Merge "Remove unused userId parameter from RecoverableKeyStoreManager."

5 files changed, 132 insertions, 155 deletions

diff --git a/core/java/android/security/recoverablekeystore/RecoverableKeyStoreLoader.java b/core/java/android/security/recoverablekeystore/RecoverableKeyStoreLoader.java
index 0cf8da5b3a86..0412326edb4a 100644
--- a/core/java/android/security/recoverablekeystore/RecoverableKeyStoreLoader.java
+++ b/core/java/android/security/recoverablekeystore/RecoverableKeyStoreLoader.java
@@ -23,7 +23,6 @@ import android.content.pm.PackageManager.NameNotFoundException;
 import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.ServiceSpecificException;
-import android.os.UserHandle;
 import android.security.KeyStore;
 import android.util.AndroidException;
 
@@ -44,8 +43,10 @@ public class RecoverableKeyStoreLoader {
 
     public static final int NO_ERROR = KeyStore.NO_ERROR;
     public static final int SYSTEM_ERROR = KeyStore.SYSTEM_ERROR;
-    public static final int UNINITIALIZED_RECOVERY_PUBLIC_KEY = 20;
-    public static final int NO_SNAPSHOT_PENDING_ERROR = 21;
+    public static final int ERROR_UNINITIALIZED_RECOVERY_PUBLIC_KEY = 20;
+    public static final int ERROR_NO_SNAPSHOT_PENDING = 21;
+    public static final int ERROR_KEYSTORE_INTERNAL_ERROR = 22;
+    public static final int ERROR_INSECURE_USER = 24;
 
