shamu: Add nfcee_access.xml

Change-Id: I3dab3147b533e9845b5910cdfab1c21c435f1437
AICP · Oct 8, 2015 · e8159da · e8159da
1 parent 701018b
commit e8159da
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 0 deletions.
diff --git a/device.mk b/device.mk
@@ -298,6 +298,10 @@ PRODUCT_COPY_FILES += \
     device/moto/shamu/nfc/libnfc-brcm.conf:system/etc/libnfc-brcm.conf \
     device/moto/shamu/nfc/libnfc-brcm-20795a10.conf:system/etc/libnfc-brcm-20795a10.conf
 
+# NFCEE access control
+PRODUCT_COPY_FILES += \
+    device/moto/shamu/nfcee_access.xml:system/etc/nfcee_access.xml
+
 # Modem debugger
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
 PRODUCT_PACKAGES += \

diff --git a/nfcee_access.xml b/nfcee_access.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
+    <!-- The built in list of signatures and package names that are allowed
+    access to the NFCEE (Secure Element).
+
+    Format:
+    <signer android:signature="SIGNATURE">
+        <package android:name="PACKAGE_NAME" />
+        ...
+    </signer>
+    ...
+
+    Rules:
+        SIGNATURE is a hex encoded X.509 certificate
+            See Debug section to generate hex encoded certificates.
+        PACKAGE_NAME is a Android package name
+        Zero or more signer tags are allowed.
+        Each signer tag must have one android:signature.
+        Zero or more package tags are allowed per signer.
+        Each package tag must have one android:name.
+        If a signer has zero package tags, then ANY application with the
+            specified certificate is granted NFCEE access.
+        If a signer has one or more package tags, then an application signed
+            with the specified certificate must have a package name that is an
+            exact match of one of the specified package names to be granted
+            NFCEE access.
+        Duplicate signer tags are not allowed.
+        Duplicate package tags for a single signer are not allowed.
+
+    Example:
+        In this example, any application from the first signer is granted
+        access, but only applications with the specified package names
+        are granted access for the second signer.
+    <signer android:signature="308201c53082012ea00302010202044ebb27cc300d06092a864886f70d01010505003026310f300d060355040a1306476f6f676c65311330110603550403130a4e69636b2050656c6c793020170d3131313131303031323432385a180f32313131313031373031323432385a3026310f300d060355040a1306476f6f676c65311330110603550403130a4e69636b2050656c6c7930819f300d06092a864886f70d010101050003818d00308189028181008d43e546b3f5572707a095ced120d8f06781fa162bcf0ffa0ed0ecb48eb90ed009f65a5a1afd69fb4d38cf24e931b69b061741b8c7ca9f785ba59509e883f5a308f5e2da3c496bb362a2229da8f95f08a92f7f94c829c56e78a34e5147d138d0be0671cb5b7caceaffae6199ba544496a7645e7df3c9f02c5ac156eb0501584f0203010001300d06092a864886f70d0101050500038181003511bcb73651a7927db71ad76e4f6dc5ba121c941ae0fd4dfe519aae8775520b204a5e3cdad2c61ad41aff2c510dbe3376a7578d8aba00f35633e1ae72c91ec83d80eac6f5f081fb8361c6c30c47b0a17932d859d7e991e02cba410a82b35234b2b1bc859e50fe308bf9b64b71a8046777300c07ead159287c187b8865e23f23" />
+    <signer