blob: df7ba26e524ff199a6ea9a92b754a7df035ba20c [file] [log] [blame]
Janis Danisevskis1af91262020-08-10 14:58:08 -07001// Copyright 2020, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Janis Danisevskise242b032020-11-17 15:57:51 -080015//! This crate implements the Keystore 2.0 service entry point.
Janis Danisevskis1af91262020-08-10 14:58:08 -070016
David Drysdale0e45a612021-02-25 17:24:36 +000017use keystore2::entropy;
Janis Danisevskisb1673db2021-02-08 18:11:57 -080018use keystore2::globals::ENFORCEMENTS;
Janis Danisevskis333b7c02021-03-23 18:57:41 -070019use keystore2::maintenance::Maintenance;
Max Biresb2e1d032021-02-08 21:35:05 -080020use keystore2::remote_provisioning::RemoteProvisioningService;
Janis Danisevskis1af91262020-08-10 14:58:08 -070021use keystore2::service::KeystoreService;
Janis Danisevskis84a83e42021-03-21 21:46:54 -070022use keystore2::{apc::ApcManager, shared_secret_negotiation};
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070023use keystore2::{authorization::AuthorizationManager, id_rotation::IdRotationState};
Janis Danisevskis1af91262020-08-10 14:58:08 -070024use log::{error, info};
Janis Danisevskisb1673db2021-02-08 18:11:57 -080025use std::{panic, path::Path, sync::mpsc::channel};
Janis Danisevskis77d72042021-01-20 15:36:30 -080026use vpnprofilestore::VpnProfileStore;
Janis Danisevskis1af91262020-08-10 14:58:08 -070027
Stephen Crane56936e82021-03-10 17:48:26 -080028static KS2_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080029static APC_SERVICE_NAME: &str = "android.security.apc";
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +000030static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization";
Max Biresb2e1d032021-02-08 21:35:05 -080031static REMOTE_PROVISIONING_SERVICE_NAME: &str = "android.security.remoteprovisioning";
Janis Danisevskis34a0cf22021-03-08 09:19:03 -080032static USER_MANAGER_SERVICE_NAME: &str = "android.security.maintenance";
Janis Danisevskis77d72042021-01-20 15:36:30 -080033static VPNPROFILESTORE_SERVICE_NAME: &str = "android.security.vpnprofilestore";
Janis Danisevskis1af91262020-08-10 14:58:08 -070034
35/// Keystore 2.0 takes one argument which is a path indicating its designated working directory.
36fn main() {
37 // Initialize android logging.
38 android_logger::init_once(
39 android_logger::Config::default().with_tag("keystore2").with_min_level(log::Level::Debug),
40 );
41 // Redirect panic messages to logcat.
42 panic::set_hook(Box::new(|panic_info| {
43 error!("{}", panic_info);
44 }));
45
46 // Saying hi.
47 info!("Keystore2 is starting.");
48
Janis Danisevskisb00ebd02021-02-02 21:52:24 -080049 // Initialize the per boot database.
50 let _keep_me_alive = keystore2::database::KeystoreDB::keep_perboot_db_alive()
51 .expect("Failed to initialize the perboot database.");
52
Janis Danisevskis1af91262020-08-10 14:58:08 -070053 let mut args = std::env::args();
54 args.next().expect("That's odd. How is there not even a first argument?");
Janis Danisevskisbf15d732020-12-08 10:35:26 -080055
Janis Danisevskis3f2955c2021-02-02 21:53:35 -080056 // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on
57 // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than
58 // Keystore 1.0. Instead we set a global variable to the database path.
Janis Danisevskisbf15d732020-12-08 10:35:26 -080059 // For the ground truth check the service startup rule for init (typically in keystore2.rc).
