Securely encrypt the master key
Remove unencrypted link since it is easier to manage directly
Move creation of key to vold
Start vold early so this is possible in a timely fashion
This is one of four changes to enable this functionality:
https://android-review.googlesource.com/#/c/144586/
https://android-review.googlesource.com/#/c/144663/
https://android-review.googlesource.com/#/c/144672/
https://android-review.googlesource.com/#/c/144673/
Bug: 18151196
Change-Id: Idb17d1f1a724c6ec509d181ae4427113e9d3b5e6
diff --git a/init/builtins.cpp b/init/builtins.cpp
index 3bbaf83..d0e56ec 100644
--- a/init/builtins.cpp
+++ b/init/builtins.cpp
@@ -29,7 +29,7 @@
#include <sys/wait.h>
#include <unistd.h>
#include <linux/loop.h>
-#include <ext4_crypt.h>
+#include <ext4_crypt_init_extensions.h>
#include <selinux/selinux.h>
#include <selinux/label.h>
@@ -386,18 +386,6 @@
}
/*
- * Callback to make a directory from the ext4 code
- */
-static int do_mount_alls_make_dir(const char* dir)
-{
- if (make_dir(dir, 0700) && errno != EEXIST) {
- return -1;
- }
-
- return 0;
-}
-
-/*
* This function might request a reboot, in which case it will
* not return.
*/
@@ -465,22 +453,6 @@
ret = wipe_data_via_recovery();
/* If reboot worked, there is no return. */
} else if (ret == FS_MGR_MNTALL_DEV_DEFAULT_FILE_ENCRYPTED) {
- // We have to create the key files here. Only init can call make_dir,
- // and we can't do it from fs_mgr as then fs_mgr would depend on
- // make_dir creating a circular dependency.
- fstab = fs_mgr_read_fstab(args[1]);
- for (int i = 0; i < fstab->num_entries; ++i) {
- if (fs_mgr_is_file_encrypted(&fstab->recs[i])) {
- if (e4crypt_create_device_key(fstab->recs[i].mount_point,
- do_mount_alls_make_dir)) {
- ERROR("Could not create device key on %s"
- " - continue unencrypted\n",
- fstab->recs[i].mount_point);
- }
- }
- }
- fs_mgr_free_fstab(fstab);
-
if (e4crypt_install_keyring()) {
return -1;
}
@@ -849,10 +821,23 @@
return -1;
}
+/*
+ * Callback to make a directory from the ext4 code
+ */
+static int do_installkeys_ensure_dir_exists(const char* dir)
+{
+ if (make_dir(dir, 0700) && errno != EEXIST) {
+ return -1;
+ }
+
+ return 0;
+}
+
int do_installkey(int nargs, char **args)
{
if (nargs == 2) {
- return e4crypt_install_key(args[1]);
+ return e4crypt_create_device_key(args[1],
+ do_installkeys_ensure_dir_exists);
}
return -1;