android:signature="3082044c30820334a003020102020900de7695041d7650c0300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e205669657731143012060355040a130b476f6f676c6520496e632e3110300e060355040b1307416e64726f6964311330110603550403130a476f6f676c65204e4643301e170d3131303332343031303332345a170d3338303830393031303332345a3077310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e205669657731143012060355040a130b476f6f676c6520496e632e3110300e060355040b1307416e64726f6964311330110603550403130a476f6f676c65204e464330820120300d06092a864886f70d01010105000382010d00308201080282010100e6ff3defe92aa10d71eb0fa6408bc036b7e243eeed68a6a4763dc7a52a31757cdac61fe510bb73c716e4000104265b347fcecef4c42bf1e1379dd0a876f028227fbbc1f9bdd5d713b2f6a935a379d2cba9c96f92d2d0787c11f1eb19548008a6a072b34b91836cfa0ae1276780e9007530166986a11c9cef46cef7c704806dde9431fb60284d120ab0e7de1d633f07687d468c51139afffdc6bc9a207ca904b8be1da0aa7b4e97756f43606488be5cae3c68e8bb7942cdf51607c930a2fcda655b75d0759cba89ad06e739bd0ba29b1f404296c2c0a85a847f5ab0d067c6c3ec9c49212042ac63a7e53b546c65b46080b4e3e680e23e1f77cfe7f6de744b1a65020103a381dc3081d9301d0603551d0e04160414a2e89064b05d08865c34db930a9d840050117aec3081a90603551d230481a130819e8014a2e89064b05d08865c34db930a9d840050117aeca17ba4793077310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e205669657731143012060355040a130b476f6f676c6520496e632e3110300e060355040b1307416e64726f6964311330110603550403130a476f6f676c65204e4643820900de7695041d7650c0300c0603551d13040530030101ff300d06092a864886f70d010105050003820101003771870ce87c3c52ea84899230c6e962d94b4d5f1293c25d88261541fd90b5555d1285cef3b8312c3f5df691a8aae04cb981b305e427fd1d2d9e1987e1d29078f13c8452990f1821980263d8d4bd36519348d8d8ba26d8b99fbf09f5fd3ebb0ea3c2f0c9376f1e1fca76f3a6a405429d081b752a7a90b756e9ab44da41abc8e1e8f88ac2758da743fb73e650719a57840ccb6b7add21b99fc681e456e1872c223d5c074adf55f6abda268c2d8b64ea0a8845eecd968f92b493127e75c753c3ff30cbc678b51c9f52961472f17da20a0dc6274aa2463434c1a9b614df697d8ff5ca8101e7a25c7db3fb055d65569c04b01d389cabba57b3a1703ec2e74a88d334">
+    </signer>
+
+    Debug:
+        Including the tag <debug /> will print to logcat the
+        hex encoded signature of applications that are denied NFCEE
+	access, for easy cut-and-paste into this file.
+     -->
+    <!-- Softcard Wallet debug -->
+    <signer android:signature="3082034830820230a00302010202044f62832f300d06092a864886f70d01010505003066310b3009060355040613025553310b3009060355040813024e593111300f060355040713084e657720596f726b310d300b060355040a130449736973310d300b060355040b13044973697331193017060355040313104a564c2056656e7475726573204c4c43301e170d3132303331363030303235355a170d3339303830323030303235355a3066310b3009060355040613025553310b3009060355040813024e593111300f060355040713084e657720596f726b310d300b060355040a130449736973310d300b060355040b13044973697331193017060355040313104a564c2056656e7475726573204c4c4330820122300d06092a864886f70d01010105000382010f003082010a02820101009aaf7f1047a6821ab0b4ffb7d58f8a0a66f09689dc59926e966b24896759b96304825ea149ebf30e6249877fedac185eec7aa7a44dc718ab578584888c673f46bc351b48dcd54f47bd27a0836032899b0510e0ce69863184bcd033b0654f09e801a24f06fadd7330f3665e12fbbf1c2b616ca14ac169d206607f229a7ad6d3579d330373be0de0d7148eabb80beed83602494247c0b7b735812a5ece89c1ce7f2229f757e29ebfae72350d2db27974cd5341ba5872a92f471a0768972e35246d0269d41d345cd8bda2df14009212d9640f3a33116460dce389c5a113b84e4a6b7f8b597cb601e53dace8777e380ffe4d9f0abfa14993a1f653c9a6bb5a245fd10203010001300d06092a864886f70d010105050003820101009089e52bb237b78c92dd95b4d07004751b3d68e12e83ab0baca39ea593b9b9f8f6395491f6616fe4d2e4c7a7e53c898a17f3ab2c9fac3b1c0886ee8e769ba96488aafd646a7aa425fb283cd6d9d600a083d18868d4d93de7ec73b258f61fc66d2a3f4b4c7b53df62fd3374a5e658bd8266ee24480923ea584f2e7adde360b459e4ad01bcb9f5582f95dab3964e546baf5b33f63acfbb64494902ebae5cc0930abb7dabf0e4727fcc755a6baa6e68be3b864ab1e6438fed6dd280f081ef1e3b3545a257b456b68787d8080653c31ed7f96f6b5a67186dc5a35e620b9bbb9d47a1871d58bf38e192906399c53cb2fab61c1392deae6209d6fb476897a471a23ab4" />
+    <!-- SoftCard Wallet AT&T production -->
