blob: c54753c38c009781d8cac8fac6e7a4c0501e8d5d [file] [log] [blame]
Janis Danisevskis1af91262020-08-10 14:58:08 -07001// Copyright 2020, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
Janis Danisevskise242b032020-11-17 15:57:51 -080015//! This crate implements the Keystore 2.0 service entry point.
Janis Danisevskis1af91262020-08-10 14:58:08 -070016
David Drysdale0e45a612021-02-25 17:24:36 +000017use keystore2::entropy;
Janis Danisevskisb1673db2021-02-08 18:11:57 -080018use keystore2::globals::ENFORCEMENTS;
Janis Danisevskis333b7c02021-03-23 18:57:41 -070019use keystore2::maintenance::Maintenance;
Hasini Gunasinghe15891e62021-06-10 16:23:27 +000020use keystore2::metrics::Metrics;
Hasini Gunasinghe365ce372021-07-02 23:13:11 +000021use keystore2::metrics_store;
Seth Moore92648b62022-02-02 13:26:18 -080022use keystore2::remote_provisioning::{
23 RemoteProvisioningService, RemotelyProvisionedKeyPoolService,
24};
Janis Danisevskis1af91262020-08-10 14:58:08 -070025use keystore2::service::KeystoreService;
Janis Danisevskis84a83e42021-03-21 21:46:54 -070026use keystore2::{apc::ApcManager, shared_secret_negotiation};
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070027use keystore2::{authorization::AuthorizationManager, id_rotation::IdRotationState};
Janis Danisevskis3eb829d2021-06-14 14:18:20 -070028use legacykeystore::LegacyKeystore;
Janis Danisevskis1af91262020-08-10 14:58:08 -070029use log::{error, info};
Seth Mooree3fd5872021-08-17 13:21:09 -070030use rusqlite::trace as sqlite_trace;
31use std::{os::raw::c_int, panic, path::Path, sync::mpsc::channel};
Janis Danisevskis1af91262020-08-10 14:58:08 -070032
Stephen Crane56936e82021-03-10 17:48:26 -080033static KS2_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
Janis Danisevskis7a1cf382020-11-20 11:22:14 -080034static APC_SERVICE_NAME: &str = "android.security.apc";
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +000035static AUTHORIZATION_SERVICE_NAME: &str = "android.security.authorization";
Hasini Gunasinghe15891e62021-06-10 16:23:27 +000036static METRICS_SERVICE_NAME: &str = "android.security.metrics";
Max Biresb2e1d032021-02-08 21:35:05 -080037static REMOTE_PROVISIONING_SERVICE_NAME: &str = "android.security.remoteprovisioning";
Seth Moore92648b62022-02-02 13:26:18 -080038static REMOTELY_PROVISIONED_KEY_POOL_SERVICE_NAME: &str =
39 "android.security.remoteprovisioning.IRemotelyProvisionedKeyPool";
Janis Danisevskis34a0cf22021-03-08 09:19:03 -080040static USER_MANAGER_SERVICE_NAME: &str = "android.security.maintenance";
Janis Danisevskis3eb829d2021-06-14 14:18:20 -070041static LEGACY_KEYSTORE_SERVICE_NAME: &str = "android.security.legacykeystore";
Janis Danisevskis1af91262020-08-10 14:58:08 -070042
43/// Keystore 2.0 takes one argument which is a path indicating its designated working directory.
44fn main() {
45 // Initialize android logging.
46 android_logger::init_once(
Matthew Maurer1f49c6e2022-02-17 20:29:07 +000047 android_logger::Config::default()
48 .with_tag("keystore2")
49 .with_min_level(log::Level::Debug)
Shaquille Johnson9da2e1c2022-09-19 12:39:01 +000050 .with_log_id(android_logger::LogId::System)
51 .format(|buf, record| {
52 writeln!(
53 buf,
54 "{}:{} - {}",
55 record.file().unwrap_or("unknown"),
56 record.line().unwrap_or(0),
57 record.args()
58 )
59 }),
Janis Danisevskis1af91262020-08-10 14:58:08 -070060 );
61 // Redirect panic messages to logcat.
62 panic::set_hook(Box::new(|panic_info| {
63 error!("{}", panic_info);
64 }));
65
66 // Saying hi.
