Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4bf1887c authored by Paul Lawrence's avatar Paul Lawrence
Browse files

Securely encrypt the master key 

Remove unencrypted link since it is easier to manage directly
Move creation of key to vold
Start vold early so this is possible in a timely fashion

This is one of four changes to enable this functionality:
  https://android-review.googlesource.com/#/c/144586/
  https://android-review.googlesource.com/#/c/144663/
  https://android-review.googlesource.com/#/c/144672/
  https://android-review.googlesource.com/#/c/144673/

Bug: 18151196
Change-Id: Idb17d1f1a724c6ec509d181ae4427113e9d3b5e6
parent 653f9581

fs_mgr/fs_mgr.c

+1 −11
Original line number Original line Diff line number Diff line
@@ -31,7 +31,7 @@ 
#include <dirent.h>

#include <dirent.h>

#include <ext4.h>

#include <ext4.h>

#include <ext4_sb.h>

#include <ext4_sb.h>

#include <ext4_crypt.h>

#include <ext4_crypt_init_extensions.h>





#include <linux/loop.h>

#include <linux/loop.h>

#include <private/android_filesystem_config.h>

#include <private/android_filesystem_config.h>
@@ -480,16 +480,6 @@ static int handle_encryptable(struct fstab *fstab, const struct fstab_rec* rec) 
            return FS_MGR_MNTALL_FAIL;

            return FS_MGR_MNTALL_FAIL;

        }

        }





        // Link it to the normal place so ext4_crypt functions work normally

        strlcat(tmp_mnt, "/unencrypted", sizeof(tmp_mnt));

        char link_path[PATH_MAX];

        strlcpy(link_path, rec->mount_point, sizeof(link_path));

        strlcat(link_path, "/unencrypted", sizeof(link_path));

        if (symlink(tmp_mnt, link_path)) {

            ERROR("Error creating symlink to unencrypted directory\n");

            return FS_MGR_MNTALL_FAIL;

        }



        return FS_MGR_MNTALL_DEV_NON_DEFAULT_FILE_ENCRYPTED;

        return FS_MGR_MNTALL_DEV_NON_DEFAULT_FILE_ENCRYPTED;

    }

    }

init/builtins.cpp

+15 −30
Original line number Original line Diff line number Diff line
@@ -29,7 +29,7 @@ 
#include <sys/wait.h>

#include <sys/wait.h>

#include <unistd.h>

#include <unistd.h>

#include <linux/loop.h>

#include <linux/loop.h>

#include <ext4_crypt.h>

#include <ext4_crypt_init_extensions.h>





#include <selinux/selinux.h>

#include <selinux/selinux.h>

#include <selinux/label.h>

#include <selinux/label.h>
@@ -385,18 +385,6 @@ static int wipe_data_via_recovery() 
    while (1) { pause(); }  // never reached

    while (1) { pause(); }  // never reached

}

}





/*

 * Callback to make a directory from the ext4 code

 */

static int do_mount_alls_make_dir(const char* dir)

{

    if (make_dir(dir, 0700) && errno != EEXIST) {

        return -1;

    }



    return 0;

}



/*

/*

 * This function might request a reboot, in which case it will

 * This function might request a reboot, in which case it will

 * not return.

 * not return.
@@ -465,22 +453,6 @@ int do_mount_all(int nargs, char **args) 
        ret = wipe_data_via_recovery();

        ret = wipe_data_via_recovery();

        /* If reboot worked, there is no return. */

        /* If reboot worked, there is no return. */

    } else if (ret == FS_MGR_MNTALL_DEV_DEFAULT_FILE_ENCRYPTED) {

    } else if (ret == FS_MGR_MNTALL_DEV_DEFAULT_FILE_ENCRYPTED) {

        // We have to create the key files here. Only init can call make_dir,

        // and we can't do it from fs_mgr as then fs_mgr would depend on

        // make_dir creating a circular dependency.

        fstab = fs_mgr_read_fstab(args[1]);

        for (int i = 0; i < fstab->num_entries; ++i) {

            if (fs_mgr_is_file_encrypted(&fstab->recs[i])) {

              if (e4crypt_create_device_key(fstab->recs[i].mount_point,

                                            do_mount_alls_make_dir)) {

                    ERROR("Could not create device key on %s"

                          " - continue unencrypted\n",

                          fstab->recs[i].mount_point);

                }

            }

        }

        fs_mgr_free_fstab(fstab);



        if (e4crypt_install_keyring()) {

        if (e4crypt_install_keyring()) {

            return -1;

            return -1;

        }

        }
@@ -849,10 +821,23 @@ int do_wait(int nargs, char **args) 
        return -1;

        return -1;

}

}





/*

 * Callback to make a directory from the ext4 code

 */

static int do_installkeys_ensure_dir_exists(const char* dir)

{

    if (make_dir(dir, 0700) && errno != EEXIST) {

        return -1;

    }



    return 0;

}



int do_installkey(int nargs, char **args)

int do_installkey(int nargs, char **args)

{

{

    if (nargs == 2) {

    if (nargs == 2) {

        return e4crypt_install_key(args[1]);

      return e4crypt_create_device_key(args[1],

                                       do_installkeys_ensure_dir_exists);

    }

    }





    return -1;

    return -1;

rootdir/init.rc

+5 −3
Original line number Original line Diff line number Diff line
@@ -226,14 +226,17 @@ on post-fs 
    mkdir /cache/lost+found 0770 root root

    mkdir /cache/lost+found 0770 root root





on post-fs-data

on post-fs-data

    installkey /data



    # We chown/chmod /data again so because mount is run as root + defaults

    # We chown/chmod /data again so because mount is run as root + defaults

    chown system system /data

    chown system system /data

    chmod 0771 /data

    chmod 0771 /data

    # We restorecon /data in case the userdata partition has been reset.

    # We restorecon /data in case the userdata partition has been reset.

    restorecon /data

    restorecon /data





    # Make sure we have the device encryption key

    start logd

    start vold

    installkey /data



    # Start bootcharting as soon as possible after the data partition is

    # Start bootcharting as soon as possible after the data partition is

    # mounted to collect more data.

    # mounted to collect more data.

    mkdir /data/bootchart 0755 shell shell

    mkdir /data/bootchart 0755 shell shell
@@ -454,7 +457,6 @@ on property:vold.decrypt=trigger_restart_min_framework 
    class_start main

    class_start main





on property:vold.decrypt=trigger_restart_framework

on property:vold.decrypt=trigger_restart_framework

    installkey /data

    class_start main

    class_start main

    class_start late_start

    class_start late_start