     /**
      * Rate limit is enforced to prevent using too many trusted remote devices, since each device
@@ -124,7 +125,7 @@ public class RecoverableKeyStoreLoader {
                     return "OK";
                 case SYSTEM_ERROR:
                     return "System error";
-                case UNINITIALIZED_RECOVERY_PUBLIC_KEY:
+                case ERROR_UNINITIALIZED_RECOVERY_PUBLIC_KEY:
                     return "Recovery service is not initialized";
                 case RATE_LIMIT_EXCEEDED:
                     return "Rate limit exceeded";
@@ -156,8 +157,7 @@ public class RecoverableKeyStoreLoader {
             @NonNull String rootCertificateAlias, @NonNull byte[] signedPublicKeyList)
             throws RecoverableKeyStoreLoaderException {
         try {
-            mBinder.initRecoveryService(
-                    rootCertificateAlias, signedPublicKeyList, UserHandle.getCallingUserId());
+            mBinder.initRecoveryService(rootCertificateAlias, signedPublicKeyList);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -176,8 +176,7 @@ public class RecoverableKeyStoreLoader {
     public @NonNull KeyStoreRecoveryData getRecoveryData(@NonNull byte[] account)
             throws RecoverableKeyStoreLoaderException {
         try {
-            KeyStoreRecoveryData recoveryData =
-                    mBinder.getRecoveryData(account, UserHandle.getCallingUserId());
+            KeyStoreRecoveryData recoveryData = mBinder.getRecoveryData(account);
             return recoveryData;
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
@@ -198,7 +197,7 @@ public class RecoverableKeyStoreLoader {
     public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent)
             throws RecoverableKeyStoreLoaderException {
         try {
-            mBinder.setSnapshotCreatedPendingIntent(intent, UserHandle.getCallingUserId());
+            mBinder.setSnapshotCreatedPendingIntent(intent);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -220,8 +219,7 @@ public class RecoverableKeyStoreLoader {
             // IPC doesn't support generic Maps.
             @SuppressWarnings("unchecked")
             Map<byte[], Integer> result =
-                    (Map<byte[], Integer>)
-                            mBinder.getRecoverySnapshotVersions(UserHandle.getCallingUserId());
+                    (Map<byte[], Integer>) mBinder.getRecoverySnapshotVersions();
             return result;
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
@@ -243,7 +241,7 @@ public class RecoverableKeyStoreLoader {
     public void setServerParameters(long serverParameters)
             throws RecoverableKeyStoreLoaderException {
         try {
-            mBinder.setServerParameters(serverParameters, UserHandle.getCallingUserId());
+            mBinder.setServerParameters(serverParameters);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -265,7 +263,7 @@ public class RecoverableKeyStoreLoader {
             @NonNull String packageName, @Nullable String[] aliases, int status)
             throws NameNotFoundException, RecoverableKeyStoreLoaderException {
         try {
-            mBinder.setRecoveryStatus(packageName, aliases, status, UserHandle.getCallingUserId());
+            mBinder.setRecoveryStatus(packageName, aliases, status);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -297,7 +295,7 @@ public class RecoverableKeyStoreLoader {
             @SuppressWarnings("unchecked")
             Map<String, Integer> result =
                     (Map<String, Integer>)
-                            mBinder.getRecoveryStatus(packageName, UserHandle.getCallingUserId());
+                            mBinder.getRecoveryStatus(packageName);
             return result;
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
@@ -317,7 +315,7 @@ public class RecoverableKeyStoreLoader {
             @NonNull @KeyStoreRecoveryMetadata.UserSecretType int[] secretTypes)
             throws RecoverableKeyStoreLoaderException {
         try {
-            mBinder.setRecoverySecretTypes(secretTypes, UserHandle.getCallingUserId());
+            mBinder.setRecoverySecretTypes(secretTypes);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -335,7 +333,7 @@ public class RecoverableKeyStoreLoader {
     public @NonNull @KeyStoreRecoveryMetadata.UserSecretType int[] getRecoverySecretTypes()
             throws RecoverableKeyStoreLoaderException {
         try {
-            return mBinder.getRecoverySecretTypes(UserHandle.getCallingUserId());
+            return mBinder.getRecoverySecretTypes();
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -353,7 +351,7 @@ public class RecoverableKeyStoreLoader {
     public @NonNull @KeyStoreRecoveryMetadata.UserSecretType int[] getPendingRecoverySecretTypes()
             throws RecoverableKeyStoreLoaderException {
         try {
-            return mBinder.getPendingRecoverySecretTypes(UserHandle.getCallingUserId());
+            return mBinder.getPendingRecoverySecretTypes();
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -373,7 +371,7 @@ public class RecoverableKeyStoreLoader {
     public void recoverySecretAvailable(@NonNull KeyStoreRecoveryMetadata recoverySecret)
             throws RecoverableKeyStoreLoaderException {
         try {
-            mBinder.recoverySecretAvailable(recoverySecret, UserHandle.getCallingUserId());
+            mBinder.recoverySecretAvailable(recoverySecret);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
@@ -412,8 +410,7 @@ public class RecoverableKeyStoreLoader {
                             verifierPublicKey,
                             vaultParams,
                             vaultChallenge,
-                            secrets,
-                            UserHandle.getCallingUserId());
+                            secrets);
             return recoveryClaim;
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
@@ -440,7 +437,7 @@ public class RecoverableKeyStoreLoader {
             throws RecoverableKeyStoreLoaderException {
         try {
             return (Map<String, byte[]>) mBinder.recoverKeys(
-                    sessionId, recoveryKeyBlob, applicationKeys, UserHandle.getCallingUserId());
+                    sessionId, recoveryKeyBlob, applicationKeys);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         } catch (ServiceSpecificException e) {
diff --git a/core/java/com/android/internal/widget/ILockSettings.aidl b/core/java/com/android/internal/widget/ILockSettings.aidl
index 77250eb01731..862288bdd63b 100644
--- a/core/java/com/android/internal/widget/ILockSettings.aidl
+++ b/core/java/com/android/internal/widget/ILockSettings.aidl
@@ -63,22 +63,21 @@ interface ILockSettings {
     // RecoverableKeyStoreLoader methods.
     // {@code ServiceSpecificException} may be thrown to signal an error, which caller can
     // convert to  {@code RecoverableKeyStoreLoader}.
-    void initRecoveryService(in String rootCertificateAlias, in byte[] signedPublicKeyList,
-            int userId);
-    KeyStoreRecoveryData getRecoveryData(in byte[] account, int userId);
+    void initRecoveryService(in String rootCertificateAlias, in byte[] signedPublicKeyList);
+    KeyStoreRecoveryData getRecoveryData(in byte[] account);
     byte[] generateAndStoreKey(String alias);
-    void setSnapshotCreatedPendingIntent(in PendingIntent intent, int userId);
-    Map getRecoverySnapshotVersions(int userId);
-    void setServerParameters(long serverParameters, int userId);
-    void setRecoveryStatus(in String packageName, in String[] aliases, int status, int userId);
-    Map getRecoveryStatus(in String packageName, int userId);
-    void setRecoverySecretTypes(in int[] secretTypes, int userId);
-    int[] getRecoverySecretTypes(int userId);
-    int[] getPendingRecoverySecretTypes(int userId);
-    void recoverySecretAvailable(in KeyStoreRecoveryMetadata recoverySecret, int userId);
+    void setSnapshotCreatedPendingIntent(in PendingIntent intent);
+    Map getRecoverySnapshotVersions();
+    void setServerParameters(long serverParameters);
+    void setRecoveryStatus(in String packageName, in String[] aliases, int status);
+    Map getRecoveryStatus(in String packageName);
+    void setRecoverySecretTypes(in int[] secretTypes);
+    int[] getRecoverySecretTypes();
+    int[] getPendingRecoverySecretTypes();
+    void recoverySecretAvailable(in KeyStoreRecoveryMetadata recoverySecret);
     byte[] startRecoverySession(in String sessionId,
             in byte[] verifierPublicKey, in byte[] vaultParams, in byte[] vaultChallenge,
-            in List<KeyStoreRecoveryMetadata> secrets, int userId);
+            in List<KeyStoreRecoveryMetadata> secrets);
     Map/*<String, byte[]>*/ recoverKeys(in String sessionId, in byte[] recoveryKeyBlob,
-            in List<KeyEntryRecoveryData> applicationKeys, int userId);
+            in List<KeyEntryRecoveryData> applicationKeys);
 }
diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java
index 02218ffc14ea..1fa8da7347d5 100644
--- a/services/core/java/com/android/server/locksettings/LockSettingsService.java
+++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java
@@ -1956,82 +1956,78 @@ public class LockSettingsService extends ILockSettings.Stub {
 
