gatekeeperd.cpp revision 33dfdc7bbc48911a8a5324b16b05e492ae653d76
1/* 2 * Copyright (C) 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#define LOG_TAG "gatekeeperd" 18 19#include "IGateKeeperService.h" 20 21#include <errno.h> 22#include <stdint.h> 23#include <inttypes.h> 24#include <fcntl.h> 25#include <unistd.h> 26 27#include <cutils/log.h> 28#include <utils/Log.h> 29 30#include <binder/IPCThreadState.h> 31#include <binder/IServiceManager.h> 32#include <binder/PermissionCache.h> 33#include <utils/String16.h> 34 35#include <keystore/IKeystoreService.h> 36#include <keystore/keystore.h> // For error code 37#include <gatekeeper/password_handle.h> // for password_handle_t 38#include <hardware/gatekeeper.h> 39#include <hardware/hw_auth_token.h> 40 41#include "SoftGateKeeperDevice.h" 42 43namespace android { 44 45static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SECURE_STORAGE"); 46static const String16 DUMP_PERMISSION("android.permission.DUMP"); 47 48class GateKeeperProxy : public BnGateKeeperService { 49public: 50 GateKeeperProxy() { 51 int ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &module); 52 if (ret < 0) { 53 ALOGW("falling back to software GateKeeper"); 54 soft_device.reset(new SoftGateKeeperDevice()); 55 } else { 56 ret = gatekeeper_open(module, &device); 57 if (ret < 0) 58 LOG_ALWAYS_FATAL_IF(ret < 0, "Unable to open GateKeeper HAL"); 59 } 60 } 61 62 virtual ~GateKeeperProxy() { 63 if (device) gatekeeper_close(device); 64 } 65 66 void store_sid(uint32_t uid, uint64_t sid) { 67 char filename[21]; 68 sprintf(filename, "%u", uid); 69 int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR); 70 if (fd < 0) { 71 ALOGE("could not open file: %s: %s", filename, strerror(errno)); 72 return; 73 } 74 write(fd, &sid, sizeof(sid)); 75 close(fd); 76 } 77 78 void maybe_store_sid(uint32_t uid, uint64_t sid) { 79 char filename[21]; 80 sprintf(filename, "%u", uid); 81 if (access(filename, F_OK) == -1) { 82 store_sid(uid, sid); 83 } 84 } 85 86 uint64_t read_sid(uint32_t uid) { 87 char filename[21]; 88 uint64_t sid; 89 sprintf(filename, "%u", uid); 90 int fd = open(filename, O_RDONLY); 91 if (fd < 0) return 0; 92 read(fd, &sid, sizeof(sid)); 93 return sid; 94 } 95 96 void clear_sid(uint32_t uid) { 97 char filename[21]; 98 sprintf(filename, "%u", uid); 99 if (remove(filename) < 0) { 100 ALOGE("%s: could not remove file [%s], attempting 0 write", __func__, strerror(errno)); 101 store_sid(uid, 0); 102 } 103 } 104 105 virtual status_t enroll(uint32_t uid, 106 const uint8_t *current_password_handle, uint32_t current_password_handle_length, 107 const uint8_t *current_password, uint32_t current_password_length, 108 const uint8_t *desired_password, uint32_t desired_password_length, 109 uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length) { 110 IPCThreadState* ipc = IPCThreadState::self(); 111 const int calling_pid = ipc->getCallingPid(); 112 const int calling_uid = ipc->getCallingUid(); 113 if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) { 114 return PERMISSION_DENIED; 115 } 116 117 // need a desired password to enroll 118 if (desired_password_length == 0) return -EINVAL; 119 120 int ret; 121 if (device) { 122 ret = device->enroll(device, uid, 123 current_password_handle, current_password_handle_length, 124 current_password, current_password_length, 125 desired_password, desired_password_length, 126 enrolled_password_handle, enrolled_password_handle_length); 127 } else { 128 ret = soft_device->enroll(uid, 129 current_password_handle, current_password_handle_length, 130 current_password, current_password_length, 131 desired_password, desired_password_length, 132 enrolled_password_handle, enrolled_password_handle_length); 133 } 134 135 if (ret >= 0) { 136 gatekeeper::password_handle_t *handle = 137 reinterpret_cast<gatekeeper::password_handle_t *>(*enrolled_password_handle); 138 store_sid(uid, handle->user_id); 139 return NO_ERROR; 140 } 141 return UNKNOWN_ERROR; 142 } 143 144 virtual status_t verify(uint32_t uid, 145 const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length, 146 const uint8_t *provided_password, uint32_t provided_password_length) { 147 uint8_t *auth_token; 148 