blob: ade9fe83cd4d9b1015b94ac553bf92341e1799e5 [file] [log] [blame]
bigbiff7ba75002020-04-11 20:47:09 -04001/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include "FsCrypt.h"
18
mauronofrio matarrese79820322020-05-25 19:48:56 +020019#include "Keymaster.h"
bigbiff7ba75002020-04-11 20:47:09 -040020#include "KeyStorage.h"
21#include "KeyUtil.h"
22#include "Utils.h"
23// #include "VoldUtil.h"
24
25#include <algorithm>
26#include <map>
27#include <set>
28#include <sstream>
29#include <string>
30#include <vector>
31
32#include <dirent.h>
33#include <errno.h>
34#include <fcntl.h>
35#include <limits.h>
36#include <selinux/android.h>
37#include <sys/mount.h>
38#include <sys/stat.h>
39#include <sys/types.h>
40#include <unistd.h>
41
42#include <private/android_filesystem_config.h>
43
44// #include "android/os/IVold.h"
45
46#include "cryptfs.h"
47
48#define EMULATED_USES_SELINUX 0
49#define MANAGE_MISC_DIRS 0
50
51#include <cutils/fs.h>
52#include <cutils/properties.h>
53
54#include <fscrypt/fscrypt.h>
55#include <fs_mgr.h>
56#include <keyutils.h>
57
58#include <android-base/file.h>
59#include <android-base/logging.h>
60#include <android-base/properties.h>
61#include <android-base/stringprintf.h>
62#include <android-base/unique_fd.h>
63
64
65using android::base::StringPrintf;
66using android::fs_mgr::GetEntryForMountPoint;
67using android::vold::kEmptyAuthentication;
68using android::vold::KeyBuffer;
mauronofrio matarrese79820322020-05-25 19:48:56 +020069using android::vold::Keymaster;
70using android::hardware::keymaster::V4_0::KeyFormat;
bigbiff7ba75002020-04-11 20:47:09 -040071// using android::vold::writeStringToFile;
72
73// Store main DE raw ref / policy
74std::string de_raw_ref;
75std::map<userid_t, std::string> s_de_key_raw_refs;
76std::map<userid_t, std::string> s_ce_key_raw_refs;
77
78namespace {
79
80struct PolicyKeyRef {
81 std::string contents_mode;
82 std::string filenames_mode;
83 std::string key_raw_ref;
84};
85
86const std::string device_key_dir = std::string() + DATA_MNT_POINT + fscrypt_unencrypted_folder;
87const std::string device_key_path = device_key_dir + "/key";
88const std::string device_key_temp = device_key_dir + "/temp";
89
90const std::string user_key_dir = std::string() + DATA_MNT_POINT + "/misc/vold/user_keys";
91const std::string user_key_temp = user_key_dir + "/temp";
bigbiffad58e1b2020-07-06 20:24:34 -040092const std::string prepare_subdirs_path = "/system/bin/vold_prepare_subdirs";
bigbiff7ba75002020-04-11 20:47:09 -040093
94const std::string systemwide_volume_key_dir =
95 std::string() + DATA_MNT_POINT + "/misc/vold/volume_keys";
96const int STORAGE_FLAG_DE = 1;
97const int STORAGE_FLAG_CE = 2;
98
99bool s_systemwide_keys_initialized = false;
100
101android::fs_mgr::Fstab fstab_default;
102
103// Some users are ephemeral, don't try to wipe their keys from disk
104std::set<userid_t> s_ephemeral_users;
105
106// TODO abolish this map, per b/26948053
107std::map<userid_t, KeyBuffer> s_ce_keys;
108
109} // namespace
110
111static bool fscrypt_is_emulated() {
112 return property_get_bool("persist.sys.emulate_fbe", false);
113}
114
115static const char* escape_empty(const std::string& value) {
116 return value.empty() ? "null" : value.c_str();
117}
118
119static std::string get_de_key_path(userid_t user_id) {
120 return StringPrintf("%s/de/%d", user_key_dir.c_str(), user_id);
121}
122
123static std::string get_ce_key_directory_path(userid_t user_id) {
124 return StringPrintf("%s/ce/%d", user_key_dir.c_str(), user_id);
125}
126
127// Returns the keys newest first
128static std::vector<std::string> get_ce_key_paths(const std::string& directory_path) {
129 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(directory_path.c_str()), closedir);
130 if (!dirp) {
131 PLOG(ERROR) << "Unable to open ce key directory: " + directory_path;
132 return std::vector<std::string>();
133 }
134 std::vector<std::string> result;
135 for (;;) {
136 errno = 0;
137 auto const entry = readdir(dirp.get());
138 if (!entry) {
139 if (errno) {
140 PLOG(ERROR) << "Unable to read ce key directory: " + directory_path;
141 return std::vector<std::string>();
142 }
143 break;
144 }
145 if (entry->d_type != DT_DIR || entry->d_name[0] != 'c') {
146 LOG(DEBUG) << "Skipping non-key " << entry->d_name;
147 continue;
148 }
149 result.emplace_back(directory_path + "/" + entry->d_name);
150 }
151 std::sort(result.begin(), result.end());
152 std::reverse(result.begin(), result.end());
153 return result;
154}
155
156static std::string get_ce_key_current_path(const std::string& directory_path) {
157 return directory_path + "/current";
158}
159
160static bool get_ce_key_new_path(const std::string& directory_path,
161 const std::vector<std::string>& paths, std::string* ce_key_path) {
162 if (paths.empty()) {
163 *ce_key_path = get_ce_key_current_path(directory_path);
164 return true;
165 }
166 for (unsigned int i = 0; i < UINT_MAX; i++) {
167 auto const candidate = StringPrintf("%s/cx%010u", directory_path.c_str(), i);
168 if (paths[0] < candidate) {
169 *ce_key_path = candidate;
170 return true;
171 }
172 }
173 return false;
174}
175
176// Discard all keys but the named one; rename it to canonical name.
