From 77462cb42a94e36db8d936af6e96c5a4c116f9e0 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Thu, 19 Mar 2026 07:33:47 +0100 Subject: [PATCH] feat(config): add SELinux permission checks, latency simulation, and hbk seed ConfigurationManager gains checkSELinuxPermission (reads /proc/pid/attr) and hasPermissionForUid (delegates to IPackageManager.checkPermission) for AOSP-compliant access control. TeeLatencySimulator provides log-normal distribution matching real QTEE/Trustonic hardware timing profiles. Module customize.sh now generates a device-unique hardware-bound key seed (32 bytes from /dev/random) and clears stale tee_status.txt on install. --- .../config/ConfigurationManager.kt | 24 ++++++- .../TEESimulator/util/TeeLatencySimulator.kt | 64 +++++++++++++++++++ module/customize.sh | 7 ++ .../android/content/pm/IPackageManager.java | 2 + stub/src/main/java/android/os/SELinux.java | 8 +++ .../main/java/android/os/ServiceManager.java | 4 ++ 6 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 app/src/main/java/org/matrix/TEESimulator/util/TeeLatencySimulator.kt create mode 100644 stub/src/main/java/android/os/SELinux.java diff --git a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt index 8d73e11..4d4b8a5 100644 --- a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt +++ b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt @@ -360,7 +360,29 @@ object ConfigurationManager { return iPackageManager } - /** Retrieves the package names associated with a UID. */ + fun checkSELinuxPermission(callingPid: Int, tclass: String, perm: String): Boolean { + return try { + val callerCtx = + java.io.File("/proc/$callingPid/attr/current").readText().trim('\u0000', ' ', '\n') + val selfCtx = + java.io.File("/proc/self/attr/current").readText().trim('\u0000', ' ', '\n') + android.os.SELinux.checkSELinuxAccess(callerCtx, selfCtx, tclass, perm) + } catch (_: Exception) { + false + } + } + + fun hasPermissionForUid(uid: Int, permission: String): Boolean { + val userId = uid / 100000 + return getPackagesForUid(uid).any { pkg -> + try { + getPackageManager()?.checkPermission(permission, pkg, userId) == 0 + } catch (_: Exception) { + false + } + } + } + fun getPackagesForUid(uid: Int): Array { return uidToPackagesCache.getOrPut(uid) { try { diff --git a/app/src/main/java/org/matrix/TEESimulator/util/TeeLatencySimulator.kt b/app/src/main/java/org/matrix/TEESimulator/util/TeeLatencySimulator.kt new file mode 100644 index 0000000..33f9952 --- /dev/null +++ b/app/src/main/java/org/matrix/TEESimulator/util/TeeLatencySimulator.kt @@ -0,0 +1,64 @@ +package org.matrix.TEESimulator.util + +import android.hardware.security.keymint.Algorithm +import java.security.SecureRandom +import java.util.concurrent.locks.LockSupport +import kotlin.math.abs +import kotlin.math.exp +import kotlin.math.ln +import kotlin.math.max + +object TeeLatencySimulator { + + private val rng = SecureRandom() + + private val sessionBiasMs: Double by lazy { rng.nextGaussian() * 5.0 } + private val coldPenaltyMs: Double by lazy { abs(rng.nextGaussian() * 12.0) } + + @Volatile private var firstCall = true + + fun simulateGenerateKeyDelay(algorithm: Int, elapsedNanos: Long) { + val elapsedMs = elapsedNanos / 1_000_000.0 + val targetMs = sampleTotalDelay(algorithm) + val remainingMs = targetMs - elapsedMs + + if (remainingMs > 1.0) { + LockSupport.parkNanos((remainingMs * 1_000_000).toLong()) + } + } + + private fun sampleTotalDelay(algorithm: Int): Double { + val base = sampleBaseCryptoDelay(algorithm) + val transit = sampleExponential(2.5) + val jitter = (rng.nextGaussian() * 2.5).coerceIn(-8.0, 12.0) + + var cold = 0.0 + if (firstCall) { + firstCall = false + cold = coldPenaltyMs + } + + return max(20.0, base + transit + jitter + sessionBiasMs + cold) + } + + private fun sampleBaseCryptoDelay(algorithm: Int): Double { + val (mu, sigma) = + when (algorithm) { + Algorithm.EC -> ln(60.0) to 0.08 + Algorithm.RSA -> ln(70.0) to 0.08 + Algorithm.AES -> ln(35.0) to 0.10 + else -> ln(40.0) to 0.10 + } + return sampleLogNormal(mu, sigma) + } + + private fun sampleLogNormal(mu: Double, sigma: Double): Double { + return exp(mu + sigma * rng.nextGaussian()) + } + + private fun sampleExponential(mean: Double): Double { + var u = rng.nextDouble() + while (u == 0.0) u = rng.nextDouble() + return -mean * ln(u) + } +} diff --git a/module/customize.sh b/module/customize.sh index 6ef1d9f..a4ce5a5 100644 --- a/module/customize.sh +++ b/module/customize.sh @@ -91,3 +91,10 @@ if [ ! -f "$CONFIG_DIR/target.txt" ]; then ui_print "- Adding default target scope" install_file "target.txt" "$CONFIG_DIR" fi + +rm -f "$CONFIG_DIR/tee_status.txt" + +if [ ! -f "$CONFIG_DIR/hbk" ]; then + ui_print "- Generating device-unique hardware-bound key seed" + head -c 32 /dev/random > "$CONFIG_DIR/hbk" +fi diff --git a/stub/src/main/java/android/content/pm/IPackageManager.java b/stub/src/main/java/android/content/pm/IPackageManager.java index 2b0b97b..7356f82 100644 --- a/stub/src/main/java/android/content/pm/IPackageManager.java +++ b/stub/src/main/java/android/content/pm/IPackageManager.java @@ -13,6 +13,8 @@ public interface IPackageManager { ParceledListSlice getInstalledPackages(long flags, int userId); + int checkPermission(String permName, String pkgName, int userId); + class Stub { public static IPackageManager asInterface(IBinder binder) { throw new UnsupportedOperationException("STUB!"); diff --git a/stub/src/main/java/android/os/SELinux.java b/stub/src/main/java/android/os/SELinux.java new file mode 100644 index 0000000..ffaaf10 --- /dev/null +++ b/stub/src/main/java/android/os/SELinux.java @@ -0,0 +1,8 @@ +package android.os; + +public class SELinux { + public static boolean checkSELinuxAccess( + String scon, String tcon, String tclass, String perm) { + throw new UnsupportedOperationException("STUB!"); + } +} diff --git a/stub/src/main/java/android/os/ServiceManager.java b/stub/src/main/java/android/os/ServiceManager.java index 2e810d4..14990bf 100644 --- a/stub/src/main/java/android/os/ServiceManager.java +++ b/stub/src/main/java/android/os/ServiceManager.java @@ -17,6 +17,10 @@ public class ServiceManager { throw new UnsupportedOperationException("STUB!"); } + public static boolean isDeclared(String name) { + throw new UnsupportedOperationException("STUB!"); + } + public static String[] listServices() { throw new UnsupportedOperationException("STUB!"); }