     @Override
     public void initRecoveryService(@NonNull String rootCertificateAlias,
-            @NonNull byte[] signedPublicKeyList, @UserIdInt int userId)
-            throws RemoteException {
+            @NonNull byte[] signedPublicKeyList) throws RemoteException {
         mRecoverableKeyStoreManager.initRecoveryService(rootCertificateAlias,
-                signedPublicKeyList, userId);
+                signedPublicKeyList);
     }
 
     @Override
-    public KeyStoreRecoveryData getRecoveryData(@NonNull byte[] account, @UserIdInt int userId)
-            throws RemoteException {
-        return mRecoverableKeyStoreManager.getRecoveryData(account, userId);
+    public KeyStoreRecoveryData getRecoveryData(@NonNull byte[] account) throws RemoteException {
+        return mRecoverableKeyStoreManager.getRecoveryData(account);
     }
 
-    public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent, int userId)
+    public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent)
             throws RemoteException {
-        mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent, userId);
+        mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent);
     }
 
-    public Map getRecoverySnapshotVersions(int userId) throws RemoteException {
-        return mRecoverableKeyStoreManager.getRecoverySnapshotVersions(userId);
+    public Map getRecoverySnapshotVersions() throws RemoteException {
+        return mRecoverableKeyStoreManager.getRecoverySnapshotVersions();
     }
 
     @Override
-    public void setServerParameters(long serverParameters, @UserIdInt int userId)
-            throws RemoteException {
-        mRecoverableKeyStoreManager.setServerParameters(serverParameters, userId);
+    public void setServerParameters(long serverParameters) throws RemoteException {
+        mRecoverableKeyStoreManager.setServerParameters(serverParameters);
     }
 
     @Override
     public void setRecoveryStatus(@NonNull String packageName, @Nullable String[] aliases,
-            int status, @UserIdInt int userId) throws RemoteException {
-        mRecoverableKeyStoreManager.setRecoveryStatus(packageName, aliases, status, userId);
+            int status) throws RemoteException {
+        mRecoverableKeyStoreManager.setRecoveryStatus(packageName, aliases, status);
     }
 
-    public Map getRecoveryStatus(@Nullable String packageName, int userId) throws RemoteException {
-        return mRecoverableKeyStoreManager.getRecoveryStatus(packageName, userId);
+    public Map getRecoveryStatus(@Nullable String packageName) throws RemoteException {
+        return mRecoverableKeyStoreManager.getRecoveryStatus(packageName);
     }
 
     @Override
     public void setRecoverySecretTypes(@NonNull @KeyStoreRecoveryMetadata.UserSecretType
-            int[] secretTypes, @UserIdInt int userId) throws RemoteException {
-        mRecoverableKeyStoreManager.setRecoverySecretTypes(secretTypes, userId);
+            int[] secretTypes) throws RemoteException {
+        mRecoverableKeyStoreManager.setRecoverySecretTypes(secretTypes);
     }
 
     @Override
-    public int[] getRecoverySecretTypes(@UserIdInt int userId) throws RemoteException {
-        return mRecoverableKeyStoreManager.getRecoverySecretTypes(userId);
+    public int[] getRecoverySecretTypes() throws RemoteException {
+        return mRecoverableKeyStoreManager.getRecoverySecretTypes();
 
     }
 
     @Override
-    public int[] getPendingRecoverySecretTypes(@UserIdInt int userId) throws RemoteException {
+    public int[] getPendingRecoverySecretTypes() throws RemoteException {
         throw new SecurityException("Not implemented");
     }
 
     @Override
-    public void recoverySecretAvailable(@NonNull KeyStoreRecoveryMetadata recoverySecret,
-            @UserIdInt int userId) throws RemoteException {
-        mRecoverableKeyStoreManager.recoverySecretAvailable(recoverySecret, userId);
+    public void recoverySecretAvailable(@NonNull KeyStoreRecoveryMetadata recoverySecret)
+            throws RemoteException {
+        mRecoverableKeyStoreManager.recoverySecretAvailable(recoverySecret);
     }
 
