1 #define TAG "ext4_utils"
3 #include "ext4_crypt.h"
11 #include <sys/mount.h>
14 #include <cutils/klog.h>
15 #include <cutils/properties.h>
16 #include <cutils/sockets.h>
18 #include "unencrypted_properties.h"
20 // ext4enc:TODO Include structure from somewhere sensible
21 // MUST be in sync with ext4_crypto.c in kernel
22 #define EXT4_MAX_KEY_SIZE 76
23 struct ext4_encryption_key
{
25 char raw
[EXT4_MAX_KEY_SIZE
];
29 static const std::string keyring
= "@s";
30 static const std::string arbitrary_sequence_number
= "42";
32 static key_serial_t device_keyring
= -1;
34 static std::string
vold_command(std::string
const& command
)
36 KLOG_INFO(TAG
, "Running command %s\n", command
.c_str());
37 int sock
= socket_local_client("vold",
38 ANDROID_SOCKET_NAMESPACE_RESERVED
,
42 KLOG_INFO(TAG
, "Cannot open vold, failing command\n");
50 CloseSocket(int sock
) : sock_(sock
) {}
51 ~CloseSocket() { close(sock_
); }
56 // Use arbitrary sequence number. This should only be used when the
57 // framework is down, so this is (mostly) OK.
58 std::string actual_command
= arbitrary_sequence_number
+ " " + command
;
59 if (write(sock
, actual_command
.c_str(), actual_command
.size() + 1) < 0) {
60 KLOG_ERROR(TAG
, "Cannot write command\n");
71 FD_SET(sock
, &read_fds
);
73 int rc
= select(sock
+ 1, &read_fds
, NULL
, NULL
, &to
);
75 KLOG_ERROR(TAG
, "Error in select %s\n", strerror(errno
));
78 KLOG_ERROR(TAG
, "Timeout\n");
80 } else if (FD_ISSET(sock
, &read_fds
)) {
82 memset(buffer
, 0, sizeof(buffer
));
83 rc
= read(sock
, buffer
, sizeof(buffer
));
86 KLOG_ERROR(TAG
, "Lost connection to Vold - did it crash?\n");
88 KLOG_ERROR(TAG
, "Error reading data (%s)\n", strerror(errno
));
93 // We don't truly know that this is the correct result. However,
94 // since this will only be used when the framework is down,
95 // it should be OK unless someone is running vdc at the same time.
96 // Worst case we force a reboot in the very rare synchronization
98 return std::string(buffer
, rc
);
103 int e4crypt_create_device_key(const char* dir
,
104 int ensure_dir_exists(const char*))
106 // Make sure folder exists. Use make_dir to set selinux permissions.
107 KLOG_INFO(TAG
, "Creating test device key\n");
108 UnencryptedProperties
props(dir
);
109 if (ensure_dir_exists(props
.GetPath().c_str())) {
110 KLOG_ERROR(TAG
, "Failed to create %s with error %s\n",
111 props
.GetPath().c_str(), strerror(errno
));
115 if (props
.Get
<std::string
>(properties::key
).empty()) {
116 // Create new key since it doesn't already exist
117 std::ifstream
urandom("/dev/urandom", std::ifstream::binary
);
119 KLOG_ERROR(TAG
, "Failed to open /dev/urandom\n");
123 // ext4enc:TODO Don't hardcode 32
124 std::string
key_material(32, '\0');
125 urandom
.read(&key_material
[0], key_material
.length());
127 KLOG_ERROR(TAG
, "Failed to read random bytes\n");
131 if (!props
.Set(properties::key
, key_material
)) {
132 KLOG_ERROR(TAG
, "Failed to write key material\n");
137 if (!props
.Remove(properties::ref
)) {
138 KLOG_ERROR(TAG
, "Failed to remove key ref\n");
145 int e4crypt_install_keyring()
147 device_keyring
= add_key("keyring",
151 KEY_SPEC_SESSION_KEYRING
);
153 if (device_keyring
== -1) {
154 KLOG_ERROR(TAG
, "Failed to create keyring\n");
158 KLOG_INFO(TAG
, "Keyring created wth id %d in process %d\n",
159 device_keyring
, getpid());
161 // ext4enc:TODO set correct permissions
162 long result
= keyctl_setperm(device_keyring
, 0x3f3f3f3f);
164 KLOG_ERROR(TAG
, "KEYCTL_SETPERM failed with error %ld\n", result
);
171 int e4crypt_install_key(const char* dir
)
173 UnencryptedProperties
props(dir
);
174 auto key
= props
.Get
<std::string
>(properties::key
);
176 // Get password to decrypt as needed
177 if (e4crypt_non_default_key(dir
)) {
178 std::string result
= vold_command("cryptfs getpw");
182 // 200 0 {{sensitive}} 0001020304
183 // where 0001020304 is hex encoding of password
184 std::istringstream
i(result
);
188 KLOG_ERROR(TAG
, "Expecting 200\n");
193 if (bit
!= arbitrary_sequence_number
) {
194 KLOG_ERROR(TAG
, "Expecting %s\n", arbitrary_sequence_number
.c_str());
199 if (bit
!= "{{sensitive}}") {
200 KLOG_INFO(TAG
, "Not encrypted\n");
207 // Add key to keyring
208 ext4_encryption_key ext4_key
= {0, {0}, 0};
209 if (key
.length() > sizeof(ext4_key
.raw
)) {
210 KLOG_ERROR(TAG
, "Key too long\n");
215 memcpy(ext4_key
.raw
, &key
[0], key
.length());
216 ext4_key
.size
= key
.length();
218 // ext4enc:TODO Use better reference not 1234567890
219 key_serial_t key_id
= add_key("logon", "ext4-key:1234567890",
220 (void*)&ext4_key
, sizeof(ext4_key
),
224 KLOG_ERROR(TAG
, "Failed to insert key into keyring with error %s\n",
229 KLOG_INFO(TAG
, "Added key %d to keyring %d in process %d\n",
230 key_id
, device_keyring
, getpid());
232 // ext4enc:TODO set correct permissions
233 long result
= keyctl_setperm(key_id
, 0x3f3f3f3f);
235 KLOG_ERROR(TAG
, "KEYCTL_SETPERM failed with error %ld\n", result
);
239 // Save reference to key so we can set policy later
240 if (!props
.Set(properties::ref
, "ext4-key:1234567890")) {
241 KLOG_ERROR(TAG
, "Cannot save key reference\n");
248 int e4crypt_set_directory_policy(const char* dir
)
250 // Only set policy on first level /data directories
251 // To make this less restrictive, consider using a policy file.
252 // However this is overkill for as long as the policy is simply
253 // to apply a global policy to all /data folders created via makedir
254 if (!dir
|| strncmp(dir
, "/data/", 6) || strchr(dir
+ 6, '/')) {
258 UnencryptedProperties
props("/data");
259 std::string ref
= props
.Get
<std::string
>(properties::ref
);
260 std::string policy
= keyring
+ "." + ref
;
261 KLOG_INFO(TAG
, "Setting policy %s\n", policy
.c_str());
262 int result
= do_policy_set(dir
, policy
.c_str());
264 KLOG_ERROR(TAG
, "Setting policy on %s failed!\n", dir
);