uint32_t auth_token_length; 149 return verifyChallenge(uid, 0, enrolled_password_handle, enrolled_password_handle_length, 150 provided_password, provided_password_length, 151 &auth_token, &auth_token_length); 152 } 153 154 virtual status_t verifyChallenge(uint32_t uid, uint64_t challenge, 155 const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length, 156 const uint8_t *provided_password, uint32_t provided_password_length, 157 uint8_t **auth_token, uint32_t *auth_token_length) { 158 IPCThreadState* ipc = IPCThreadState::self(); 159 const int calling_pid = ipc->getCallingPid(); 160 const int calling_uid = ipc->getCallingUid(); 161 if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) { 162 return PERMISSION_DENIED; 163 } 164 165 // can't verify if we're missing either param 166 if ((enrolled_password_handle_length | provided_password_length) == 0) 167 return -EINVAL; 168 169 int ret; 170 if (device) { 171 ret = device->verify(device, uid, challenge, 172 enrolled_password_handle, enrolled_password_handle_length, 173 provided_password, provided_password_length, auth_token, auth_token_length); 174 } else { 175 ret = soft_device->verify(uid, challenge, 176 enrolled_password_handle, enrolled_password_handle_length, 177 provided_password, provided_password_length, auth_token, auth_token_length); 178 } 179 180 if (ret >= 0 && *auth_token != NULL && *auth_token_length > 0) { 181 // TODO: cache service? 182 sp<IServiceManager> sm = defaultServiceManager(); 183 sp<IBinder> binder = sm->getService(String16("android.security.keystore")); 184 sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder); 185 if (service != NULL) { 186 status_t ret = service->addAuthToken(*auth_token, *auth_token_length); 187 if (ret != ResponseCode::NO_ERROR) { 188 ALOGE("Falure sending auth token to KeyStore: %d", ret); 189 } 190 } else { 191 ALOGE("Unable to communicate with KeyStore"); 192 } 193 } 194 195 if (ret >= 0) { 196 maybe_store_sid(uid, reinterpret_cast<const gatekeeper::password_handle_t *>( 197 enrolled_password_handle)->user_id); 198 return NO_ERROR; 199 } 200 201 return UNKNOWN_ERROR; 202 } 203 204 virtual uint64_t getSecureUserId(uint32_t uid) { 205 return read_sid(uid); 206 } 207 208 virtual void clearSecureUserId(uint32_t uid) { 209 IPCThreadState* ipc = IPCThreadState::self(); 210 const int calling_pid = ipc->getCallingPid(); 211 const int calling_uid = ipc->getCallingUid(); 212 if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) { 213 ALOGE("%s: permission denied for [%d:%d]", __func__, calling_pid, calling_uid); 214 return; 215 } 216 clear_sid(uid); 217 } 218 219 virtual status_t dump(int fd, const Vector<String16> &) { 220 IPCThreadState* ipc = IPCThreadState::self(); 221 const int pid = ipc->getCallingPid(); 222 const int uid = ipc->getCallingUid(); 223 if (!PermissionCache::checkPermission(DUMP_PERMISSION, pid, uid)) { 224 return PERMISSION_DENIED; 225 } 226 227 if (device == NULL) { 228 const char *result = "Device not available"; 229 write(fd, result, strlen(result) + 1); 230 } else { 231 const char *result = "OK"; 232 write(fd, result, strlen(result) + 1); 233 } 234 235 return NO_ERROR; 236 } 237 238private: 239 gatekeeper_device_t *device; 240 UniquePtr<SoftGateKeeperDevice> soft_device; 241 const hw_module_t *module; 242}; 243}// namespace android 244 245int main(int argc, char* argv[]) { 246 ALOGI("Starting gatekeeperd..."); 247 if (argc < 2) { 248 ALOGE("A directory must be specified!"); 249 return 1; 250 } 251 if (chdir(argv[1]) == -1) { 252 ALOGE("chdir: %s: %s", argv[1], strerror(errno)); 253 return 1; 254 } 255 256 android::sp<android::IServiceManager> sm = android::defaultServiceManager(); 257 android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy(); 258 android::status_t ret = sm->addService( 259 android::String16("android.service.gatekeeper.IGateKeeperService"), proxy); 260 if (ret != android::OK) { 261 ALOGE("Couldn't register binder service!"); 262 return -1; 263 } 264 265 /* 266 * We're the only thread in existence, so we're just going to process 267 * Binder transaction as a single-threaded program. 268 */ 269 android::IPCThreadState::self()->joinThreadPool(); 270 return 0; 271} 272