blob: 0d14f84a9f1f60f78b0f289d64c2681570122903 [file] [log] [blame]
Janis Danisevskis1af91262020-08-10 14:58:08 -07001// Copyright 2020, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Janis Danisevskise242b032020-11-17 15:57:51 -080015//! This crate implements the Keystore 2.0 service entry point.
Janis Danisevskis1af91262020-08-10 14:58:08 -070016
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080017use keystore2::apc::ApcManager;
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +000018use keystore2::authorization::AuthorizationManager;
Janis Danisevskisb1673db2021-02-08 18:11:57 -080019use keystore2::globals::ENFORCEMENTS;
Max Biresb2e1d032021-02-08 21:35:05 -080020use keystore2::remote_provisioning::RemoteProvisioningService;
Janis Danisevskis1af91262020-08-10 14:58:08 -070021use keystore2::service::KeystoreService;
Hasini Gunasingheda895552021-01-27 19:34:37 +000022use keystore2::user_manager::UserManager;
Janis Danisevskis1af91262020-08-10 14:58:08 -070023use log::{error, info};
Janis Danisevskisb1673db2021-02-08 18:11:57 -080024use std::{panic, path::Path, sync::mpsc::channel};
Janis Danisevskis77d72042021-01-20 15:36:30 -080025use vpnprofilestore::VpnProfileStore;
Janis Danisevskis1af91262020-08-10 14:58:08 -070026
27static KS2_SERVICE_NAME: &str = "android.system.keystore2";
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080028static APC_SERVICE_NAME: &str = "android.security.apc";
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +000029static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization";
Max Biresb2e1d032021-02-08 21:35:05 -080030static REMOTE_PROVISIONING_SERVICE_NAME: &str = "android.security.remoteprovisioning";
Hasini Gunasingheda895552021-01-27 19:34:37 +000031static USER_MANAGER_SERVICE_NAME: &str = "android.security.usermanager";
Janis Danisevskis77d72042021-01-20 15:36:30 -080032static VPNPROFILESTORE_SERVICE_NAME: &str = "android.security.vpnprofilestore";
Janis Danisevskis1af91262020-08-10 14:58:08 -070033
34/// Keystore 2.0 takes one argument which is a path indicating its designated working directory.
35fn main() {
36 // Initialize android logging.
37 android_logger::init_once(
38 android_logger::Config::default().with_tag("keystore2").with_min_level(log::Level::Debug),
39 );
40 // Redirect panic messages to logcat.
41 panic::set_hook(Box::new(|panic_info| {
42 error!("{}", panic_info);
43 }));
44
45 // Saying hi.
46 info!("Keystore2 is starting.");
47
Janis Danisevskisb00ebd02021-02-02 21:52:24 -080048 // Initialize the per boot database.
49 let _keep_me_alive = keystore2::database::KeystoreDB::keep_perboot_db_alive()
50 .expect("Failed to initialize the perboot database.");
51
Janis Danisevskis1af91262020-08-10 14:58:08 -070052 let mut args = std::env::args();
53 args.next().expect("That's odd. How is there not even a first argument?");
Janis Danisevskisbf15d732020-12-08 10:35:26 -080054
Janis Danisevskis3f2955c2021-02-02 21:53:35 -080055 // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on
56 // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than
57 // Keystore 1.0. Instead we set a global variable to the database path.
Janis Danisevskisbf15d732020-12-08 10:35:26 -080058 // For the ground truth check the service startup rule for init (typically in keystore2.rc).
Janis Danisevskis1af91262020-08-10 14:58:08 -070059 if let Some(dir) = args.next() {
Janis Danisevskis3f2955c2021-02-02 21:53:35 -080060 *keystore2::globals::DB_PATH.lock().expect("Could not lock DB_PATH.") =
61 Path::new(&dir).to_path_buf();
Janis Danisevskis1af91262020-08-10 14:58:08 -070062 } else {
63 panic!("Must specify a working directory.");
64 }
65
Janis Danisevskisb1673db2021-02-08 18:11:57 -080066 let (confirmation_token_sender, confirmation_token_receiver) = channel();
67
68 ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver);
69
Janis Danisevskis8c6378e2021-01-01 09:30:37 -080070 info!("Starting thread pool now.");
71 binder::ProcessState::start_thread_pool();
72
Janis Danisevskis1af91262020-08-10 14:58:08 -070073 let ks_service = KeystoreService::new_native_binder().unwrap_or_else(|e| {
74 panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e);
75 });
76 binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| {
77 panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e);
78 });
79
Janis Danisevskisb1673db2021-02-08 18:11:57 -080080 let apc_service =
81 ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| {
82 panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e);
83 });
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080084 binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| {
85 panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e);
86 });
87
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +000088 let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| {
89 panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
90 });
91 binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder())
92 .unwrap_or_else(|e| {
93 panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
94 });
95
Hasini Gunasingheda895552021-01-27 19:34:37 +000096 let usermanager_service = UserManager::new_native_binder().unwrap_or_else(|e| {
97 panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
98 });
99 binder::add_service(USER_MANAGER_SERVICE_NAME, usermanager_service.as_binder()).unwrap_or_else(
100 |e| {
101 panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
102 },
103 );
104
Max Biresb2e1d032021-02-08 21:35:05 -0800105 // Devices with KS2 and KM 1.0 may not have any IRemotelyProvisionedComponent HALs at all. Do
106 // not panic if new_native_binder returns failure because it could not find the TEE HAL.
107 if let Ok(remote_provisioning_service) = RemoteProvisioningService::new_native_binder() {
108 binder::add_service(
109 REMOTE_PROVISIONING_SERVICE_NAME,
110 remote_provisioning_service.as_binder(),
111 )
112 .unwrap_or_else(|e| {
113 panic!(
114 "Failed to register service {} because of {:?}.",
115 REMOTE_PROVISIONING_SERVICE_NAME, e
116 );
117 });
118 }
Janis Danisevskis77d72042021-01-20 15:36:30 -0800119
120 let vpnprofilestore = VpnProfileStore::new_native_binder(
121 &keystore2::globals::DB_PATH.lock().expect("Could not get DB_PATH."),
122 );
123 binder::add_service(VPNPROFILESTORE_SERVICE_NAME, vpnprofilestore.as_binder()).unwrap_or_else(
124 |e| {
125 panic!(
126 "Failed to register service {} because of {:?}.",
127 VPNPROFILESTORE_SERVICE_NAME, e
128 );
129 },
130 );
131
Janis Danisevskis1af91262020-08-10 14:58:08 -0700132 info!("Successfully registered Keystore 2.0 service.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700133
Janis Danisevskise242b032020-11-17 15:57:51 -0800134 info!("Joining thread pool now.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700135 binder::ProcessState::join_thread_pool();
136}