Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package com.android.server.biometrics; |
| 18 | |
| 19 | import static android.Manifest.permission.USE_BIOMETRIC; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 20 | import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 21 | import static android.Manifest.permission.USE_FINGERPRINT; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 22 | import static android.hardware.biometrics.BiometricAuthenticator.TYPE_FACE; |
| 23 | import static android.hardware.biometrics.BiometricAuthenticator.TYPE_FINGERPRINT; |
| 24 | import static android.hardware.biometrics.BiometricAuthenticator.TYPE_IRIS; |
| 25 | import static android.hardware.biometrics.BiometricAuthenticator.TYPE_NONE; |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 26 | import static android.hardware.biometrics.BiometricManager.Authenticators; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 27 | |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 28 | import android.app.ActivityManager; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 29 | import android.app.IActivityManager; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 30 | import android.app.UserSwitchObserver; |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 31 | import android.app.admin.DevicePolicyManager; |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 32 | import android.app.trust.ITrustManager; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 33 | import android.content.ContentResolver; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 34 | import android.content.Context; |
| 35 | import android.content.pm.PackageManager; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 36 | import android.database.ContentObserver; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 37 | import android.hardware.biometrics.BiometricAuthenticator; |
| 38 | import android.hardware.biometrics.BiometricConstants; |
Kevin Chyn | 3a018719 | 2018-10-08 15:40:05 -0700 | [diff] [blame] | 39 | import android.hardware.biometrics.BiometricPrompt; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 40 | import android.hardware.biometrics.BiometricSourceType; |
Kevin Chyn | 7782d14 | 2019-01-18 12:51:33 -0800 | [diff] [blame] | 41 | import android.hardware.biometrics.BiometricsProtoEnums; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 42 | import android.hardware.biometrics.IBiometricAuthenticator; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 43 | import android.hardware.biometrics.IBiometricEnabledOnKeyguardCallback; |
Kevin Chyn | 352adfe | 2018-09-20 22:28:50 -0700 | [diff] [blame] | 44 | import android.hardware.biometrics.IBiometricService; |
| 45 | import android.hardware.biometrics.IBiometricServiceReceiver; |
Kevin Chyn | 23289ef | 2018-11-28 16:32:36 -0800 | [diff] [blame] | 46 | import android.hardware.biometrics.IBiometricServiceReceiverInternal; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 47 | import android.net.Uri; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 48 | import android.os.Binder; |
| 49 | import android.os.Bundle; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 50 | import android.os.DeadObjectException; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 51 | import android.os.Handler; |
| 52 | import android.os.IBinder; |
| 53 | import android.os.Looper; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 54 | import android.os.Message; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 55 | import android.os.RemoteException; |
| 56 | import android.os.ServiceManager; |
| 57 | import android.os.UserHandle; |
Kevin Chyn | d79e24e | 2018-09-25 12:06:59 -0700 | [diff] [blame] | 58 | import android.provider.Settings; |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 59 | import android.security.KeyStore; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 60 | import android.text.TextUtils; |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 61 | import android.util.Pair; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 62 | import android.util.Slog; |
Kevin Chyn | 7782d14 | 2019-01-18 12:51:33 -0800 | [diff] [blame] | 63 | import android.util.StatsLog; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 64 | |
| 65 | import com.android.internal.R; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 66 | import com.android.internal.annotations.VisibleForTesting; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 67 | import com.android.internal.os.SomeArgs; |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 68 | import com.android.internal.statusbar.IStatusBarService; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 69 | import com.android.server.SystemService; |
| 70 | |
| 71 | import java.util.ArrayList; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 72 | import java.util.HashMap; |
| 73 | import java.util.Iterator; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 74 | import java.util.List; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 75 | import java.util.Map; |
| 76 | import java.util.Random; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 77 | |
| 78 | /** |
| 79 | * System service that arbitrates the modality for BiometricPrompt to use. |
| 80 | */ |
Kevin Chyn | 352adfe | 2018-09-20 22:28:50 -0700 | [diff] [blame] | 81 | public class BiometricService extends SystemService { |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 82 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 83 | static final String TAG = "BiometricService"; |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 84 | private static final boolean DEBUG = true; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 85 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 86 | private static final int MSG_ON_AUTHENTICATION_SUCCEEDED = 2; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 87 | private static final int MSG_ON_AUTHENTICATION_REJECTED = 3; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 88 | private static final int MSG_ON_ERROR = 4; |
| 89 | private static final int MSG_ON_ACQUIRED = 5; |
| 90 | private static final int MSG_ON_DISMISSED = 6; |
| 91 | private static final int MSG_ON_TRY_AGAIN_PRESSED = 7; |
| 92 | private static final int MSG_ON_READY_FOR_AUTHENTICATION = 8; |
| 93 | private static final int MSG_AUTHENTICATE = 9; |
| 94 | private static final int MSG_CANCEL_AUTHENTICATION = 10; |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 95 | private static final int MSG_ON_AUTHENTICATION_TIMED_OUT = 11; |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 96 | private static final int MSG_ON_DEVICE_CREDENTIAL_PRESSED = 12; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 97 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 98 | /** |
| 99 | * Authentication either just called and we have not transitioned to the CALLED state, or |
| 100 | * authentication terminated (success or error). |
| 101 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 102 | static final int STATE_AUTH_IDLE = 0; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 103 | /** |
| 104 | * Authentication was called and we are waiting for the <Biometric>Services to return their |
| 105 | * cookies before starting the hardware and showing the BiometricPrompt. |
| 106 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 107 | static final int STATE_AUTH_CALLED = 1; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 108 | /** |
| 109 | * Authentication started, BiometricPrompt is showing and the hardware is authenticating. |
| 110 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 111 | static final int STATE_AUTH_STARTED = 2; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 112 | /** |
| 113 | * Authentication is paused, waiting for the user to press "try again" button. Only |
| 114 | * passive modalities such as Face or Iris should have this state. Note that for passive |
| 115 | * modalities, the HAL enters the idle state after onAuthenticated(false) which differs from |
| 116 | * fingerprint. |
| 117 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 118 | static final int STATE_AUTH_PAUSED = 3; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 119 | /** |
| 120 | * Authentication is successful, but we're waiting for the user to press "confirm" button. |
| 121 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 122 | static final int STATE_AUTH_PENDING_CONFIRM = 5; |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 123 | /** |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 124 | * Biometric authenticated, waiting for SysUI to finish animation |
| 125 | */ |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 126 | static final int STATE_AUTHENTICATED_PENDING_SYSUI = 6; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 127 | /** |
| 128 | * Biometric error, waiting for SysUI to finish animation |
| 129 | */ |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 130 | static final int STATE_ERROR_PENDING_SYSUI = 7; |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 131 | /** |
| 132 | * Device credential in AuthController is showing |
| 133 | */ |
| 134 | static final int STATE_SHOWING_DEVICE_CREDENTIAL = 8; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 135 | |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 136 | final class AuthSession { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 137 | // Map of Authenticator/Cookie pairs. We expect to receive the cookies back from |
| 138 | // <Biometric>Services before we can start authenticating. Pairs that have been returned |
| 139 | // are moved to mModalitiesMatched. |
| 140 | final HashMap<Integer, Integer> mModalitiesWaiting; |
| 141 | // Pairs that have been matched. |
| 142 | final HashMap<Integer, Integer> mModalitiesMatched = new HashMap<>(); |
| 143 | |
| 144 | // The following variables are passed to authenticateInternal, which initiates the |
| 145 | // appropriate <Biometric>Services. |
| 146 | final IBinder mToken; |
| 147 | final long mSessionId; |
| 148 | final int mUserId; |
| 149 | // Original receiver from BiometricPrompt. |
| 150 | final IBiometricServiceReceiver mClientReceiver; |
| 151 | final String mOpPackageName; |
| 152 | // Info to be shown on BiometricDialog when all cookies are returned. |
| 153 | final Bundle mBundle; |
| 154 | final int mCallingUid; |
| 155 | final int mCallingPid; |
| 156 | final int mCallingUserId; |
| 157 | // Continue authentication with the same modality/modalities after "try again" is |
| 158 | // pressed |
| 159 | final int mModality; |
| 160 | final boolean mRequireConfirmation; |
| 161 | |
| 162 | // The current state, which can be either idle, called, or started |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 163 | int mState = STATE_AUTH_IDLE; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 164 | // For explicit confirmation, do not send to keystore until the user has confirmed |
| 165 | // the authentication. |
| 166 | byte[] mTokenEscrow; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 167 | // Waiting for SystemUI to complete animation |
| 168 | int mErrorEscrow; |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 169 | int mVendorCodeEscrow; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 170 | |
Kevin Chyn | 7fca236 | 2019-06-20 17:20:42 -0700 | [diff] [blame] | 171 | // Timestamp when authentication started |
| 172 | private long mStartTimeMs; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 173 | // Timestamp when hardware authentication occurred |
| 174 | private long mAuthenticatedTimeMs; |
| 175 | |
| 176 | AuthSession(HashMap<Integer, Integer> modalities, IBinder token, long sessionId, |
| 177 | int userId, IBiometricServiceReceiver receiver, String opPackageName, |
| 178 | Bundle bundle, int callingUid, int callingPid, int callingUserId, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 179 | int modality, boolean requireConfirmation) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 180 | mModalitiesWaiting = modalities; |
| 181 | mToken = token; |
| 182 | mSessionId = sessionId; |
| 183 | mUserId = userId; |
| 184 | mClientReceiver = receiver; |
| 185 | mOpPackageName = opPackageName; |
| 186 | mBundle = bundle; |
| 187 | mCallingUid = callingUid; |
| 188 | mCallingPid = callingPid; |
| 189 | mCallingUserId = callingUserId; |
| 190 | mModality = modality; |
| 191 | mRequireConfirmation = requireConfirmation; |
| 192 | } |
| 193 | |
| 194 | boolean isCrypto() { |
| 195 | return mSessionId != 0; |
| 196 | } |
| 197 | |
| 198 | boolean containsCookie(int cookie) { |
| 199 | if (mModalitiesWaiting != null && mModalitiesWaiting.containsValue(cookie)) { |
| 200 | return true; |
| 201 | } |
| 202 | if (mModalitiesMatched != null && mModalitiesMatched.containsValue(cookie)) { |
| 203 | return true; |
| 204 | } |
| 205 | return false; |
