blob: 397f131e7602527a668699f9f4017e40487ec5b4 [file] [log] [blame]
bigbiff7ba75002020-04-11 20:47:09 -04001/*
2 * Copyright (C) 2015 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include "FsCrypt.h"
18
mauronofrio matarrese79820322020-05-25 19:48:56 +020019#include "Keymaster.h"
bigbiff7ba75002020-04-11 20:47:09 -040020#include "KeyStorage.h"
21#include "KeyUtil.h"
22#include "Utils.h"
23// #include "VoldUtil.h"
24
25#include <algorithm>
26#include <map>
27#include <set>
28#include <sstream>
29#include <string>
30#include <vector>
31
32#include <dirent.h>
33#include <errno.h>
34#include <fcntl.h>
35#include <limits.h>
36#include <selinux/android.h>
37#include <sys/mount.h>
38#include <sys/stat.h>
39#include <sys/types.h>
40#include <unistd.h>
41
42#include <private/android_filesystem_config.h>
43
44// #include "android/os/IVold.h"
45
46#include "cryptfs.h"
47
48#define EMULATED_USES_SELINUX 0
49#define MANAGE_MISC_DIRS 0
50
51#include <cutils/fs.h>
52#include <cutils/properties.h>
53
54#include <fscrypt/fscrypt.h>
55#include <fs_mgr.h>
56#include <keyutils.h>
57
58#include <android-base/file.h>
59#include <android-base/logging.h>
60#include <android-base/properties.h>
61#include <android-base/stringprintf.h>
62#include <android-base/unique_fd.h>
63
64
65using android::base::StringPrintf;
66using android::fs_mgr::GetEntryForMountPoint;
67using android::vold::kEmptyAuthentication;
68using android::vold::KeyBuffer;
mauronofrio matarrese79820322020-05-25 19:48:56 +020069using android::vold::Keymaster;
70using android::hardware::keymaster::V4_0::KeyFormat;
bigbiff7ba75002020-04-11 20:47:09 -040071// using android::vold::writeStringToFile;
72
73// Store main DE raw ref / policy
74std::string de_raw_ref;
75std::map<userid_t, std::string> s_de_key_raw_refs;
76std::map<userid_t, std::string> s_ce_key_raw_refs;
77
78namespace {
79
80struct PolicyKeyRef {
81 std::string contents_mode;
82 std::string filenames_mode;
83 std::string key_raw_ref;
84};
85
86const std::string device_key_dir = std::string() + DATA_MNT_POINT + fscrypt_unencrypted_folder;
87const std::string device_key_path = device_key_dir + "/key";
88const std::string device_key_temp = device_key_dir + "/temp";
89
90const std::string user_key_dir = std::string() + DATA_MNT_POINT + "/misc/vold/user_keys";
91const std::string user_key_temp = user_key_dir + "/temp";
92const std::string prepare_subdirs_path = "/sbin/vold_prepare_subdirs";
93
94const std::string systemwide_volume_key_dir =
95 std::string() + DATA_MNT_POINT + "/misc/vold/volume_keys";
96const int STORAGE_FLAG_DE = 1;
97const int STORAGE_FLAG_CE = 2;
98
99bool s_systemwide_keys_initialized = false;
100
101android::fs_mgr::Fstab fstab_default;
102
103// Some users are ephemeral, don't try to wipe their keys from disk
104std::set<userid_t> s_ephemeral_users;
105
106// TODO abolish this map, per b/26948053
107std::map<userid_t, KeyBuffer> s_ce_keys;
108
109} // namespace
110
111static bool fscrypt_is_emulated() {
112 return property_get_bool("persist.sys.emulate_fbe", false);
113}
114
115static const char* escape_empty(const std::string& value) {
116 return value.empty() ? "null" : value.c_str();
117}
118
119static std::string get_de_key_path(userid_t user_id) {
120 return StringPrintf("%s/de/%d", user_key_dir.c_str(), user_id);
121}
122
123static std::string get_ce_key_directory_path(userid_t user_id) {
124 return StringPrintf("%s/ce/%d", user_key_dir.c_str(), user_id);
125}
126
127// Returns the keys newest first
128static std::vector<std::string> get_ce_key_paths(const std::string& directory_path) {
129 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(directory_path.c_str()), closedir);
130 if (!dirp) {
131 PLOG(ERROR) << "Unable to open ce key directory: " + directory_path;
132 return std::vector<std::string>();
133 }
134 std::vector<std::string> result;
135 for (;;) {
136 errno = 0;
137 auto const entry = readdir(dirp.get());
138 if (!entry) {
139 if (errno) {
140 PLOG(ERROR) << "Unable to read ce key directory: " + directory_path;
141 return std::vector<std::string>();
142 }
143 break;
144 }
145 if (entry->d_type != DT_DIR || entry->d_name[0] != 'c') {
146 LOG(DEBUG) << "Skipping non-key " << entry->d_name;
147 continue;
148 }
149 result.emplace_back(directory_path + "/" + entry->d_name);
150 }
151 std::sort(result.begin(), result.end());
152 std::reverse(result.begin(), result.end());
153 return result;
154}
155
156static std::string get_ce_key_current_path(const std::string& directory_path) {
157 return directory_path + "/current";
158}
159
160static bool get_ce_key_new_path(const std::string& directory_path,
161 const std::vector<std::string>& paths, std::string* ce_key_path) {
162 if (paths.empty()) {
163 *ce_key_path = get_ce_key_current_path(directory_path);
164 return true;
165 }
166 for (unsigned int i = 0; i < UINT_MAX; i++) {
167 auto const candidate = StringPrintf("%s/cx%010u", directory_path.c_str(), i);
168 if (paths[0] < candidate) {
169 *ce_key_path = candidate;
170 return true;
171 }
172 }
173 return false;
174}
175
176// Discard all keys but the named one; rename it to canonical name.