     @Override
     public byte[] startRecoverySession(@NonNull String sessionId,
             @NonNull byte[] verifierPublicKey, @NonNull byte[] vaultParams,
-            @NonNull byte[] vaultChallenge, @NonNull List<KeyStoreRecoveryMetadata> secrets,
-            @UserIdInt int userId) throws RemoteException {
+            @NonNull byte[] vaultChallenge, @NonNull List<KeyStoreRecoveryMetadata> secrets)
+            throws RemoteException {
         return mRecoverableKeyStoreManager.startRecoverySession(sessionId, verifierPublicKey,
-                vaultParams, vaultChallenge, secrets, userId);
+                vaultParams, vaultChallenge, secrets);
     }
 
     @Override
     public Map<String, byte[]> recoverKeys(@NonNull String sessionId,
-            @NonNull byte[] recoveryKeyBlob, @NonNull List<KeyEntryRecoveryData> applicationKeys,
-            @UserIdInt int userId)
+            @NonNull byte[] recoveryKeyBlob, @NonNull List<KeyEntryRecoveryData> applicationKeys)
             throws RemoteException {
         return mRecoverableKeyStoreManager.recoverKeys(
-                sessionId, recoveryKeyBlob, applicationKeys, userId);
+                sessionId, recoveryKeyBlob, applicationKeys);
     }
 
     @Override
diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java
index eccf241dd47f..c73f852470a7 100644
--- a/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java
+++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManager.java
@@ -63,9 +63,11 @@ import javax.crypto.AEADBadTagException;
 public class RecoverableKeyStoreManager {
     private static final String TAG = "RecoverableKeyStoreMgr";
 
-    private static final int ERROR_INSECURE_USER = 1;
-    private static final int ERROR_KEYSTORE_INTERNAL_ERROR = 2;
-    private static final int ERROR_DATABASE_ERROR = 3;
+    // TODO: move error codes to RecoverableKeyStoreLoader.
+    private static int ERROR_INSECURE_USER = 1;
+    private static int ERROR_KEYSTORE_INTERNAL_ERROR = 2;
+    private static int ERROR_DATABASE_ERROR = 3;
+    private static int ERROR_RECOVERY_SESSION_NOT_FOUND = 4;
 
     private static RecoverableKeyStoreManager mInstance;
 
@@ -119,9 +121,10 @@ public class RecoverableKeyStoreManager {
     }
 
     public void initRecoveryService(
-            @NonNull String rootCertificateAlias, @NonNull byte[] signedPublicKeyList, int userId)
+            @NonNull String rootCertificateAlias, @NonNull byte[] signedPublicKeyList)
             throws RemoteException {
         checkRecoverKeyStorePermission();
+        int userId = UserHandle.getCallingUserId();
         // TODO: open /system/etc/security/... cert file, and check the signature on the public keys
         PublicKey publicKey;
         try {
@@ -144,22 +147,22 @@ public class RecoverableKeyStoreManager {
      * @return recovery data
      * @hide
      */
-    public @NonNull KeyStoreRecoveryData getRecoveryData(@NonNull byte[] account, int userId)
+    public @NonNull KeyStoreRecoveryData getRecoveryData(@NonNull byte[] account)
             throws RemoteException {
         checkRecoverKeyStorePermission();
 
         KeyStoreRecoveryData snapshot = mSnapshotStorage.get(UserHandle.getCallingUserId());
         if (snapshot == null) {
-            throw new ServiceSpecificException(RecoverableKeyStoreLoader.NO_SNAPSHOT_PENDING_ERROR);
+            throw new ServiceSpecificException(RecoverableKeyStoreLoader.ERROR_NO_SNAPSHOT_PENDING);
         }
         return snapshot;
     }
 
-    public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent, int userId)
+    public void setSnapshotCreatedPendingIntent(@Nullable PendingIntent intent)
             throws RemoteException {
         checkRecoverKeyStorePermission();
-        final int recoveryAgentUid = Binder.getCallingUid();
-        mListenersStorage.setSnapshotListener(recoveryAgentUid, intent);
+        int uid = Binder.getCallingUid();
+        mListenersStorage.setSnapshotListener(uid, intent);
     }
 
     /**
@@ -168,14 +171,15 @@ public class RecoverableKeyStoreManager {
      *
      * @return Map from Recovery agent account to snapshot version.
      */
-    public @NonNull Map<byte[], Integer> getRecoverySnapshotVersions(int userId)
+    public @NonNull Map<byte[], Integer> getRecoverySnapshotVersions()
             throws RemoteException {
         checkRecoverKeyStorePermission();
         throw new UnsupportedOperationException();
     }
 
-    public void setServerParameters(long serverParameters, int userId) throws RemoteException {
+    public void setServerParameters(long serverParameters) throws RemoteException {
         checkRecoverKeyStorePermission();
+        int userId = UserHandle.getCallingUserId();
         mDatabase.setServerParameters(userId, Binder.getCallingUid(), serverParameters);
     }
 