| 206 | } |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 207 | |
Kevin Chyn | 8429da2 | 2019-09-24 12:42:35 -0700 | [diff] [blame] | 208 | boolean isAllowDeviceCredential() { |
Kevin Chyn | c70d6b8 | 2019-10-03 15:32:37 -0700 | [diff] [blame] | 209 | return Utils.isDeviceCredentialAllowed(mBundle); |
Kevin Chyn | 8429da2 | 2019-09-24 12:42:35 -0700 | [diff] [blame] | 210 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 211 | } |
| 212 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 213 | private final Injector mInjector; |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 214 | private final DevicePolicyManager mDevicePolicyManager; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 215 | @VisibleForTesting |
| 216 | final IBiometricService.Stub mImpl; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 217 | @VisibleForTesting |
Ilya Matyukhin | a610efb | 2019-10-02 12:46:27 -0700 | [diff] [blame] | 218 | final SettingObserver mSettingObserver; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 219 | private final List<EnabledOnKeyguardCallback> mEnabledOnKeyguardCallbacks; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 220 | private final Random mRandom = new Random(); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 221 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 222 | @VisibleForTesting |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 223 | IStatusBarService mStatusBarService; |
| 224 | @VisibleForTesting |
| 225 | KeyStore mKeyStore; |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 226 | @VisibleForTesting |
| 227 | ITrustManager mTrustManager; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 228 | |
| 229 | // Get and cache the available authenticator (manager) classes. Used since aidl doesn't support |
| 230 | // polymorphism :/ |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 231 | final ArrayList<AuthenticatorWrapper> mAuthenticators = new ArrayList<>(); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 232 | |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 233 | BiometricStrengthController mBiometricStrengthController; |
| 234 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 235 | // The current authentication session, null if idle/done. We need to track both the current |
| 236 | // and pending sessions since errors may be sent to either. |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 237 | @VisibleForTesting |
| 238 | AuthSession mCurrentAuthSession; |
| 239 | @VisibleForTesting |
| 240 | AuthSession mPendingAuthSession; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 241 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 242 | @VisibleForTesting |
| 243 | final Handler mHandler = new Handler(Looper.getMainLooper()) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 244 | @Override |
| 245 | public void handleMessage(Message msg) { |
| 246 | switch (msg.what) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 247 | case MSG_ON_AUTHENTICATION_SUCCEEDED: { |
| 248 | SomeArgs args = (SomeArgs) msg.obj; |
| 249 | handleAuthenticationSucceeded( |
| 250 | (boolean) args.arg1 /* requireConfirmation */, |
| 251 | (byte[]) args.arg2 /* token */); |
| 252 | args.recycle(); |
| 253 | break; |
| 254 | } |
| 255 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 256 | case MSG_ON_AUTHENTICATION_REJECTED: { |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 257 | handleAuthenticationRejected(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 258 | break; |
| 259 | } |
| 260 | |
| 261 | case MSG_ON_ERROR: { |
| 262 | SomeArgs args = (SomeArgs) msg.obj; |
| 263 | handleOnError( |
| 264 | args.argi1 /* cookie */, |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 265 | args.argi2 /* modality */, |
| 266 | args.argi3 /* error */, |
| 267 | args.argi4 /* vendorCode */); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 268 | args.recycle(); |
| 269 | break; |
| 270 | } |
| 271 | |
| 272 | case MSG_ON_ACQUIRED: { |
| 273 | SomeArgs args = (SomeArgs) msg.obj; |
| 274 | handleOnAcquired( |
| 275 | args.argi1 /* acquiredInfo */, |
| 276 | (String) args.arg1 /* message */); |
| 277 | args.recycle(); |
| 278 | break; |
| 279 | } |
| 280 | |
| 281 | case MSG_ON_DISMISSED: { |
| 282 | handleOnDismissed(msg.arg1); |
| 283 | break; |
| 284 | } |
| 285 | |
| 286 | case MSG_ON_TRY_AGAIN_PRESSED: { |
| 287 | handleOnTryAgainPressed(); |
| 288 | break; |
| 289 | } |
| 290 | |
| 291 | case MSG_ON_READY_FOR_AUTHENTICATION: { |
| 292 | SomeArgs args = (SomeArgs) msg.obj; |
| 293 | handleOnReadyForAuthentication( |
| 294 | args.argi1 /* cookie */, |
| 295 | (boolean) args.arg1 /* requireConfirmation */, |
| 296 | args.argi2 /* userId */); |
| 297 | args.recycle(); |
| 298 | break; |
| 299 | } |
| 300 | |
| 301 | case MSG_AUTHENTICATE: { |
| 302 | SomeArgs args = (SomeArgs) msg.obj; |
| 303 | handleAuthenticate( |
| 304 | (IBinder) args.arg1 /* token */, |
| 305 | (long) args.arg2 /* sessionId */, |
| 306 | args.argi1 /* userid */, |
| 307 | (IBiometricServiceReceiver) args.arg3 /* receiver */, |
| 308 | (String) args.arg4 /* opPackageName */, |
| 309 | (Bundle) args.arg5 /* bundle */, |
| 310 | args.argi2 /* callingUid */, |
| 311 | args.argi3 /* callingPid */, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 312 | args.argi4 /* callingUserId */); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 313 | args.recycle(); |
| 314 | break; |
| 315 | } |
| 316 | |
| 317 | case MSG_CANCEL_AUTHENTICATION: { |
| 318 | SomeArgs args = (SomeArgs) msg.obj; |
| 319 | handleCancelAuthentication( |
| 320 | (IBinder) args.arg1 /* token */, |
| 321 | (String) args.arg2 /* opPackageName */); |
| 322 | args.recycle(); |
| 323 | break; |
| 324 | } |
| 325 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 326 | case MSG_ON_AUTHENTICATION_TIMED_OUT: { |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 327 | SomeArgs args = (SomeArgs) msg.obj; |
| 328 | handleAuthenticationTimedOut( |
| 329 | args.argi1 /* modality */, |
| 330 | args.argi2 /* error */, |
| 331 | args.argi3 /* vendorCode */); |
| 332 | args.recycle(); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 333 | break; |
| 334 | } |
| 335 | |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 336 | case MSG_ON_DEVICE_CREDENTIAL_PRESSED: { |
| 337 | handleOnDeviceCredentialPressed(); |
| 338 | break; |
| 339 | } |
| 340 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 341 | default: |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 342 | Slog.e(TAG, "Unknown message: " + msg); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 343 | break; |
| 344 | } |
| 345 | } |
| 346 | }; |
| 347 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 348 | /** |
| 349 | * Wraps IBiometricAuthenticator implementation and stores information about the authenticator. |
| 350 | * TODO(b/141025588): Consider refactoring the tests to not rely on this implementation detail. |
| 351 | */ |
| 352 | @VisibleForTesting |
| 353 | public static final class AuthenticatorWrapper { |
| 354 | public final int id; |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 355 | public final int OEMStrength; // strength as configured by the OEM |
| 356 | private int updatedStrength; // strength updated by BiometricStrengthController |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 357 | public final int modality; |
| 358 | public final IBiometricAuthenticator impl; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 359 | |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 360 | AuthenticatorWrapper(int id, int modality, int strength, |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 361 | IBiometricAuthenticator impl) { |
| 362 | this.id = id; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 363 | this.modality = modality; |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 364 | this.OEMStrength = strength; |
| 365 | this.updatedStrength = strength; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 366 | this.impl = impl; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 367 | } |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 368 | |
| 369 | /** |
| 370 | * Returns the actual strength, taking any updated strengths into effect. Since more bits |
| 371 | * means lower strength, the resulting strength is never stronger than the OEM's configured |
| 372 | * strength. |
| 373 | * @return a bitfield, see {@link Authenticators} |
| 374 | */ |
| 375 | public int getActualStrength() { |
| 376 | return OEMStrength | updatedStrength; |
| 377 | } |
| 378 | |
| 379 | /** |
| 380 | * Stores the updated strength, which takes effect whenever {@link #getActualStrength()} |
| 381 | * is checked. |
| 382 | * @param newStrength |
| 383 | */ |
| 384 | public void updateStrength(int newStrength) { |
| 385 | String log = "updateStrength: Before(" + toString() + ")"; |
| 386 | updatedStrength = newStrength; |
| 387 | log += " After(" + toString() + ")"; |
| 388 | Slog.d(TAG, log); |
| 389 | } |
| 390 | |
| 391 | @Override |
| 392 | public String toString() { |
| 393 | return "ID(" + id + ")" |
| 394 | + " OEMStrength: " + OEMStrength |
| 395 | + " updatedStrength: " + updatedStrength |
| 396 | + " modality " + modality |
| 397 | + " authenticator: " + impl; |
| 398 | } |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 399 | } |
| 400 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 401 | @VisibleForTesting |
| 402 | public static class SettingObserver extends ContentObserver { |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 403 | |
| 404 | private static final boolean DEFAULT_KEYGUARD_ENABLED = true; |
| 405 | private static final boolean DEFAULT_APP_ENABLED = true; |
| 406 | private static final boolean DEFAULT_ALWAYS_REQUIRE_CONFIRMATION = false; |
| 407 | |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 408 | private final Uri FACE_UNLOCK_KEYGUARD_ENABLED = |
| 409 | Settings.Secure.getUriFor(Settings.Secure.FACE_UNLOCK_KEYGUARD_ENABLED); |
| 410 | private final Uri FACE_UNLOCK_APP_ENABLED = |
| 411 | Settings.Secure.getUriFor(Settings.Secure.FACE_UNLOCK_APP_ENABLED); |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 412 | private final Uri FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION = |
| 413 | Settings.Secure.getUriFor(Settings.Secure.FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 414 | |
| 415 | private final ContentResolver mContentResolver; |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 416 | private final List<BiometricService.EnabledOnKeyguardCallback> mCallbacks; |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 417 | |
Ilya Matyukhin | a610efb | 2019-10-02 12:46:27 -0700 | [diff] [blame] | 418 | private final Map<Integer, Boolean> mFaceEnabledOnKeyguard = new HashMap<>(); |
| 419 | private final Map<Integer, Boolean> mFaceEnabledForApps = new HashMap<>(); |
| 420 | private final Map<Integer, Boolean> mFaceAlwaysRequireConfirmation = new HashMap<>(); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 421 | |
| 422 | /** |
| 423 | * Creates a content observer. |
| 424 | * |
| 425 | * @param handler The handler to run {@link #onChange} on, or null if none. |
| 426 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 427 | public SettingObserver(Context context, Handler handler, |
| 428 | List<BiometricService.EnabledOnKeyguardCallback> callbacks) { |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 429 | super(handler); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 430 | mContentResolver = context.getContentResolver(); |
| 431 | mCallbacks = callbacks; |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 432 | updateContentObserver(); |
| 433 | } |
| 434 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 435 | public void updateContentObserver() { |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 436 | mContentResolver.unregisterContentObserver(this); |
| 437 | mContentResolver.registerContentObserver(FACE_UNLOCK_KEYGUARD_ENABLED, |
| 438 | false /* notifyForDescendents */, |
| 439 | this /* observer */, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 440 | UserHandle.USER_ALL); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 441 | mContentResolver.registerContentObserver(FACE_UNLOCK_APP_ENABLED, |
| 442 | false /* notifyForDescendents */, |
| 443 | this /* observer */, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 444 | UserHandle.USER_ALL); |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 445 | mContentResolver.registerContentObserver(FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION, |
| 446 | false /* notifyForDescendents */, |
| 447 | this /* observer */, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 448 | UserHandle.USER_ALL); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 449 | } |
| 450 | |
