Override OEM unlock check with downstream security state flag wheneve…

…r it is present
GrapheneOS · Oct 1, 2024 · 0c26690 · 0c26690
1 parent 2bcbdc1
commit 0c26690
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/app/src/main/java/app/attestation/auditor/AttestationProtocol.java b/app/src/main/java/app/attestation/auditor/AttestationProtocol.java
@@ -1523,6 +1523,13 @@ static AttestationResult generateSerialized(final Context context, final byte[]
                 osEnforcedFlags |= OS_ENFORCED_FLAGS_SYSTEM_USER;
             }
             if (extraSecurityState != Bundle.EMPTY) {
+                String oemUnlockAllowedKey = "android.ext.OEM_UNLOCK_ALLOWED";
+                if (extraSecurityState.containsKey(oemUnlockAllowedKey)) {
+                    osEnforcedFlags &= ~OS_ENFORCED_FLAGS_OEM_UNLOCK_ALLOWED;
+                    if (extraSecurityState.getBoolean(oemUnlockAllowedKey, false)) {
+                        osEnforcedFlags |= OS_ENFORCED_FLAGS_OEM_UNLOCK_ALLOWED;
+                    }
+                }
             }
             serializer.putInt(osEnforcedFlags);