diff --git a/CryptCommandListener.cpp b/CryptCommandListener.cpp
index b6f9398..798a912 100644
--- a/CryptCommandListener.cpp
+++ b/CryptCommandListener.cpp
@@ -90,8 +90,8 @@
 void CryptCommandListener::dumpArgs(int /*argc*/, char ** /*argv*/, int /*argObscure*/) { }
 #endif
 
-int CryptCommandListener::sendGenericOkFail(SocketClient *cli, int cond) {
-    if (!cond) {
+int CryptCommandListener::sendGenericOkFailOnBool(SocketClient *cli, bool success) {
+    if (success) {
         return cli->sendMsg(ResponseCode::CommandOkay, "Command succeeded", false);
     } else {
         return cli->sendMsg(ResponseCode::OperationFailed, "Command failed", false);
@@ -374,41 +374,36 @@
 
     } else if (subcommand == "init_user0") {
         if (!check_argc(cli, subcommand, argc, 2, "")) return 0;
-        return sendGenericOkFail(cli, e4crypt_init_user0());
+        return sendGenericOkFailOnBool(cli, e4crypt_init_user0());
 
     } else if (subcommand == "create_user_key") {
         if (!check_argc(cli, subcommand, argc, 5, "<user> <serial> <ephemeral>")) return 0;
-        return sendGenericOkFail(cli,
-                                 e4crypt_vold_create_user_key(atoi(argv[2]),
-                                                              atoi(argv[3]),
-                                                              atoi(argv[4]) != 0));
+        return sendGenericOkFailOnBool(cli, e4crypt_vold_create_user_key(
+            atoi(argv[2]), atoi(argv[3]), atoi(argv[4]) != 0));
 
     } else if (subcommand == "destroy_user_key") {
         if (!check_argc(cli, subcommand, argc, 3, "<user>")) return 0;
-        return sendGenericOkFail(cli, e4crypt_destroy_user_key(atoi(argv[2])));
+        return sendGenericOkFailOnBool(cli, e4crypt_destroy_user_key(atoi(argv[2])));
 
     } else if (subcommand == "change_user_key") {
         if (!check_argc(cli, subcommand, argc, 7,
             "<user> <serial> <token> <old_secret> <new_secret>")) return 0;
-        return sendGenericOkFail(cli, e4crypt_change_user_key(
+        return sendGenericOkFailOnBool(cli, e4crypt_change_user_key(
             atoi(argv[2]), atoi(argv[3]), argv[4], argv[5], argv[6]));
 
     } else if (subcommand == "unlock_user_key") {
         if (!check_argc(cli, subcommand, argc, 6, "<user> <serial> <token> <secret>")) return 0;
-        return sendGenericOkFail(cli, e4crypt_unlock_user_key(
+        return sendGenericOkFailOnBool(cli, e4crypt_unlock_user_key(
             atoi(argv[2]), atoi(argv[3]), argv[4], argv[5]));
 
     } else if (subcommand == "lock_user_key") {
         if (!check_argc(cli, subcommand, argc, 3, "<user>")) return 0;
-        return sendGenericOkFail(cli, e4crypt_lock_user_key(atoi(argv[2])));
+        return sendGenericOkFailOnBool(cli, e4crypt_lock_user_key(atoi(argv[2])));
 
     } else if (subcommand == "prepare_user_storage") {
         if (!check_argc(cli, subcommand, argc, 6, "<uuid> <user> <serial> <flags>")) return 0;
-        return sendGenericOkFail(cli,
-                                 e4crypt_prepare_user_storage(parseNull(argv[2]),
-                                                              atoi(argv[3]),
-                                                              atoi(argv[4]),
-                                                              atoi(argv[5])));
+        return sendGenericOkFailOnBool(cli, e4crypt_prepare_user_storage(
+            parseNull(argv[2]), atoi(argv[3]), atoi(argv[4]), atoi(argv[5])));
 
     } else {
         dumpArgs(argc, argv, -1);
diff --git a/CryptCommandListener.h b/CryptCommandListener.h
index 1653239..478ac02 100644
--- a/CryptCommandListener.h
+++ b/CryptCommandListener.h
@@ -28,7 +28,7 @@
 
 private:
     static void dumpArgs(int argc, char **argv, int argObscure);
-    static int sendGenericOkFail(SocketClient *cli, int cond);
+    static int sendGenericOkFailOnBool(SocketClient *cli, bool success);
 
     class CryptfsCmd : public VoldCommand {
     public:
diff --git a/Ext4Crypt.cpp b/Ext4Crypt.cpp
index eaa08db..b82e75d 100644
--- a/Ext4Crypt.cpp
+++ b/Ext4Crypt.cpp
@@ -61,33 +61,20 @@
 static constexpr int FLAG_STORAGE_DE = 1 << 0;
 static constexpr int FLAG_STORAGE_CE = 1 << 1;
 