| 451 | @Override |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 452 | public void onChange(boolean selfChange, Uri uri, int userId) { |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 453 | if (FACE_UNLOCK_KEYGUARD_ENABLED.equals(uri)) { |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 454 | mFaceEnabledOnKeyguard.put(userId, Settings.Secure.getIntForUser( |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 455 | mContentResolver, |
| 456 | Settings.Secure.FACE_UNLOCK_KEYGUARD_ENABLED, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 457 | DEFAULT_KEYGUARD_ENABLED ? 1 : 0 /* default */, |
| 458 | userId) != 0); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 459 | |
Kevin Chyn | 750663c | 2019-05-15 12:17:38 -0700 | [diff] [blame] | 460 | if (userId == ActivityManager.getCurrentUser() && !selfChange) { |
Kevin Chyn | 0c00033 | 2019-04-04 16:02:37 -0700 | [diff] [blame] | 461 | notifyEnabledOnKeyguardCallbacks(userId); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 462 | } |
| 463 | } else if (FACE_UNLOCK_APP_ENABLED.equals(uri)) { |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 464 | mFaceEnabledForApps.put(userId, Settings.Secure.getIntForUser( |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 465 | mContentResolver, |
| 466 | Settings.Secure.FACE_UNLOCK_APP_ENABLED, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 467 | DEFAULT_APP_ENABLED ? 1 : 0 /* default */, |
| 468 | userId) != 0); |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 469 | } else if (FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION.equals(uri)) { |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 470 | mFaceAlwaysRequireConfirmation.put(userId, Settings.Secure.getIntForUser( |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 471 | mContentResolver, |
| 472 | Settings.Secure.FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION, |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 473 | DEFAULT_ALWAYS_REQUIRE_CONFIRMATION ? 1 : 0 /* default */, |
| 474 | userId) != 0); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 475 | } |
| 476 | } |
| 477 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 478 | public boolean getFaceEnabledOnKeyguard() { |
Kevin Chyn | 750663c | 2019-05-15 12:17:38 -0700 | [diff] [blame] | 479 | final int user = ActivityManager.getCurrentUser(); |
| 480 | if (!mFaceEnabledOnKeyguard.containsKey(user)) { |
| 481 | onChange(true /* selfChange */, FACE_UNLOCK_KEYGUARD_ENABLED, user); |
| 482 | } |
| 483 | return mFaceEnabledOnKeyguard.get(user); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 484 | } |
| 485 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 486 | public boolean getFaceEnabledForApps(int userId) { |
Kevin Chyn | 750663c | 2019-05-15 12:17:38 -0700 | [diff] [blame] | 487 | if (!mFaceEnabledForApps.containsKey(userId)) { |
| 488 | onChange(true /* selfChange */, FACE_UNLOCK_APP_ENABLED, userId); |
| 489 | } |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 490 | return mFaceEnabledForApps.getOrDefault(userId, DEFAULT_APP_ENABLED); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 491 | } |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 492 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 493 | public boolean getFaceAlwaysRequireConfirmation(int userId) { |
Kevin Chyn | 750663c | 2019-05-15 12:17:38 -0700 | [diff] [blame] | 494 | if (!mFaceAlwaysRequireConfirmation.containsKey(userId)) { |
| 495 | onChange(true /* selfChange */, FACE_UNLOCK_ALWAYS_REQUIRE_CONFIRMATION, userId); |
| 496 | } |
| 497 | return mFaceAlwaysRequireConfirmation.get(userId); |
Kevin Chyn | 3140283 | 2019-01-10 15:56:41 -0800 | [diff] [blame] | 498 | } |
Kevin Chyn | 0c00033 | 2019-04-04 16:02:37 -0700 | [diff] [blame] | 499 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 500 | public void notifyEnabledOnKeyguardCallbacks(int userId) { |
| 501 | List<EnabledOnKeyguardCallback> callbacks = mCallbacks; |
Kevin Chyn | 0c00033 | 2019-04-04 16:02:37 -0700 | [diff] [blame] | 502 | for (int i = 0; i < callbacks.size(); i++) { |
| 503 | callbacks.get(i).notify(BiometricSourceType.FACE, |
Lucas Dupin | 7d95f15 | 2019-07-17 16:25:54 -0700 | [diff] [blame] | 504 | mFaceEnabledOnKeyguard.getOrDefault(userId, DEFAULT_KEYGUARD_ENABLED), |
| 505 | userId); |
Kevin Chyn | 0c00033 | 2019-04-04 16:02:37 -0700 | [diff] [blame] | 506 | } |
| 507 | } |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 508 | } |
| 509 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 510 | final class EnabledOnKeyguardCallback implements IBinder.DeathRecipient { |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 511 | |
| 512 | private final IBiometricEnabledOnKeyguardCallback mCallback; |
| 513 | |
| 514 | EnabledOnKeyguardCallback(IBiometricEnabledOnKeyguardCallback callback) { |
| 515 | mCallback = callback; |
| 516 | try { |
| 517 | mCallback.asBinder().linkToDeath(EnabledOnKeyguardCallback.this, 0); |
| 518 | } catch (RemoteException e) { |
| 519 | Slog.w(TAG, "Unable to linkToDeath", e); |
| 520 | } |
| 521 | } |
| 522 | |
Lucas Dupin | 7d95f15 | 2019-07-17 16:25:54 -0700 | [diff] [blame] | 523 | void notify(BiometricSourceType sourceType, boolean enabled, int userId) { |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 524 | try { |
Lucas Dupin | 7d95f15 | 2019-07-17 16:25:54 -0700 | [diff] [blame] | 525 | mCallback.onChanged(sourceType, enabled, userId); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 526 | } catch (DeadObjectException e) { |
| 527 | Slog.w(TAG, "Death while invoking notify", e); |
| 528 | mEnabledOnKeyguardCallbacks.remove(this); |
| 529 | } catch (RemoteException e) { |
| 530 | Slog.w(TAG, "Failed to invoke onChanged", e); |
| 531 | } |
| 532 | } |
| 533 | |
| 534 | @Override |
| 535 | public void binderDied() { |
| 536 | Slog.e(TAG, "Enabled callback binder died"); |
| 537 | mEnabledOnKeyguardCallbacks.remove(this); |
| 538 | } |
| 539 | } |
| 540 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 541 | // Wrap the client's receiver so we can do things with the BiometricDialog first |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 542 | @VisibleForTesting |
| 543 | final IBiometricServiceReceiverInternal mInternalReceiver = |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 544 | new IBiometricServiceReceiverInternal.Stub() { |
| 545 | @Override |
| 546 | public void onAuthenticationSucceeded(boolean requireConfirmation, byte[] token) |
| 547 | throws RemoteException { |
| 548 | SomeArgs args = SomeArgs.obtain(); |
| 549 | args.arg1 = requireConfirmation; |
| 550 | args.arg2 = token; |
| 551 | mHandler.obtainMessage(MSG_ON_AUTHENTICATION_SUCCEEDED, args).sendToTarget(); |
| 552 | } |
| 553 | |
| 554 | @Override |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 555 | public void onAuthenticationFailed() |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 556 | throws RemoteException { |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 557 | Slog.v(TAG, "onAuthenticationFailed"); |
| 558 | mHandler.obtainMessage(MSG_ON_AUTHENTICATION_REJECTED).sendToTarget(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 559 | } |
| 560 | |
| 561 | @Override |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 562 | public void onError(int cookie, int modality, int error, int vendorCode) |
| 563 | throws RemoteException { |
Kevin Chyn | e674e85 | 2019-04-24 12:39:40 -0700 | [diff] [blame] | 564 | // Determine if error is hard or soft error. Certain errors (such as TIMEOUT) are |
| 565 | // soft errors and we should allow the user to try authenticating again instead of |
| 566 | // dismissing BiometricPrompt. |
| 567 | if (error == BiometricConstants.BIOMETRIC_ERROR_TIMEOUT) { |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 568 | SomeArgs args = SomeArgs.obtain(); |
| 569 | args.argi1 = modality; |
| 570 | args.argi2 = error; |
| 571 | args.argi3 = vendorCode; |
| 572 | mHandler.obtainMessage(MSG_ON_AUTHENTICATION_TIMED_OUT, args).sendToTarget(); |
Kevin Chyn | e674e85 | 2019-04-24 12:39:40 -0700 | [diff] [blame] | 573 | } else { |
| 574 | SomeArgs args = SomeArgs.obtain(); |
| 575 | args.argi1 = cookie; |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 576 | args.argi2 = modality; |
| 577 | args.argi3 = error; |
| 578 | args.argi4 = vendorCode; |
Kevin Chyn | e674e85 | 2019-04-24 12:39:40 -0700 | [diff] [blame] | 579 | mHandler.obtainMessage(MSG_ON_ERROR, args).sendToTarget(); |
| 580 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 581 | } |
| 582 | |
| 583 | @Override |
| 584 | public void onAcquired(int acquiredInfo, String message) throws RemoteException { |
| 585 | SomeArgs args = SomeArgs.obtain(); |
| 586 | args.argi1 = acquiredInfo; |
| 587 | args.arg1 = message; |
| 588 | mHandler.obtainMessage(MSG_ON_ACQUIRED, args).sendToTarget(); |
| 589 | } |
| 590 | |
| 591 | @Override |
| 592 | public void onDialogDismissed(int reason) throws RemoteException { |
| 593 | mHandler.obtainMessage(MSG_ON_DISMISSED, reason, 0 /* arg2 */).sendToTarget(); |
| 594 | } |
| 595 | |
| 596 | @Override |
| 597 | public void onTryAgainPressed() { |
| 598 | mHandler.sendEmptyMessage(MSG_ON_TRY_AGAIN_PRESSED); |
| 599 | } |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 600 | |
| 601 | @Override |
| 602 | public void onDeviceCredentialPressed() { |
| 603 | mHandler.sendEmptyMessage(MSG_ON_DEVICE_CREDENTIAL_PRESSED); |
| 604 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 605 | }; |
| 606 | |
| 607 | |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 608 | /** |
| 609 | * This is just a pass-through service that wraps Fingerprint, Iris, Face services. This service |
| 610 | * should not carry any state. The reality is we need to keep a tiny amount of state so that |
| 611 | * cancelAuthentication() can go to the right place. |
| 612 | */ |
Kevin Chyn | bf830a3 | 2018-10-07 15:58:46 -0700 | [diff] [blame] | 613 | private final class BiometricServiceWrapper extends IBiometricService.Stub { |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 614 | @Override // Binder call |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 615 | public void onReadyForAuthentication(int cookie, boolean requireConfirmation, int userId) { |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 616 | checkInternalPermission(); |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 617 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 618 | SomeArgs args = SomeArgs.obtain(); |
| 619 | args.argi1 = cookie; |
| 620 | args.arg1 = requireConfirmation; |
| 621 | args.argi2 = userId; |
| 622 | mHandler.obtainMessage(MSG_ON_READY_FOR_AUTHENTICATION, args).sendToTarget(); |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 623 | } |
| 624 | |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 625 | @Override // Binder call |
| 626 | public void authenticate(IBinder token, long sessionId, int userId, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 627 | IBiometricServiceReceiver receiver, String opPackageName, Bundle bundle) |
Kevin Chyn | 23289ef | 2018-11-28 16:32:36 -0800 | [diff] [blame] | 628 | throws RemoteException { |
Kevin Chyn | 067085a | 2018-11-12 15:49:19 -0800 | [diff] [blame] | 629 | final int callingUid = Binder.getCallingUid(); |
| 630 | final int callingPid = Binder.getCallingPid(); |
| 631 | final int callingUserId = UserHandle.getCallingUserId(); |
| 632 | |
| 633 | // In the BiometricServiceBase, check do the AppOps and foreground check. |
| 634 | if (userId == callingUserId) { |
| 635 | // Check the USE_BIOMETRIC permission here. |
| 636 | checkPermission(); |
| 637 | } else { |
| 638 | // Only allow internal clients to authenticate with a different userId |
| 639 | Slog.w(TAG, "User " + callingUserId + " is requesting authentication of userid: " |
| 640 | + userId); |
| 641 | checkInternalPermission(); |
| 642 | } |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 643 | |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 644 | if (token == null || receiver == null || opPackageName == null || bundle == null) { |
Kevin Chyn | 7c2371a | 2018-09-12 01:54:18 -0700 | [diff] [blame] | 645 | Slog.e(TAG, "Unable to authenticate, one or more null arguments"); |
| 646 | return; |
| 647 | } |
| 648 | |
Kevin Chyn | d04b43d | 2019-12-13 12:56:41 -0800 | [diff] [blame] | 649 | if (!Utils.isValidAuthenticatorConfig(bundle)) { |
| 650 | throw new SecurityException("Invalid authenticator configuration"); |
| 651 | } |
| 652 | |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 653 | if (bundle.getBoolean(BiometricPrompt.EXTRA_DISALLOW_BIOMETRICS_IF_POLICY_EXISTS)) { |
| 654 | checkInternalPermission(); |
| 655 | } |
| 656 | |
Kevin Chyn | c70d6b8 | 2019-10-03 15:32:37 -0700 | [diff] [blame] | 657 | Utils.combineAuthenticatorBundles(bundle); |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 658 | |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 659 | // Check the usage of this in system server. Need to remove this check if it becomes a |