@@ -187,7 +191,7 @@ public class RecoverableKeyStoreManager {
      * @param status - new status
      */
     public void setRecoveryStatus(
-            @NonNull String packageName, @Nullable String[] aliases, int status, int userId)
+            @NonNull String packageName, @Nullable String[] aliases, int status)
             throws RemoteException {
         checkRecoverKeyStorePermission();
         int uid = Binder.getCallingUid();
@@ -211,7 +215,7 @@ public class RecoverableKeyStoreManager {
      *
      * @return {@code Map} from KeyStore alias to recovery status.
      */
-    public @NonNull Map<String, Integer> getRecoveryStatus(@Nullable String packageName, int userId)
+    public @NonNull Map<String, Integer> getRecoveryStatus(@Nullable String packageName)
             throws RemoteException {
         // Any application should be able to check status for its own keys.
         // If caller is a recovery agent it can check statuses for other packages, but
@@ -225,7 +229,7 @@ public class RecoverableKeyStoreManager {
      * @hide
      */
     public void setRecoverySecretTypes(
-            @NonNull @KeyStoreRecoveryMetadata.UserSecretType int[] secretTypes, int userId)
+            @NonNull @KeyStoreRecoveryMetadata.UserSecretType int[] secretTypes)
             throws RemoteException {
         checkRecoverKeyStorePermission();
         mDatabase.setRecoverySecretTypes(UserHandle.getCallingUserId(), Binder.getCallingUid(),
@@ -238,7 +242,7 @@ public class RecoverableKeyStoreManager {
      * @return secret types
      * @hide
      */
-    public @NonNull int[] getRecoverySecretTypes(int userId) throws RemoteException {
+    public @NonNull int[] getRecoverySecretTypes() throws RemoteException {
         checkRecoverKeyStorePermission();
         return mDatabase.getRecoverySecretTypes(UserHandle.getCallingUserId(),
             Binder.getCallingUid());
@@ -250,17 +254,17 @@ public class RecoverableKeyStoreManager {
      * @return secret types
      * @hide
      */
-    public @NonNull int[] getPendingRecoverySecretTypes(int userId) throws RemoteException {
+    public @NonNull int[] getPendingRecoverySecretTypes() throws RemoteException {
         checkRecoverKeyStorePermission();
         throw new UnsupportedOperationException();
     }
 
     public void recoverySecretAvailable(
-            @NonNull KeyStoreRecoveryMetadata recoverySecret, int userId) throws RemoteException {
-        final int callingUid = Binder.getCallingUid(); // Recovery agent uid.
+            @NonNull KeyStoreRecoveryMetadata recoverySecret) throws RemoteException {
+        int uid = Binder.getCallingUid();
         if (recoverySecret.getLockScreenUiFormat() == KeyStoreRecoveryMetadata.TYPE_LOCKSCREEN) {
             throw new SecurityException(
-                    "Caller " + callingUid + "is not allowed to set lock screen secret");
+                    "Caller " + uid + " is not allowed to set lock screen secret");
         }
         checkRecoverKeyStorePermission();
         // TODO: add hook from LockSettingsService to set lock screen secret.
@@ -284,10 +288,10 @@ public class RecoverableKeyStoreManager {
             @NonNull byte[] verifierPublicKey,
             @NonNull byte[] vaultParams,
             @NonNull byte[] vaultChallenge,
-            @NonNull List<KeyStoreRecoveryMetadata> secrets,
-            int userId)
+            @NonNull List<KeyStoreRecoveryMetadata> secrets)
             throws RemoteException {
         checkRecoverKeyStorePermission();
+        int uid = Binder.getCallingUid();
 
         if (secrets.size() != 1) {
             // TODO: support multiple secrets
@@ -297,7 +301,7 @@ public class RecoverableKeyStoreManager {
         byte[] keyClaimant = KeySyncUtils.generateKeyClaimant();
         byte[] kfHash = secrets.get(0).getSecret();
         mRecoverySessionStorage.add(
-                userId,
+                uid,
                 new RecoverySessionStorage.Entry(sessionId, kfHash, keyClaimant, vaultParams));
 
         try {
@@ -335,22 +339,21 @@ public class RecoverableKeyStoreManager {
      *     service.
      * @param applicationKeys The encrypted key blobs returned by the remote vault service. These
      *     were wrapped with the recovery key.
-     * @param uid The uid of the recovery agent.
      * @return Map from alias to raw key material.
      * @throws RemoteException if an error occurred recovering the keys.
      */
     public Map<String, byte[]> recoverKeys(
             @NonNull String sessionId,
             @NonNull byte[] encryptedRecoveryKey,
-            @NonNull List<KeyEntryRecoveryData> applicationKeys,
-            int uid)
+            @NonNull List<KeyEntryRecoveryData> applicationKeys)
             throws RemoteException {
         checkRecoverKeyStorePermission();
-
+        int uid = Binder.getCallingUid();
         RecoverySessionStorage.Entry sessionEntry = mRecoverySessionStorage.get(uid, sessionId);
         if (sessionEntry == null) {
-            throw new RemoteException(String.format(Locale.US,
-                    "User %d does not have pending session '%s'", uid, sessionId));
+            throw new ServiceSpecificException(ERROR_KEYSTORE_INTERNAL_ERROR,
+                    String.format(Locale.US,
+                    "Application uid=%d does not have pending session '%s'", uid, sessionId));
         }
 