177// No point in acting on errors in this; ignore them.
178static void fixate_user_ce_key(const std::string& directory_path, const std::string& to_fix,
179 const std::vector<std::string>& paths) {
180 for (auto const other_path : paths) {
181 if (other_path != to_fix) {
182 android::vold::destroyKey(other_path);
183 }
184 }
185 auto const current_path = get_ce_key_current_path(directory_path);
186 if (to_fix != current_path) {
187 LOG(DEBUG) << "Renaming " << to_fix << " to " << current_path;
188 if (rename(to_fix.c_str(), current_path.c_str()) != 0) {
189 PLOG(WARNING) << "Unable to rename " << to_fix << " to " << current_path;
190 return;
191 }
192 }
193 android::vold::FsyncDirectory(directory_path);
194}
195
196static bool read_and_fixate_user_ce_key(userid_t user_id,
197 const android::vold::KeyAuthentication& auth,
198 KeyBuffer* ce_key) {
199 auto const directory_path = get_ce_key_directory_path(user_id);
200 auto const paths = get_ce_key_paths(directory_path);
201 for (auto const ce_key_path : paths) {
202 LOG(DEBUG) << "Trying user CE key " << ce_key_path;
203 if (android::vold::retrieveKey(ce_key_path, auth, ce_key)) {
204 LOG(DEBUG) << "Successfully retrieved key";
205 fixate_user_ce_key(directory_path, ce_key_path, paths);
206 return true;
207 }
208 }
209 LOG(ERROR) << "Failed to find working ce key for user " << user_id;
210 return false;
211}
212
mauronofrio matarrese79820322020-05-25 19:48:56 +0200213static bool is_wrapped_key_supported_common(const std::string& mount_point) {
mauronofrio matarrese17fb1212020-05-25 19:59:17 +0200214 LOG(DEBUG) << "Determining wrapped-key support for " << mount_point;
215 std::string wrapped_key_supported = android::base::GetProperty("fbe.data.wrappedkey", "false");
216 LOG(DEBUG) << "fbe.data.wrappedkey = " << wrapped_key_supported;
217 if (mount_point == DATA_MNT_POINT && wrapped_key_supported == "true") {
218 LOG(DEBUG) << "Wrapped key supported on " << mount_point;
219 return true;
220 } else {
mauronofrio matarrese79820322020-05-25 19:48:56 +0200221 return false;
222 }
mauronofrio matarrese79820322020-05-25 19:48:56 +0200223}
224
225bool is_wrapped_key_supported() {
226 return is_wrapped_key_supported_common(DATA_MNT_POINT);
227}
228
229bool is_wrapped_key_supported_external() {
230 return false;
231}
232
mauronofrio539597d2020-05-25 22:23:48 +0200233bool is_metadata_wrapped_key_supported_common(const std::string& mount_point) {
mauronofrio matarresef1079ed2020-05-25 20:52:57 +0200234 LOG(DEBUG) << "Determining metadata wrapped-key support for " << mount_point;
235 std::string wrapped_key_supported = android::base::GetProperty("fbe.metadata.wrappedkey", "false");
236 LOG(DEBUG) << "fbe.metadata.wrappedkey = " << wrapped_key_supported;
237 if (mount_point == METADATA_MNT_POINT && wrapped_key_supported == "true") {
238 LOG(DEBUG) << "Wrapped key supported on " << mount_point;
239 return true;
240 } else {
241 return false;
242 }
243}
244
mauronofrio539597d2020-05-25 22:23:48 +0200245bool is_metadata_wrapped_key_supported() {
246 return is_metadata_wrapped_key_supported_common(METADATA_MNT_POINT);
247}
248
bigbiff7ba75002020-04-11 20:47:09 -0400249static bool read_and_install_user_ce_key(userid_t user_id,
250 const android::vold::KeyAuthentication& auth) {
251 if (s_ce_key_raw_refs.count(user_id) != 0) return true;
252 KeyBuffer ce_key;
253 if (!read_and_fixate_user_ce_key(user_id, auth, &ce_key)) return false;
254 std::string ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200255 if (is_wrapped_key_supported()) {
256 KeyBuffer ephemeral_wrapped_key;
257 if (!getEphemeralWrappedKey(KeyFormat::RAW, ce_key, &ephemeral_wrapped_key)) {
258 LOG(ERROR) << "Failed to export ce key";
259 return false;
260 }
261 ce_key = std::move(ephemeral_wrapped_key);
262 }
bigbiff7ba75002020-04-11 20:47:09 -0400263 if (!android::vold::installKey(ce_key, &ce_raw_ref)) return false;
264 s_ce_keys[user_id] = std::move(ce_key);
265 s_ce_key_raw_refs[user_id] = ce_raw_ref;
266 LOG(DEBUG) << "Installed ce key for user " << user_id;
267 return true;
268}
269
270static bool prepare_dir(const std::string& dir, mode_t mode, uid_t uid, gid_t gid) {
271 LOG(DEBUG) << "Preparing: " << dir;
272 if (fs_prepare_dir(dir.c_str(), mode, uid, gid) != 0) {
273 PLOG(ERROR) << "Failed to prepare " << dir;
274 return false;
275 }
276 return true;
277}
278
279static bool destroy_dir(const std::string& dir) {
280 LOG(DEBUG) << "Destroying: " << dir;
281 if (rmdir(dir.c_str()) != 0 && errno != ENOENT) {
282 PLOG(ERROR) << "Failed to destroy " << dir;
283 return false;
284 }
285 return true;
286}
287
288// NB this assumes that there is only one thread listening for crypt commands, because
289// it creates keys in a fixed location.