| 660 | // public API. |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 661 | final boolean useDefaultTitle = |
| 662 | bundle.getBoolean(BiometricPrompt.KEY_USE_DEFAULT_TITLE, false); |
| 663 | if (useDefaultTitle) { |
Kevin Chyn | 3a018719 | 2018-10-08 15:40:05 -0700 | [diff] [blame] | 664 | checkInternalPermission(); |
Kevin Chyn | 23289ef | 2018-11-28 16:32:36 -0800 | [diff] [blame] | 665 | // Set the default title if necessary |
Kevin Chyn | 9eed612 | 2019-03-28 21:14:19 -0700 | [diff] [blame] | 666 | if (TextUtils.isEmpty(bundle.getCharSequence(BiometricPrompt.KEY_TITLE))) { |
| 667 | bundle.putCharSequence(BiometricPrompt.KEY_TITLE, |
| 668 | getContext().getString(R.string.biometric_dialog_default_title)); |
Kevin Chyn | 23289ef | 2018-11-28 16:32:36 -0800 | [diff] [blame] | 669 | } |
Kevin Chyn | 3a018719 | 2018-10-08 15:40:05 -0700 | [diff] [blame] | 670 | } |
| 671 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 672 | SomeArgs args = SomeArgs.obtain(); |
| 673 | args.arg1 = token; |
| 674 | args.arg2 = sessionId; |
| 675 | args.argi1 = userId; |
| 676 | args.arg3 = receiver; |
| 677 | args.arg4 = opPackageName; |
| 678 | args.arg5 = bundle; |
| 679 | args.argi2 = callingUid; |
| 680 | args.argi3 = callingPid; |
| 681 | args.argi4 = callingUserId; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 682 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 683 | mHandler.obtainMessage(MSG_AUTHENTICATE, args).sendToTarget(); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 684 | } |
| 685 | |
Kevin Chyn | 1b2137c | 2019-01-24 16:32:38 -0800 | [diff] [blame] | 686 | @Override // Binder call |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 687 | public void cancelAuthentication(IBinder token, String opPackageName) |
| 688 | throws RemoteException { |
| 689 | checkPermission(); |
Kevin Chyn | 23289ef | 2018-11-28 16:32:36 -0800 | [diff] [blame] | 690 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 691 | SomeArgs args = SomeArgs.obtain(); |
| 692 | args.arg1 = token; |
| 693 | args.arg2 = opPackageName; |
| 694 | mHandler.obtainMessage(MSG_CANCEL_AUTHENTICATION, args).sendToTarget(); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 695 | } |
Kevin Chyn | 05c2150 | 2018-09-18 13:07:19 -0700 | [diff] [blame] | 696 | |
| 697 | @Override // Binder call |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 698 | public int canAuthenticate(String opPackageName, int userId, |
| 699 | @Authenticators.Types int authenticators) { |
Kevin Chyn | 28623b6 | 2019-06-11 11:43:33 -0700 | [diff] [blame] | 700 | Slog.d(TAG, "canAuthenticate: User=" + userId |
Kevin Chyn | d04b43d | 2019-12-13 12:56:41 -0800 | [diff] [blame] | 701 | + ", Caller=" + UserHandle.getCallingUserId() |
| 702 | + ", Authenticators=" + authenticators); |
Kevin Chyn | 69183e5 | 2018-09-21 17:04:09 -0700 | [diff] [blame] | 703 | |
Kevin Chyn | 28623b6 | 2019-06-11 11:43:33 -0700 | [diff] [blame] | 704 | if (userId != UserHandle.getCallingUserId()) { |
| 705 | checkInternalPermission(); |
| 706 | } else { |
| 707 | checkPermission(); |
| 708 | } |
| 709 | |
Kevin Chyn | d04b43d | 2019-12-13 12:56:41 -0800 | [diff] [blame] | 710 | |
| 711 | if (!Utils.isValidAuthenticatorConfig(authenticators)) { |
| 712 | throw new SecurityException("Invalid authenticator configuration"); |
| 713 | } |
| 714 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 715 | final Bundle bundle = new Bundle(); |
| 716 | bundle.putInt(BiometricPrompt.KEY_AUTHENTICATORS_ALLOWED, authenticators); |
| 717 | |
| 718 | int biometricConstantsResult = BiometricConstants.BIOMETRIC_ERROR_HW_UNAVAILABLE; |
Kevin Chyn | 05c2150 | 2018-09-18 13:07:19 -0700 | [diff] [blame] | 719 | final long ident = Binder.clearCallingIdentity(); |
| 720 | try { |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 721 | biometricConstantsResult = checkAndGetAuthenticators(userId, bundle, opPackageName, |
| 722 | false /* checkDevicePolicyManager */).second; |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 723 | if (biometricConstantsResult != BiometricConstants.BIOMETRIC_SUCCESS |
| 724 | && Utils.isDeviceCredentialAllowed(bundle)) { |
| 725 | // If there's an issue with biometrics, but device credential is allowed and |
| 726 | // set up, return SUCCESS. If device credential isn't set up either, return |
| 727 | // ERROR_NO_DEVICE_CREDENTIAL. |
| 728 | if (mTrustManager.isDeviceSecure(userId)) { |
| 729 | biometricConstantsResult = BiometricConstants.BIOMETRIC_SUCCESS; |
| 730 | } else { |
| 731 | biometricConstantsResult = |
| 732 | BiometricConstants.BIOMETRIC_ERROR_NO_DEVICE_CREDENTIAL; |
| 733 | } |
| 734 | } |
| 735 | |
| 736 | } catch (RemoteException e) { |
| 737 | Slog.e(TAG, "Remote exception", e); |
Kevin Chyn | 05c2150 | 2018-09-18 13:07:19 -0700 | [diff] [blame] | 738 | } finally { |
| 739 | Binder.restoreCallingIdentity(ident); |
| 740 | } |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 741 | |
| 742 | return Utils.biometricConstantsToBiometricManager(biometricConstantsResult); |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 743 | } |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 744 | |
Kevin Chyn | 27f9231 | 2019-07-26 12:41:33 -0700 | [diff] [blame] | 745 | @Override |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 746 | public boolean hasEnrolledBiometrics(int userId, String opPackageName) { |
Kevin Chyn | 27f9231 | 2019-07-26 12:41:33 -0700 | [diff] [blame] | 747 | checkInternalPermission(); |
| 748 | |
| 749 | final long ident = Binder.clearCallingIdentity(); |
| 750 | try { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 751 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
| 752 | if (authenticator.impl.hasEnrolledTemplates(userId, opPackageName)) { |
Kevin Chyn | 27f9231 | 2019-07-26 12:41:33 -0700 | [diff] [blame] | 753 | return true; |
| 754 | } |
| 755 | } |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 756 | } catch (RemoteException e) { |
| 757 | Slog.e(TAG, "Remote exception", e); |
Kevin Chyn | 27f9231 | 2019-07-26 12:41:33 -0700 | [diff] [blame] | 758 | } finally { |
| 759 | Binder.restoreCallingIdentity(ident); |
| 760 | } |
| 761 | return false; |
| 762 | } |
| 763 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 764 | @Override |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 765 | public void registerAuthenticator(int id, int modality, int strength, |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 766 | IBiometricAuthenticator authenticator) { |
Ilya Matyukhin | e4675b3 | 2019-11-07 16:07:19 -0800 | [diff] [blame] | 767 | checkInternalPermission(); |
| 768 | |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 769 | Slog.d(TAG, "Registering ID: " + id |
| 770 | + " Modality: " + modality |
| 771 | + " Strength: " + strength); |
| 772 | |
Kevin Chyn | 9cef363 | 2019-12-15 18:21:46 -0800 | [diff] [blame] | 773 | if (authenticator == null) { |
| 774 | throw new IllegalArgumentException("Authenticator must not be null." |
| 775 | + " Did you forget to modify the core/res/res/values/xml overlay for" |
| 776 | + " config_biometric_sensors?"); |
| 777 | } |
| 778 | |
Kevin Chyn | e8d2d1f | 2019-12-13 15:36:49 -0800 | [diff] [blame] | 779 | if (strength != Authenticators.BIOMETRIC_STRONG |
| 780 | && strength != Authenticators.BIOMETRIC_WEAK) { |
| 781 | throw new IllegalStateException("Unsupported strength"); |
| 782 | } |
| 783 | |
| 784 | for (AuthenticatorWrapper wrapper : mAuthenticators) { |
| 785 | if (wrapper.id == id) { |
| 786 | throw new IllegalStateException("Cannot register duplicate authenticator"); |
| 787 | } |
| 788 | } |
| 789 | |
| 790 | // This happens infrequently enough, not worth caching. |
| 791 | final String[] configs = mInjector.getConfiguration(getContext()); |
| 792 | boolean idFound = false; |
| 793 | for (int i = 0; i < configs.length; i++) { |
| 794 | SensorConfig config = new SensorConfig(configs[i]); |
| 795 | if (config.mId == id) { |
| 796 | idFound = true; |
| 797 | break; |
| 798 | } |
| 799 | } |
| 800 | if (!idFound) { |
| 801 | throw new IllegalStateException("Cannot register unknown id"); |
| 802 | } |
| 803 | |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 804 | mAuthenticators.add(new AuthenticatorWrapper(id, modality, strength, authenticator)); |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 805 | } |
| 806 | |
Kevin Chyn | bf830a3 | 2018-10-07 15:58:46 -0700 | [diff] [blame] | 807 | @Override // Binder call |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 808 | public void registerEnabledOnKeyguardCallback(IBiometricEnabledOnKeyguardCallback callback) |
| 809 | throws RemoteException { |
| 810 | checkInternalPermission(); |
| 811 | mEnabledOnKeyguardCallbacks.add(new EnabledOnKeyguardCallback(callback)); |
| 812 | try { |
| 813 | callback.onChanged(BiometricSourceType.FACE, |
Lucas Dupin | 7d95f15 | 2019-07-17 16:25:54 -0700 | [diff] [blame] | 814 | mSettingObserver.getFaceEnabledOnKeyguard(), |
| 815 | UserHandle.getCallingUserId()); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 816 | } catch (RemoteException e) { |
| 817 | Slog.w(TAG, "Remote exception", e); |
| 818 | } |
| 819 | } |
Kevin Chyn | bf830a3 | 2018-10-07 15:58:46 -0700 | [diff] [blame] | 820 | |
| 821 | @Override // Binder call |
| 822 | public void setActiveUser(int userId) { |
| 823 | checkInternalPermission(); |
| 824 | final long ident = Binder.clearCallingIdentity(); |
| 825 | try { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 826 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
| 827 | authenticator.impl.setActiveUser(userId); |
Kevin Chyn | bf830a3 | 2018-10-07 15:58:46 -0700 | [diff] [blame] | 828 | } |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 829 | } catch (RemoteException e) { |
| 830 | Slog.e(TAG, "Remote exception", e); |
Kevin Chyn | bf830a3 | 2018-10-07 15:58:46 -0700 | [diff] [blame] | 831 | } finally { |
| 832 | Binder.restoreCallingIdentity(ident); |
| 833 | } |
| 834 | } |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 835 | |
Kevin Chyn | 6adb3a1 | 2018-12-05 19:40:31 -0800 | [diff] [blame] | 836 | @Override // Binder call |
Kevin Chyn | a38653c | 2019-02-11 17:46:21 -0800 | [diff] [blame] | 837 | public void resetLockout(byte[] token) { |
Kevin Chyn | 6adb3a1 | 2018-12-05 19:40:31 -0800 | [diff] [blame] | 838 | checkInternalPermission(); |
| 839 | final long ident = Binder.clearCallingIdentity(); |
| 840 | try { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 841 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
| 842 | authenticator.impl.resetLockout(token); |
Kevin Chyn | 6adb3a1 | 2018-12-05 19:40:31 -0800 | [diff] [blame] | 843 | } |
| 844 | } catch (RemoteException e) { |
| 845 | Slog.e(TAG, "Remote exception", e); |
| 846 | } finally { |
| 847 | Binder.restoreCallingIdentity(ident); |
| 848 | } |
| 849 | } |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 850 | } |
| 851 | |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 852 | private void checkInternalPermission() { |
Kevin Chyn | e92cdae | 2018-11-21 16:35:04 -0800 | [diff] [blame] | 853 | getContext().enforceCallingOrSelfPermission(USE_BIOMETRIC_INTERNAL, |
Kevin Chyn | 3a018719 | 2018-10-08 15:40:05 -0700 | [diff] [blame] | 854 | "Must have USE_BIOMETRIC_INTERNAL permission"); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 855 | } |
| 856 | |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 857 | private void checkPermission() { |
Kevin Chyn | 71db85f | 2019-05-14 15:32:47 -0700 | [diff] [blame] | 858 | if (getContext().checkCallingOrSelfPermission(USE_FINGERPRINT) |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 859 | != PackageManager.PERMISSION_GRANTED) { |
Kevin Chyn | 71db85f | 2019-05-14 15:32:47 -0700 | [diff] [blame] | 860 | getContext().enforceCallingOrSelfPermission(USE_BIOMETRIC, |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 861 | "Must have USE_BIOMETRIC permission"); |
| 862 | } |
| 863 | } |
| 864 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 865 | /** |
| 866 | * Class for injecting dependencies into BiometricService. |
| 867 | * TODO(b/141025588): Replace with a dependency injection framework (e.g. Guice, Dagger). |
| 868 | */ |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 869 | @VisibleForTesting |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 870 | public static class Injector { |
| 871 | |
| 872 | @VisibleForTesting |
| 873 | public IActivityManager getActivityManagerService() { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 874 | return ActivityManager.getService(); |
| 875 | } |
| 876 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 877 | @VisibleForTesting |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 878 | public ITrustManager getTrustManager() { |
| 879 | return ITrustManager.Stub.asInterface(ServiceManager.getService(Context.TRUST_SERVICE)); |
