From f554b364160ffc159ca261da65a8d0eada4a7b31 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Wed, 20 May 2026 03:59:10 +0100 Subject: [PATCH] fix: intercept createOperation under any caller UID Mirror of the change applied to GENERATE_KEY in 95b8c27. Drop the outer shouldSkipUid gate so handleCreateOperation always runs. handleCreateOperation already gates on the cache lookup (KeyMintSecurityLevelInterceptor.kt:298-326): domain=APP looks up KeyIdentifier(callingUid, alias) in generatedKeys and forwards to HAL on miss; domain=KEY_ID looks up by nspace filtered by uid and forwards on miss. The outer UID gate was redundant when the lookup hits, and harmful when a key was generated under a non-target-list UID (e.g. Shizuku-routed callers at shell 2000 / root 0 after 95b8c27). Without this change, a BYO key created under Shizuku-routed UID that the app later attempts to use (signing operation under the same Shizuku-routed UID) would be forwarded to real HAL, which has no record of our software key, producing a silent operation failure instead of the simulator handling the sign internally. Surfaced by adversarial audit. CREATE_OPERATION no longer needs the outer gate because handleCreateOperation's own cache-or-forward logic is the correct gate. --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index e65a830..1b5ce36 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -79,7 +79,7 @@ class KeyMintSecurityLevelInterceptor( CREATE_OPERATION_TRANSACTION -> { logTransaction(txId, transactionNames[code]!!, callingUid, callingPid) - if (!ConfigurationManager.shouldSkipUid(callingUid)) return handleCreateOperation(txId, callingUid, data) + return handleCreateOperation(txId, callingUid, data) } IMPORT_KEY_TRANSACTION -> { logTransaction(txId, transactionNames[code]!!, callingUid, callingPid)