290static bool create_and_install_user_keys(userid_t user_id, bool create_ephemeral) {
291 KeyBuffer de_key, ce_key;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200292
293 if(is_wrapped_key_supported()) {
294 if (!generateWrappedKey(user_id, android::vold::KeyType::DE_USER, &de_key)) return false;
295 if (!generateWrappedKey(user_id, android::vold::KeyType::CE_USER, &ce_key)) return false;
296 } else {
297 if (!android::vold::randomKey(&de_key)) return false;
298 if (!android::vold::randomKey(&ce_key)) return false;
299 }
300
bigbiff7ba75002020-04-11 20:47:09 -0400301 if (create_ephemeral) {
302 // If the key should be created as ephemeral, don't store it.
303 s_ephemeral_users.insert(user_id);
304 } else {
305 auto const directory_path = get_ce_key_directory_path(user_id);
306 if (!prepare_dir(directory_path, 0700, AID_ROOT, AID_ROOT)) return false;
307 auto const paths = get_ce_key_paths(directory_path);
308 std::string ce_key_path;
309 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
310 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, kEmptyAuthentication,
311 ce_key))
312 return false;
313 fixate_user_ce_key(directory_path, ce_key_path, paths);
314 // Write DE key second; once this is written, all is good.
315 if (!android::vold::storeKeyAtomically(get_de_key_path(user_id), user_key_temp,
316 kEmptyAuthentication, de_key))
317 return false;
318 }
mauronofrio matarrese79820322020-05-25 19:48:56 +0200319
bigbiff7ba75002020-04-11 20:47:09 -0400320 std::string ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200321 if (is_wrapped_key_supported()) {
322 KeyBuffer ephemeral_wrapped_de_key;
323 KeyBuffer ephemeral_wrapped_ce_key;
324
325 /* Export and install the DE keys */
326 if (!getEphemeralWrappedKey(KeyFormat::RAW, de_key, &ephemeral_wrapped_de_key)) {
327 LOG(ERROR) << "Failed to export de_key";
328 return false;
329 }
330 /* Export and install the CE keys */
331 if (!getEphemeralWrappedKey(KeyFormat::RAW, ce_key, &ephemeral_wrapped_ce_key)) {
332 LOG(ERROR) << "Failed to export de_key";
333 return false;
334 }
335
336 de_key = std::move(ephemeral_wrapped_de_key);
337 ce_key = std::move(ephemeral_wrapped_ce_key);
338 }
339 if (!android::vold::installKey(de_key, &de_raw_ref)) return false;
bigbiff7ba75002020-04-11 20:47:09 -0400340 if (!android::vold::installKey(ce_key, &ce_raw_ref)) return false;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200341 s_ce_keys[user_id] = std::move(ce_key);
342
343 s_de_key_raw_refs[user_id] = de_raw_ref;
bigbiff7ba75002020-04-11 20:47:09 -0400344 s_ce_key_raw_refs[user_id] = ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200345
bigbiff7ba75002020-04-11 20:47:09 -0400346 LOG(DEBUG) << "Created keys for user " << user_id;
347 return true;
348}
349
350bool lookup_key_ref(const std::map<userid_t, std::string>& key_map, userid_t user_id,
351 std::string* raw_ref) {
352 auto refi = key_map.find(user_id);
353 if (refi == key_map.end()) {
354 LOG(DEBUG) << "Cannot find key for " << user_id;
355 return false;
356 }
357 *raw_ref = refi->second;
358 return true;
359}
360
361static void get_data_file_encryption_modes(PolicyKeyRef* key_ref) {
362 if (!ReadDefaultFstab(&fstab_default)) {
363 PLOG(ERROR) << "Failed to open default fstab";
364 return;
365 }
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200366 /*auto entry = android::fs_mgr::GetEntryForMountPoint(&fstab_default, DATA_MNT_POINT);
bigbiff7ba75002020-04-11 20:47:09 -0400367 if (entry == nullptr) {
368 LOG(ERROR) << "get_data_file_encryption_modes::failed\n";
369 return;
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200370 }*/
371 LOG(INFO) << "contents mode '" << android::base::GetProperty("fbe.contents", "aes-256-xts") << "' filenames '" << android::base::GetProperty("fbe.filenames", "aes-256-heh") << "'\n";
372 key_ref->contents_mode =
373 android::base::GetProperty("fbe.contents", "aes-256-xts");
374 key_ref->filenames_mode =
375 android::base::GetProperty("fbe.filenames", "aes-256-heh");
bigbiff7ba75002020-04-11 20:47:09 -0400376}
377
378static bool ensure_policy(const PolicyKeyRef& key_ref, const std::string& path) {
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200379 return true;
380 /*return fscrypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
bigbiff7ba75002020-04-11 20:47:09 -0400381 key_ref.key_raw_ref.size(), key_ref.contents_mode.c_str(),
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200382 key_ref.filenames_mode.c_str()) == 0;*/
bigbiff7ba75002020-04-11 20:47:09 -0400383}
384
385static bool is_numeric(const char* name) {
386 for (const char* p = name; *p != '\0'; p++) {
387 if (!isdigit(*p)) return false;
388 }
389 return true;
390}
391
392static bool load_all_de_keys() {
393 auto de_dir = user_key_dir + "/de";
394 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(de_dir.c_str()), closedir);
395 if (!dirp) {
396 PLOG(ERROR) << "Unable to read de key directory";
397 return false;
398 }
399 for (;;) {
400 errno = 0;
401 auto entry = readdir(dirp.get());
402 if (!entry) {
403 if (errno) {
404 PLOG(ERROR) << "Unable to read de key directory";
405 return false;
406 }
