Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | package android.service.gatekeeper; |
| 18 | |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 19 | import android.service.gatekeeper.GateKeeperResponse; |
| 20 | |
Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 21 | /** |
| 22 | * Interface for communication with GateKeeper, the |
| 23 | * secure password storage daemon. |
| 24 | * |
| 25 | * This must be kept manually in sync with system/core/gatekeeperd |
| 26 | * until AIDL can generate both C++ and Java bindings. |
| 27 | * |
| 28 | * @hide |
| 29 | */ |
| 30 | interface IGateKeeperService { |
| 31 | /** |
| 32 | * Enrolls a password, returning the handle to the enrollment to be stored locally. |
| 33 | * @param uid The Android user ID associated to this enrollment |
| 34 | * @param currentPasswordHandle The previously enrolled handle, or null if none |
| 35 | * @param currentPassword The previously enrolled plaintext password, or null if none. |
| 36 | * If provided, must verify against the currentPasswordHandle. |
| 37 | * @param desiredPassword The new desired password, for which a handle will be returned |
| 38 | * upon success. |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 39 | * @return an EnrollResponse or null on failure |
Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 40 | */ |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 41 | GateKeeperResponse enroll(int uid, in byte[] currentPasswordHandle, in byte[] currentPassword, |
Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 42 | in byte[] desiredPassword); |
| 43 | |
| 44 | /** |
| 45 | * Verifies an enrolled handle against a provided, plaintext blob. |
| 46 | * @param uid The Android user ID associated to this enrollment |
| 47 | * @param enrolledPasswordHandle The handle against which the provided password will be |
| 48 | * verified. |
| 49 | * @param The plaintext blob to verify against enrolledPassword. |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 50 | * @return a VerifyResponse, or null on failure. |
Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 51 | */ |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 52 | GateKeeperResponse verify(int uid, in byte[] enrolledPasswordHandle, in byte[] providedPassword); |
| 53 | |
Andres Morales | d9fc85a | 2015-04-09 19:14:42 -0700 | [diff] [blame] | 54 | /** |
| 55 | * Verifies an enrolled handle against a provided, plaintext blob. |
| 56 | * @param uid The Android user ID associated to this enrollment |
| 57 | * @param challenge a challenge to authenticate agaisnt the device credential. If successful |
Andres Morales | ca38add | 2015-04-16 13:03:42 -0700 | [diff] [blame] | 58 | * authentication occurs, this value will be written to the returned |
Andres Morales | d9fc85a | 2015-04-09 19:14:42 -0700 | [diff] [blame] | 59 | * authentication attestation. |
| 60 | * @param enrolledPasswordHandle The handle against which the provided password will be |
| 61 | * verified. |
| 62 | * @param The plaintext blob to verify against enrolledPassword. |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 63 | * @return a VerifyResponse with an attestation, or null on failure. |
Andres Morales | d9fc85a | 2015-04-09 19:14:42 -0700 | [diff] [blame] | 64 | */ |
Andres Morales | 2397427 | 2015-05-14 22:42:26 -0700 | [diff] [blame] | 65 | GateKeeperResponse verifyChallenge(int uid, long challenge, in byte[] enrolledPasswordHandle, |
Andres Morales | d9fc85a | 2015-04-09 19:14:42 -0700 | [diff] [blame] | 66 | in byte[] providedPassword); |
Andres Morales | ca38add | 2015-04-16 13:03:42 -0700 | [diff] [blame] | 67 | |
| 68 | /** |
| 69 | * Retrieves the secure identifier for the user with the provided Android ID, |
| 70 | * or 0 if none is found. |
| 71 | * @param uid the Android user id |
| 72 | */ |
| 73 | long getSecureUserId(int uid); |
Andres Morales | cfb6160 | 2015-04-16 16:31:15 -0700 | [diff] [blame] | 74 | |
| 75 | /** |
| 76 | * Clears secure user id associated with the provided Android ID. |
| 77 | * Must be called when password is set to NONE. |
| 78 | * @param uid the Android user id. |
| 79 | */ |
| 80 | void clearSecureUserId(int uid); |
Adrian Roos | 7374d3a | 2017-03-31 14:14:53 -0700 | [diff] [blame] | 81 | |
| 82 | /** |
| 83 | * Notifies gatekeeper that device setup has been completed and any potentially still existing |
| 84 | * state from before a factory reset can be cleaned up (if it has not been already). |
| 85 | */ |
| 86 | void reportDeviceSetupComplete(); |
Andres Morales | 8fa5665 | 2015-03-31 09:19:50 -0700 | [diff] [blame] | 87 | } |