| 880 | } |
| 881 | |
| 882 | @VisibleForTesting |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 883 | public IStatusBarService getStatusBarService() { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 884 | return IStatusBarService.Stub.asInterface( |
| 885 | ServiceManager.getService(Context.STATUS_BAR_SERVICE)); |
| 886 | } |
| 887 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 888 | /** |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 889 | * Allows to mock SettingObserver for testing. |
| 890 | */ |
| 891 | @VisibleForTesting |
| 892 | public SettingObserver getSettingObserver(Context context, Handler handler, |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 893 | List<EnabledOnKeyguardCallback> callbacks) { |
| 894 | return new SettingObserver(context, handler, callbacks); |
| 895 | } |
| 896 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 897 | @VisibleForTesting |
| 898 | public KeyStore getKeyStore() { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 899 | return KeyStore.getInstance(); |
| 900 | } |
| 901 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 902 | /** |
| 903 | * Allows to enable/disable debug logs. |
| 904 | */ |
| 905 | @VisibleForTesting |
| 906 | public boolean isDebugEnabled(Context context, int userId) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 907 | return Utils.isDebugEnabled(context, userId); |
| 908 | } |
| 909 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 910 | /** |
| 911 | * Allows to stub publishBinderService(...) for testing. |
| 912 | */ |
| 913 | @VisibleForTesting |
| 914 | public void publishBinderService(BiometricService service, IBiometricService.Stub impl) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 915 | service.publishBinderService(Context.BIOMETRIC_SERVICE, impl); |
| 916 | } |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 917 | |
| 918 | /** |
| 919 | * Allows to mock BiometricStrengthController for testing. |
| 920 | */ |
| 921 | @VisibleForTesting |
| 922 | public BiometricStrengthController getBiometricStrengthController( |
| 923 | BiometricService service) { |
| 924 | return new BiometricStrengthController(service); |
| 925 | } |
Kevin Chyn | e8d2d1f | 2019-12-13 15:36:49 -0800 | [diff] [blame] | 926 | |
| 927 | /** |
| 928 | * Allows to test with various device sensor configurations. |
| 929 | * @param context System Server context |
| 930 | * @return the sensor configuration from core/res/res/values/config.xml |
| 931 | */ |
| 932 | @VisibleForTesting |
| 933 | public String[] getConfiguration(Context context) { |
| 934 | return context.getResources().getStringArray(R.array.config_biometric_sensors); |
| 935 | } |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 936 | } |
| 937 | |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 938 | /** |
| 939 | * Initializes the system service. |
| 940 | * <p> |
| 941 | * Subclasses must define a single argument constructor that accepts the context |
| 942 | * and passes it to super. |
| 943 | * </p> |
| 944 | * |
| 945 | * @param context The system server context. |
| 946 | */ |
Kevin Chyn | 352adfe | 2018-09-20 22:28:50 -0700 | [diff] [blame] | 947 | public BiometricService(Context context) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 948 | this(context, new Injector()); |
| 949 | } |
| 950 | |
| 951 | @VisibleForTesting |
| 952 | BiometricService(Context context, Injector injector) { |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 953 | super(context); |
| 954 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 955 | mInjector = injector; |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 956 | mDevicePolicyManager = (DevicePolicyManager) context |
| 957 | .getSystemService(context.DEVICE_POLICY_SERVICE); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 958 | mImpl = new BiometricServiceWrapper(); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 959 | mEnabledOnKeyguardCallbacks = new ArrayList<>(); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 960 | mSettingObserver = mInjector.getSettingObserver(context, mHandler, |
| 961 | mEnabledOnKeyguardCallbacks); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 962 | |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 963 | try { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 964 | injector.getActivityManagerService().registerUserSwitchObserver( |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 965 | new UserSwitchObserver() { |
| 966 | @Override |
| 967 | public void onUserSwitchComplete(int newUserId) { |
| 968 | mSettingObserver.updateContentObserver(); |
Kevin Chyn | 0c00033 | 2019-04-04 16:02:37 -0700 | [diff] [blame] | 969 | mSettingObserver.notifyEnabledOnKeyguardCallbacks(newUserId); |
Kevin Chyn | b7b54a6 | 2018-09-28 18:48:12 -0700 | [diff] [blame] | 970 | } |
| 971 | }, BiometricService.class.getName() |
| 972 | ); |
| 973 | } catch (RemoteException e) { |
| 974 | Slog.e(TAG, "Failed to register user switch observer", e); |
| 975 | } |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 976 | } |
| 977 | |
| 978 | @Override |
| 979 | public void onStart() { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 980 | mKeyStore = mInjector.getKeyStore(); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 981 | mStatusBarService = mInjector.getStatusBarService(); |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 982 | mTrustManager = mInjector.getTrustManager(); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 983 | mInjector.publishBinderService(this, mImpl); |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 984 | mBiometricStrengthController = mInjector.getBiometricStrengthController(this); |
| 985 | mBiometricStrengthController.startListening(); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 986 | } |
| 987 | |
| 988 | /** |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 989 | * @param modality one of {@link BiometricAuthenticator#TYPE_FINGERPRINT}, |
| 990 | * {@link BiometricAuthenticator#TYPE_IRIS} or {@link BiometricAuthenticator#TYPE_FACE} |
| 991 | * @return |
| 992 | */ |
| 993 | private int mapModalityToDevicePolicyType(int modality) { |
| 994 | switch (modality) { |
| 995 | case TYPE_FINGERPRINT: |
| 996 | return DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT; |
| 997 | case TYPE_IRIS: |
| 998 | return DevicePolicyManager.KEYGUARD_DISABLE_IRIS; |
| 999 | case TYPE_FACE: |
| 1000 | return DevicePolicyManager.KEYGUARD_DISABLE_FACE; |
| 1001 | default: |
| 1002 | Slog.e(TAG, "Error modality=" + modality); |
| 1003 | return DevicePolicyManager.KEYGUARD_DISABLE_FEATURES_NONE; |
| 1004 | } |
| 1005 | } |
| 1006 | |
| 1007 | // TODO(joshmccloskey): Update this to throw an error if a new modality is added and this |
| 1008 | // logic is not updated. |
| 1009 | private boolean isBiometricDisabledByDevicePolicy(int modality, int effectiveUserId) { |
| 1010 | final int biometricToCheck = mapModalityToDevicePolicyType(modality); |
| 1011 | if (biometricToCheck == DevicePolicyManager.KEYGUARD_DISABLE_FEATURES_NONE) { |
| 1012 | Slog.e(TAG, "Allowing unknown modality " + modality + " to pass Device Policy check"); |
| 1013 | return false; |
| 1014 | } |
| 1015 | final int devicePolicyDisabledFeatures = |
| 1016 | mDevicePolicyManager.getKeyguardDisabledFeatures(null, effectiveUserId); |
| 1017 | final boolean isBiometricDisabled = |
| 1018 | (biometricToCheck & devicePolicyDisabledFeatures) != 0; |
| 1019 | Slog.w(TAG, "isBiometricDisabledByDevicePolicy(" + modality + "," + effectiveUserId |
| 1020 | + ")=" + isBiometricDisabled); |
| 1021 | return isBiometricDisabled; |
| 1022 | } |
| 1023 | |
| 1024 | /** |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1025 | * Checks if there are any available biometrics, and returns the modality. This method also |
| 1026 | * returns errors through the callback (no biometric feature, hardware not detected, no |
| 1027 | * templates enrolled, etc). This service must not start authentication if errors are sent. |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1028 | * |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 1029 | * @param userId the user to check for |
| 1030 | * @param bundle passed from {@link BiometricPrompt} |
| 1031 | * @param opPackageName see {@link android.app.AppOpsManager} |
| 1032 | * |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1033 | * @return A pair [Modality, Error] with Modality being one of |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1034 | * {@link BiometricAuthenticator#TYPE_NONE}, |
| 1035 | * {@link BiometricAuthenticator#TYPE_FINGERPRINT}, |
| 1036 | * {@link BiometricAuthenticator#TYPE_IRIS}, |
| 1037 | * {@link BiometricAuthenticator#TYPE_FACE} |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1038 | * and the error containing one of the {@link BiometricConstants} errors. |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1039 | * |
| 1040 | * TODO(kchyn): Update this to handle DEVICE_CREDENTIAL better, reduce duplicate code in callers |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1041 | */ |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1042 | private Pair<Integer, Integer> checkAndGetAuthenticators(int userId, Bundle bundle, |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 1043 | String opPackageName, boolean checkDevicePolicyManager) throws RemoteException { |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1044 | if (!Utils.isBiometricAllowed(bundle) |
| 1045 | && Utils.isDeviceCredentialAllowed(bundle) |
| 1046 | && !mTrustManager.isDeviceSecure(userId)) { |
| 1047 | // If only device credential is being checked, and the user doesn't have one set up |
| 1048 | return new Pair<>(TYPE_NONE, BiometricConstants.BIOMETRIC_ERROR_NO_DEVICE_CREDENTIAL); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1049 | } |
| 1050 | |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1051 | // Assuming that authenticators are listed in priority-order, the rest of this function |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1052 | // will attempt to find the first authenticator that's as strong or stronger than the |
| 1053 | // requested strength, available, enrolled, and enabled. The tricky part is returning the |
| 1054 | // correct error. Error strings that are modality-specific should also respect the |
| 1055 | // priority-order. |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1056 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1057 | // Find first authenticator that's strong enough, detected, enrolled, and enabled. |
| 1058 | boolean hasSufficientStrength = false; |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1059 | boolean isHardwareDetected = false; |
| 1060 | boolean hasTemplatesEnrolled = false; |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1061 | boolean enabledForApps = false; |
| 1062 | |
Ilya Matyukhin | 8344b1bf | 2019-09-19 16:46:22 -0700 | [diff] [blame] | 1063 | int modality = TYPE_NONE; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1064 | int firstHwAvailable = TYPE_NONE; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1065 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
Haining Chen | 5c7ed9a | 2019-10-29 11:17:48 -0700 | [diff] [blame] | 1066 | final int actualStrength = authenticator.getActualStrength(); |
Kevin Chyn | d04b43d | 2019-12-13 12:56:41 -0800 | [diff] [blame] | 1067 | final int requestedStrength = Utils.getPublicBiometricStrength(bundle); |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1068 | if (Utils.isAtLeastStrength(actualStrength, requestedStrength)) { |
| 1069 | hasSufficientStrength = true; |
| 1070 | modality = authenticator.modality; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1071 | if (authenticator.impl.isHardwareDetected(opPackageName)) { |
| 1072 | isHardwareDetected = true; |
| 1073 | if (firstHwAvailable == TYPE_NONE) { |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1074 | // Store the first one since we want to return the error in correct |
| 1075 | // priority order. |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1076 | firstHwAvailable = modality; |
| 1077 | } |
| 1078 | if (authenticator.impl.hasEnrolledTemplates(userId, opPackageName)) { |
| 1079 | hasTemplatesEnrolled = true; |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 1080 | // If the device policy manager disables a specific biometric, skip it. |
| 1081 | if (checkDevicePolicyManager && |
| 1082 | isBiometricDisabledByDevicePolicy(modality, userId)) { |
| 1083 | continue; |
| 1084 | } |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1085 | if (isEnabledForApp(modality, userId)) { |
| 1086 | enabledForApps = true; |
| 1087 | break; |
| 1088 | } |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1089 | } |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1090 | } |
| 1091 | } |
| 1092 | } |