         try {
@@ -372,7 +375,7 @@ public class RecoverableKeyStoreManager {
      */
     public byte[] generateAndStoreKey(@NonNull String alias) throws RemoteException {
         int uid = Binder.getCallingUid();
-        int userId = Binder.getCallingUserHandle().getIdentifier();
+        int userId = UserHandle.getCallingUserId();
 
         PlatformEncryptionKey encryptionKey;
 
@@ -400,7 +403,7 @@ public class RecoverableKeyStoreManager {
 
     private byte[] decryptRecoveryKey(
             RecoverySessionStorage.Entry sessionEntry, byte[] encryptedClaimResponse)
-            throws RemoteException {
+            throws RemoteException, ServiceSpecificException {
         try {
             byte[] locallyEncryptedKey = KeySyncUtils.decryptRecoveryClaimResponse(
                     sessionEntry.getKeyClaimant(),
@@ -408,18 +411,12 @@ public class RecoverableKeyStoreManager {
                     encryptedClaimResponse);
             return KeySyncUtils.decryptRecoveryKey(sessionEntry.getLskfHash(), locallyEncryptedKey);
         } catch (InvalidKeyException | AEADBadTagException e) {
-            throw new RemoteException(
-                    "Failed to decrypt recovery key",
-                    e,
-                    /*enableSuppression=*/ true,
-                    /*writeableStackTrace=*/ true);
+            throw new ServiceSpecificException(ERROR_KEYSTORE_INTERNAL_ERROR,
+                    "Failed to decrypt recovery key " + e.getMessage());
+
         } catch (NoSuchAlgorithmException e) {
             // Should never happen: all the algorithms used are required by AOSP implementations
-            throw new RemoteException(
-                    "Missing required algorithm",
-                    e,
-                    /*enableSuppression=*/ true,
-                    /*writeableStackTrace=*/ true);
+            throw new ServiceSpecificException(ERROR_KEYSTORE_INTERNAL_ERROR, e.getMessage());
         }
     }
 
diff --git a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java
index 88df62bae3df..445fbdeab6f6 100644
--- a/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java
+++ b/services/tests/servicestests/src/com/android/server/locksettings/recoverablekeystore/RecoverableKeyStoreManagerTest.java
@@ -37,6 +37,7 @@ import android.content.Context;
 import android.content.Intent;
 import android.os.Binder;
 import android.os.RemoteException;
+import android.os.ServiceSpecificException;
 import android.os.UserHandle;
 import android.security.recoverablekeystore.KeyDerivationParameters;
 import android.security.recoverablekeystore.KeyEntryRecoveryData;
@@ -96,7 +97,6 @@ public class RecoverableKeyStoreManagerTest {
     private static final byte[] TEST_SECRET = getUtf8Bytes("password1234");
     private static final byte[] TEST_VAULT_CHALLENGE = getUtf8Bytes("vault_challenge");
     private static final byte[] TEST_VAULT_PARAMS = getUtf8Bytes("vault_params");
-    private static final int TEST_USER_ID = 10009;
     private static final int KEY_CLAIMANT_LENGTH_BYTES = 16;
     private static final byte[] RECOVERY_RESPONSE_HEADER =
             "V1 reencrypted_recovery_key".getBytes(StandardCharsets.UTF_8);
@@ -174,8 +174,7 @@ public class RecoverableKeyStoreManagerTest {
                                 TYPE_LOCKSCREEN,
                                 TYPE_PASSWORD,
                                 KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                                TEST_SECRET)),
-                TEST_USER_ID);
+                                TEST_SECRET)));
 
         verify(mMockContext, times(1))
                 .enforceCallingOrSelfPermission(
@@ -194,12 +193,11 @@ public class RecoverableKeyStoreManagerTest {
                                 TYPE_LOCKSCREEN,
                                 TYPE_PASSWORD,
                                 KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                                TEST_SECRET)),
-                TEST_USER_ID);
+                                TEST_SECRET)));
 