177// No point in acting on errors in this; ignore them.
178static void fixate_user_ce_key(const std::string& directory_path, const std::string& to_fix,
179 const std::vector<std::string>& paths) {
180 for (auto const other_path : paths) {
181 if (other_path != to_fix) {
182 android::vold::destroyKey(other_path);
183 }
184 }
185 auto const current_path = get_ce_key_current_path(directory_path);
186 if (to_fix != current_path) {
187 LOG(DEBUG) << "Renaming " << to_fix << " to " << current_path;
188 if (rename(to_fix.c_str(), current_path.c_str()) != 0) {
189 PLOG(WARNING) << "Unable to rename " << to_fix << " to " << current_path;
190 return;
191 }
192 }
193 android::vold::FsyncDirectory(directory_path);
194}
195
196static bool read_and_fixate_user_ce_key(userid_t user_id,
197 const android::vold::KeyAuthentication& auth,
198 KeyBuffer* ce_key) {
199 auto const directory_path = get_ce_key_directory_path(user_id);
200 auto const paths = get_ce_key_paths(directory_path);
201 for (auto const ce_key_path : paths) {
202 LOG(DEBUG) << "Trying user CE key " << ce_key_path;
203 if (android::vold::retrieveKey(ce_key_path, auth, ce_key)) {
204 LOG(DEBUG) << "Successfully retrieved key";
205 fixate_user_ce_key(directory_path, ce_key_path, paths);
206 return true;
207 }
208 }
209 LOG(ERROR) << "Failed to find working ce key for user " << user_id;
210 return false;
211}
212
mauronofrio matarrese79820322020-05-25 19:48:56 +0200213static bool is_wrapped_key_supported_common(const std::string& mount_point) {
mauronofrio matarrese17fb1212020-05-25 19:59:17 +0200214 LOG(DEBUG) << "Determining wrapped-key support for " << mount_point;
215 std::string wrapped_key_supported = android::base::GetProperty("fbe.data.wrappedkey", "false");
216 LOG(DEBUG) << "fbe.data.wrappedkey = " << wrapped_key_supported;
217 if (mount_point == DATA_MNT_POINT && wrapped_key_supported == "true") {
218 LOG(DEBUG) << "Wrapped key supported on " << mount_point;
219 return true;
220 } else {
mauronofrio matarrese79820322020-05-25 19:48:56 +0200221 return false;
222 }
mauronofrio matarrese79820322020-05-25 19:48:56 +0200223}
224
225bool is_wrapped_key_supported() {
226 return is_wrapped_key_supported_common(DATA_MNT_POINT);
227}
228
229bool is_wrapped_key_supported_external() {
230 return false;
231}
232
mauronofrio539597d2020-05-25 22:23:48 +0200233bool is_metadata_wrapped_key_supported_common(const std::string& mount_point) {
mauronofrio matarresef1079ed2020-05-25 20:52:57 +0200234 LOG(DEBUG) << "Determining metadata wrapped-key support for " << mount_point;
235 std::string wrapped_key_supported = android::base::GetProperty("fbe.metadata.wrappedkey", "false");
236 LOG(DEBUG) << "fbe.metadata.wrappedkey = " << wrapped_key_supported;
237 if (mount_point == METADATA_MNT_POINT && wrapped_key_supported == "true") {
238 LOG(DEBUG) << "Wrapped key supported on " << mount_point;
239 return true;
240 } else {
241 return false;
242 }
243}
244
mauronofrio539597d2020-05-25 22:23:48 +0200245bool is_metadata_wrapped_key_supported() {
246 return is_metadata_wrapped_key_supported_common(METADATA_MNT_POINT);
247}
248
bigbiff7ba75002020-04-11 20:47:09 -0400249static bool read_and_install_user_ce_key(userid_t user_id,
250 const android::vold::KeyAuthentication& auth) {
251 if (s_ce_key_raw_refs.count(user_id) != 0) return true;
252 KeyBuffer ce_key;
253 if (!read_and_fixate_user_ce_key(user_id, auth, &ce_key)) return false;
254 std::string ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200255 if (is_wrapped_key_supported()) {
256 KeyBuffer ephemeral_wrapped_key;
257 if (!getEphemeralWrappedKey(KeyFormat::RAW, ce_key, &ephemeral_wrapped_key)) {
258 LOG(ERROR) << "Failed to export ce key";
259 return false;
260 }
261 ce_key = std::move(ephemeral_wrapped_key);
262 }
bigbiff7ba75002020-04-11 20:47:09 -0400263 if (!android::vold::installKey(ce_key, &ce_raw_ref)) return false;
264 s_ce_keys[user_id] = std::move(ce_key);
265 s_ce_key_raw_refs[user_id] = ce_raw_ref;
266 LOG(DEBUG) << "Installed ce key for user " << user_id;
267 return true;
268}
269
270static bool prepare_dir(const std::string& dir, mode_t mode, uid_t uid, gid_t gid) {
271 LOG(DEBUG) << "Preparing: " << dir;
272 if (fs_prepare_dir(dir.c_str(), mode, uid, gid) != 0) {
273 PLOG(ERROR) << "Failed to prepare " << dir;
274 return false;
275 }
276 return true;
277}
278
279static bool destroy_dir(const std::string& dir) {
280 LOG(DEBUG) << "Destroying: " << dir;
281 if (rmdir(dir.c_str()) != 0 && errno != ENOENT) {
282 PLOG(ERROR) << "Failed to destroy " << dir;
283 return false;
284 }
285 return true;
286}
287
288// NB this assumes that there is only one thread listening for crypt commands, because
289// it creates keys in a fixed location.