407 break;
408 }
409 if (entry->d_type != DT_DIR || !is_numeric(entry->d_name)) {
410 LOG(DEBUG) << "Skipping non-de-key " << entry->d_name;
411 continue;
412 }
413 userid_t user_id = std::stoi(entry->d_name);
414 if (s_de_key_raw_refs.count(user_id) == 0) {
415 auto key_path = de_dir + "/" + entry->d_name;
416 KeyBuffer key;
417 if (!android::vold::retrieveKey(key_path, kEmptyAuthentication, &key)) return false;
418 std::string raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200419 if (is_wrapped_key_supported()) {
420 KeyBuffer ephemeral_wrapped_key;
421 if (!getEphemeralWrappedKey(KeyFormat::RAW, key, &ephemeral_wrapped_key)) {
422 LOG(ERROR) << "Failed to export de_key in create_and_install_user_keys";
423 return false;
424 }
425 key = std::move(ephemeral_wrapped_key);
426 }
bigbiff7ba75002020-04-11 20:47:09 -0400427 if (!android::vold::installKey(key, &raw_ref)) return false;
428 s_de_key_raw_refs[user_id] = raw_ref;
429 LOG(DEBUG) << "Installed de key for user " << user_id;
Noah Jacobson81d638d2019-04-28 00:10:07 -0400430
431 std::string user_prop = "twrp.user." + std::to_string(user_id) + ".decrypt";
432 property_set(user_prop.c_str(), "0");
bigbiff7ba75002020-04-11 20:47:09 -0400433 }
434 }
435 // fscrypt:TODO: go through all DE directories, ensure that all user dirs have the
436 // correct policy set on them, and that no rogue ones exist.
437 return true;
438}
439
440bool fscrypt_initialize_systemwide_keys() {
441 LOG(INFO) << "fscrypt_initialize_systemwide_keys";
mauronofrio matarrese79820322020-05-25 19:48:56 +0200442 bool wrapped_key_supported = false;
bigbiff7ba75002020-04-11 20:47:09 -0400443
444 if (s_systemwide_keys_initialized) {
445 LOG(INFO) << "Already initialized";
446 return true;
447 }
448
449 PolicyKeyRef device_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200450 wrapped_key_supported = is_wrapped_key_supported();
451
452 if (!android::vold::retrieveAndInstallKey(true, kEmptyAuthentication,
453 device_key_path, device_key_temp,
454 &device_ref.key_raw_ref, wrapped_key_supported))
bigbiff7ba75002020-04-11 20:47:09 -0400455 return false;
456 get_data_file_encryption_modes(&device_ref);
457
458 std::string modestring = device_ref.contents_mode + ":" + device_ref.filenames_mode;
459 std::string mode_filename = std::string("/data") + fscrypt_key_mode;
460 if (!android::vold::writeStringToFile(modestring, mode_filename)) return false;
461
462 std::string ref_filename = std::string("/data") + fscrypt_key_ref;
463 if (!android::vold::writeStringToFile(device_ref.key_raw_ref, ref_filename)) return false;
464 LOG(INFO) << "Wrote system DE key reference to:" << ref_filename;
465
466 KeyBuffer per_boot_key;
467 if (!android::vold::randomKey(&per_boot_key)) return false;
468 std::string per_boot_raw_ref;
469 if (!android::vold::installKey(per_boot_key, &per_boot_raw_ref)) return false;
470 std::string per_boot_ref_filename = std::string("/data") + fscrypt_key_per_boot_ref;
471 if (!android::vold::writeStringToFile(per_boot_raw_ref, per_boot_ref_filename)) return false;
472 LOG(INFO) << "Wrote per boot key reference to:" << per_boot_ref_filename;
473
474 if (!android::vold::FsyncDirectory(device_key_dir)) return false;
475 s_systemwide_keys_initialized = true;
476 de_raw_ref = device_ref.key_raw_ref;
477 return true;
478}
479
480bool fscrypt_init_user0() {
481 if (!ReadDefaultFstab(&fstab_default)) {
482 PLOG(ERROR) << "Failed to open default fstab";
483 return -1;
484 }
485 if (fscrypt_is_native()) {
486 if (!prepare_dir(user_key_dir, 0700, AID_ROOT, AID_ROOT)) return false;
487 if (!prepare_dir(user_key_dir + "/ce", 0700, AID_ROOT, AID_ROOT)) return false;
488 if (!prepare_dir(user_key_dir + "/de", 0700, AID_ROOT, AID_ROOT)) return false;
489 if (!android::vold::pathExists(get_de_key_path(0))) {
490 if (!create_and_install_user_keys(0, false)) return false;
491 }
492 // TODO: switch to loading only DE_0 here once framework makes
493 // explicit calls to install DE keys for secondary users
494 if (!load_all_de_keys()) return false;
495 }
496 // We can only safely prepare DE storage here, since CE keys are probably
497 // entangled with user credentials. The framework will always prepare CE
498 // storage once CE keys are installed.
499 if (!fscrypt_prepare_user_storage("", 0, 0, STORAGE_FLAG_DE)) {
500 LOG(ERROR) << "Failed to prepare user 0 storage";
501 return false;
502 }
503 // If this is a non-FBE device that recently left an emulated mode,
504 // restore user data directories to known-good state.
505 if (!fscrypt_is_native() && !fscrypt_is_emulated()) {
506 fscrypt_unlock_user_key(0, 0, "!", "!");
507 }
508
509 return true;
510}
511
512bool fscrypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral) {
513 LOG(DEBUG) << "fscrypt_vold_create_user_key for " << user_id << " serial " << serial;
514 if (!fscrypt_is_native()) {
515 return true;
516 }
517 // FIXME test for existence of key that is not loaded yet
518 if (s_ce_key_raw_refs.count(user_id) != 0) {
519 LOG(ERROR) << "Already exists, can't fscrypt_vold_create_user_key for " << user_id
520 << " serial " << serial;
521 // FIXME should we fail the command?
