1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef ANDROID_VOLD_KEYUTIL_H 18 #define ANDROID_VOLD_KEYUTIL_H 19 20 #include "KeyBuffer.h" 21 #include "KeyStorage.h" 22 23 #include <fscrypt/fscrypt.h> 24 25 #include <memory> 26 #include <string> 27 28 namespace android { 29 namespace vold { 30 31 // Description of how to generate a key when needed. 32 struct KeyGeneration { 33 size_t keysize; 34 bool allow_gen; 35 bool use_hw_wrapped_key; 36 }; 37 38 // Generate a key as specified in KeyGeneration 39 bool generateStorageKey(const KeyGeneration& gen, KeyBuffer* key); 40 41 // Returns a key with allow_gen false so generateStorageKey returns false; 42 // this is used to indicate to retrieveOrGenerateKey that a key should not 43 // be generated. 44 const KeyGeneration neverGen(); 45 46 bool isFsKeyringSupported(void); 47 48 // Install a file-based encryption key to the kernel, for use by encrypted files 49 // on the specified filesystem using the specified encryption policy version. 50 // 51 // For v1 policies, we use FS_IOC_ADD_ENCRYPTION_KEY if the kernel supports it. 52 // Otherwise we add the key to the global session keyring as a "logon" key. 53 // 54 // For v2 policies, we always use FS_IOC_ADD_ENCRYPTION_KEY; it's the only way 55 // the kernel supports. 56 // 57 // If kernel supports FS_IOC_ADD_ENCRYPTION_KEY, also installs key of 58 // fscrypt-provisioning type to the global session keyring. This makes it 59 // possible to unmount and then remount mountpoint without losing the file-based 60 // key. 61 // 62 // Returns %true on success, %false on failure. On success also sets *policy 63 // to the EncryptionPolicy used to refer to this key. 64 bool installKey(const std::string& mountpoint, const android::fscrypt::EncryptionOptions& options, 65 const KeyBuffer& key, android::fscrypt::EncryptionPolicy* policy); 66 67 // Evict a file-based encryption key from the kernel. 68 // 69 // This undoes the effect of installKey(). 70 // 71 // If the kernel doesn't support the filesystem-level keyring, the caller is 72 // responsible for dropping caches. 73 bool evictKey(const std::string& mountpoint, const android::fscrypt::EncryptionPolicy& policy); 74 75 // Retrieves the key from the named directory, or generates it if it doesn't 76 // exist. 77 bool retrieveOrGenerateKey(const std::string& key_path, const std::string& tmp_path, 78 const KeyAuthentication& key_authentication, const KeyGeneration& gen, 79 KeyBuffer* key); 80 81 // Re-installs a file-based encryption key of fscrypt-provisioning type from the 82 // global session keyring back into fs keyring of the mountpoint. 83 bool reloadKeyFromSessionKeyring(const std::string& mountpoint, 84 const android::fscrypt::EncryptionPolicy& policy); 85 86 } // namespace vold 87 } // namespace android 88 89 #endif 90