290static bool create_and_install_user_keys(userid_t user_id, bool create_ephemeral) {
291 KeyBuffer de_key, ce_key;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200292
293 if(is_wrapped_key_supported()) {
294 if (!generateWrappedKey(user_id, android::vold::KeyType::DE_USER, &de_key)) return false;
295 if (!generateWrappedKey(user_id, android::vold::KeyType::CE_USER, &ce_key)) return false;
296 } else {
297 if (!android::vold::randomKey(&de_key)) return false;
298 if (!android::vold::randomKey(&ce_key)) return false;
299 }
300
bigbiff7ba75002020-04-11 20:47:09 -0400301 if (create_ephemeral) {
302 // If the key should be created as ephemeral, don't store it.
303 s_ephemeral_users.insert(user_id);
304 } else {
305 auto const directory_path = get_ce_key_directory_path(user_id);
306 if (!prepare_dir(directory_path, 0700, AID_ROOT, AID_ROOT)) return false;
307 auto const paths = get_ce_key_paths(directory_path);
308 std::string ce_key_path;
309 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
310 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, kEmptyAuthentication,
311 ce_key))
312 return false;
313 fixate_user_ce_key(directory_path, ce_key_path, paths);
314 // Write DE key second; once this is written, all is good.
315 if (!android::vold::storeKeyAtomically(get_de_key_path(user_id), user_key_temp,
316 kEmptyAuthentication, de_key))
317 return false;
318 }
mauronofrio matarrese79820322020-05-25 19:48:56 +0200319
bigbiff7ba75002020-04-11 20:47:09 -0400320 std::string ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200321 if (is_wrapped_key_supported()) {
322 KeyBuffer ephemeral_wrapped_de_key;
323 KeyBuffer ephemeral_wrapped_ce_key;
324
325 /* Export and install the DE keys */
326 if (!getEphemeralWrappedKey(KeyFormat::RAW, de_key, &ephemeral_wrapped_de_key)) {
327 LOG(ERROR) << "Failed to export de_key";
328 return false;
329 }
330 /* Export and install the CE keys */
331 if (!getEphemeralWrappedKey(KeyFormat::RAW, ce_key, &ephemeral_wrapped_ce_key)) {
332 LOG(ERROR) << "Failed to export de_key";
333 return false;
334 }
335
336 de_key = std::move(ephemeral_wrapped_de_key);
337 ce_key = std::move(ephemeral_wrapped_ce_key);
338 }
339 if (!android::vold::installKey(de_key, &de_raw_ref)) return false;
bigbiff7ba75002020-04-11 20:47:09 -0400340 if (!android::vold::installKey(ce_key, &ce_raw_ref)) return false;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200341 s_ce_keys[user_id] = std::move(ce_key);
342
343 s_de_key_raw_refs[user_id] = de_raw_ref;
bigbiff7ba75002020-04-11 20:47:09 -0400344 s_ce_key_raw_refs[user_id] = ce_raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200345
bigbiff7ba75002020-04-11 20:47:09 -0400346 LOG(DEBUG) << "Created keys for user " << user_id;
347 return true;
348}
349
350bool lookup_key_ref(const std::map<userid_t, std::string>& key_map, userid_t user_id,
351 std::string* raw_ref) {
352 auto refi = key_map.find(user_id);
353 if (refi == key_map.end()) {
354 LOG(DEBUG) << "Cannot find key for " << user_id;
355 return false;
356 }
357 *raw_ref = refi->second;
358 return true;
359}
360
361static void get_data_file_encryption_modes(PolicyKeyRef* key_ref) {
362 if (!ReadDefaultFstab(&fstab_default)) {
363 PLOG(ERROR) << "Failed to open default fstab";
364 return;
365 }
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200366 /*auto entry = android::fs_mgr::GetEntryForMountPoint(&fstab_default, DATA_MNT_POINT);
bigbiff7ba75002020-04-11 20:47:09 -0400367 if (entry == nullptr) {
368 LOG(ERROR) << "get_data_file_encryption_modes::failed\n";
369 return;
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200370 }*/
371 LOG(INFO) << "contents mode '" << android::base::GetProperty("fbe.contents", "aes-256-xts") << "' filenames '" << android::base::GetProperty("fbe.filenames", "aes-256-heh") << "'\n";
372 key_ref->contents_mode =
373 android::base::GetProperty("fbe.contents", "aes-256-xts");
374 key_ref->filenames_mode =
375 android::base::GetProperty("fbe.filenames", "aes-256-heh");
bigbiff7ba75002020-04-11 20:47:09 -0400376}
377
378static bool ensure_policy(const PolicyKeyRef& key_ref, const std::string& path) {
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200379 return true;
380 /*return fscrypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
bigbiff7ba75002020-04-11 20:47:09 -0400381 key_ref.key_raw_ref.size(), key_ref.contents_mode.c_str(),
mauronofrio matarresee50fde52020-05-28 09:40:44 +0200382 key_ref.filenames_mode.c_str()) == 0;*/
bigbiff7ba75002020-04-11 20:47:09 -0400383}
384
385static bool is_numeric(const char* name) {
386 for (const char* p = name; *p != '\0'; p++) {
387 if (!isdigit(*p)) return false;
388 }
389 return true;
390}
391
392static bool load_all_de_keys() {
393 auto de_dir = user_key_dir + "/de";
394 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(de_dir.c_str()), closedir);
395 if (!dirp) {
396 PLOG(ERROR) << "Unable to read de key directory";
397 return false;
398 }
399 for (;;) {
400 errno = 0;
401 auto entry = readdir(dirp.get());
402 if (!entry) {
403 if (errno) {
404 PLOG(ERROR) << "Unable to read de key directory";
405 return false;
406 }
407 break;
408 }
409 if (entry->d_type != DT_DIR || !is_numeric(entry->d_name)) {
410 LOG(DEBUG) << "Skipping non-de-key " << entry->d_name;
411 continue;
412 }
413 userid_t user_id = std::stoi(entry->d_name);
414 if (s_de_key_raw_refs.count(user_id) == 0) {
415 auto key_path = de_dir + "/" + entry->d_name;
416 KeyBuffer key;
417 if (!android::vold::retrieveKey(key_path, kEmptyAuthentication, &key)) return false;
418 std::string raw_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200419 if (is_wrapped_key_supported()) {
420 KeyBuffer ephemeral_wrapped_key;
421 if (!getEphemeralWrappedKey(KeyFormat::RAW, key, &ephemeral_wrapped_key)) {
422 LOG(ERROR) << "Failed to export de_key in create_and_install_user_keys";
423 return false;
424 }
425 key = std::move(ephemeral_wrapped_key);
426 }
bigbiff7ba75002020-04-11 20:47:09 -0400427 if (!android::vold::installKey(key, &raw_ref)) return false;
428 s_de_key_raw_refs[user_id] = raw_ref;
429 LOG(DEBUG) << "Installed de key for user " << user_id;
430 }
431 }
432 // fscrypt:TODO: go through all DE directories, ensure that all user dirs have the
433 // correct policy set on them, and that no rogue ones exist.