522 return true;
523 }
524 if (!create_and_install_user_keys(user_id, ephemeral)) {
525 return false;
526 }
527 return true;
528}
529
530static void drop_caches() {
531 // Clean any dirty pages (otherwise they won't be dropped).
532 sync();
533 // Drop inode and page caches.
534 if (!android::vold::writeStringToFile("3", "/proc/sys/vm/drop_caches")) {
535 PLOG(ERROR) << "Failed to drop caches during key eviction";
536 }
537}
538
539static bool evict_ce_key(userid_t user_id) {
540 s_ce_keys.erase(user_id);
541 bool success = true;
542 std::string raw_ref;
543 // If we haven't loaded the CE key, no need to evict it.
544 if (lookup_key_ref(s_ce_key_raw_refs, user_id, &raw_ref)) {
545 success &= android::vold::evictKey(raw_ref);
546 drop_caches();
547 }
548 s_ce_key_raw_refs.erase(user_id);
549 return success;
550}
551
552bool fscrypt_destroy_user_key(userid_t user_id) {
553 LOG(DEBUG) << "fscrypt_destroy_user_key(" << user_id << ")";
554 if (!fscrypt_is_native()) {
555 return true;
556 }
557 bool success = true;
558 std::string raw_ref;
559 success &= evict_ce_key(user_id);
560 success &=
561 lookup_key_ref(s_de_key_raw_refs, user_id, &raw_ref) && android::vold::evictKey(raw_ref);
562 s_de_key_raw_refs.erase(user_id);
563 auto it = s_ephemeral_users.find(user_id);
564 if (it != s_ephemeral_users.end()) {
565 s_ephemeral_users.erase(it);
566 } else {
567 for (auto const path : get_ce_key_paths(get_ce_key_directory_path(user_id))) {
568 success &= android::vold::destroyKey(path);
569 }
570 auto de_key_path = get_de_key_path(user_id);
571 if (android::vold::pathExists(de_key_path)) {
572 success &= android::vold::destroyKey(de_key_path);
573 } else {
574 LOG(INFO) << "Not present so not erasing: " << de_key_path;
575 }
576 }
577 return success;
578}
579
580static bool emulated_lock(const std::string& path) {
581 if (chmod(path.c_str(), 0000) != 0) {
582 PLOG(ERROR) << "Failed to chmod " << path;
583 return false;
584 }
585#if EMULATED_USES_SELINUX
586 if (setfilecon(path.c_str(), "u:object_r:storage_stub_file:s0") != 0) {
587 PLOG(WARNING) << "Failed to setfilecon " << path;
588 return false;
589 }
590#endif
591 return true;
592}
593
594static bool emulated_unlock(const std::string& path, mode_t mode) {
595 if (chmod(path.c_str(), mode) != 0) {
596 PLOG(ERROR) << "Failed to chmod " << path;
597 // FIXME temporary workaround for b/26713622
598 if (fscrypt_is_emulated()) return false;
599 }
600#if EMULATED_USES_SELINUX
601 if (selinux_android_restorecon(path.c_str(), SELINUX_ANDROID_RESTORECON_FORCE) != 0) {
602 PLOG(WARNING) << "Failed to restorecon " << path;
603 // FIXME temporary workaround for b/26713622
604 if (fscrypt_is_emulated()) return false;
605 }
606#endif
607 return true;
608}
609
610static bool parse_hex(const std::string& hex, std::string* result) {
611 if (hex == "!") {
612 *result = "";
613 return true;
614 }
615 if (android::vold::HexToStr(hex, *result) != 0) {
616 LOG(ERROR) << "Invalid FBE hex string"; // Don't log the string for security reasons
617 return false;
618 }
619 return true;
620}
621
622static std::string volkey_path(const std::string& misc_path, const std::string& volume_uuid) {
623 return misc_path + "/vold/volume_keys/" + volume_uuid + "/default";
624}
625
626static std::string volume_secdiscardable_path(const std::string& volume_uuid) {
627 return systemwide_volume_key_dir + "/" + volume_uuid + "/secdiscardable";
628}
629
630static bool read_or_create_volkey(const std::string& misc_path, const std::string& volume_uuid,
631 PolicyKeyRef* key_ref) {
632 auto secdiscardable_path = volume_secdiscardable_path(volume_uuid);
633 std::string secdiscardable_hash;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200634 bool wrapped_key_supported = false;
bigbiff7ba75002020-04-11 20:47:09 -0400635 if (android::vold::pathExists(secdiscardable_path)) {
636 if (!android::vold::readSecdiscardable(secdiscardable_path, &secdiscardable_hash))
637 return false;
638 } else {
639 if (fs_mkdirs(secdiscardable_path.c_str(), 0700) != 0) {
640 PLOG(ERROR) << "Creating directories for: " << secdiscardable_path;
641 return false;
642 }
643 if (!android::vold::createSecdiscardable(secdiscardable_path, &secdiscardable_hash))
644 return false;
645 }
646 auto key_path = volkey_path(misc_path, volume_uuid);
647 if (fs_mkdirs(key_path.c_str(), 0700) != 0) {
648 PLOG(ERROR) << "Creating directories for: " << key_path;
649 return false;
650 }
651 android::vold::KeyAuthentication auth("", secdiscardable_hash);
mauronofrio matarrese79820322020-05-25 19:48:56 +0200652 wrapped_key_supported = is_wrapped_key_supported_external();
653
bigbiff7ba75002020-04-11 20:47:09 -0400654 if (!android::vold::retrieveAndInstallKey(true, auth, key_path, key_path + "_tmp",
mauronofrio matarrese79820322020-05-25 19:48:56 +0200655 &key_ref->key_raw_ref, wrapped_key_supported))
bigbiff7ba75002020-04-11 20:47:09 -0400656 return false;
657 key_ref->contents_mode =
658 android::base::GetProperty("ro.crypto.volume.contents_mode", "aes-256-xts");
659 key_ref->filenames_mode =
660 android::base::GetProperty("ro.crypto.volume.filenames_mode", "aes-256-heh");
661 return true;
662}
663
664static bool destroy_volkey(const std::string& misc_path, const std::string& volume_uuid) {
665 auto path = volkey_path(misc_path, volume_uuid);
