Set correct SID when generating a platform key
Previously, the key was bound to the user's id instead of its SID.
Also adds ag/6288390 which detects and regenerates existing invalid keys.
In general, this change:
1) Is backwards compatible for the primary user with existing keys (no
change in key creation as SID set to 0 = uses primary user's SID).
2) Is compatible for all new keys created in all users going forward.
3) Handles existing invalid keys in non-primary users by force
regenerating a new valid key upon next use.
TODO for a future CL: Handle SID == 0 case better (b/124095438).
Bug: 123213054
Test: 1) atest FrameworksServicesTests:com.android.server.locksettings.recoverablekeystore
2) atest -m RecoveryControllerHostTest RecoverableKeyStoreEndtoEndHostTest
RecoverySessionHostTest
3) Manual tests:
* Primary user's backwards compatibility -> generate key without change,
flash new change, key continues to work; generate new key by re-enabling backup,
new key created and encrypted backup succeeds.
* Add work profile with new screen lock -> key generated and encrypted
backup succeeds.
* Add work profile and use existing screen lock -> key generated and
encrypted backup succeeds.
* Add work profile and perform encrypted backup before change (invalid
key generated) -> flash new change, invalid key detected and new valid
key generated.
Change-Id: I27b4bde3298a6b1c5373317af807bf7700f73768
3 files changed