434 return true;
435}
436
437bool fscrypt_initialize_systemwide_keys() {
438 LOG(INFO) << "fscrypt_initialize_systemwide_keys";
mauronofrio matarrese79820322020-05-25 19:48:56 +0200439 bool wrapped_key_supported = false;
bigbiff7ba75002020-04-11 20:47:09 -0400440
441 if (s_systemwide_keys_initialized) {
442 LOG(INFO) << "Already initialized";
443 return true;
444 }
445
446 PolicyKeyRef device_ref;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200447 wrapped_key_supported = is_wrapped_key_supported();
448
449 if (!android::vold::retrieveAndInstallKey(true, kEmptyAuthentication,
450 device_key_path, device_key_temp,
451 &device_ref.key_raw_ref, wrapped_key_supported))
bigbiff7ba75002020-04-11 20:47:09 -0400452 return false;
453 get_data_file_encryption_modes(&device_ref);
454
455 std::string modestring = device_ref.contents_mode + ":" + device_ref.filenames_mode;
456 std::string mode_filename = std::string("/data") + fscrypt_key_mode;
457 if (!android::vold::writeStringToFile(modestring, mode_filename)) return false;
458
459 std::string ref_filename = std::string("/data") + fscrypt_key_ref;
460 if (!android::vold::writeStringToFile(device_ref.key_raw_ref, ref_filename)) return false;
461 LOG(INFO) << "Wrote system DE key reference to:" << ref_filename;
462
463 KeyBuffer per_boot_key;
464 if (!android::vold::randomKey(&per_boot_key)) return false;
465 std::string per_boot_raw_ref;
466 if (!android::vold::installKey(per_boot_key, &per_boot_raw_ref)) return false;
467 std::string per_boot_ref_filename = std::string("/data") + fscrypt_key_per_boot_ref;
468 if (!android::vold::writeStringToFile(per_boot_raw_ref, per_boot_ref_filename)) return false;
469 LOG(INFO) << "Wrote per boot key reference to:" << per_boot_ref_filename;
470
471 if (!android::vold::FsyncDirectory(device_key_dir)) return false;
472 s_systemwide_keys_initialized = true;
473 de_raw_ref = device_ref.key_raw_ref;
474 return true;
475}
476
477bool fscrypt_init_user0() {
478 if (!ReadDefaultFstab(&fstab_default)) {
479 PLOG(ERROR) << "Failed to open default fstab";
480 return -1;
481 }
482 if (fscrypt_is_native()) {
483 if (!prepare_dir(user_key_dir, 0700, AID_ROOT, AID_ROOT)) return false;
484 if (!prepare_dir(user_key_dir + "/ce", 0700, AID_ROOT, AID_ROOT)) return false;
485 if (!prepare_dir(user_key_dir + "/de", 0700, AID_ROOT, AID_ROOT)) return false;
486 if (!android::vold::pathExists(get_de_key_path(0))) {
487 if (!create_and_install_user_keys(0, false)) return false;
488 }
489 // TODO: switch to loading only DE_0 here once framework makes
490 // explicit calls to install DE keys for secondary users
491 if (!load_all_de_keys()) return false;
492 }
493 // We can only safely prepare DE storage here, since CE keys are probably
494 // entangled with user credentials. The framework will always prepare CE
495 // storage once CE keys are installed.
496 if (!fscrypt_prepare_user_storage("", 0, 0, STORAGE_FLAG_DE)) {
497 LOG(ERROR) << "Failed to prepare user 0 storage";
498 return false;
499 }
500 // If this is a non-FBE device that recently left an emulated mode,
501 // restore user data directories to known-good state.
502 if (!fscrypt_is_native() && !fscrypt_is_emulated()) {
503 fscrypt_unlock_user_key(0, 0, "!", "!");
504 }
505
506 return true;
507}
508
509bool fscrypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral) {
510 LOG(DEBUG) << "fscrypt_vold_create_user_key for " << user_id << " serial " << serial;
511 if (!fscrypt_is_native()) {
512 return true;
513 }
514 // FIXME test for existence of key that is not loaded yet
515 if (s_ce_key_raw_refs.count(user_id) != 0) {
516 LOG(ERROR) << "Already exists, can't fscrypt_vold_create_user_key for " << user_id
517 << " serial " << serial;
518 // FIXME should we fail the command?