+    <signer android:signature="3082037a30820262a00302010202044f86ea3a300d06092a864886f70d0101050500307f310b30090603550406130255533110300e06035504081307556e6b6e6f776e3110300e06035504071307556e6b6e6f776e311c301a060355040a0c13415426542053657276696365732c20496e632e311c301a060355040b0c13415426542053657276696365732c20496e632e3110300e06035504031307556e6b6e6f776e301e170d3132303431323134343431305a170d3339303832393134343431305a307f310b30090603550406130255533110300e06035504081307556e6b6e6f776e3110300e06035504071307556e6b6e6f776e311c301a060355040a0c13415426542053657276696365732c20496e632e311c301a060355040b0c13415426542053657276696365732c20496e632e3110300e06035504031307556e6b6e6f776e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a8292e38262bf7371b34ec160fda04231356343fc38b1e06f6293e1a2230d65dba637ca6901f72fd600bfb8f27ad8b851e5f341331bc53c22118884d98b755f3aebcaa541c34f3f98d9660eef006a18425bb5bc762317d27b27c13caafe5c75663aba207c4bdc909352bfcda289503b175976e7a0dcbb2cb59d6d579fcc0c36e15483442b2c2d595aedc806b629347a8c3eb30be0841b5f12a50d8dd03fb25ebe21074d660eeaf0629fcc7479ae382301d29c5d372e295a1e0426c92da910b65d35fa5b94c37032edfdb497db0ca4a5cea7a6ec5c8aa356e8e775b489d33fe9abe775716e705d92b9555fbb8c359be30e668da3469a6475e61c3ea3c4c7bbe850203010001300d06092a864886f70d010105050003820101000dc0e6494b8aaf20daf0fca2186dfc9d54862096b848e507edeb38466f2f00568f2913688e0aaf87504e115aaee363d5186ecc9eb8f219fc7dbb41d8abff0ecdf5edcb0b4c7a09fc0991bcd52cbcd937563135526d778d1592660af1c09af1ea49ba9e1aa695150f97746eec9a43de2b63844a668476780a22d6757b20ebfa835e15bf060f5645e8d1a1a0e9a1908e3cb080edd798c7f717b0f4e14549801e1d9728300face227fb8c656eeed0b4121625daa28b057ae3d17d5afc15bd419284931ed8c3bd57f5dbbcc8cf5ad2295347e469b3d42c88d876b6da4bc18f1c961142a17bad3585b7d61ca8594ad5177ea26d01265ce257486a551512f4da02116c" />
+    <!-- SoftCard Wallet VZW production -->
+    <signer android:signature="308203C2308202AAA00302010202044F6B9529300D06092A864886F70D01010505003081A2310B3009060355040613025553310B3009060355040813024E4A311630140603550407130D4261736B696E6720526964676531243022060355040A131B566572697A6F6E20436F6D6D756E69636174696F6E7320496E632E31193017060355040B1310566572697A6F6E20576972656C657373312D302B06035504031324566572697A6F6E20576972656C657373205369676E696E67204365727469666963617465301E170D3132303332323231313030315A170D3339303830383231313030315A3081A2310B3009060355040613025553310B3009060355040813024E4A311630140603550407130D4261736B696E6720526964676531243022060355040A131B566572697A6F6E20436F6D6D756E69636174696F6E7320496E632E31193017060355040B1310566572697A6F6E20576972656C657373312D302B06035504031324566572697A6F6E20576972656C657373205369676E696E6720436572746966696361746530820122300D06092A864886F70D01010105000382010F003082010A02820101009452BDCE78F36373D547CA2F6FE0939C239E423311F96A9A2CA253A7B21CBE6F82AF19A97E4B183270395D222423B3A3B9C1809D213E048EF4C63C3C8033C8AC7EB7943E95EF209D819EDEAA9AA41A4F8838054CEA83A19AFD49BE794DA3AFAAA4216320754D6161E691C64E2396DCA7DF0AFB030FFAAEBA96F1575385CB2EF967A09652D14CA2B6A9ECD58A8DFDDB16792A00E5427C7435CAC1714A3C4014B1ACEE14D6E2B220888DF392ACA253D731884E9D5D40214D36033206F07B8F48BD94FFB649F8CD84417AF9A7E4A344FBB3BEA0DA18DD55E2BBFE3A953A3D484CBB02E650FEE8CD2A74C6CCF506F382592BD64F03A10BC64BDAB4577C47E55C96850203010001300D06092A864886F70D01010505000382010100902BBEE97568A427EE75054C731BDADB5D045EB6557B771C06A4BE4D2253650D9E7CE04CBBF10516B23B6E7E03154CB181B421FC91527A9BDBBD7CF4025F4F808888A8A06C1C34C7637F423B56017FD7C002FD651C7C9BD1B73BCEBB31A0DD0870CDFD117BA119BC32324835E7A4E43FD2267B2FB6A326F7E978B7A856FB0E07C663750BC4ED0A11FB48A05AC0B01CA9B14E65496D5F3866617E6C4A63428ED68F56E87A8544CEE4FC1BBD07ED91D888089B2950397AA332883E3DB5C51D41EA31C76CE03B62AB61ABF17CF5E5145A85CE2DDE698D0E8038346DEE9BC59DCBED7CDF41D3CAD10A61B3357A380FC403F2FD1DCD955B2D5DD9D9DFABEFF8284103" />
+</resources>
+