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070060 let id_rotation_state = if let Some(dir) = args.next() {
61 let db_path = Path::new(&dir);
Janis Danisevskis3f2955c2021-02-02 21:53:35 -080062 *keystore2::globals::DB_PATH.lock().expect("Could not lock DB_PATH.") =
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070063 db_path.to_path_buf();
64 IdRotationState::new(&db_path)
Janis Danisevskis1af91262020-08-10 14:58:08 -070065 } else {
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070066 panic!("Must specify a database directory.");
67 };
Janis Danisevskis1af91262020-08-10 14:58:08 -070068
Janis Danisevskisb1673db2021-02-08 18:11:57 -080069 let (confirmation_token_sender, confirmation_token_receiver) = channel();
70
71 ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver);
72
Ulyana Trafimovich229f2c02021-04-06 16:07:07 +000073 info!("Starting boot level watcher.");
74 std::thread::spawn(|| {
75 keystore2::globals::ENFORCEMENTS
76 .watch_boot_level()
77 .unwrap_or_else(|e| error!("watch_boot_level failed: {}", e));
78 });
79
David Drysdale0e45a612021-02-25 17:24:36 +000080 entropy::register_feeder();
Janis Danisevskis84a83e42021-03-21 21:46:54 -070081 shared_secret_negotiation::perform_shared_secret_negotiation();
David Drysdale0e45a612021-02-25 17:24:36 +000082
Janis Danisevskis8c6378e2021-01-01 09:30:37 -080083 info!("Starting thread pool now.");
84 binder::ProcessState::start_thread_pool();
85
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070086 let ks_service = KeystoreService::new_native_binder(id_rotation_state).unwrap_or_else(|e| {
Janis Danisevskis1af91262020-08-10 14:58:08 -070087 panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e);
88 });
89 binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| {
90 panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e);
91 });
92
Janis Danisevskisb1673db2021-02-08 18:11:57 -080093 let apc_service =
94 ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| {
95 panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e);
96 });
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080097 binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| {
98 panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e);
99 });
100
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +0000101 let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| {
102 panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
103 });
104 binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder())
105 .unwrap_or_else(|e| {
106 panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
107 });
108
Janis Danisevskis34a0cf22021-03-08 09:19:03 -0800109 let maintenance_service = Maintenance::new_native_binder().unwrap_or_else(|e| {
Hasini Gunasingheda895552021-01-27 19:34:37 +0000110 panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
111 });
Janis Danisevskis34a0cf22021-03-08 09:19:03 -0800112 binder::add_service(USER_MANAGER_SERVICE_NAME, maintenance_service.as_binder()).unwrap_or_else(
Hasini Gunasingheda895552021-01-27 19:34:37 +0000113 |e| {
114 panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
115 },
116 );
117
Max Biresb2e1d032021-02-08 21:35:05 -0800118 // Devices with KS2 and KM 1.0 may not have any IRemotelyProvisionedComponent HALs at all. Do
119 // not panic if new_native_binder returns failure because it could not find the TEE HAL.
120 if let Ok(remote_provisioning_service) = RemoteProvisioningService::new_native_binder() {
121 binder::add_service(
122 REMOTE_PROVISIONING_SERVICE_NAME,
123 remote_provisioning_service.as_binder(),
124 )
125 .unwrap_or_else(|e| {
126 panic!(
127 "Failed to register service {} because of {:?}.",
128 REMOTE_PROVISIONING_SERVICE_NAME, e
129 );
130 });
131 }
Janis Danisevskis77d72042021-01-20 15:36:30 -0800132
133 let vpnprofilestore = VpnProfileStore::new_native_binder(
134 &keystore2::globals::DB_PATH.lock().expect("Could not get DB_PATH."),
135 );
136 binder::add_service(VPNPROFILESTORE_SERVICE_NAME, vpnprofilestore.as_binder()).unwrap_or_else(
137 |e| {
138 panic!(
139 "Failed to register service {} because of {:?}.",
140 VPNPROFILESTORE_SERVICE_NAME, e
141 );
142 },
143 );
144
Janis Danisevskis1af91262020-08-10 14:58:08 -0700145 info!("Successfully registered Keystore 2.0 service.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700146
Janis Danisevskise242b032020-11-17 15:57:51 -0800147 info!("Joining thread pool now.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700148 binder::ProcessState::join_thread_pool();
149}