519 return true;
520 }
521 if (!create_and_install_user_keys(user_id, ephemeral)) {
522 return false;
523 }
524 return true;
525}
526
527static void drop_caches() {
528 // Clean any dirty pages (otherwise they won't be dropped).
529 sync();
530 // Drop inode and page caches.
531 if (!android::vold::writeStringToFile("3", "/proc/sys/vm/drop_caches")) {
532 PLOG(ERROR) << "Failed to drop caches during key eviction";
533 }
534}
535
536static bool evict_ce_key(userid_t user_id) {
537 s_ce_keys.erase(user_id);
538 bool success = true;
539 std::string raw_ref;
540 // If we haven't loaded the CE key, no need to evict it.
541 if (lookup_key_ref(s_ce_key_raw_refs, user_id, &raw_ref)) {
542 success &= android::vold::evictKey(raw_ref);
543 drop_caches();
544 }
545 s_ce_key_raw_refs.erase(user_id);
546 return success;
547}
548
549bool fscrypt_destroy_user_key(userid_t user_id) {
550 LOG(DEBUG) << "fscrypt_destroy_user_key(" << user_id << ")";
551 if (!fscrypt_is_native()) {
552 return true;
553 }
554 bool success = true;
555 std::string raw_ref;
556 success &= evict_ce_key(user_id);
557 success &=
558 lookup_key_ref(s_de_key_raw_refs, user_id, &raw_ref) && android::vold::evictKey(raw_ref);
559 s_de_key_raw_refs.erase(user_id);
560 auto it = s_ephemeral_users.find(user_id);
561 if (it != s_ephemeral_users.end()) {
562 s_ephemeral_users.erase(it);
563 } else {
564 for (auto const path : get_ce_key_paths(get_ce_key_directory_path(user_id))) {
565 success &= android::vold::destroyKey(path);
566 }
567 auto de_key_path = get_de_key_path(user_id);
568 if (android::vold::pathExists(de_key_path)) {
569 success &= android::vold::destroyKey(de_key_path);
570 } else {
571 LOG(INFO) << "Not present so not erasing: " << de_key_path;
572 }
573 }
574 return success;
575}
576
577static bool emulated_lock(const std::string& path) {
578 if (chmod(path.c_str(), 0000) != 0) {
579 PLOG(ERROR) << "Failed to chmod " << path;
580 return false;
581 }
582#if EMULATED_USES_SELINUX
583 if (setfilecon(path.c_str(), "u:object_r:storage_stub_file:s0") != 0) {
584 PLOG(WARNING) << "Failed to setfilecon " << path;
585 return false;
586 }
587#endif
588 return true;
589}
590
591static bool emulated_unlock(const std::string& path, mode_t mode) {
592 if (chmod(path.c_str(), mode) != 0) {
593 PLOG(ERROR) << "Failed to chmod " << path;
594 // FIXME temporary workaround for b/26713622
595 if (fscrypt_is_emulated()) return false;
596 }
597#if EMULATED_USES_SELINUX
598 if (selinux_android_restorecon(path.c_str(), SELINUX_ANDROID_RESTORECON_FORCE) != 0) {
599 PLOG(WARNING) << "Failed to restorecon " << path;
600 // FIXME temporary workaround for b/26713622
601 if (fscrypt_is_emulated()) return false;
602 }
603#endif
604 return true;
605}
606
607static bool parse_hex(const std::string& hex, std::string* result) {
608 if (hex == "!") {
609 *result = "";
610 return true;
611 }
612 if (android::vold::HexToStr(hex, *result) != 0) {
613 LOG(ERROR) << "Invalid FBE hex string"; // Don't log the string for security reasons
614 return false;
615 }
616 return true;
617}
618
619static std::string volkey_path(const std::string& misc_path, const std::string& volume_uuid) {
620 return misc_path + "/vold/volume_keys/" + volume_uuid + "/default";
621}
622
623static std::string volume_secdiscardable_path(const std::string& volume_uuid) {
624 return systemwide_volume_key_dir + "/" + volume_uuid + "/secdiscardable";
625}
626
627static bool read_or_create_volkey(const std::string& misc_path, const std::string& volume_uuid,
628 PolicyKeyRef* key_ref) {
629 auto secdiscardable_path = volume_secdiscardable_path(volume_uuid);
630 std::string secdiscardable_hash;
mauronofrio matarrese79820322020-05-25 19:48:56 +0200631 bool wrapped_key_supported = false;
bigbiff7ba75002020-04-11 20:47:09 -0400632 if (android::vold::pathExists(secdiscardable_path)) {
633 if (!android::vold::readSecdiscardable(secdiscardable_path, &secdiscardable_hash))
634 return false;
635 } else {
636 if (fs_mkdirs(secdiscardable_path.c_str(), 0700) != 0) {
637 PLOG(ERROR) << "Creating directories for: " << secdiscardable_path;
638 return false;
639 }
640 if (!android::vold::createSecdiscardable(secdiscardable_path, &secdiscardable_hash))
641 return false;
642 }
643 auto key_path = volkey_path(misc_path, volume_uuid);
644 if (fs_mkdirs(key_path.c_str(), 0700) != 0) {
645 PLOG(ERROR) << "Creating directories for: " << key_path;
646 return false;
647 }
648 android::vold::KeyAuthentication auth("", secdiscardable_hash);
mauronofrio matarrese79820322020-05-25 19:48:56 +0200649 wrapped_key_supported = is_wrapped_key_supported_external();
650
bigbiff7ba75002020-04-11 20:47:09 -0400651 if (!android::vold::retrieveAndInstallKey(true, auth, key_path, key_path + "_tmp",
mauronofrio matarrese79820322020-05-25 19:48:56 +0200652 &key_ref->key_raw_ref, wrapped_key_supported))
bigbiff7ba75002020-04-11 20:47:09 -0400653 return false;
654 key_ref->contents_mode =
655 android::base::GetProperty("ro.crypto.volume.contents_mode", "aes-256-xts");
656 key_ref->filenames_mode =
657 android::base::GetProperty("ro.crypto.volume.filenames_mode", "aes-256-heh");
658 return true;
659}
660
661static bool destroy_volkey(const std::string& misc_path, const std::string& volume_uuid) {
662 auto path = volkey_path(misc_path, volume_uuid);
