1 // Copyright 2020, The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 //! This crate implements the Keystore 2.0 service entry point.
16
17 use keystore2::entropy;
18 use keystore2::globals::ENFORCEMENTS;
19 use keystore2::maintenance::Maintenance;
20 use keystore2::metrics::Metrics;
21 use keystore2::metrics_store;
22 use keystore2::service::KeystoreService;
23 use keystore2::{apc::ApcManager, shared_secret_negotiation};
24 use keystore2::{authorization::AuthorizationManager, id_rotation::IdRotationState};
25 use legacykeystore::LegacyKeystore;
26 use log::{error, info};
27 use rusqlite::trace as sqlite_trace;
28 use std::{os::raw::c_int, panic, path::Path, sync::mpsc::channel};
29
30 static KS2_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
31 static APC_SERVICE_NAME: &str = "android.security.apc";
32 static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization";
33 static METRICS_SERVICE_NAME: &str = "android.security.metrics";
34 static USER_MANAGER_SERVICE_NAME: &str = "android.security.maintenance";
35 static LEGACY_KEYSTORE_SERVICE_NAME: &str = "android.security.legacykeystore";
36
37 /// Keystore 2.0 takes one argument which is a path indicating its designated working directory.
main()38 fn main() {
39 // Initialize android logging.
40 android_logger::init_once(
41 android_logger::Config::default()
42 .with_tag("keystore2")
43 .with_max_level(log::LevelFilter::Debug)
44 .with_log_buffer(android_logger::LogId::System)
45 .format(|buf, record| {
46 writeln!(
47 buf,
48 "{}:{} - {}",
49 record.file().unwrap_or("unknown"),
50 record.line().unwrap_or(0),
51 record.args()
52 )
53 }),
54 );
55 // Redirect panic messages to logcat.
56 panic::set_hook(Box::new(|panic_info| {
57 error!("{}", panic_info);
58 }));
59
60 // Saying hi.
61 info!("Keystore2 is starting.");
62
63 let mut args = std::env::args();
64 args.next().expect("That's odd. How is there not even a first argument?");
65
66 // This must happen early before any other sqlite operations.
67 log::info!("Setting up sqlite logging for keystore2");
68 fn sqlite_log_handler(err: c_int, message: &str) {
69 log::error!("[SQLITE3] {}: {}", err, message);
70 }
71 // SAFETY: There are no other threads yet, `sqlite_log_handler` is threadsafe, and it doesn't
72 // invoke any SQLite calls.
73 unsafe { sqlite_trace::config_log(Some(sqlite_log_handler)) }
74 .expect("Error setting sqlite log callback.");
75
76 // Write/update keystore.crash_count system property.
77 metrics_store::update_keystore_crash_sysprop();
78
79 // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on
80 // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than
81 // Keystore 1.0. Instead we set a global variable to the database path.
82 // For the ground truth check the service startup rule for init (typically in keystore2.rc).
83 let id_rotation_state = if let Some(dir) = args.next() {
84 let db_path = Path::new(&dir);
85 *keystore2::globals::DB_PATH.write().expect("Could not lock DB_PATH.") =
86 db_path.to_path_buf();
87 IdRotationState::new(db_path)
88 } else {
89 panic!("Must specify a database directory.");
90 };
91
92 let (confirmation_token_sender, confirmation_token_receiver) = channel();
93
94 ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver);
95
96 entropy::register_feeder();
97 shared_secret_negotiation::perform_shared_secret_negotiation();
98
99 info!("Starting thread pool now.");
100 binder::ProcessState::start_thread_pool();
101
102 let ks_service = KeystoreService::new_native_binder(id_rotation_state).unwrap_or_else(|e| {
103 panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e);
104 });
105 binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| {
106 panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e);
107 });
108
109 let apc_service =
110 ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| {
111 panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e);
112 });
113 binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| {
114 panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e);
115 });
116
117 let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| {
118 panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
119 });
120 binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder())
121 .unwrap_or_else(|e| {
122 panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
123 });
124
125 let (delete_listener, legacykeystore) = LegacyKeystore::new_native_binder(
126 &keystore2::globals::DB_PATH.read().expect("Could not get DB_PATH."),
127 );
128
129 let maintenance_service = Maintenance::new_native_binder(delete_listener).unwrap_or_else(|e| {
130 panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
131 });
132 binder::add_service(USER_MANAGER_SERVICE_NAME, maintenance_service.as_binder()).unwrap_or_else(
133 |e| {
134 panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
135 },
136 );
137
138 let metrics_service = Metrics::new_native_binder().unwrap_or_else(|e| {
139 panic!("Failed to create service {} because of {:?}.", METRICS_SERVICE_NAME, e);
140 });
141 binder::add_service(METRICS_SERVICE_NAME, metrics_service.as_binder()).unwrap_or_else(|e| {
142 panic!("Failed to register service {} because of {:?}.", METRICS_SERVICE_NAME, e);
143 });
144
145 binder::add_service(LEGACY_KEYSTORE_SERVICE_NAME, legacykeystore.as_binder()).unwrap_or_else(
146 |e| {
147 panic!(
148 "Failed to register service {} because of {:?}.",
149 LEGACY_KEYSTORE_SERVICE_NAME, e
150 );
151 },
152 );
153
154 info!("Successfully registered Keystore 2.0 service.");
155
156 info!("Joining thread pool now.");
157 binder::ProcessState::join_thread_pool();
158 }
159