67 info!("Keystore2 is starting.");
68
69 let mut args = std::env::args();
70 args.next().expect("That's odd. How is there not even a first argument?");
Janis Danisevskisbf15d732020-12-08 10:35:26 -080071
Seth Mooree3fd5872021-08-17 13:21:09 -070072 // This must happen early before any other sqlite operations.
73 log::info!("Setting up sqlite logging for keystore2");
74 fn sqlite_log_handler(err: c_int, message: &str) {
75 log::error!("[SQLITE3] {}: {}", err, message);
76 }
77 unsafe { sqlite_trace::config_log(Some(sqlite_log_handler)) }
78 .expect("Error setting sqlite log callback.");
79
Hasini Gunasinghe365ce372021-07-02 23:13:11 +000080 // Write/update keystore.crash_count system property.
81 metrics_store::update_keystore_crash_sysprop();
82
Janis Danisevskis3f2955c2021-02-02 21:53:35 -080083 // Keystore 2.0 cannot change to the database directory (typically /data/misc/keystore) on
84 // startup as Keystore 1.0 did because Keystore 2.0 is intended to run much earlier than
85 // Keystore 1.0. Instead we set a global variable to the database path.
Janis Danisevskisbf15d732020-12-08 10:35:26 -080086 // For the ground truth check the service startup rule for init (typically in keystore2.rc).
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070087 let id_rotation_state = if let Some(dir) = args.next() {
88 let db_path = Path::new(&dir);
Seth Moorea3e611a2021-05-11 10:07:45 -070089 *keystore2::globals::DB_PATH.write().expect("Could not lock DB_PATH.") =
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070090 db_path.to_path_buf();
Chris Wailesd5aaaef2021-07-27 16:04:33 -070091 IdRotationState::new(db_path)
Janis Danisevskis1af91262020-08-10 14:58:08 -070092 } else {
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -070093 panic!("Must specify a database directory.");
94 };
Janis Danisevskis1af91262020-08-10 14:58:08 -070095
Janis Danisevskisb1673db2021-02-08 18:11:57 -080096 let (confirmation_token_sender, confirmation_token_receiver) = channel();
97
98 ENFORCEMENTS.install_confirmation_token_receiver(confirmation_token_receiver);
99
David Drysdale0e45a612021-02-25 17:24:36 +0000100 entropy::register_feeder();
Janis Danisevskis84a83e42021-03-21 21:46:54 -0700101 shared_secret_negotiation::perform_shared_secret_negotiation();
David Drysdale0e45a612021-02-25 17:24:36 +0000102
Janis Danisevskis8c6378e2021-01-01 09:30:37 -0800103 info!("Starting thread pool now.");
104 binder::ProcessState::start_thread_pool();
105
Janis Danisevskis5cb52dc2021-04-07 16:31:18 -0700106 let ks_service = KeystoreService::new_native_binder(id_rotation_state).unwrap_or_else(|e| {
Janis Danisevskis1af91262020-08-10 14:58:08 -0700107 panic!("Failed to create service {} because of {:?}.", KS2_SERVICE_NAME, e);
108 });
109 binder::add_service(KS2_SERVICE_NAME, ks_service.as_binder()).unwrap_or_else(|e| {
110 panic!("Failed to register service {} because of {:?}.", KS2_SERVICE_NAME, e);
111 });
112
Janis Danisevskisb1673db2021-02-08 18:11:57 -0800113 let apc_service =
114 ApcManager::new_native_binder(confirmation_token_sender).unwrap_or_else(|e| {
115 panic!("Failed to create service {} because of {:?}.", APC_SERVICE_NAME, e);
116 });
Janis Danisevskis7a1cf382020-11-20 11:22:14 -0800117 binder::add_service(APC_SERVICE_NAME, apc_service.as_binder()).unwrap_or_else(|e| {
118 panic!("Failed to register service {} because of {:?}.", APC_SERVICE_NAME, e);
119 });
120
Janis Danisevskis9f10a6a2021-01-18 16:45:21 +0000121 let authorization_service = AuthorizationManager::new_native_binder().unwrap_or_else(|e| {
122 panic!("Failed to create service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
123 });
