[S] Change in aram-applet[master]: AccessRuleMaster: allow locking of STORE DATA commands - gerrit-log

4 Mar 2025

Attention is currently required from: laforge.

dexter has posted comments on this change by dexter. (
https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email )

Change subject: AccessRuleMaster: allow locking of STORE DATA commands
......................................................................

Patch Set 2:

(4 comments)

Patchset:

PS2: 
Thanks for your review input.

File aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java:

https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/bf633831_f7220c0e?… :
PS2, Line 106:                    
ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
...
  why is this exception not raised in the INSTALL FOR
PERSO case? The only condition for raising it is […] This is part of the scheme. As
far as I understand INSTALL FOR PERSONALIZATION can only be issued from a secure channel
with the ISD.

The process() method is executed when APDUs are sent to the application when it is
selected. Here we have no authentication but we can set this.aram_lock_status to true,
which will make processCmdStoreData() inaccessible for normal users.

In processData() we do not have this blocking logic because this method is only accessible
from a secure channel from the ISD.

This is at least how I understood the world. Please correct me if I am wrong. If there is
a way to call processData() without beeing authenticated, then my Idea will not work of
course.

https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/76ea6920_a805e0ee?… :
PS2, Line 304: 		this.aram_lock_status = true;
...
  mixing tab (new) and space (old) indentation
Done

https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/6640b8f9_3cfe7173?… :
PS2, Line 307: 		this.aram_lock_status = false;
...
  where is the check that this command is only issued
via the INSTALL FOR PERSO ? This method is called from processData() and process().
As far as I know processData only runs when INSTALL FOR PERSONALIZATION is executed. So
from that perspective we should be fine. When the method is called from process()
this.aram_lock_status is checked first, so the executions barred when
this.aram_lock_status is true (see line 105). I think this should be sufficient.

-- 
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
Gerrit-Change-Number: 39615
Gerrit-PatchSet: 2
Gerrit-Owner: dexter &lt;pmaier(a)sysmocom.de&gt;
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge &lt;laforge(a)osmocom.org&gt;
Gerrit-Attention: laforge &lt;laforge(a)osmocom.org&gt;
Gerrit-Comment-Date: Tue, 04 Mar 2025 08:56:54 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge &lt;laforge(a)osmocom.org&gt;