From 2e5155fb75de4f02447b631969741cbae6132eef Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Wed, 17 Jun 2026 11:34:22 +0100 Subject: [PATCH] fix(keystore): serve getKeyEntry for skipped UIDs Un-targeted privileged callers (e.g. KeyAttestation via Shizuku) have their attest-key and device-id generateKey requests force-forged, but getKeyEntry blanket-skipped those UIDs before the owned-key lookup, so the framework's attestKeyAlias resolution in AndroidKeyStoreKeyPairGeneratorSpi.initialize() returned KEY_NOT_FOUND and surfaced as "Invalid attestKeyAlias". Let getKeyEntry reach the owned-key lookup for skipped UIDs; a non-owned key still skips post-processing so an un-targeted app's real key is never patched. --- .../interception/keystore/Keystore2Interceptor.kt | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt index 19d13b1..aba7f67 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt @@ -254,7 +254,9 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() { return InterceptorUtils.createTypedObjectReply(response) } - if (ConfigurationManager.shouldSkipUid(callingUid)) + // generateKey force-forges attest/device-id keys even for skipped UIDs; getKeyEntry + // must serve them back or the framework's attestKeyAlias lookup gets KEY_NOT_FOUND. + if (code != GET_KEY_ENTRY_TRANSACTION && ConfigurationManager.shouldSkipUid(callingUid)) return TransactionResult.ContinueAndSkipPost if (code == DELETE_KEY_TRANSACTION) { @@ -341,7 +343,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() { ) return InterceptorUtils.createErrorReply(RESPONSE_KEY_NOT_FOUND) } - return TransactionResult.Continue + // Owned keys were served above; for a skipped UID a non-owned key must still skip + // post-processing so we never patch an un-targeted app's real key. + return if (ConfigurationManager.shouldSkipUid(callingUid)) + TransactionResult.ContinueAndSkipPost + else TransactionResult.Continue } if (KeyMintSecurityLevelInterceptor.isAttestationKey(keyId))