666 if (!android::vold::pathExists(path)) return true;
667 return android::vold::destroyKey(path);
668}
669
670bool fscrypt_add_user_key_auth(userid_t user_id, int serial, const std::string& token_hex,
671 const std::string& secret_hex) {
672 LOG(DEBUG) << "fscrypt_add_user_key_auth " << user_id << " serial=" << serial
673 << " token_present=" << (token_hex != "!");
674 if (!fscrypt_is_native()) return true;
675 if (s_ephemeral_users.count(user_id) != 0) return true;
676 std::string token, secret;
677 if (!parse_hex(token_hex, &token)) return false;
678 if (!parse_hex(secret_hex, &secret)) return false;
679 auto auth =
680 secret.empty() ? kEmptyAuthentication : android::vold::KeyAuthentication(token, secret);
bigbiff7ba75002020-04-11 20:47:09 -0400681 auto const directory_path = get_ce_key_directory_path(user_id);
682 auto const paths = get_ce_key_paths(directory_path);
mauronofrio matarrese79820322020-05-25 19:48:56 +0200683
684 KeyBuffer ce_key;
685 if(is_wrapped_key_supported()) {
686 std::string ce_key_current_path = get_ce_key_current_path(directory_path);
687 if (android::vold::retrieveKey(ce_key_current_path, kEmptyAuthentication, &ce_key)) {
688 LOG(DEBUG) << "Successfully retrieved key";
689 } else {
690 if (android::vold::retrieveKey(ce_key_current_path, auth, &ce_key)) {
691 LOG(DEBUG) << "Successfully retrieved key";
692 }
693 }
694 } else {
695 auto it = s_ce_keys.find(user_id);
696 if (it == s_ce_keys.end()) {
697 LOG(ERROR) << "Key not loaded into memory, can't change for user " << user_id;
698 return false;
699 }
700 ce_key = it->second;
701 }
702
bigbiff7ba75002020-04-11 20:47:09 -0400703 std::string ce_key_path;
704 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
705 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, auth, ce_key)) return false;
706 if (!android::vold::FsyncDirectory(directory_path)) return false;
707 return true;
708}
709
mauronofrio matarrese79820322020-05-25 19:48:56 +0200710bool fscrypt_clear_user_key_auth(userid_t user_id, int serial, const std::string& token_hex,
711 const std::string& secret_hex) {
712 LOG(DEBUG) << "fscrypt_clear_user_key_auth " << user_id << " serial=" << serial
713 << " token_present=" << (token_hex != "!");
714 if (!fscrypt_is_native()) return true;
715 if (s_ephemeral_users.count(user_id) != 0) return true;
716 std::string token, secret;
717
718 if (!parse_hex(token_hex, &token)) return false;
719 if (!parse_hex(secret_hex, &secret)) return false;
720
721 if (is_wrapped_key_supported()) {
722 auto const directory_path = get_ce_key_directory_path(user_id);
723 auto const paths = get_ce_key_paths(directory_path);
724
725 KeyBuffer ce_key;
726 std::string ce_key_current_path = get_ce_key_current_path(directory_path);
727
728 auto auth = android::vold::KeyAuthentication(token, secret);
729 /* Retrieve key while removing a pin. A secret is needed */
730 if (android::vold::retrieveKey(ce_key_current_path, auth, &ce_key)) {
731 LOG(DEBUG) << "Successfully retrieved key";
732 } else {
733 /* Retrieve key when going None to swipe and vice versa when a
734 synthetic password is present */
735 if (android::vold::retrieveKey(ce_key_current_path, kEmptyAuthentication, &ce_key)) {
736 LOG(DEBUG) << "Successfully retrieved key";
737 }
738 }
739
740 std::string ce_key_path;
741 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
742 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, kEmptyAuthentication, ce_key))
743 return false;
744 } else {
745 if(!fscrypt_add_user_key_auth(user_id, serial, "!", "!")) return false;
746 }
747 return true;
748}
749
bigbiff7ba75002020-04-11 20:47:09 -0400750bool fscrypt_fixate_newest_user_key_auth(userid_t user_id) {
751 LOG(DEBUG) << "fscrypt_fixate_newest_user_key_auth " << user_id;
752 if (!fscrypt_is_native()) return true;
753 if (s_ephemeral_users.count(user_id) != 0) return true;
754 auto const directory_path = get_ce_key_directory_path(user_id);
755 auto const paths = get_ce_key_paths(directory_path);
756 if (paths.empty()) {
757 LOG(ERROR) << "No ce keys present, cannot fixate for user " << user_id;
758 return false;
759 }
760 fixate_user_ce_key(directory_path, paths[0], paths);
761 return true;
762}
763
764// TODO: rename to 'install' for consistency, and take flags to know which keys to install
765bool fscrypt_unlock_user_key(userid_t user_id, int serial, const std::string& token_hex,
766 const std::string& secret_hex) {
767 LOG(DEBUG) << "fscrypt_unlock_user_key " << user_id << " serial=" << serial
768 << " token_present=" << (token_hex != "!");
769 if (fscrypt_is_native()) {
770 if (s_ce_key_raw_refs.count(user_id) != 0) {
771 LOG(WARNING) << "Tried to unlock already-unlocked key for user " << user_id;
772 return true;
773 }
774 std::string token, secret;
775 if (!parse_hex(token_hex, &token)) return false;
776 if (!parse_hex(secret_hex, &secret)) return false;
777 android::vold::KeyAuthentication auth(token, secret);
778 if (!read_and_install_user_ce_key(user_id, auth)) {
779 LOG(ERROR) << "Couldn't read key for " << user_id;
780 return false;
781 }
782 } else {
783 // When in emulation mode, we just use chmod. However, we also
784 // unlock directories when not in emulation mode, to bring devices
785 // back into a known-good state.