         assertEquals(1, mRecoverySessionStorage.size());
         RecoverySessionStorage.Entry entry =
-                mRecoverySessionStorage.get(TEST_USER_ID, TEST_SESSION_ID);
+                mRecoverySessionStorage.get(Binder.getCallingUid(), TEST_SESSION_ID);
         assertArrayEquals(TEST_SECRET, entry.getLskfHash());
         assertEquals(KEY_CLAIMANT_LENGTH_BYTES, entry.getKeyClaimant().length);
     }
@@ -212,8 +210,7 @@ public class RecoverableKeyStoreManagerTest {
                     TEST_PUBLIC_KEY,
                     TEST_VAULT_PARAMS,
                     TEST_VAULT_CHALLENGE,
-                    ImmutableList.of(),
-                    TEST_USER_ID);
+                    ImmutableList.of());
             fail("should have thrown");
         } catch (RemoteException e) {
             assertEquals("Only a single KeyStoreRecoveryMetadata is supported", e.getMessage());
@@ -233,8 +230,7 @@ public class RecoverableKeyStoreManagerTest {
                                     TYPE_LOCKSCREEN,
                                     TYPE_PASSWORD,
                                     KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                                    TEST_SECRET)),
-                    TEST_USER_ID);
+                                    TEST_SECRET)));
             fail("should have thrown");
         } catch (RemoteException e) {
             assertEquals("Not a valid X509 key", e.getMessage());
@@ -249,12 +245,10 @@ public class RecoverableKeyStoreManagerTest {
                     /*recoveryKeyBlob=*/ randomBytes(32),
                     /*applicationKeys=*/ ImmutableList.of(
                             new KeyEntryRecoveryData(getUtf8Bytes("alias"), randomBytes(32))
-                    ),
-                    TEST_USER_ID);
+                    ));
             fail("should have thrown");
-        } catch (RemoteException e) {
-            assertEquals("User 10009 does not have pending session 'karlin'",
-                    e.getMessage());
+        } catch (ServiceSpecificException e) {
+            // expected
         }
     }
 
@@ -269,18 +263,17 @@ public class RecoverableKeyStoreManagerTest {
                         TYPE_LOCKSCREEN,
                         TYPE_PASSWORD,
                         KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                        TEST_SECRET)),
-                TEST_USER_ID);
+                        TEST_SECRET)));
 
         try {
             mRecoverableKeyStoreManager.recoverKeys(
                     TEST_SESSION_ID,
                     /*encryptedRecoveryKey=*/ randomBytes(60),
-                    /*applicationKeys=*/ ImmutableList.of(),
-                    /*uid=*/ TEST_USER_ID);
+                    /*applicationKeys=*/ ImmutableList.of());
             fail("should have thrown");
-        } catch (RemoteException e) {
-            assertEquals("Failed to decrypt recovery key", e.getMessage());
+        } catch (ServiceSpecificException e) {
+            assertThat(e.getMessage()).startsWith("Failed to decrypt recovery key");
+            //assertEquals("Failed to decrypt recovery key", e.getMessage());
         }
     }
 
@@ -295,9 +288,8 @@ public class RecoverableKeyStoreManagerTest {
                         TYPE_LOCKSCREEN,
                         TYPE_PASSWORD,
                         KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                        TEST_SECRET)),
-                TEST_USER_ID);
-        byte[] keyClaimant = mRecoverySessionStorage.get(TEST_USER_ID, TEST_SESSION_ID)
+                        TEST_SECRET)));
+        byte[] keyClaimant = mRecoverySessionStorage.get(Binder.getCallingUid(), TEST_SESSION_ID)
                 .getKeyClaimant();
         SecretKey recoveryKey = randomRecoveryKey();
         byte[] encryptedClaimResponse = encryptClaimResponse(
@@ -310,8 +302,7 @@ public class RecoverableKeyStoreManagerTest {
             mRecoverableKeyStoreManager.recoverKeys(
                     TEST_SESSION_ID,
                     /*encryptedRecoveryKey=*/ encryptedClaimResponse,
-                    /*applicationKeys=*/ ImmutableList.of(badApplicationKey),
-                    /*uid=*/ TEST_USER_ID);
+                    /*applicationKeys=*/ ImmutableList.of(badApplicationKey));
             fail("should have thrown");
         } catch (RemoteException e) {
             assertEquals("Failed to recover key with alias 'nick'", e.getMessage());
@@ -329,9 +320,8 @@ public class RecoverableKeyStoreManagerTest {
                         TYPE_LOCKSCREEN,
                         TYPE_PASSWORD,
                         KeyDerivationParameters.createSHA256Parameters(TEST_SALT),
-                        TEST_SECRET)),
-                TEST_USER_ID);
-        byte[] keyClaimant = mRecoverySessionStorage.get(TEST_USER_ID, TEST_SESSION_ID)
+                        TEST_SECRET)));
+        byte[] keyClaimant = mRecoverySessionStorage.get(Binder.getCallingUid(), TEST_SESSION_ID)
                 .getKeyClaimant();
         SecretKey recoveryKey = randomRecoveryKey();
         byte[] encryptedClaimResponse = encryptClaimResponse(
@@ -344,8 +334,7 @@ public class RecoverableKeyStoreManagerTest {
         Map<String, byte[]> recoveredKeys = mRecoverableKeyStoreManager.recoverKeys(
                 TEST_SESSION_ID,
                 encryptedClaimResponse,
-                ImmutableList.of(applicationKey),
-                TEST_USER_ID);
+                ImmutableList.of(applicationKey));
 