| 1093 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1094 | Slog.d(TAG, "checkAndGetAuthenticators: user=" + userId |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 1095 | + " checkDevicePolicyManager=" + checkDevicePolicyManager |
Kevin Chyn | be67ce0 | 2019-06-10 16:14:22 -0700 | [diff] [blame] | 1096 | + " isHardwareDetected=" + isHardwareDetected |
| 1097 | + " hasTemplatesEnrolled=" + hasTemplatesEnrolled |
| 1098 | + " enabledForApps=" + enabledForApps); |
| 1099 | |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1100 | // Check error conditions |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1101 | if (!hasSufficientStrength) { |
| 1102 | return new Pair<>(TYPE_NONE, BiometricConstants.BIOMETRIC_ERROR_HW_NOT_PRESENT); |
| 1103 | } else if (!isHardwareDetected) { |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1104 | return new Pair<>(TYPE_NONE, BiometricConstants.BIOMETRIC_ERROR_HW_UNAVAILABLE); |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1105 | } else if (!hasTemplatesEnrolled) { |
| 1106 | // Return the modality here so the correct error string can be sent. This error is |
| 1107 | // preferred over !enabledForApps |
| 1108 | return new Pair<>(firstHwAvailable, BiometricConstants.BIOMETRIC_ERROR_NO_BIOMETRICS); |
| 1109 | } else if (!enabledForApps) { |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1110 | return new Pair<>(TYPE_NONE, BiometricConstants.BIOMETRIC_ERROR_HW_UNAVAILABLE); |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1111 | } |
| 1112 | |
Kevin Chyn | a8b57ef | 2018-10-25 11:09:23 -0700 | [diff] [blame] | 1113 | return new Pair<>(modality, BiometricConstants.BIOMETRIC_SUCCESS); |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1114 | } |
| 1115 | |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 1116 | private boolean isEnabledForApp(int modality, int userId) { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1117 | switch (modality) { |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1118 | case TYPE_FINGERPRINT: |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1119 | return true; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1120 | case TYPE_IRIS: |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1121 | return true; |
Kevin Chyn | 87f257a | 2018-11-27 16:26:07 -0800 | [diff] [blame] | 1122 | case TYPE_FACE: |
Kevin Chyn | 2170ab7 | 2019-04-03 20:28:28 -0700 | [diff] [blame] | 1123 | return mSettingObserver.getFaceEnabledForApps(userId); |
Kevin Chyn | e741142 | 2018-09-27 17:28:20 -0700 | [diff] [blame] | 1124 | default: |
| 1125 | Slog.w(TAG, "Unsupported modality: " + modality); |
| 1126 | return false; |
| 1127 | } |
| 1128 | } |
| 1129 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1130 | private void logDialogDismissed(int reason) { |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 1131 | if (reason == BiometricPrompt.DISMISSED_REASON_BIOMETRIC_CONFIRMED) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1132 | // Explicit auth, authentication confirmed. |
| 1133 | // Latency in this case is authenticated -> confirmed. <Biometric>Service |
| 1134 | // should have the first half (first acquired -> authenticated). |
| 1135 | final long latency = System.currentTimeMillis() |
| 1136 | - mCurrentAuthSession.mAuthenticatedTimeMs; |
| 1137 | |
| 1138 | if (LoggableMonitor.DEBUG) { |
| 1139 | Slog.v(LoggableMonitor.TAG, "Confirmed! Modality: " + statsModality() |
| 1140 | + ", User: " + mCurrentAuthSession.mUserId |
| 1141 | + ", IsCrypto: " + mCurrentAuthSession.isCrypto() |
| 1142 | + ", Client: " + BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT |
| 1143 | + ", RequireConfirmation: " |
| 1144 | + mCurrentAuthSession.mRequireConfirmation |
| 1145 | + ", State: " + StatsLog.BIOMETRIC_AUTHENTICATED__STATE__CONFIRMED |
| 1146 | + ", Latency: " + latency); |
| 1147 | } |
| 1148 | |
| 1149 | StatsLog.write(StatsLog.BIOMETRIC_AUTHENTICATED, |
| 1150 | statsModality(), |
| 1151 | mCurrentAuthSession.mUserId, |
| 1152 | mCurrentAuthSession.isCrypto(), |
| 1153 | BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, |
| 1154 | mCurrentAuthSession.mRequireConfirmation, |
| 1155 | StatsLog.BIOMETRIC_AUTHENTICATED__STATE__CONFIRMED, |
Kevin Chyn | 4858da4 | 2019-04-11 13:02:56 -0700 | [diff] [blame] | 1156 | latency, |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1157 | mInjector.isDebugEnabled(getContext(), mCurrentAuthSession.mUserId)); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1158 | } else { |
Kevin Chyn | 7fca236 | 2019-06-20 17:20:42 -0700 | [diff] [blame] | 1159 | |
| 1160 | final long latency = System.currentTimeMillis() - mCurrentAuthSession.mStartTimeMs; |
| 1161 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1162 | int error = reason == BiometricPrompt.DISMISSED_REASON_NEGATIVE |
| 1163 | ? BiometricConstants.BIOMETRIC_ERROR_NEGATIVE_BUTTON |
| 1164 | : reason == BiometricPrompt.DISMISSED_REASON_USER_CANCEL |
| 1165 | ? BiometricConstants.BIOMETRIC_ERROR_USER_CANCELED |
| 1166 | : 0; |
| 1167 | if (LoggableMonitor.DEBUG) { |
| 1168 | Slog.v(LoggableMonitor.TAG, "Dismissed! Modality: " + statsModality() |
| 1169 | + ", User: " + mCurrentAuthSession.mUserId |
| 1170 | + ", IsCrypto: " + mCurrentAuthSession.isCrypto() |
| 1171 | + ", Action: " + BiometricsProtoEnums.ACTION_AUTHENTICATE |
| 1172 | + ", Client: " + BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT |
Kevin Chyn | 7fca236 | 2019-06-20 17:20:42 -0700 | [diff] [blame] | 1173 | + ", Error: " + error |
| 1174 | + ", Latency: " + latency); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1175 | } |
| 1176 | // Auth canceled |
| 1177 | StatsLog.write(StatsLog.BIOMETRIC_ERROR_OCCURRED, |
| 1178 | statsModality(), |
| 1179 | mCurrentAuthSession.mUserId, |
| 1180 | mCurrentAuthSession.isCrypto(), |
| 1181 | BiometricsProtoEnums.ACTION_AUTHENTICATE, |
| 1182 | BiometricsProtoEnums.CLIENT_BIOMETRIC_PROMPT, |
| 1183 | error, |
Kevin Chyn | 4858da4 | 2019-04-11 13:02:56 -0700 | [diff] [blame] | 1184 | 0 /* vendorCode */, |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1185 | mInjector.isDebugEnabled(getContext(), mCurrentAuthSession.mUserId), |
Kevin Chyn | 7fca236 | 2019-06-20 17:20:42 -0700 | [diff] [blame] | 1186 | latency); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1187 | } |
| 1188 | } |
| 1189 | |
| 1190 | private int statsModality() { |
| 1191 | int modality = 0; |
| 1192 | if (mCurrentAuthSession == null) { |
| 1193 | return BiometricsProtoEnums.MODALITY_UNKNOWN; |
| 1194 | } |
| 1195 | if ((mCurrentAuthSession.mModality & BiometricAuthenticator.TYPE_FINGERPRINT) |
| 1196 | != 0) { |
| 1197 | modality |= BiometricsProtoEnums.MODALITY_FINGERPRINT; |
| 1198 | } |
| 1199 | if ((mCurrentAuthSession.mModality & BiometricAuthenticator.TYPE_IRIS) != 0) { |
| 1200 | modality |= BiometricsProtoEnums.MODALITY_IRIS; |
| 1201 | } |
| 1202 | if ((mCurrentAuthSession.mModality & BiometricAuthenticator.TYPE_FACE) != 0) { |
| 1203 | modality |= BiometricsProtoEnums.MODALITY_FACE; |
| 1204 | } |
| 1205 | return modality; |
| 1206 | } |
| 1207 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1208 | private void handleAuthenticationSucceeded(boolean requireConfirmation, byte[] token) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1209 | try { |
| 1210 | // Should never happen, log this to catch bad HAL behavior (e.g. auth succeeded |
| 1211 | // after user dismissed/canceled dialog). |
| 1212 | if (mCurrentAuthSession == null) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1213 | Slog.e(TAG, "handleAuthenticationSucceeded: Auth session is null"); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1214 | return; |
| 1215 | } |
| 1216 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1217 | // Store the auth token and submit it to keystore after the dialog is confirmed / |
| 1218 | // animating away. |
| 1219 | mCurrentAuthSession.mTokenEscrow = token; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1220 | if (!requireConfirmation) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1221 | mCurrentAuthSession.mState = STATE_AUTHENTICATED_PENDING_SYSUI; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1222 | } else { |
| 1223 | mCurrentAuthSession.mAuthenticatedTimeMs = System.currentTimeMillis(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1224 | mCurrentAuthSession.mState = STATE_AUTH_PENDING_CONFIRM; |
| 1225 | } |
| 1226 | |
| 1227 | // Notify SysUI that the biometric has been authenticated. SysUI already knows |
| 1228 | // the implicit/explicit state and will react accordingly. |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1229 | mStatusBarService.onBiometricAuthenticated(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1230 | } catch (RemoteException e) { |
| 1231 | Slog.e(TAG, "Remote exception", e); |
| 1232 | } |
| 1233 | } |
| 1234 | |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1235 | private void handleAuthenticationRejected() { |
| 1236 | Slog.v(TAG, "handleAuthenticationRejected()"); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1237 | try { |
| 1238 | // Should never happen, log this to catch bad HAL behavior (e.g. auth succeeded |
| 1239 | // after user dismissed/canceled dialog). |
| 1240 | if (mCurrentAuthSession == null) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1241 | Slog.e(TAG, "handleAuthenticationRejected: Auth session is null"); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1242 | return; |
| 1243 | } |
| 1244 | |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1245 | mStatusBarService.onBiometricError(TYPE_NONE, |
| 1246 | BiometricConstants.BIOMETRIC_PAUSED_REJECTED, 0 /* vendorCode */); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1247 | |
| 1248 | // TODO: This logic will need to be updated if BP is multi-modal |
| 1249 | if ((mCurrentAuthSession.mModality & TYPE_FACE) != 0) { |
| 1250 | // Pause authentication. onBiometricAuthenticated(false) causes the |
| 1251 | // dialog to show a "try again" button for passive modalities. |
| 1252 | mCurrentAuthSession.mState = STATE_AUTH_PAUSED; |
| 1253 | } |
| 1254 | |
| 1255 | mCurrentAuthSession.mClientReceiver.onAuthenticationFailed(); |
| 1256 | } catch (RemoteException e) { |
| 1257 | Slog.e(TAG, "Remote exception", e); |
| 1258 | } |
| 1259 | } |
| 1260 | |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1261 | private void handleAuthenticationTimedOut(int modality, int error, int vendorCode) { |
| 1262 | Slog.v(TAG, String.format("handleAuthenticationTimedOut(%d, %d, %d)", modality, error, |
| 1263 | vendorCode)); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1264 | try { |
| 1265 | // Should never happen, log this to catch bad HAL behavior (e.g. auth succeeded |
| 1266 | // after user dismissed/canceled dialog). |
| 1267 | if (mCurrentAuthSession == null) { |
| 1268 | Slog.e(TAG, "handleAuthenticationTimedOut: Auth session is null"); |
| 1269 | return; |
| 1270 | } |
| 1271 | |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1272 | mStatusBarService.onBiometricError(modality, error, vendorCode); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1273 | mCurrentAuthSession.mState = STATE_AUTH_PAUSED; |
| 1274 | } catch (RemoteException e) { |
| 1275 | Slog.e(TAG, "Remote exception", e); |
| 1276 | } |
| 1277 | } |
| 1278 | |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1279 | private void handleOnError(int cookie, int modality, int error, int vendorCode) { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1280 | Slog.d(TAG, "handleOnError: " + error + " cookie: " + cookie); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1281 | // Errors can either be from the current auth session or the pending auth session. |
| 1282 | // The pending auth session may receive errors such as ERROR_LOCKOUT before |
| 1283 | // it becomes the current auth session. Similarly, the current auth session may |
| 1284 | // receive errors such as ERROR_CANCELED while the pending auth session is preparing |
| 1285 | // to be started. Thus we must match error messages with their cookies to be sure |
| 1286 | // of their intended receivers. |
| 1287 | try { |
| 1288 | if (mCurrentAuthSession != null && mCurrentAuthSession.containsCookie(cookie)) { |
Kevin Chyn | 050315f | 2019-08-08 14:22:54 -0700 | [diff] [blame] | 1289 | mCurrentAuthSession.mErrorEscrow = error; |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1290 | mCurrentAuthSession.mVendorCodeEscrow = vendorCode; |
Kevin Chyn | 050315f | 2019-08-08 14:22:54 -0700 | [diff] [blame] | 1291 | |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1292 | if (mCurrentAuthSession.mState == STATE_AUTH_STARTED) { |
Kevin Chyn | 8429da2 | 2019-09-24 12:42:35 -0700 | [diff] [blame] | 1293 | final boolean errorLockout = error == BiometricConstants.BIOMETRIC_ERROR_LOCKOUT |
| 1294 | || error == BiometricConstants.BIOMETRIC_ERROR_LOCKOUT_PERMANENT; |