786 if (!emulated_unlock(android::vold::BuildDataSystemCePath(user_id), 0771) ||
787 !emulated_unlock(android::vold::BuildDataMiscCePath(user_id), 01771) ||
788 !emulated_unlock(android::vold::BuildDataMediaCePath("", user_id), 0770) ||
789 !emulated_unlock(android::vold::BuildDataUserCePath("", user_id), 0771)) {
790 LOG(ERROR) << "Failed to unlock user " << user_id;
791 return false;
792 }
793 }
794 return true;
795}
796
797// TODO: rename to 'evict' for consistency
798bool fscrypt_lock_user_key(userid_t user_id) {
799 LOG(DEBUG) << "fscrypt_lock_user_key " << user_id;
800 if (fscrypt_is_native()) {
801 return evict_ce_key(user_id);
802 } else if (fscrypt_is_emulated()) {
803 // When in emulation mode, we just use chmod
804 if (!emulated_lock(android::vold::BuildDataSystemCePath(user_id)) ||
805 !emulated_lock(android::vold::BuildDataMiscCePath(user_id)) ||
806 !emulated_lock(android::vold::BuildDataMediaCePath("", user_id)) ||
807 !emulated_lock(android::vold::BuildDataUserCePath("", user_id))) {
808 LOG(ERROR) << "Failed to lock user " << user_id;
809 return false;
810 }
811 }
812
813 return true;
814}
815
816static bool prepare_subdirs(const std::string& action, const std::string& volume_uuid,
817 userid_t user_id, int flags) {
818 if (0 != android::vold::ForkExecvp(
819 std::vector<std::string>{prepare_subdirs_path, action, volume_uuid,
820 std::to_string(user_id), std::to_string(flags)})) {
821 LOG(ERROR) << "vold_prepare_subdirs failed";
822 return false;
823 }
824 return true;
825}
826
827bool fscrypt_prepare_user_storage(const std::string& volume_uuid, userid_t user_id, int serial,
828 int flags) {
829 LOG(DEBUG) << "fscrypt_prepare_user_storage for volume " << escape_empty(volume_uuid)
830 << ", user " << user_id << ", serial " << serial << ", flags " << flags;
831
832 if (flags & STORAGE_FLAG_DE) {
833 // DE_sys key
834 auto system_legacy_path = android::vold::BuildDataSystemLegacyPath(user_id);
835 auto misc_legacy_path = android::vold::BuildDataMiscLegacyPath(user_id);
836 auto profiles_de_path = android::vold::BuildDataProfilesDePath(user_id);
837
838 // DE_n key
839 auto system_de_path = android::vold::BuildDataSystemDePath(user_id);
840 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id);
841 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id);
842 auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);
843
844 if (volume_uuid.empty()) {
845 if (!prepare_dir(system_legacy_path, 0700, AID_SYSTEM, AID_SYSTEM)) return false;
846#if MANAGE_MISC_DIRS
847 if (!prepare_dir(misc_legacy_path, 0750, multiuser_get_uid(user_id, AID_SYSTEM),
848 multiuser_get_uid(user_id, AID_EVERYBODY)))
849 return false;
850#endif
851 if (!prepare_dir(profiles_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
852
853 if (!prepare_dir(system_de_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
854 if (!prepare_dir(misc_de_path, 01771, AID_SYSTEM, AID_MISC)) return false;
855 if (!prepare_dir(vendor_de_path, 0771, AID_ROOT, AID_ROOT)) return false;
856 }
857 if (!prepare_dir(user_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
858
859 if (fscrypt_is_native()) {
860 PolicyKeyRef de_ref;
861 if (volume_uuid.empty()) {
862 if (!lookup_key_ref(s_de_key_raw_refs, user_id, &de_ref.key_raw_ref)) return false;
863 get_data_file_encryption_modes(&de_ref);
864 if (!ensure_policy(de_ref, system_de_path)) return false;
865 if (!ensure_policy(de_ref, misc_de_path)) return false;
866 if (!ensure_policy(de_ref, vendor_de_path)) return false;
867 } else {
868 if (!read_or_create_volkey(misc_de_path, volume_uuid, &de_ref)) return false;
869 }
870 if (!ensure_policy(de_ref, user_de_path)) return false;
871 }
872 }
873 if (flags & STORAGE_FLAG_CE) {
874 // CE_n key
875 auto system_ce_path = android::vold::BuildDataSystemCePath(user_id);
876 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id);
877 auto vendor_ce_path = android::vold::BuildDataVendorCePath(user_id);
878 auto media_ce_path = android::vold::BuildDataMediaCePath(volume_uuid, user_id);
879 auto user_ce_path = android::vold::BuildDataUserCePath(volume_uuid, user_id);
880
881 if (volume_uuid.empty()) {
882 if (!prepare_dir(system_ce_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
883 if (!prepare_dir(misc_ce_path, 01771, AID_SYSTEM, AID_MISC)) return false;
884 if (!prepare_dir(vendor_ce_path, 0771, AID_ROOT, AID_ROOT)) return false;
885 }
886 if (!prepare_dir(media_ce_path, 0770, AID_MEDIA_RW, AID_MEDIA_RW)) return false;
887 if (!prepare_dir(user_ce_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
888