         assertThat(recoveredKeys).hasSize(1);
         assertThat(recoveredKeys.get(TEST_ALIAS)).isEqualTo(applicationKeyBytes);
@@ -357,27 +346,26 @@ public class RecoverableKeyStoreManagerTest {
         PendingIntent intent = PendingIntent.getBroadcast(
                 InstrumentationRegistry.getTargetContext(), /*requestCode=*/1,
                 new Intent(), /*flags=*/ 0);
-        mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent, /*userId=*/ 0);
+        mRecoverableKeyStoreManager.setSnapshotCreatedPendingIntent(intent);
         verify(mMockListenersStorage).setSnapshotListener(eq(uid), any(PendingIntent.class));
     }
 
     @Test
     public void setRecoverySecretTypes() throws Exception {
-        int userId = UserHandle.getCallingUserId();
         int[] types1 = new int[]{11, 2000};
         int[] types2 = new int[]{1, 2, 3};
         int[] types3 = new int[]{};
 
-        mRecoverableKeyStoreManager.setRecoverySecretTypes(types1, userId);
-        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes(userId)).isEqualTo(
+        mRecoverableKeyStoreManager.setRecoverySecretTypes(types1);
+        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes()).isEqualTo(
                 types1);
 
-        mRecoverableKeyStoreManager.setRecoverySecretTypes(types2, userId);
-        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes(userId)).isEqualTo(
+        mRecoverableKeyStoreManager.setRecoverySecretTypes(types2);
+        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes()).isEqualTo(
                 types2);
 
-        mRecoverableKeyStoreManager.setRecoverySecretTypes(types3, userId);
-        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes(userId)).isEqualTo(
+        mRecoverableKeyStoreManager.setRecoverySecretTypes(types3);
+        assertThat(mRecoverableKeyStoreManager.getRecoverySecretTypes()).isEqualTo(
                 types3);
     }
 
@@ -391,13 +379,13 @@ public class RecoverableKeyStoreManagerTest {
         WrappedKey wrappedKey = new WrappedKey(NONCE, KEY_MATERIAL, GENERATION_ID, status);
         mRecoverableKeyStoreDb.insertKey(userId, uid, alias, wrappedKey);
         Map<String, Integer> statuses =
-                mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+                mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(1);
         assertThat(statuses).containsEntry(alias, status);
 
         mRecoverableKeyStoreManager.setRecoveryStatus(
-                /*packageName=*/ null, new String[] {alias}, status2, userId);
-        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+                /*packageName=*/ null, new String[] {alias}, status2);
+        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(1);
         assertThat(statuses).containsEntry(alias, status2); // updated
     }
@@ -415,30 +403,30 @@ public class RecoverableKeyStoreManagerTest {
         mRecoverableKeyStoreDb.insertKey(userId, uid, alias, wrappedKey);
         mRecoverableKeyStoreDb.insertKey(userId, uid, alias2, wrappedKey);
         Map<String, Integer> statuses =
-                mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+                mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(2);
         assertThat(statuses).containsEntry(alias, status);
         assertThat(statuses).containsEntry(alias2, status);
 
         mRecoverableKeyStoreManager.setRecoveryStatus(
-                /*packageName=*/ null, /*aliases=*/ null, status2, userId);
-        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+                /*packageName=*/ null, /*aliases=*/ null, status2);
+        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(2);
         assertThat(statuses).containsEntry(alias, status2); // updated
         assertThat(statuses).containsEntry(alias2, status2); // updated
 
         mRecoverableKeyStoreManager.setRecoveryStatus(
-                /*packageName=*/ null, new String[] {alias2}, status3, userId);
+                /*packageName=*/ null, new String[] {alias2}, status3);
 
-        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(2);
         assertThat(statuses).containsEntry(alias, status2);
         assertThat(statuses).containsEntry(alias2, status3); // updated
 
         mRecoverableKeyStoreManager.setRecoveryStatus(
-                /*packageName=*/ null, new String[] {alias, alias2}, status, userId);
+                /*packageName=*/ null, new String[] {alias, alias2}, status);
 
-        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null, userId);
+        statuses = mRecoverableKeyStoreManager.getRecoveryStatus(/*packageName=*/ null);
         assertThat(statuses).hasSize(2);
         assertThat(statuses).containsEntry(alias, status); // updated
         assertThat(statuses).containsEntry(alias2, status); // updated