| 1295 | if (mCurrentAuthSession.isAllowDeviceCredential() && errorLockout) { |
| 1296 | // SystemUI handles transition from biometric to device credential. |
| 1297 | mCurrentAuthSession.mState = STATE_SHOWING_DEVICE_CREDENTIAL; |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1298 | mStatusBarService.onBiometricError(modality, error, vendorCode); |
Kevin Chyn | 2291072 | 2019-12-13 16:57:51 -0800 | [diff] [blame] | 1299 | } else if (error == BiometricConstants.BIOMETRIC_ERROR_CANCELED) { |
| 1300 | mStatusBarService.hideAuthenticationDialog(); |
| 1301 | // TODO: If multiple authenticators are simultaneously running, this will |
| 1302 | // need to be modified. Send the error to the client here, instead of doing |
| 1303 | // a round trip to SystemUI. |
| 1304 | mCurrentAuthSession.mClientReceiver.onError(modality, error, vendorCode); |
| 1305 | mCurrentAuthSession = null; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1306 | } else { |
Kevin Chyn | 8429da2 | 2019-09-24 12:42:35 -0700 | [diff] [blame] | 1307 | mCurrentAuthSession.mState = STATE_ERROR_PENDING_SYSUI; |
Kevin Chyn | 2291072 | 2019-12-13 16:57:51 -0800 | [diff] [blame] | 1308 | mStatusBarService.onBiometricError(modality, error, vendorCode); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1309 | } |
| 1310 | } else if (mCurrentAuthSession.mState == STATE_AUTH_PAUSED) { |
| 1311 | // In the "try again" state, we should forward canceled errors to |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1312 | // the client and and clean up. The only error we should get here is |
| 1313 | // ERROR_CANCELED due to another client kicking us out. |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1314 | mCurrentAuthSession.mClientReceiver.onError(modality, error, vendorCode); |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1315 | mStatusBarService.hideAuthenticationDialog(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1316 | mCurrentAuthSession = null; |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 1317 | } else if (mCurrentAuthSession.mState == STATE_SHOWING_DEVICE_CREDENTIAL) { |
| 1318 | Slog.d(TAG, "Biometric canceled, ignoring from state: " |
| 1319 | + mCurrentAuthSession.mState); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1320 | } else { |
| 1321 | Slog.e(TAG, "Impossible session error state: " |
| 1322 | + mCurrentAuthSession.mState); |
| 1323 | } |
| 1324 | } else if (mPendingAuthSession != null |
| 1325 | && mPendingAuthSession.containsCookie(cookie)) { |
| 1326 | if (mPendingAuthSession.mState == STATE_AUTH_CALLED) { |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1327 | // If any error is received while preparing the auth session (lockout, etc), |
| 1328 | // and if device credential is allowed, just show the credential UI. |
| 1329 | if (mPendingAuthSession.isAllowDeviceCredential()) { |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 1330 | @Authenticators.Types int authenticators = |
| 1331 | mPendingAuthSession.mBundle.getInt( |
| 1332 | BiometricPrompt.KEY_AUTHENTICATORS_ALLOWED, 0); |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1333 | // Disallow biometric and notify SystemUI to show the authentication prompt. |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 1334 | authenticators &= ~Authenticators.BIOMETRIC_WEAK; |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1335 | mPendingAuthSession.mBundle.putInt( |
| 1336 | BiometricPrompt.KEY_AUTHENTICATORS_ALLOWED, |
| 1337 | authenticators); |
| 1338 | |
| 1339 | mCurrentAuthSession = mPendingAuthSession; |
| 1340 | mCurrentAuthSession.mState = STATE_SHOWING_DEVICE_CREDENTIAL; |
| 1341 | mPendingAuthSession = null; |
| 1342 | |
| 1343 | mStatusBarService.showAuthenticationDialog( |
| 1344 | mCurrentAuthSession.mBundle, |
| 1345 | mInternalReceiver, |
| 1346 | 0 /* biometricModality */, |
| 1347 | false /* requireConfirmation */, |
| 1348 | mCurrentAuthSession.mUserId, |
| 1349 | mCurrentAuthSession.mOpPackageName); |
| 1350 | } else { |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1351 | mPendingAuthSession.mClientReceiver.onError(modality, error, vendorCode); |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1352 | mPendingAuthSession = null; |
| 1353 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1354 | } else { |
| 1355 | Slog.e(TAG, "Impossible pending session error state: " |
| 1356 | + mPendingAuthSession.mState); |
| 1357 | } |
Kevin Chyn | 8429da2 | 2019-09-24 12:42:35 -0700 | [diff] [blame] | 1358 | } else { |
| 1359 | Slog.e(TAG, "Unknown cookie: " + cookie); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1360 | } |
| 1361 | } catch (RemoteException e) { |
| 1362 | Slog.e(TAG, "Remote exception", e); |
| 1363 | } |
| 1364 | } |
| 1365 | |
| 1366 | private void handleOnAcquired(int acquiredInfo, String message) { |
| 1367 | // Should never happen, log this to catch bad HAL behavior (e.g. auth succeeded |
| 1368 | // after user dismissed/canceled dialog). |
| 1369 | if (mCurrentAuthSession == null) { |
| 1370 | Slog.e(TAG, "onAcquired(): Auth session is null"); |
| 1371 | return; |
| 1372 | } |
| 1373 | |
| 1374 | if (acquiredInfo != BiometricConstants.BIOMETRIC_ACQUIRED_GOOD) { |
Kevin Chyn | 3b53d6f | 2019-05-01 11:49:05 -0700 | [diff] [blame] | 1375 | if (message == null) { |
| 1376 | Slog.w(TAG, "Ignoring null message: " + acquiredInfo); |
| 1377 | return; |
| 1378 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1379 | try { |
| 1380 | mStatusBarService.onBiometricHelp(message); |
| 1381 | } catch (RemoteException e) { |
| 1382 | Slog.e(TAG, "Remote exception", e); |
| 1383 | } |
| 1384 | } |
| 1385 | } |
| 1386 | |
| 1387 | private void handleOnDismissed(int reason) { |
| 1388 | if (mCurrentAuthSession == null) { |
Kevin Chyn | c53d981 | 2019-07-30 18:10:30 -0700 | [diff] [blame] | 1389 | Slog.e(TAG, "onDismissed: " + reason + ", auth session null"); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1390 | return; |
| 1391 | } |
| 1392 | |
| 1393 | logDialogDismissed(reason); |
| 1394 | |
| 1395 | try { |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1396 | switch (reason) { |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 1397 | case BiometricPrompt.DISMISSED_REASON_CREDENTIAL_CONFIRMED: |
| 1398 | case BiometricPrompt.DISMISSED_REASON_BIOMETRIC_CONFIRMED: |
| 1399 | case BiometricPrompt.DISMISSED_REASON_BIOMETRIC_CONFIRM_NOT_REQUIRED: |
| 1400 | if (mCurrentAuthSession.mTokenEscrow != null) { |
| 1401 | mKeyStore.addAuthToken(mCurrentAuthSession.mTokenEscrow); |
| 1402 | } |
Curtis Belmonte | 6601bc3 | 2020-01-09 17:46:31 -0800 | [diff] [blame] | 1403 | mCurrentAuthSession.mClientReceiver.onAuthenticationSucceeded( |
| 1404 | Utils.getAuthenticationTypeForResult(reason)); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1405 | break; |
| 1406 | |
| 1407 | case BiometricPrompt.DISMISSED_REASON_NEGATIVE: |
| 1408 | mCurrentAuthSession.mClientReceiver.onDialogDismissed(reason); |
| 1409 | // Cancel authentication. Skip the token/package check since we are cancelling |
| 1410 | // from system server. The interface is permission protected so this is fine. |
| 1411 | cancelInternal(null /* token */, null /* package */, false /* fromClient */); |
| 1412 | break; |
| 1413 | |
| 1414 | case BiometricPrompt.DISMISSED_REASON_USER_CANCEL: |
| 1415 | mCurrentAuthSession.mClientReceiver.onError( |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1416 | mCurrentAuthSession.mModality, |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1417 | BiometricConstants.BIOMETRIC_ERROR_USER_CANCELED, |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1418 | 0 /* vendorCode */ |
| 1419 | ); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1420 | // Cancel authentication. Skip the token/package check since we are cancelling |
| 1421 | // from system server. The interface is permission protected so this is fine. |
| 1422 | cancelInternal(null /* token */, null /* package */, false /* fromClient */); |
| 1423 | break; |
| 1424 | |
Kevin Chyn | 050315f | 2019-08-08 14:22:54 -0700 | [diff] [blame] | 1425 | case BiometricPrompt.DISMISSED_REASON_SERVER_REQUESTED: |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1426 | case BiometricPrompt.DISMISSED_REASON_ERROR: |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1427 | mCurrentAuthSession.mClientReceiver.onError( |
| 1428 | mCurrentAuthSession.mModality, |
| 1429 | mCurrentAuthSession.mErrorEscrow, |
| 1430 | mCurrentAuthSession.mVendorCodeEscrow |
| 1431 | ); |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1432 | break; |
| 1433 | |
| 1434 | default: |
| 1435 | Slog.w(TAG, "Unhandled reason: " + reason); |
| 1436 | break; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1437 | } |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 1438 | |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1439 | // Dialog is gone, auth session is done. |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1440 | mCurrentAuthSession = null; |
| 1441 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1442 | } catch (RemoteException e) { |
| 1443 | Slog.e(TAG, "Remote exception", e); |
| 1444 | } |
| 1445 | } |
| 1446 | |
| 1447 | private void handleOnTryAgainPressed() { |
| 1448 | Slog.d(TAG, "onTryAgainPressed"); |
| 1449 | // No need to check permission, since it can only be invoked by SystemUI |
| 1450 | // (or system server itself). |
| 1451 | authenticateInternal(mCurrentAuthSession.mToken, |
| 1452 | mCurrentAuthSession.mSessionId, |
| 1453 | mCurrentAuthSession.mUserId, |
| 1454 | mCurrentAuthSession.mClientReceiver, |
| 1455 | mCurrentAuthSession.mOpPackageName, |
| 1456 | mCurrentAuthSession.mBundle, |
| 1457 | mCurrentAuthSession.mCallingUid, |
| 1458 | mCurrentAuthSession.mCallingPid, |
| 1459 | mCurrentAuthSession.mCallingUserId, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1460 | mCurrentAuthSession.mModality); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1461 | } |
| 1462 | |
Kevin Chyn | ff168dc | 2019-09-16 16:04:38 -0700 | [diff] [blame] | 1463 | private void handleOnDeviceCredentialPressed() { |
| 1464 | Slog.d(TAG, "onDeviceCredentialPressed"); |
| 1465 | if (mCurrentAuthSession == null) { |
| 1466 | Slog.e(TAG, "Auth session null"); |
| 1467 | return; |
| 1468 | } |
| 1469 | |
| 1470 | // Cancel authentication. Skip the token/package check since we are cancelling |
| 1471 | // from system server. The interface is permission protected so this is fine. |
| 1472 | cancelInternal(null /* token */, null /* package */, false /* fromClient */); |
| 1473 | |
| 1474 | mCurrentAuthSession.mState = STATE_SHOWING_DEVICE_CREDENTIAL; |
| 1475 | } |
| 1476 | |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1477 | /** |
| 1478 | * Invoked when each service has notified that its client is ready to be started. When |
| 1479 | * all biometrics are ready, this invokes the SystemUI dialog through StatusBar. |
| 1480 | */ |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1481 | private void handleOnReadyForAuthentication(int cookie, boolean requireConfirmation, |
| 1482 | int userId) { |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1483 | if (mPendingAuthSession == null) { |
| 1484 | // Only should happen if a biometric was locked out when authenticate() was invoked. |
| 1485 | // In that case, if device credentials are allowed, the UI is already showing. If not |
| 1486 | // allowed, the error has already been returned to the caller. |
| 1487 | Slog.w(TAG, "Pending auth session null"); |
| 1488 | return; |
| 1489 | } |
| 1490 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1491 | Iterator it = mPendingAuthSession.mModalitiesWaiting.entrySet().iterator(); |
| 1492 | while (it.hasNext()) { |
| 1493 | Map.Entry<Integer, Integer> pair = (Map.Entry) it.next(); |
| 1494 | if (pair.getValue() == cookie) { |
| 1495 | mPendingAuthSession.mModalitiesMatched.put(pair.getKey(), pair.getValue()); |
| 1496 | mPendingAuthSession.mModalitiesWaiting.remove(pair.getKey()); |
| 1497 | Slog.d(TAG, "Matched cookie: " + cookie + ", " |
| 1498 | + mPendingAuthSession.mModalitiesWaiting.size() + " remaining"); |
| 1499 | break; |
| 1500 | } |
| 1501 | } |
| 1502 | |
| 1503 | if (mPendingAuthSession.mModalitiesWaiting.isEmpty()) { |
| 1504 | final boolean continuing = mCurrentAuthSession != null |
| 1505 | && mCurrentAuthSession.mState == STATE_AUTH_PAUSED; |
| 1506 | |
| 1507 | mCurrentAuthSession = mPendingAuthSession; |
Kevin Chyn | 7fca236 | 2019-06-20 17:20:42 -0700 | [diff] [blame] | 1508 | |
| 1509 | // Time starts when lower layers are ready to start the client. |
| 1510 | mCurrentAuthSession.mStartTimeMs = System.currentTimeMillis(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1511 | mPendingAuthSession = null; |
| 1512 | |
| 1513 | mCurrentAuthSession.mState = STATE_AUTH_STARTED; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1514 | int modality = TYPE_NONE; |