663 if (!android::vold::pathExists(path)) return true;
664 return android::vold::destroyKey(path);
665}
666
667bool fscrypt_add_user_key_auth(userid_t user_id, int serial, const std::string& token_hex,
668 const std::string& secret_hex) {
669 LOG(DEBUG) << "fscrypt_add_user_key_auth " << user_id << " serial=" << serial
670 << " token_present=" << (token_hex != "!");
671 if (!fscrypt_is_native()) return true;
672 if (s_ephemeral_users.count(user_id) != 0) return true;
673 std::string token, secret;
674 if (!parse_hex(token_hex, &token)) return false;
675 if (!parse_hex(secret_hex, &secret)) return false;
676 auto auth =
677 secret.empty() ? kEmptyAuthentication : android::vold::KeyAuthentication(token, secret);
bigbiff7ba75002020-04-11 20:47:09 -0400678 auto const directory_path = get_ce_key_directory_path(user_id);
679 auto const paths = get_ce_key_paths(directory_path);
mauronofrio matarrese79820322020-05-25 19:48:56 +0200680
681 KeyBuffer ce_key;
682 if(is_wrapped_key_supported()) {
683 std::string ce_key_current_path = get_ce_key_current_path(directory_path);
684 if (android::vold::retrieveKey(ce_key_current_path, kEmptyAuthentication, &ce_key)) {
685 LOG(DEBUG) << "Successfully retrieved key";
686 } else {
687 if (android::vold::retrieveKey(ce_key_current_path, auth, &ce_key)) {
688 LOG(DEBUG) << "Successfully retrieved key";
689 }
690 }
691 } else {
692 auto it = s_ce_keys.find(user_id);
693 if (it == s_ce_keys.end()) {
694 LOG(ERROR) << "Key not loaded into memory, can't change for user " << user_id;
695 return false;
696 }
697 ce_key = it->second;
698 }
699
bigbiff7ba75002020-04-11 20:47:09 -0400700 std::string ce_key_path;
701 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
702 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, auth, ce_key)) return false;
703 if (!android::vold::FsyncDirectory(directory_path)) return false;
704 return true;
705}
706
mauronofrio matarrese79820322020-05-25 19:48:56 +0200707bool fscrypt_clear_user_key_auth(userid_t user_id, int serial, const std::string& token_hex,
708 const std::string& secret_hex) {
709 LOG(DEBUG) << "fscrypt_clear_user_key_auth " << user_id << " serial=" << serial
710 << " token_present=" << (token_hex != "!");
711 if (!fscrypt_is_native()) return true;
712 if (s_ephemeral_users.count(user_id) != 0) return true;
713 std::string token, secret;
714
715 if (!parse_hex(token_hex, &token)) return false;
716 if (!parse_hex(secret_hex, &secret)) return false;
717
718 if (is_wrapped_key_supported()) {
719 auto const directory_path = get_ce_key_directory_path(user_id);
720 auto const paths = get_ce_key_paths(directory_path);
721
722 KeyBuffer ce_key;
723 std::string ce_key_current_path = get_ce_key_current_path(directory_path);
724
725 auto auth = android::vold::KeyAuthentication(token, secret);
726 /* Retrieve key while removing a pin. A secret is needed */
727 if (android::vold::retrieveKey(ce_key_current_path, auth, &ce_key)) {
728 LOG(DEBUG) << "Successfully retrieved key";
729 } else {
730 /* Retrieve key when going None to swipe and vice versa when a
731 synthetic password is present */
732 if (android::vold::retrieveKey(ce_key_current_path, kEmptyAuthentication, &ce_key)) {
733 LOG(DEBUG) << "Successfully retrieved key";
734 }
735 }
736
737 std::string ce_key_path;
738 if (!get_ce_key_new_path(directory_path, paths, &ce_key_path)) return false;
739 if (!android::vold::storeKeyAtomically(ce_key_path, user_key_temp, kEmptyAuthentication, ce_key))
740 return false;
741 } else {
742 if(!fscrypt_add_user_key_auth(user_id, serial, "!", "!")) return false;
743 }
744 return true;
745}
746
bigbiff7ba75002020-04-11 20:47:09 -0400747bool fscrypt_fixate_newest_user_key_auth(userid_t user_id) {
748 LOG(DEBUG) << "fscrypt_fixate_newest_user_key_auth " << user_id;
749 if (!fscrypt_is_native()) return true;
750 if (s_ephemeral_users.count(user_id) != 0) return true;
751 auto const directory_path = get_ce_key_directory_path(user_id);
752 auto const paths = get_ce_key_paths(directory_path);
753 if (paths.empty()) {
754 LOG(ERROR) << "No ce keys present, cannot fixate for user " << user_id;
755 return false;
756 }
757 fixate_user_ce_key(directory_path, paths[0], paths);
758 return true;
759}
760
761// TODO: rename to 'install' for consistency, and take flags to know which keys to install
762bool fscrypt_unlock_user_key(userid_t user_id, int serial, const std::string& token_hex,
763 const std::string& secret_hex) {
764 LOG(DEBUG) << "fscrypt_unlock_user_key " << user_id << " serial=" << serial
765 << " token_present=" << (token_hex != "!");
766 if (fscrypt_is_native()) {
767 if (s_ce_key_raw_refs.count(user_id) != 0) {
768 LOG(WARNING) << "Tried to unlock already-unlocked key for user " << user_id;
769 return true;
770 }
771 std::string token, secret;
772 if (!parse_hex(token_hex, &token)) return false;
773 if (!parse_hex(secret_hex, &secret)) return false;
774 android::vold::KeyAuthentication auth(token, secret);
775 if (!read_and_install_user_ce_key(user_id, auth)) {
776 LOG(ERROR) << "Couldn't read key for " << user_id;
777 return false;
778 }
779 } else {
780 // When in emulation mode, we just use chmod. However, we also
781 // unlock directories when not in emulation mode, to bring devices
782 // back into a known-good state.
