Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 1 | // Copyright 2020, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
Janis Danisevskis | e242b03 | 2020-11-17 15:57:51 -0800 | [diff] [blame] | 15 | //! This crate implements the Keystore 2.0 service entry point. |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 16 | |
Janis Danisevskis | 7a1cf38 | 2020-11-20 11:22:14 -0800 | [diff] [blame] | 17 | use keystore2::apc::ApcManager; |
Janis Danisevskis | 9f10a6a | 2021-01-18 16:45:21 +0000 | [diff] [blame] | 18 | use keystore2::authorization::AuthorizationManager; |
Janis Danisevskis | b1673db | 2021-02-08 18:11:57 -0800 | [diff] [blame] | 19 | use keystore2::globals::ENFORCEMENTS; |
Max Bires | b2e1d03 | 2021-02-08 21:35:05 -0800 | [diff] [blame] | 20 | use keystore2::remote_provisioning::RemoteProvisioningService; |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 21 | use keystore2::service::KeystoreService; |
Janis Danisevskis | 34a0cf2 | 2021-03-08 09:19:03 -0800 | [diff] [blame^] | 22 | use keystore2::user_manager::Maintenance; |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 23 | use log::{error, info}; |
Janis Danisevskis | b1673db | 2021-02-08 18:11:57 -0800 | [diff] [blame] | 24 | use std::{panic, path::Path, sync::mpsc::channel}; |
Janis Danisevskis | 77d7204 | 2021-01-20 15:36:30 -0800 | [diff] [blame] | 25 | use vpnprofilestore::VpnProfileStore; |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 26 | |
| 27 | static KS2_SERVICE_NAME: &str = "android.system.keystore2"; |
Janis Danisevskis | 7a1cf38 | 2020-11-20 11:22:14 -0800 | [diff] [blame] | 28 | static APC_SERVICE_NAME: &str = "android.security.apc"; |
Janis Danisevskis | 9f10a6a | 2021-01-18 16:45:21 +0000 | [diff] [blame] | 29 | static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization"; |
Max Bires | b2e1d03 | 2021-02-08 21:35:05 -0800 | [diff] [blame] | 30 | static REMOTE_PROVISIONING_SERVICE_NAME: &str = "android.security.remoteprovisioning"; |
Janis Danisevskis | 34a0cf2 | 2021-03-08 09:19:03 -0800 | [diff] [blame^] | 31 | static USER_MANAGER_SERVICE_NAME: &str = "android.security.maintenance"; |
Janis Danisevskis | 77d7204 | 2021-01-20 15:36:30 -0800 | [diff] [blame] | 32 | static VPNPROFILESTORE_SERVICE_NAME: &str = "android.security.vpnprofilestore"; |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 33 | |
| 34 | /// Keystore 2.0 takes one argument which is a path indicating its designated working directory. |
| 35 | fn main() { |
| 36 | // Initialize android logging. |
| 37 | android_logger::init_once( |
| 38 | android_logger::Config::default().with_tag("keystore2").with_min_level(log::Level::Debug), |
| 39 | ); |
| 40 | // Redirect panic messages to logcat. |
| 41 | panic::set_hook(Box::new(|panic_info| { |
| 42 | error!("{}", panic_info); |
| 43 | })); |
| 44 | |
| 45 | // Saying hi. |
| 46 | info!("Keystore2 is starting."); |
| 47 | |
Janis Danisevskis | b00ebd0 | 2021-02-02 21:52:24 -0800 | [diff] [blame] | 48 | // Initialize the per boot database. |
| 49 | let _keep_me_alive = keystore2::database::KeystoreDB::keep_perboot_db_alive() |
| 50 | .expect("Failed to initialize the perboot database."); |
| 51 | |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 52 | let mut args = std::env::args(); |
| 53 | args.next().expect("That's odd. How is there not even a first argument?"); |
Janis Danisevskis | bf15d73 | 2020-12-08 10:35:26 -0800 | [diff] [blame] | 54 | |
Janis Danisevskis | 3f2955c | 2021-02-02 21:53:35 -0800 | [diff] [blame] | 55 | // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on |
| 56 | // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than |
| 57 | // Keystore 1.0. Instead we set a global variable to the database path. |
Janis Danisevskis | bf15d73 | 2020-12-08 10:35:26 -0800 | [diff] [blame] | 58 | // For the ground truth check the service startup rule for init (typically in keystore2.rc). |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 59 | if let Some(dir) = args.next() { |
Janis Danisevskis | 3f2955c | 2021-02-02 21:53:35 -0800 | [diff] [blame] | 60 | *keystore2::globals::DB_PATH.lock().expect("Could not lock DB_PATH.") = |
| 61 | Path::new(&dir).to_path_buf(); |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 62 | } else { |
| 63 | panic!("Must specify a working directory."); |
| 64 | } |
| 65 | |