889 if (fscrypt_is_native()) {
890 PolicyKeyRef ce_ref;
891 if (volume_uuid.empty()) {
892 if (!lookup_key_ref(s_ce_key_raw_refs, user_id, &ce_ref.key_raw_ref)) return false;
893 get_data_file_encryption_modes(&ce_ref);
894 if (!ensure_policy(ce_ref, system_ce_path)) return false;
895 if (!ensure_policy(ce_ref, misc_ce_path)) return false;
896 if (!ensure_policy(ce_ref, vendor_ce_path)) return false;
897
898 } else {
899 if (!read_or_create_volkey(misc_ce_path, volume_uuid, &ce_ref)) return false;
900 }
901 if (!ensure_policy(ce_ref, media_ce_path)) return false;
902 if (!ensure_policy(ce_ref, user_ce_path)) return false;
903 }
904
905 if (volume_uuid.empty()) {
906 // Now that credentials have been installed, we can run restorecon
907 // over these paths
908 // NOTE: these paths need to be kept in sync with libselinux
909 android::vold::RestoreconRecursive(system_ce_path);
910 android::vold::RestoreconRecursive(vendor_ce_path);
911 android::vold::RestoreconRecursive(misc_ce_path);
912 }
913 }
914 if (!prepare_subdirs("prepare", volume_uuid, user_id, flags)) return false;
915
916 return true;
917}
918
919bool fscrypt_destroy_user_storage(const std::string& volume_uuid, userid_t user_id, int flags) {
920 LOG(DEBUG) << "fscrypt_destroy_user_storage for volume " << escape_empty(volume_uuid)
921 << ", user " << user_id << ", flags " << flags;
922 bool res = true;
923
924 res &= prepare_subdirs("destroy", volume_uuid, user_id, flags);
925
926 if (flags & STORAGE_FLAG_CE) {
927 // CE_n key
928 auto system_ce_path = android::vold::BuildDataSystemCePath(user_id);
929 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id);
930 auto vendor_ce_path = android::vold::BuildDataVendorCePath(user_id);
931 auto media_ce_path = android::vold::BuildDataMediaCePath(volume_uuid, user_id);
932 auto user_ce_path = android::vold::BuildDataUserCePath(volume_uuid, user_id);
933
934 res &= destroy_dir(media_ce_path);
935 res &= destroy_dir(user_ce_path);
936 if (volume_uuid.empty()) {
937 res &= destroy_dir(system_ce_path);
938 res &= destroy_dir(misc_ce_path);
939 res &= destroy_dir(vendor_ce_path);
940 } else {
941 if (fscrypt_is_native()) {
942 res &= destroy_volkey(misc_ce_path, volume_uuid);
943 }
944 }
945 }
946
947 if (flags & STORAGE_FLAG_DE) {
948 // DE_sys key
949 auto system_legacy_path = android::vold::BuildDataSystemLegacyPath(user_id);
950 auto misc_legacy_path = android::vold::BuildDataMiscLegacyPath(user_id);
951 auto profiles_de_path = android::vold::BuildDataProfilesDePath(user_id);
952
953 // DE_n key
954 auto system_de_path = android::vold::BuildDataSystemDePath(user_id);
955 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id);
956 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id);
957 auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);
958
959 res &= destroy_dir(user_de_path);
960 if (volume_uuid.empty()) {
961 res &= destroy_dir(system_legacy_path);
962#if MANAGE_MISC_DIRS
963 res &= destroy_dir(misc_legacy_path);
964#endif
965 res &= destroy_dir(profiles_de_path);
966 res &= destroy_dir(system_de_path);
967 res &= destroy_dir(misc_de_path);
968 res &= destroy_dir(vendor_de_path);
969 } else {
970 if (fscrypt_is_native()) {
971 res &= destroy_volkey(misc_de_path, volume_uuid);
972 }
973 }
974 }
975
976 return res;
977}
978
979static bool destroy_volume_keys(const std::string& directory_path, const std::string& volume_uuid) {
980 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(directory_path.c_str()), closedir);
981 if (!dirp) {
982 PLOG(ERROR) << "Unable to open directory: " + directory_path;
983 return false;
984 }
985 bool res = true;
986 for (;;) {
987 errno = 0;
988 auto const entry = readdir(dirp.get());
989 if (!entry) {
990 if (errno) {
991 PLOG(ERROR) << "Unable to read directory: " + directory_path;
992 return false;
993 }
994 break;
995 }
996 if (entry->d_type != DT_DIR || entry->d_name[0] == '.') {
997 LOG(DEBUG) << "Skipping non-user " << entry->d_name;
998 continue;
999 }
1000 res &= destroy_volkey(directory_path + "/" + entry->d_name, volume_uuid);
1001 }
1002 return res;
1003}
1004
1005bool fscrypt_destroy_volume_keys(const std::string& volume_uuid) {
1006 bool res = true;
1007 LOG(DEBUG) << "fscrypt_destroy_volume_keys for volume " << escape_empty(volume_uuid);
1008 auto secdiscardable_path = volume_secdiscardable_path(volume_uuid);
1009 res &= android::vold::runSecdiscardSingle(secdiscardable_path);
1010 res &= destroy_volume_keys("/data/misc_ce", volume_uuid);
1011 res &= destroy_volume_keys("/data/misc_de", volume_uuid);
1012 return res;
1013}