ext4_crypt_init_extensions.cpp revision 4818b73cf845e05c6b14afb07e38da0b6720865a 
1/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define TAG "ext4_utils"
18
19#include "ext4_crypt_init_extensions.h"
20#include "ext4_crypt.h"
21
22#include <android-base/logging.h>
23
24#include <string>
25#include <vector>
26
27#include <dirent.h>
28#include <errno.h>
29#include <sys/mount.h>
30#include <sys/stat.h>
31#include <unistd.h>
32
33#include <android-base/file.h>
34
35#include <cutils/klog.h>
36#include <cutils/properties.h>
37#include <cutils/sockets.h>
38#include <logwrap/logwrap.h>
39
40#include "key_control.h"
41
42static const std::string arbitrary_sequence_number = "42";
43static const int vold_command_timeout_ms = 60 * 1000;
44
45static void kernel_logger(android::base::LogId, android::base::LogSeverity severity, const char*,
46        const char*, unsigned int, const char* message) {
47    if (severity == android::base::ERROR || severity == android::base::FATAL) {
48        KLOG_ERROR(TAG, "%s\n", message);
49    } else if (severity == android::base::WARNING) {
50        KLOG_WARNING(TAG, "%s\n", message);
51    } else {
52        KLOG_INFO(TAG, "%s\n", message);
53    }
54}
55
56static void init_logging() {
57    android::base::SetLogger(kernel_logger);
58}
59
60int e4crypt_create_device_key(const char* dir,
61                              int ensure_dir_exists(const char*))
62{
63    init_logging();
64
65    // Make sure folder exists. Use make_dir to set selinux permissions.
66    std::string unencrypted_dir = std::string(dir) + e4crypt_unencrypted_folder;
67    if (ensure_dir_exists(unencrypted_dir.c_str())) {
68        KLOG_ERROR(TAG, "Failed to create %s (%s)\n",
69                   unencrypted_dir.c_str(),
70                   strerror(errno));
71        return -1;
72    }
73
74    const char* argv[] = { "/system/bin/vdc", "--wait", "cryptfs", "enablefilecrypto" };
75    int rc = android_fork_execvp(4, (char**) argv, NULL, false, true);
76    LOG(INFO) << "enablefilecrypto result: " << rc;
77    return rc;
78}
79
80int e4crypt_install_keyring()
81{
82    init_logging();
83
84    key_serial_t device_keyring = add_key("keyring", "e4crypt", 0, 0,
85                                          KEY_SPEC_SESSION_KEYRING);
86
87    if (device_keyring == -1) {
88        KLOG_ERROR(TAG, "Failed to create keyring (%s)\n", strerror(errno));
89        return -1;
90    }
91
92    KLOG_INFO(TAG, "Keyring created with id %d in process %d\n",
93              device_keyring, getpid());
94
95    return 0;
96}
97
98int e4crypt_do_init_user0()
99{
100    init_logging();
101
102    const char* argv[] = { "/system/bin/vdc", "--wait", "cryptfs", "init_user0" };
103    int rc = android_fork_execvp(4, (char**) argv, NULL, false, true);
104    LOG(INFO) << "init_user0 result: " << rc;
105    return rc;
106}
107
108int e4crypt_set_directory_policy(const char* dir)
109{
110    init_logging();
111
112    // Only set policy on first level /data directories
113    // To make this less restrictive, consider using a policy file.
114    // However this is overkill for as long as the policy is simply
115    // to apply a global policy to all /data folders created via makedir
116    if (!dir || strncmp(dir, "/data/", 6) || strchr(dir + 6, '/')) {
117        return 0;
118    }
119
120    // Special case various directories that must not be encrypted,
121    // often because their subdirectories must be encrypted.
122    // This isn't a nice way to do this, see b/26641735
123    std::vector<std::string> directories_to_exclude = {
124        "lost+found",
125        "system_ce", "system_de",
126        "misc_ce", "misc_de",
127        "media",
128        "data", "user", "user_de",
129    };
130    std::string prefix = "/data/";
131    for (auto d: directories_to_exclude) {
132        if ((prefix + d) == dir) {
133            KLOG_INFO(TAG, "Not setting policy on %s\n", dir);
134            return 0;
135        }
136    }
137
138    std::string ref_filename = std::string("/data") + e4crypt_key_ref;
139    std::string policy;
140    if (!android::base::ReadFileToString(ref_filename, &policy)) {
141        KLOG_ERROR(TAG, "Unable to read system policy to set on %s\n", dir);
142        return -1;
143    }
144    KLOG_INFO(TAG, "Setting policy on %s\n", dir);
145    int result = e4crypt_policy_ensure(dir, policy.c_str(), policy.size());
146    if (result) {
147        KLOG_ERROR(TAG, "Setting %02x%02x%02x%02x policy on %s failed!\n",
148                   policy[0], policy[1], policy[2], policy[3], dir);
149        return -1;
150    }
151
152    return 0;
153}
154