783 if (!emulated_unlock(android::vold::BuildDataSystemCePath(user_id), 0771) ||
784 !emulated_unlock(android::vold::BuildDataMiscCePath(user_id), 01771) ||
785 !emulated_unlock(android::vold::BuildDataMediaCePath("", user_id), 0770) ||
786 !emulated_unlock(android::vold::BuildDataUserCePath("", user_id), 0771)) {
787 LOG(ERROR) << "Failed to unlock user " << user_id;
788 return false;
789 }
790 }
791 return true;
792}
793
794// TODO: rename to 'evict' for consistency
795bool fscrypt_lock_user_key(userid_t user_id) {
796 LOG(DEBUG) << "fscrypt_lock_user_key " << user_id;
797 if (fscrypt_is_native()) {
798 return evict_ce_key(user_id);
799 } else if (fscrypt_is_emulated()) {
800 // When in emulation mode, we just use chmod
801 if (!emulated_lock(android::vold::BuildDataSystemCePath(user_id)) ||
802 !emulated_lock(android::vold::BuildDataMiscCePath(user_id)) ||
803 !emulated_lock(android::vold::BuildDataMediaCePath("", user_id)) ||
804 !emulated_lock(android::vold::BuildDataUserCePath("", user_id))) {
805 LOG(ERROR) << "Failed to lock user " << user_id;
806 return false;
807 }
808 }
809
810 return true;
811}
812
813static bool prepare_subdirs(const std::string& action, const std::string& volume_uuid,
814 userid_t user_id, int flags) {
815 if (0 != android::vold::ForkExecvp(
816 std::vector<std::string>{prepare_subdirs_path, action, volume_uuid,
817 std::to_string(user_id), std::to_string(flags)})) {
818 LOG(ERROR) << "vold_prepare_subdirs failed";
819 return false;
820 }
821 return true;
822}
823
824bool fscrypt_prepare_user_storage(const std::string& volume_uuid, userid_t user_id, int serial,
825 int flags) {
826 LOG(DEBUG) << "fscrypt_prepare_user_storage for volume " << escape_empty(volume_uuid)
827 << ", user " << user_id << ", serial " << serial << ", flags " << flags;
828
829 if (flags & STORAGE_FLAG_DE) {
830 // DE_sys key
831 auto system_legacy_path = android::vold::BuildDataSystemLegacyPath(user_id);
832 auto misc_legacy_path = android::vold::BuildDataMiscLegacyPath(user_id);
833 auto profiles_de_path = android::vold::BuildDataProfilesDePath(user_id);
834
835 // DE_n key
836 auto system_de_path = android::vold::BuildDataSystemDePath(user_id);
837 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id);
838 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id);
839 auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);
840
841 if (volume_uuid.empty()) {
842 if (!prepare_dir(system_legacy_path, 0700, AID_SYSTEM, AID_SYSTEM)) return false;
843#if MANAGE_MISC_DIRS
844 if (!prepare_dir(misc_legacy_path, 0750, multiuser_get_uid(user_id, AID_SYSTEM),
845 multiuser_get_uid(user_id, AID_EVERYBODY)))
846 return false;
847#endif
848 if (!prepare_dir(profiles_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
849
850 if (!prepare_dir(system_de_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
851 if (!prepare_dir(misc_de_path, 01771, AID_SYSTEM, AID_MISC)) return false;
852 if (!prepare_dir(vendor_de_path, 0771, AID_ROOT, AID_ROOT)) return false;
853 }
854 if (!prepare_dir(user_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
855
856 if (fscrypt_is_native()) {
857 PolicyKeyRef de_ref;
858 if (volume_uuid.empty()) {
859 if (!lookup_key_ref(s_de_key_raw_refs, user_id, &de_ref.key_raw_ref)) return false;
860 get_data_file_encryption_modes(&de_ref);
861 if (!ensure_policy(de_ref, system_de_path)) return false;
862 if (!ensure_policy(de_ref, misc_de_path)) return false;
863 if (!ensure_policy(de_ref, vendor_de_path)) return false;
864 } else {
865 if (!read_or_create_volkey(misc_de_path, volume_uuid, &de_ref)) return false;
866 }
867 if (!ensure_policy(de_ref, user_de_path)) return false;
868 }
869 }
870 if (flags & STORAGE_FLAG_CE) {
871 // CE_n key
872 auto system_ce_path = android::vold::BuildDataSystemCePath(user_id);
873 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id);
874 auto vendor_ce_path = android::vold::BuildDataVendorCePath(user_id);
875 auto media_ce_path = android::vold::BuildDataMediaCePath(volume_uuid, user_id);
876 auto user_ce_path = android::vold::BuildDataUserCePath(volume_uuid, user_id);
877
878 if (volume_uuid.empty()) {
879 if (!prepare_dir(system_ce_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
880 if (!prepare_dir(misc_ce_path, 01771, AID_SYSTEM, AID_MISC)) return false;
881 if (!prepare_dir(vendor_ce_path, 0771, AID_ROOT, AID_ROOT)) return false;
882 }
883 if (!prepare_dir(media_ce_path, 0770, AID_MEDIA_RW, AID_MEDIA_RW)) return false;
884 if (!prepare_dir(user_ce_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
885
886 if (fscrypt_is_native()) {
