1 // Copyright 2020, The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 //! This crate implements the Keystore 2.0 service entry point.
16
17 use keystore2::entropy;
18 use keystore2::globals::ENFORCEMENTS;
19 use keystore2::maintenance::Maintenance;
20 use keystore2::metrics::Metrics;
21 use keystore2::metrics_store;
22 use keystore2::remote_provisioning::RemoteProvisioningService;
23 use keystore2::service::KeystoreService;
24 use keystore2::{apc::ApcManager, shared_secret_negotiation};
25 use keystore2::{authorization::AuthorizationManager, id_rotation::IdRotationState};
26 use legacykeystore::LegacyKeystore;
27 use log::{error, info};
28 use std::{panic, path::Path, sync::mpsc::channel};
29
30 static KS2_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
31 static APC_SERVICE_NAME: &str = "android.security.apc";
32 static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization";
33 static METRICS_SERVICE_NAME: &str = "android.security.metrics";
34 static REMOTE_PROVISIONING_SERVICE_NAME: &str = "android.security.remoteprovisioning";
35 static USER_MANAGER_SERVICE_NAME: &str = "android.security.maintenance";
36 static LEGACY_KEYSTORE_SERVICE_NAME: &str = "android.security.legacykeystore";
37
38 /// Keystore 2.0 takes one argument which is a path indicating its designated working directory.
main()39 fn main() {
40 // Initialize android logging.
41 android_logger::init_once(
42 android_logger::Config::default().with_tag("keystore2").with_min_level(log::Level::Debug),
43 );
44 // Redirect panic messages to logcat.
45 panic::set_hook(Box::new(|panic_info| {
46 error!("{}", panic_info);
47 }));
48
49 // Saying hi.
50 info!("Keystore2 is starting.");
51
52 let mut args = std::env::args();
53 args.next().expect("That's odd. How is there not even a first argument?");
54
55 // Write/update keystore.crash_count system property.
56 metrics_store::update_keystore_crash_sysprop();
57
58 // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on
59 // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than
60 // Keystore 1.0. Instead we set a global variable to the database path.
61 // For the ground truth check the service startup rule for init (typically in keystore2.rc).
62 let id_rotation_state = if let Some(dir) = args.next() {
63 let db_path = Path::new(&dir);
64 *keystore2::globals::DB_PATH.write().expect("Could not lock DB_PATH.") =
65 db_path.to_path_buf();
66 IdRotationState::new(&db_path)
67 } else {
68 panic!("Must specify a database directory.");
69 };
70
71 let (confirmation_token_sender, confirmation_token_receiver) = channel();
72
73 ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver);
74
75 entropy::register_feeder();
76 shared_secret_negotiation::perform_shared_secret_negotiation();
77
78 info!("Starting thread pool now.");
79 binder::ProcessState::start_thread_pool();
80
81 let ks_service = KeystoreService::new_native_binder(id_rotation_state).unwrap_or_else(|e| {
82 panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e);
83 });
84 binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| {
85 panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e);
86 });
87
88 let apc_service =
89 ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| {
90 panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e);
91 });
92 binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| {
93 panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e);
94 });
95
96 let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| {
97 panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
98 });
99 binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder())
100 .unwrap_or_else(|e| {
101 panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
102 });
103
104 let (delete_listener, legacykeystore) = LegacyKeystore::new_native_binder(
105 &keystore2::globals::DB_PATH.read().expect("Could not get DB_PATH."),
106 );
107
108 let maintenance_service = Maintenance::new_native_binder(delete_listener).unwrap_or_else(|e| {
109 panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
110 });
111 binder::add_service(USER_MANAGER_SERVICE_NAME, maintenance_service.as_binder()).unwrap_or_else(
112 |e| {
113 panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
114 },
115 );
116
117 let metrics_service = Metrics::new_native_binder().unwrap_or_else(|e| {
118 panic!("Failed to create service {} because of {:?}.", METRICS_SERVICE_NAME, e);
119 });
120 binder::add_service(METRICS_SERVICE_NAME, metrics_service.as_binder()).unwrap_or_else(|e| {
121 panic!("Failed to register service {} because of {:?}.", METRICS_SERVICE_NAME, e);
122 });
123
124 // Devices with KS2 and KM 1.0 may not have any IRemotelyProvisionedComponent HALs at all. Do
125 // not panic if new_native_binder returns failure because it could not find the TEE HAL.
126 if let Ok(remote_provisioning_service) = RemoteProvisioningService::new_native_binder() {
127 binder::add_service(
128 REMOTE_PROVISIONING_SERVICE_NAME,
129 remote_provisioning_service.as_binder(),
130 )
131 .unwrap_or_else(|e| {
132 panic!(
133 "Failed to register service {} because of {:?}.",
134 REMOTE_PROVISIONING_SERVICE_NAME, e
135 );
136 });
137 }
138
139 binder::add_service(LEGACY_KEYSTORE_SERVICE_NAME, legacykeystore.as_binder()).unwrap_or_else(
140 |e| {
141 panic!(
142 "Failed to register service {} because of {:?}.",
143 LEGACY_KEYSTORE_SERVICE_NAME, e
144 );
145 },
146 );
147
148 info!("Successfully registered Keystore 2.0 service.");
149
150 info!("Joining thread pool now.");
151 binder::ProcessState::join_thread_pool();
152 }
153