124 binder::add_service(AUTHORIZATION_SERVICE_NAME, authorization_service.as_binder())
125 .unwrap_or_else(|e| {
126 panic!("Failed to register service {} because of {:?}.", AUTHORIZATION_SERVICE_NAME, e);
127 });
128
Janis Danisevskis5898d152021-06-15 08:23:46 -0700129 let (delete_listener, legacykeystore) = LegacyKeystore::new_native_binder(
130 &keystore2::globals::DB_PATH.read().expect("Could not get DB_PATH."),
131 );
132
133 let maintenance_service = Maintenance::new_native_binder(delete_listener).unwrap_or_else(|e| {
Hasini Gunasingheda895552021-01-27 19:34:37 +0000134 panic!("Failed to create service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
135 });
Janis Danisevskis34a0cf22021-03-08 09:19:03 -0800136 binder::add_service(USER_MANAGER_SERVICE_NAME, maintenance_service.as_binder()).unwrap_or_else(
Hasini Gunasingheda895552021-01-27 19:34:37 +0000137 |e| {
138 panic!("Failed to register service {} because of {:?}.", USER_MANAGER_SERVICE_NAME, e);
139 },
140 );
141
Hasini Gunasinghe15891e62021-06-10 16:23:27 +0000142 let metrics_service = Metrics::new_native_binder().unwrap_or_else(|e| {
143 panic!("Failed to create service {} because of {:?}.", METRICS_SERVICE_NAME, e);
144 });
145 binder::add_service(METRICS_SERVICE_NAME, metrics_service.as_binder()).unwrap_or_else(|e| {
146 panic!("Failed to register service {} because of {:?}.", METRICS_SERVICE_NAME, e);
147 });
148
Max Biresb2e1d032021-02-08 21:35:05 -0800149 // Devices with KS2 and KM 1.0 may not have any IRemotelyProvisionedComponent HALs at all. Do
150 // not panic if new_native_binder returns failure because it could not find the TEE HAL.
151 if let Ok(remote_provisioning_service) = RemoteProvisioningService::new_native_binder() {
152 binder::add_service(
153 REMOTE_PROVISIONING_SERVICE_NAME,
154 remote_provisioning_service.as_binder(),
155 )
156 .unwrap_or_else(|e| {
157 panic!(
158 "Failed to register service {} because of {:?}.",
159 REMOTE_PROVISIONING_SERVICE_NAME, e
160 );
161 });
162 }
Janis Danisevskis77d72042021-01-20 15:36:30 -0800163
Seth Moore92648b62022-02-02 13:26:18 -0800164 // Even if the IRemotelyProvisionedComponent HAL is implemented, it doesn't mean that the keys
165 // may be fetched via the key pool. The HAL must be a new version that exports a unique id. If
166 // none of the HALs support this, then the key pool service is not published.
Seth Moore8c147102022-02-22 16:05:09 -0800167 match RemotelyProvisionedKeyPoolService::new_native_binder() {
168 Ok(key_pool_service) => {
169 binder::add_service(
170 REMOTELY_PROVISIONED_KEY_POOL_SERVICE_NAME,
171 key_pool_service.as_binder(),
172 )
173 .unwrap_or_else(|e| {
174 panic!(
175 "Failed to register service {} because of {:?}.",
176 REMOTELY_PROVISIONED_KEY_POOL_SERVICE_NAME, e
177 );
178 });
179 }
180 Err(e) => log::info!("Not publishing IRemotelyProvisionedKeyPool service: {:?}", e),
Seth Moore92648b62022-02-02 13:26:18 -0800181 }
182
Janis Danisevskis3eb829d2021-06-14 14:18:20 -0700183 binder::add_service(LEGACY_KEYSTORE_SERVICE_NAME, legacykeystore.as_binder()).unwrap_or_else(
Janis Danisevskis77d72042021-01-20 15:36:30 -0800184 |e| {
185 panic!(
186 "Failed to register service {} because of {:?}.",
Janis Danisevskis3eb829d2021-06-14 14:18:20 -0700187 LEGACY_KEYSTORE_SERVICE_NAME, e
Janis Danisevskis77d72042021-01-20 15:36:30 -0800188 );
189 },
190 );
191
Janis Danisevskis1af91262020-08-10 14:58:08 -0700192 info!("Successfully registered Keystore 2.0 service.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700193
Janis Danisevskise242b032020-11-17 15:57:51 -0800194 info!("Joining thread pool now.");
Janis Danisevskis1af91262020-08-10 14:58:08 -0700195 binder::ProcessState::join_thread_pool();
196}