1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "grant_store.h"
18
19 #include "blob.h"
20 #include <algorithm>
21 #include <sstream>
22
23 namespace keystore {
24
25 static constexpr uint64_t kInvalidGrantNo = std::numeric_limits<uint64_t>::max();
26 static const char* kKeystoreGrantInfix = "_KEYSTOREGRANT_";
27 static constexpr size_t kKeystoreGrantInfixLength = 15;
28
Grant(const KeyBlobEntry & entry,const uint64_t grant_no)29 Grant::Grant(const KeyBlobEntry& entry, const uint64_t grant_no)
30 : entry_(entry), grant_no_(grant_no) {}
31
parseGrantAlias(const std::string & grantAlias)32 static std::pair<uint64_t, std::string> parseGrantAlias(const std::string& grantAlias) {
33 auto pos = grantAlias.rfind(kKeystoreGrantInfix);
34 if (pos == std::string::npos) return {kInvalidGrantNo, ""};
35 std::stringstream s(grantAlias.substr(pos + kKeystoreGrantInfixLength));
36 std::string wrapped_alias = grantAlias.substr(0, pos);
37 uint64_t grant_no = kInvalidGrantNo;
38 s >> grant_no;
39 if (s.fail() || grant_no == kInvalidGrantNo) return {kInvalidGrantNo, ""};
40 return {grant_no, wrapped_alias};
41 }
42
put(const uid_t uid,const LockedKeyBlobEntry & lockedEntry)43 std::string GrantStore::put(const uid_t uid, const LockedKeyBlobEntry& lockedEntry) {
44 std::unique_lock<std::shared_mutex> lock(mutex_);
45 std::stringstream s;
46 KeyBlobEntry blobEntry = *lockedEntry;
47 s << blobEntry.alias() << kKeystoreGrantInfix;
48
49 std::set<Grant, std::less<>>& uid_grant_list = grants_[uid];
50
51 bool success = false;
52 auto iterator =
53 std::find_if(uid_grant_list.begin(), uid_grant_list.end(),
54 [&](const Grant& entry) { return success = entry.entry_ == blobEntry; });
55 while (!success) {
56 std::tie(iterator, success) = uid_grant_list.emplace(blobEntry, std::rand());
57 }
58 s << iterator->grant_no_;
59 return s.str();
60 }
61
get(const uid_t uid,const std::string & alias) const62 ReadLockedGrant GrantStore::get(const uid_t uid, const std::string& alias) const {
63 std::shared_lock<std::shared_mutex> lock(mutex_);
64 uint64_t grant_no;
65 std::string wrappedAlias;
66 std::tie(grant_no, wrappedAlias) = parseGrantAlias(alias);
67 if (grant_no == kInvalidGrantNo) return {};
68 auto uid_set_iter = grants_.find(uid);
69 if (uid_set_iter == grants_.end()) return {};
70 auto& uid_grant_list = uid_set_iter->second;
71 auto grant = uid_grant_list.find(grant_no);
72 if (grant == uid_grant_list.end()) return {};
73 if (grant->entry_.alias() != wrappedAlias) return {};
74 return {&(*grant), std::move(lock)};
75 }
76
removeByFileAlias(const uid_t granteeUid,const LockedKeyBlobEntry & lockedEntry)77 bool GrantStore::removeByFileAlias(const uid_t granteeUid, const LockedKeyBlobEntry& lockedEntry) {
78 std::unique_lock<std::shared_mutex> lock(mutex_);
79 auto& uid_grant_list = grants_[granteeUid];
80 for (auto i = uid_grant_list.begin(); i != uid_grant_list.end(); ++i) {
81 if (i->entry_ == *lockedEntry) {
82 uid_grant_list.erase(i);
83 return true;
84 }
85 }
86 return false;
87 }
88
removeAllGrantsToKey(const uid_t granterUid,const std::string & alias)89 void GrantStore::removeAllGrantsToKey(const uid_t granterUid, const std::string& alias) {
90 std::unique_lock<std::shared_mutex> lock(mutex_);
91 for (auto& uid_grant_list : grants_) {
92 for (auto i = uid_grant_list.second.begin(); i != uid_grant_list.second.end(); ++i) {
93 if (i->entry_.alias() == alias && i->entry_.uid() == granterUid) {
94 uid_grant_list.second.erase(i);
95 break;
96 }
97 }
98 }
99 }
100
removeAllGrantsToUid(const uid_t granteeUid)101 void GrantStore::removeAllGrantsToUid(const uid_t granteeUid) {
102 std::unique_lock<std::shared_mutex> lock(mutex_);
103 grants_.erase(granteeUid);
104 }
105
106 } // namespace keystore
107