1 #define TAG "ext4_utils"
2
3 #include "ext4_crypt_init_extensions.h"
4
5 #include <string>
6
7 #include <dirent.h>
8 #include <errno.h>
9 #include <sys/mount.h>
10 #include <sys/stat.h>
11
12 #include <cutils/klog.h>
13 #include <cutils/properties.h>
14 #include <cutils/sockets.h>
15 #include <poll.h>
16
17 #include "key_control.h"
18 #include "unencrypted_properties.h"
19
20 static const std::string arbitrary_sequence_number = "42";
21 static const int vold_command_timeout_ms = 60 * 1000;
22
vold_command(std::string const & command)23 static std::string vold_command(std::string const& command)
24 {
25 KLOG_INFO(TAG, "Running command %s\n", command.c_str());
26 int sock = -1;
27
28 while (true) {
29 sock = socket_local_client("cryptd",
30 ANDROID_SOCKET_NAMESPACE_RESERVED,
31 SOCK_STREAM);
32 if (sock >= 0) {
33 break;
34 }
35 usleep(10000);
36 }
37
38 if (sock < 0) {
39 KLOG_INFO(TAG, "Cannot open vold, failing command (%s)\n", strerror(errno));
40 return "";
41 }
42
43 class CloseSocket
44 {
45 int sock_;
46 public:
47 CloseSocket(int sock) : sock_(sock) {}
48 ~CloseSocket() { close(sock_); }
49 };
50
51 CloseSocket cs(sock);
52
53 // Use arbitrary sequence number. This should only be used when the
54 // framework is down, so this is (mostly) OK.
55 std::string actual_command = arbitrary_sequence_number + " " + command;
56 if (write(sock, actual_command.c_str(), actual_command.size() + 1) < 0) {
57 KLOG_ERROR(TAG, "Cannot write command (%s)\n", strerror(errno));
58 return "";
59 }
60
61 struct pollfd poll_sock = {sock, POLLIN, 0};
62
63 int rc = TEMP_FAILURE_RETRY(poll(&poll_sock, 1, vold_command_timeout_ms));
64 if (rc < 0) {
65 KLOG_ERROR(TAG, "Error in poll (%s)\n", strerror(errno));
66 return "";
67 }
68
69 if (!(poll_sock.revents & POLLIN)) {
70 KLOG_ERROR(TAG, "Timeout\n");
71 return "";
72 }
73 char buffer[4096];
74 memset(buffer, 0, sizeof(buffer));
75 rc = TEMP_FAILURE_RETRY(read(sock, buffer, sizeof(buffer)));
76 if (rc <= 0) {
77 if (rc == 0) {
78 KLOG_ERROR(TAG, "Lost connection to Vold - did it crash?\n");
79 } else {
80 KLOG_ERROR(TAG, "Error reading data (%s)\n", strerror(errno));
81 }
82 return "";
83 }
84
85 // We don't truly know that this is the correct result. However,
86 // since this will only be used when the framework is down,
87 // it should be OK unless someone is running vdc at the same time.
88 // Worst case we force a reboot in the very rare synchronization
89 // error
90 return std::string(buffer, rc);
91 }
92
e4crypt_create_device_key(const char * dir,int ensure_dir_exists (const char *))93 int e4crypt_create_device_key(const char* dir,
94 int ensure_dir_exists(const char*))
95 {
96 // Already encrypted with password? If so bail
97 std::string temp_folder = std::string() + dir + "/tmp_mnt";
98 DIR* temp_dir = opendir(temp_folder.c_str());
99 if (temp_dir) {
100 closedir(temp_dir);
101 return 0;
102 }
103
104 // Make sure folder exists. Use make_dir to set selinux permissions.
105 if (ensure_dir_exists(UnencryptedProperties::GetPath(dir).c_str())) {
106 KLOG_ERROR(TAG, "Failed to create %s (%s)\n",
107 UnencryptedProperties::GetPath(dir).c_str(),
108 strerror(errno));
109 return -1;
110 }
111
112 auto result = vold_command("cryptfs enablefilecrypto");
113 // ext4enc:TODO proper error handling
114 KLOG_INFO(TAG, "enablefilecrypto returned with result %s\n",
115 result.c_str());
116
117 return 0;
118 }
119
e4crypt_install_keyring()120 int e4crypt_install_keyring()
121 {
122 key_serial_t device_keyring = add_key("keyring", "e4crypt", 0, 0,
123 KEY_SPEC_SESSION_KEYRING);
124
125 if (device_keyring == -1) {
126 KLOG_ERROR(TAG, "Failed to create keyring (%s)\n", strerror(errno));
127 return -1;
128 }
129
130 KLOG_INFO(TAG, "Keyring created wth id %d in process %d\n",
131 device_keyring, getpid());
132
133 return 0;
134 }
135
e4crypt_set_directory_policy(const char * dir)136 int e4crypt_set_directory_policy(const char* dir)
137 {
138 // Only set policy on first level /data directories
139 // To make this less restrictive, consider using a policy file.
140 // However this is overkill for as long as the policy is simply
141 // to apply a global policy to all /data folders created via makedir
142 if (!dir || strncmp(dir, "/data/", 6) || strchr(dir + 6, '/')) {
143 return 0;
144 }
145
146 // Don't encrypt lost+found - ext4 doesn't like it
147 if (!strcmp(dir, "/data/lost+found")) {
148 return 0;
149 }
150
151 // ext4enc:TODO exclude /data/user with a horrible special case.
152 if (!strcmp(dir, "/data/user")) {
153 return 0;
154 }
155
156 UnencryptedProperties props("/data");
157 std::string policy = props.Get<std::string>(properties::ref);
158 if (policy.empty()) {
159 // ext4enc:TODO why is this OK?
160 return 0;
161 }
162
163 KLOG_INFO(TAG, "Setting policy on %s\n", dir);
164 int result = do_policy_set(dir, policy.c_str(), policy.size());
165 if (result) {
166 KLOG_ERROR(TAG, "Setting %02x%02x%02x%02x policy on %s failed!\n",
167 policy[0], policy[1], policy[2], policy[3], dir);
168 return -1;
169 }
170
171 return 0;
172 }
173
e4crypt_set_user_crypto_policies(const char * dir)174 int e4crypt_set_user_crypto_policies(const char* dir)
175 {
176 auto command = std::string() + "cryptfs setusercryptopolicies " + dir;
177 auto result = vold_command(command);
178 // ext4enc:TODO proper error handling
179 KLOG_INFO(TAG, "setusercryptopolicies returned with result %s\n",
180 result.c_str());
181 return 0;
182 }
183