| 1515 | it = mCurrentAuthSession.mModalitiesMatched.entrySet().iterator(); |
| 1516 | while (it.hasNext()) { |
| 1517 | Map.Entry<Integer, Integer> pair = (Map.Entry) it.next(); |
| 1518 | boolean foundAuthenticator = false; |
| 1519 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
| 1520 | if (authenticator.modality == pair.getKey()) { |
| 1521 | foundAuthenticator = true; |
| 1522 | try { |
| 1523 | authenticator.impl.startPreparedClient(pair.getValue()); |
| 1524 | } catch (RemoteException e) { |
| 1525 | Slog.e(TAG, "Remote exception", e); |
| 1526 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1527 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1528 | } |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1529 | if (!foundAuthenticator) { |
| 1530 | Slog.e(TAG, "Unknown modality: " + pair.getKey()); |
| 1531 | } |
| 1532 | modality |= pair.getKey(); |
| 1533 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1534 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1535 | if (!continuing) { |
| 1536 | try { |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1537 | mStatusBarService.showAuthenticationDialog(mCurrentAuthSession.mBundle, |
Kevin Chyn | 050315f | 2019-08-08 14:22:54 -0700 | [diff] [blame] | 1538 | mInternalReceiver, modality, requireConfirmation, userId, |
| 1539 | mCurrentAuthSession.mOpPackageName); |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1540 | } catch (RemoteException e) { |
| 1541 | Slog.e(TAG, "Remote exception", e); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1542 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1543 | } |
| 1544 | } |
| 1545 | } |
| 1546 | |
| 1547 | private void handleAuthenticate(IBinder token, long sessionId, int userId, |
| 1548 | IBiometricServiceReceiver receiver, String opPackageName, Bundle bundle, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1549 | int callingUid, int callingPid, int callingUserId) { |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1550 | |
| 1551 | mHandler.post(() -> { |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1552 | int modality = TYPE_NONE; |
| 1553 | int result; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1554 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1555 | try { |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 1556 | final boolean checkDevicePolicyManager = bundle.getBoolean( |
| 1557 | BiometricPrompt.EXTRA_DISALLOW_BIOMETRICS_IF_POLICY_EXISTS, false); |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1558 | final Pair<Integer, Integer> pair = checkAndGetAuthenticators(userId, bundle, |
joshmccloskey | 15c0a44 | 2019-10-18 16:09:06 -0700 | [diff] [blame] | 1559 | opPackageName, checkDevicePolicyManager); |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1560 | modality = pair.first; |
| 1561 | result = pair.second; |
| 1562 | } catch (RemoteException e) { |
| 1563 | Slog.e(TAG, "Remote exception", e); |
| 1564 | result = BiometricConstants.BIOMETRIC_ERROR_HW_UNAVAILABLE; |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1565 | } |
| 1566 | |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1567 | try { |
| 1568 | if (result == BiometricConstants.BIOMETRIC_ERROR_NO_DEVICE_CREDENTIAL) { |
| 1569 | // If the app allowed device credential but the user hasn't set it up yet, |
| 1570 | // return this error. |
| 1571 | receiver.onError(modality, result, 0 /* vendorCode */); |
| 1572 | } else if (result != BiometricConstants.BIOMETRIC_SUCCESS) { |
| 1573 | if (Utils.isDeviceCredentialAllowed(bundle)) { |
| 1574 | // If there's a problem with biometrics but device credential is allowed, |
| 1575 | // only show credential UI. |
| 1576 | bundle.putInt(BiometricPrompt.KEY_AUTHENTICATORS_ALLOWED, |
| 1577 | Authenticators.DEVICE_CREDENTIAL); |
| 1578 | authenticateInternal(token, sessionId, userId, receiver, opPackageName, |
| 1579 | bundle, callingUid, callingPid, callingUserId, modality); |
| 1580 | } else { |
| 1581 | receiver.onError(modality, result, 0 /* vendorCode */); |
| 1582 | } |
| 1583 | } else { |
| 1584 | // BIOMETRIC_SUCCESS, proceed to authentication |
| 1585 | authenticateInternal(token, sessionId, userId, receiver, opPackageName, bundle, |
| 1586 | callingUid, callingPid, callingUserId, modality); |
| 1587 | } |
| 1588 | } catch (RemoteException e) { |
| 1589 | Slog.e(TAG, "Remote exception", e); |
| 1590 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1591 | }); |
| 1592 | } |
| 1593 | |
| 1594 | /** |
Ilya Matyukhin | 8344b1bf | 2019-09-19 16:46:22 -0700 | [diff] [blame] | 1595 | * handleAuthenticate() (above) which is called from BiometricPrompt determines which |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1596 | * modality/modalities to start authenticating with. authenticateInternal() should only be |
| 1597 | * used for: |
| 1598 | * 1) Preparing <Biometric>Services for authentication when BiometricPrompt#authenticate is, |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1599 | * invoked, shortly after which BiometricPrompt is shown and authentication starts |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1600 | * 2) Preparing <Biometric>Services for authentication when BiometricPrompt is already shown |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1601 | * and the user has pressed "try again" |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1602 | */ |
| 1603 | private void authenticateInternal(IBinder token, long sessionId, int userId, |
| 1604 | IBiometricServiceReceiver receiver, String opPackageName, Bundle bundle, |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1605 | int callingUid, int callingPid, int callingUserId, int modality) { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1606 | boolean requireConfirmation = bundle.getBoolean( |
| 1607 | BiometricPrompt.KEY_REQUIRE_CONFIRMATION, true /* default */); |
| 1608 | if ((modality & TYPE_FACE) != 0) { |
| 1609 | // Check if the user has forced confirmation to be required in Settings. |
| 1610 | requireConfirmation = requireConfirmation |
| 1611 | || mSettingObserver.getFaceAlwaysRequireConfirmation(userId); |
| 1612 | } |
| 1613 | // Generate random cookies to pass to the services that should prepare to start |
| 1614 | // authenticating. Store the cookie here and wait for all services to "ack" |
| 1615 | // with the cookie. Once all cookies are received, we can show the prompt |
| 1616 | // and let the services start authenticating. The cookie should be non-zero. |
| 1617 | final int cookie = mRandom.nextInt(Integer.MAX_VALUE - 1) + 1; |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 1618 | final @Authenticators.Types int authenticators = bundle.getInt( |
| 1619 | BiometricPrompt.KEY_AUTHENTICATORS_ALLOWED, 0); |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1620 | Slog.d(TAG, "Creating auth session. Modality: " + modality |
| 1621 | + ", cookie: " + cookie |
| 1622 | + ", authenticators: " + authenticators); |
| 1623 | final HashMap<Integer, Integer> modalities = new HashMap<>(); |
| 1624 | |
| 1625 | // If it's only device credential, we don't need to wait - LockSettingsService is |
| 1626 | // always ready to check credential (SystemUI invokes that path). |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 1627 | if ((authenticators & ~Authenticators.DEVICE_CREDENTIAL) != 0) { |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1628 | modalities.put(modality, cookie); |
| 1629 | } |
| 1630 | mPendingAuthSession = new AuthSession(modalities, token, sessionId, userId, |
| 1631 | receiver, opPackageName, bundle, callingUid, callingPid, callingUserId, |
| 1632 | modality, requireConfirmation); |
| 1633 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1634 | try { |
Curtis Belmonte | 13eb581 | 2019-10-22 14:17:30 -0700 | [diff] [blame] | 1635 | if (authenticators == Authenticators.DEVICE_CREDENTIAL) { |
Kevin Chyn | c70d6b8 | 2019-10-03 15:32:37 -0700 | [diff] [blame] | 1636 | mPendingAuthSession.mState = STATE_SHOWING_DEVICE_CREDENTIAL; |
| 1637 | mCurrentAuthSession = mPendingAuthSession; |
| 1638 | mPendingAuthSession = null; |
| 1639 | |
| 1640 | mStatusBarService.showAuthenticationDialog( |
| 1641 | mCurrentAuthSession.mBundle, |
| 1642 | mInternalReceiver, |
| 1643 | 0 /* biometricModality */, |
| 1644 | false /* requireConfirmation */, |
| 1645 | mCurrentAuthSession.mUserId, |
| 1646 | mCurrentAuthSession.mOpPackageName); |
| 1647 | } else { |
| 1648 | mPendingAuthSession.mState = STATE_AUTH_CALLED; |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1649 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
Ilya Matyukhin | 30f1dd8 | 2019-11-18 18:08:56 -0800 | [diff] [blame] | 1650 | // TODO(b/141025588): use ids instead of modalities to avoid ambiguity. |
| 1651 | if (authenticator.modality == modality) { |
| 1652 | authenticator.impl.prepareForAuthentication(requireConfirmation, token, |
| 1653 | sessionId, userId, mInternalReceiver, opPackageName, cookie, |
| 1654 | callingUid, callingPid, callingUserId); |
| 1655 | break; |
| 1656 | } |
Kevin Chyn | c70d6b8 | 2019-10-03 15:32:37 -0700 | [diff] [blame] | 1657 | } |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1658 | } |
| 1659 | } catch (RemoteException e) { |
| 1660 | Slog.e(TAG, "Unable to start authentication", e); |
| 1661 | } |
| 1662 | } |
| 1663 | |
| 1664 | private void handleCancelAuthentication(IBinder token, String opPackageName) { |
| 1665 | if (token == null || opPackageName == null) { |
| 1666 | Slog.e(TAG, "Unable to cancel, one or more null arguments"); |
| 1667 | return; |
| 1668 | } |
| 1669 | |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1670 | if (mCurrentAuthSession != null && mCurrentAuthSession.mState != STATE_AUTH_STARTED) { |
Kevin Chyn | 5a90a65 | 2019-03-25 18:11:16 -0700 | [diff] [blame] | 1671 | // We need to check the current authenticators state. If we're pending confirm |
| 1672 | // or idle, we need to dismiss the dialog and send an ERROR_CANCELED to the client, |
| 1673 | // since we won't be getting an onError from the driver. |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1674 | try { |
| 1675 | // Send error to client |
| 1676 | mCurrentAuthSession.mClientReceiver.onError( |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1677 | mCurrentAuthSession.mModality, |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1678 | BiometricConstants.BIOMETRIC_ERROR_CANCELED, |
Ilya Matyukhin | 0f9da35 | 2019-10-03 14:10:01 -0700 | [diff] [blame] | 1679 | 0 /* vendorCode */ |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1680 | ); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1681 | mCurrentAuthSession = null; |
Kevin Chyn | 86f1b8e | 2019-09-24 19:00:49 -0700 | [diff] [blame] | 1682 | mStatusBarService.hideAuthenticationDialog(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1683 | } catch (RemoteException e) { |
| 1684 | Slog.e(TAG, "Remote exception", e); |
| 1685 | } |
| 1686 | } else { |
joshmccloskey | 568d329 | 2019-09-17 14:02:23 -0700 | [diff] [blame] | 1687 | cancelInternal(token, opPackageName, true /* fromClient */); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1688 | } |
| 1689 | } |
| 1690 | |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1691 | void cancelInternal(IBinder token, String opPackageName, boolean fromClient) { |
| 1692 | final int callingUid = Binder.getCallingUid(); |
| 1693 | final int callingPid = Binder.getCallingPid(); |
| 1694 | final int callingUserId = UserHandle.getCallingUserId(); |
Kevin Chyn | 84c2f5e | 2019-03-16 13:05:16 -0700 | [diff] [blame] | 1695 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1696 | if (mCurrentAuthSession == null) { |
| 1697 | Slog.w(TAG, "Skipping cancelInternal"); |
| 1698 | return; |
| 1699 | } else if (mCurrentAuthSession.mState != STATE_AUTH_STARTED) { |
| 1700 | Slog.w(TAG, "Skipping cancelInternal, state: " + mCurrentAuthSession.mState); |
| 1701 | return; |
| 1702 | } |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1703 | |
Ilya Matyukhin | f2da1a1 | 2019-09-25 15:31:03 -0700 | [diff] [blame] | 1704 | // TODO: For multiple modalities, send a single ERROR_CANCELED only when all |
| 1705 | // drivers have canceled authentication. |
| 1706 | for (AuthenticatorWrapper authenticator : mAuthenticators) { |
| 1707 | if ((authenticator.modality & mCurrentAuthSession.mModality) != 0) { |
| 1708 | try { |
| 1709 | authenticator.impl.cancelAuthenticationFromService(token, opPackageName, |
| 1710 | callingUid, callingPid, callingUserId, fromClient); |
| 1711 | } catch (RemoteException e) { |
| 1712 | Slog.e(TAG, "Unable to cancel authentication"); |
| 1713 | } |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1714 | } |
Kevin Chyn | 9f8b2fc | 2019-08-02 18:24:32 -0700 | [diff] [blame] | 1715 | } |
| 1716 | } |
Kevin Chyn | a24e9fd | 2018-08-27 12:39:17 -0700 | [diff] [blame] | 1717 | } |