Attention is currently required from: laforge. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email ) Change subject: AccessRuleMaster: allow locking of STORE DATA commands ...................................................................... Patch Set 2: (4 comments) Patchset: PS2: Thanks for your review input. File aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java: https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/bf633831_f7220c0e?u... : PS2, Line 106: ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);

why is this exception not raised in the INSTALL FOR PERSO case? The only condition for raising it is […] This is part of the scheme. As far as I understand INSTALL FOR PERSONALIZATION can only be issued from a secure channel with the ISD.

The process() method is executed when APDUs are sent to the application when it is selected. Here we have no authentication but we can set this.aram_lock_status to true, which will make processCmdStoreData() inaccessible for normal users. In processData() we do not have this blocking logic because this method is only accessible from a secure channel from the ISD. This is at least how I understood the world. Please correct me if I am wrong. If there is a way to call processData() without beeing authenticated, then my Idea will not work of course. https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/76ea6920_a805e0ee?u... : PS2, Line 304: this.aram_lock_status = true;

mixing tab (new) and space (old) indentation Done

https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/6640b8f9_3cfe7173?u... : PS2, Line 307: this.aram_lock_status = false;

where is the check that this command is only issued via the INSTALL FOR PERSO ? This method is called from processData() and process(). As far as I know processData only runs when INSTALL FOR PERSONALIZATION is executed. So from that perspective we should be fine. When the method is called from process() this.aram_lock_status is checked first, so the executions barred when this.aram_lock_status is true (see line 105). I think this should be sufficient.

-- To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: aram-applet Gerrit-Branch: master Gerrit-Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db Gerrit-Change-Number: 39615 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier@sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: laforge <laforge@osmocom.org> Gerrit-Attention: laforge <laforge@osmocom.org> Gerrit-Comment-Date: Tue, 04 Mar 2025 08:56:54 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge@osmocom.org>