887 PolicyKeyRef ce_ref;
888 if (volume_uuid.empty()) {
889 if (!lookup_key_ref(s_ce_key_raw_refs, user_id, &ce_ref.key_raw_ref)) return false;
890 get_data_file_encryption_modes(&ce_ref);
891 if (!ensure_policy(ce_ref, system_ce_path)) return false;
892 if (!ensure_policy(ce_ref, misc_ce_path)) return false;
893 if (!ensure_policy(ce_ref, vendor_ce_path)) return false;
894
895 } else {
896 if (!read_or_create_volkey(misc_ce_path, volume_uuid, &ce_ref)) return false;
897 }
898 if (!ensure_policy(ce_ref, media_ce_path)) return false;
899 if (!ensure_policy(ce_ref, user_ce_path)) return false;
900 }
901
902 if (volume_uuid.empty()) {
903 // Now that credentials have been installed, we can run restorecon
904 // over these paths
905 // NOTE: these paths need to be kept in sync with libselinux
906 android::vold::RestoreconRecursive(system_ce_path);
907 android::vold::RestoreconRecursive(vendor_ce_path);
908 android::vold::RestoreconRecursive(misc_ce_path);
909 }
910 }
911 if (!prepare_subdirs("prepare", volume_uuid, user_id, flags)) return false;
912
913 return true;
914}
915
916bool fscrypt_destroy_user_storage(const std::string& volume_uuid, userid_t user_id, int flags) {
917 LOG(DEBUG) << "fscrypt_destroy_user_storage for volume " << escape_empty(volume_uuid)
918 << ", user " << user_id << ", flags " << flags;
919 bool res = true;
920
921 res &= prepare_subdirs("destroy", volume_uuid, user_id, flags);
922
923 if (flags & STORAGE_FLAG_CE) {
924 // CE_n key
925 auto system_ce_path = android::vold::BuildDataSystemCePath(user_id);
926 auto misc_ce_path = android::vold::BuildDataMiscCePath(user_id);
927 auto vendor_ce_path = android::vold::BuildDataVendorCePath(user_id);
928 auto media_ce_path = android::vold::BuildDataMediaCePath(volume_uuid, user_id);
929 auto user_ce_path = android::vold::BuildDataUserCePath(volume_uuid, user_id);
930
931 res &= destroy_dir(media_ce_path);
932 res &= destroy_dir(user_ce_path);
933 if (volume_uuid.empty()) {
934 res &= destroy_dir(system_ce_path);
935 res &= destroy_dir(misc_ce_path);
936 res &= destroy_dir(vendor_ce_path);
937 } else {
938 if (fscrypt_is_native()) {
939 res &= destroy_volkey(misc_ce_path, volume_uuid);
940 }
941 }
942 }
943
944 if (flags & STORAGE_FLAG_DE) {
945 // DE_sys key
946 auto system_legacy_path = android::vold::BuildDataSystemLegacyPath(user_id);
947 auto misc_legacy_path = android::vold::BuildDataMiscLegacyPath(user_id);
948 auto profiles_de_path = android::vold::BuildDataProfilesDePath(user_id);
949
950 // DE_n key
951 auto system_de_path = android::vold::BuildDataSystemDePath(user_id);
952 auto misc_de_path = android::vold::BuildDataMiscDePath(user_id);
953 auto vendor_de_path = android::vold::BuildDataVendorDePath(user_id);
954 auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);
955
956 res &= destroy_dir(user_de_path);
957 if (volume_uuid.empty()) {
958 res &= destroy_dir(system_legacy_path);
959#if MANAGE_MISC_DIRS
960 res &= destroy_dir(misc_legacy_path);
961#endif
962 res &= destroy_dir(profiles_de_path);
963 res &= destroy_dir(system_de_path);
964 res &= destroy_dir(misc_de_path);
965 res &= destroy_dir(vendor_de_path);
966 } else {
967 if (fscrypt_is_native()) {
968 res &= destroy_volkey(misc_de_path, volume_uuid);
969 }
970 }
971 }
972
973 return res;
974}
975
976static bool destroy_volume_keys(const std::string& directory_path, const std::string& volume_uuid) {
977 auto dirp = std::unique_ptr<DIR, int (*)(DIR*)>(opendir(directory_path.c_str()), closedir);
978 if (!dirp) {
979 PLOG(ERROR) << "Unable to open directory: " + directory_path;
980 return false;
981 }
982 bool res = true;
983 for (;;) {
984 errno = 0;
985 auto const entry = readdir(dirp.get());
986 if (!entry) {
987 if (errno) {
988 PLOG(ERROR) << "Unable to read directory: " + directory_path;
989 return false;
990 }
991 break;
992 }
993 if (entry->d_type != DT_DIR || entry->d_name[0] == '.') {
994 LOG(DEBUG) << "Skipping non-user " << entry->d_name;
995 continue;
996 }
997 res &= destroy_volkey(directory_path + "/" + entry->d_name, volume_uuid);
998 }
999 return res;
1000}
1001
1002bool fscrypt_destroy_volume_keys(const std::string& volume_uuid) {
1003 bool res = true;
1004 LOG(DEBUG) << "fscrypt_destroy_volume_keys for volume " << escape_empty(volume_uuid);
1005 auto secdiscardable_path = volume_secdiscardable_path(volume_uuid);
1006 res &= android::vold::runSecdiscardSingle(secdiscardable_path);
1007 res &= destroy_volume_keys("/data/misc_ce", volume_uuid);
1008 res &= destroy_volume_keys("/data/misc_de", volume_uuid);
1009 return res;
1010}