From 8544aac260dae720b9313c0061984185d0b8ebd1 Mon Sep 17 00:00:00 2001 From: Andrea-lyz Date: Tue, 26 May 2026 22:53:28 +0200 Subject: [PATCH] fix(intercept): use ContinueAndSkipPost for KEY_ID createOperation NOT FOUND MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When handleCreateOperation receives a Domain.KEY_ID request for a key not in our generatedKeys cache, it correctly forwards to the real HAL. However, it previously returned TransactionResult.Continue, which lets the post-handler run. The post-handler unconditionally registers an OperationInterceptor on the IKeystoreOperation binder returned by real keystore2. This interceptor then interferes with the caller's operation (intercepting finish/abort/updateAad calls). On devices where vendor daemons (e.g. fingerprint calibration) use Domain.KEY_ID for their hardware-backed keys, this causes operation failures — the OperationInterceptor races with the immediate finish/abort call and may reject updateAad with INVALID_TAG if the operation is not GCM mode. Fix: return ContinueAndSkipPost (matching the existing Domain.APP NOT FOUND path) so the post-handler never runs for operations on keys we don't own. When the key IS in generatedKeys, we never reach this return — we proceed to create a SoftwareOperation directly in pre-transact. Symptom: OnePlus engineering mode ultrasonic fingerprint calibration hash retrieval fails with module enabled, works with module disabled. Signed-off-by: Andrea-lyz --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index d7b9ced..581dc1a 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -317,7 +317,7 @@ class KeyMintSecurityLevelInterceptor( entry ?: run { trackAndEnforceOpLimit(callingUid, txId)?.let { return it } SystemLogger.info("[TX_ID: $txId] createOperation KeyId(${keyDescriptor.nspace}) NOT FOUND for uid=$callingUid. Forwarding to HAL.") - return TransactionResult.Continue + return TransactionResult.ContinueAndSkipPost } } else -> {