Adding e4crypt support
Add file encryption flag to fstab.
If file encryption flag set in fstab, handle identically to block
encrypted volumes.
Requires matching change:
https://googleplex-android-review.git.corp.google.com/#/c/642778/
Change-Id: I28c236959f2d7d5f0dccc8ea45c325ea0cf871fc
diff --git a/init/builtins.cpp b/init/builtins.cpp
index e659cfa..9ff6b4a 100644
--- a/init/builtins.cpp
+++ b/init/builtins.cpp
@@ -29,6 +29,7 @@
#include <sys/wait.h>
#include <unistd.h>
#include <linux/loop.h>
+#include <ext4_crypt.h>
#include <selinux/selinux.h>
#include <selinux/label.h>
@@ -302,7 +303,7 @@
}
}
- return 0;
+ return e4crypt_set_directory_policy(args[1]);
}
static struct {
@@ -514,6 +515,36 @@
ERROR("fs_mgr_mount_all suggested recovery, so wiping data via recovery.\n");
ret = wipe_data_via_recovery();
/* If reboot worked, there is no return. */
+ } else if (ret == FS_MGR_MNTALL_DEV_DEFAULT_FILE_ENCRYPTED) {
+ // We have to create the key files here. Only init can call make_dir,
+ // and we can't do it from fs_mgr as then fs_mgr would depend on
+ // make_dir creating a circular dependency.
+ fstab = fs_mgr_read_fstab(args[1]);
+ for (int i = 0; i < fstab->num_entries; ++i) {
+ if (fs_mgr_is_file_encrypted(&fstab->recs[i])) {
+ if (e4crypt_create_device_key(fstab->recs[i].mount_point)) {
+ ERROR("Could not create device key on %s"
+ " - continue unencrypted\n",
+ fstab->recs[i].mount_point);
+ }
+ }
+ }
+ fs_mgr_free_fstab(fstab);
+
+ if (e4crypt_install_keyring()) {
+ return -1;
+ }
+ property_set("ro.crypto.state", "encrypted");
+
+ // Although encrypted, we have device key, so we do not need to
+ // do anything different from the nonencrypted case.
+ action_for_each_trigger("nonencrypted", action_add_queue_tail);
+ } else if (ret == FS_MGR_MNTALL_DEV_NON_DEFAULT_FILE_ENCRYPTED) {
+ if (e4crypt_install_keyring()) {
+ return -1;
+ }
+ property_set("ro.crypto.state", "encrypted");
+ property_set("vold.decrypt", "trigger_restart_min_framework");
} else if (ret > 0) {
ERROR("fs_mgr_mount_all returned unexpected error %d\n", ret);
}
@@ -866,3 +897,12 @@
} else
return -1;
}
+
+int do_installkey(int nargs, char **args)
+{
+ if (nargs == 2) {
+ return e4crypt_install_key(args[1]);
+ }
+
+ return -1;
+}