsFlags) {
+ for (int attestationFlag : attestationUtilsFlags) {
+ if (attestationFlag == USE_INDIVIDUAL_ATTESTATION
+ && !mInjector.getPackageManager().hasSystemFeature(
+ PackageManager.FEATURE_DEVICE_UNIQUE_ATTESTATION)) {
+ throw new UnsupportedOperationException("Device Individual attestation is not "
+ + "supported on this device.");
+ }
+ }
+ }
+
@Override
public boolean setKeyPairCertificate(ComponentName who, String callerPackage, String alias,
byte[] cert, byte[] chain, boolean isUserSelectable) {