Janis Danisevskis | b1673db | 2021-02-08 18:11:57 -0800 | [diff] [blame] | 66 | let (confirmation_token_sender, confirmation_token_receiver) = channel(); |
| 67 | |
| 68 | ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver); |
| 69 | |
Paul Crowley | 7c57bf1 | 2021-02-02 16:26:57 -0800 | [diff] [blame] | 70 | info!("Starting boot level watcher."); |
| 71 | std::thread::spawn(|| { |
| 72 | keystore2::globals::ENFORCEMENTS |
| 73 | .watch_boot_level() |
| 74 | .unwrap_or_else(|e| error!("watch_boot_level failed: {}", e)); |
| 75 | }); |
| 76 | |
Janis Danisevskis | 8c6378e | 2021-01-01 09:30:37 -0800 | [diff] [blame] | 77 | info!("Starting thread pool now."); |
| 78 | binder::ProcessState::start_thread_pool(); |
| 79 | |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 80 | let ks_service = KeystoreService::new_native_binder().unwrap_or_else(|e| { |
| 81 | panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e); |
| 82 | }); |
| 83 | binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| { |
| 84 | panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e); |
| 85 | }); |
| 86 | |
Janis Danisevskis | b1673db | 2021-02-08 18:11:57 -0800 | [diff] [blame] | 87 | let apc_service = |
| 88 | ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| { |
| 89 | panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e); |
| 90 | }); |
Janis Danisevskis | 7a1cf38 | 2020-11-20 11:22:14 -0800 | [diff] [blame] | 91 | binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| { |
| 92 | panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e); |
| 93 | }); |
| 94 | |
Janis Danisevskis | 9f10a6a | 2021-01-18 16:45:21 +0000 | [diff] [blame] | 95 | let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| { |
| 96 | panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e); |
| 97 | }); |
| 98 | binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder()) |
| 99 | .unwrap_or_else(|e| { |
| 100 | panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e); |
| 101 | }); |
| 102 | |
Janis Danisevskis | 34a0cf2 | 2021-03-08 09:19:03 -0800 | [diff] [blame^] | 103 | let maintenance_service = Maintenance::new_native_binder().unwrap_or_else(|e| { |
Hasini Gunasinghe | da89555 | 2021-01-27 19:34:37 +0000 | [diff] [blame] | 104 | panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e); |
| 105 | }); |
Janis Danisevskis | 34a0cf2 | 2021-03-08 09:19:03 -0800 | [diff] [blame^] | 106 | binder::add_service(USER_MANAGER_SERVICE_NAME, maintenance_service.as_binder()).unwrap_or_else( |
Hasini Gunasinghe | da89555 | 2021-01-27 19:34:37 +0000 | [diff] [blame] | 107 | |e| { |
| 108 | panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e); |
| 109 | }, |
| 110 | ); |
| 111 | |
Max Bires | b2e1d03 | 2021-02-08 21:35:05 -0800 | [diff] [blame] | 112 | // Devices with KS2 and KM 1.0 may not have any IRemotelyProvisionedComponent HALs at all. Do |
| 113 | // not panic if new_native_binder returns failure because it could not find the TEE HAL. |
| 114 | if let Ok(remote_provisioning_service) = RemoteProvisioningService::new_native_binder() { |
| 115 | binder::add_service( |
| 116 | REMOTE_PROVISIONING_SERVICE_NAME, |
| 117 | remote_provisioning_service.as_binder(), |
| 118 | ) |
| 119 | .unwrap_or_else(|e| { |
| 120 | panic!( |
| 121 | "Failed to register service {} because of {:?}.", |
| 122 | REMOTE_PROVISIONING_SERVICE_NAME, e |
| 123 | ); |
| 124 | }); |
| 125 | } |
Janis Danisevskis | 77d7204 | 2021-01-20 15:36:30 -0800 | [diff] [blame] | 126 | |
| 127 | let vpnprofilestore = VpnProfileStore::new_native_binder( |
| 128 | &keystore2::globals::DB_PATH.lock().expect("Could not get DB_PATH."), |
| 129 | ); |
| 130 | binder::add_service(VPNPROFILESTORE_SERVICE_NAME, vpnprofilestore.as_binder()).unwrap_or_else( |
| 131 | |e| { |
| 132 | panic!( |
| 133 | "Failed to register service {} because of {:?}.", |
| 134 | VPNPROFILESTORE_SERVICE_NAME, e |
| 135 | ); |
| 136 | }, |
| 137 | ); |
| 138 | |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 139 | info!("Successfully registered Keystore 2.0 service."); |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 140 | |
Janis Danisevskis | e242b03 | 2020-11-17 15:57:51 -0800 | [diff] [blame] | 141 | info!("Joining thread pool now."); |
Janis Danisevskis | 1af9126 | 2020-08-10 14:58:08 -0700 | [diff] [blame] | 142 | binder::ProcessState::join_thread_pool(); |
| 143 | } |