-static bool e4crypt_is_native() {
-    char value[PROPERTY_VALUE_MAX];
-    property_get("ro.crypto.type", value, "none");
-    return !strcmp(value, "file");
-}
-
-static bool e4crypt_is_emulated() {
-    return property_get_bool("persist.sys.emulate_fbe", false);
-}
-
-static const char* escape_null(const char* value) {
-    return (value == nullptr) ? "null" : value;
-}
-
 namespace {
     // Key length in bits
     const int key_length = 128;
     static_assert(key_length % 8 == 0,
                   "Key length must be multiple of 8 bits");
 
-    const std::string device_key_leaf = "/unencrypted/key";
-    const std::string device_key_temp = "/unencrypted/temp";
+    const std::string device_key_dir = std::string() + DATA_MNT_POINT + "/unencrypted";
+    const std::string device_key_path = device_key_dir + "/key";
+    const std::string device_key_temp = device_key_dir + "/temp";
 
     const std::string user_key_dir = std::string() + DATA_MNT_POINT + "/misc/vold/user_keys";
     const std::string user_key_temp = user_key_dir + "/temp";
 
-    bool s_enabled = false;
+    bool s_global_de_initialized = false;
 
     // Some users are ephemeral, don't try to wipe their keys from disk
     std::set<userid_t> s_ephemeral_users;
@@ -114,9 +101,18 @@
 }
 
 // TODO replace with proper function to test for file encryption
-int e4crypt_crypto_complete(const char* path)
-{
-    return e4crypt_is_native() ? 0 : -1;
+bool e4crypt_is_native() {
+    char value[PROPERTY_VALUE_MAX];
+    property_get("ro.crypto.type", value, "none");
+    return !strcmp(value, "file");
+}
+
+static bool e4crypt_is_emulated() {
+    return property_get_bool("persist.sys.emulate_fbe", false);
+}
+
+static const char* escape_null(const char* value) {
+    return (value == nullptr) ? "null" : value;
 }
 
 // Get raw keyref - used to make keyname and to pass to ioctl
@@ -238,17 +234,17 @@
 
 // NB this assumes that there is only one thread listening for crypt commands, because
 // it creates keys in a fixed location.
-static bool store_key(const std::string &key_path,
+static bool store_key(const std::string &key_path, const std::string &tmp_path,
         const android::vold::KeyAuthentication &auth, const std::string &key) {
     if (path_exists(key_path)) {
         LOG(ERROR) << "Already exists, cannot create key at: " << key_path;
         return false;
     }
-    if (path_exists(user_key_temp)) {
-        android::vold::destroyKey(user_key_temp);
+    if (path_exists(tmp_path)) {
+        android::vold::destroyKey(tmp_path);
     }
-    if (!android::vold::storeKey(user_key_temp, auth, key)) return false;
-    if (rename(user_key_temp.c_str(), key_path.c_str()) != 0) {
+    if (!android::vold::storeKey(tmp_path, auth, key)) return false;
+    if (rename(tmp_path.c_str(), key_path.c_str()) != 0) {
         PLOG(ERROR) << "Unable to move new key to location: " << key_path;
         return false;
     }
@@ -264,10 +260,12 @@
         // If the key should be created as ephemeral, don't store it.
         s_ephemeral_users.insert(user_id);
     } else {
-        if (!store_key(get_de_key_path(user_id), kEmptyAuthentication, de_key)) return false;
+        if (!store_key(get_de_key_path(user_id), user_key_temp,
+                kEmptyAuthentication, de_key)) return false;
         if (!prepare_dir(user_key_dir + "/ce/" + std::to_string(user_id),
             0700, AID_ROOT, AID_ROOT)) return false;
-        if (!store_key(get_ce_key_path(user_id), kEmptyAuthentication, ce_key)) return false;
+        if (!store_key(get_ce_key_path(user_id), user_key_temp,
+                kEmptyAuthentication, ce_key)) return false;
     }
     std::string de_raw_ref;
     if (!install_key(de_key, de_raw_ref)) return false;
@@ -344,58 +342,48 @@
     return true;
 }
 
-int e4crypt_enable(const char* path)
+bool e4crypt_initialize_global_de()
 {
-    LOG(INFO) << "e4crypt_enable";
+    LOG(INFO) << "e4crypt_initialize_global_de";
 
-    if (s_enabled) {
-        LOG(INFO) << "Already enabled";
-        return 0;
+    if (s_global_de_initialized) {
+        LOG(INFO) << "Already initialized";
+        return true;
     }
 
     std::string device_key;
-    std::string device_key_path = std::string(path) + device_key_leaf;
-    if (!android::vold::retrieveKey(device_key_path, kEmptyAuthentication, device_key)) {
+    if (path_exists(device_key_path)) {
+        if (!android::vold::retrieveKey(device_key_path,
+                kEmptyAuthentication, device_key)) return false;
+    } else {
         LOG(INFO) << "Creating new key";
-        if (!random_key(device_key)) {
-            return -1;
-        }
-
-        std::string key_temp = std::string(path) + device_key_temp;
-        if (path_exists(key_temp)) {
-            android::vold::destroyKey(key_temp);
-        }
-
-        if (!android::vold::storeKey(key_temp, kEmptyAuthentication, device_key)) return false;
-        if (rename(key_temp.c_str(), device_key_path.c_str()) != 0) {
-            PLOG(ERROR) << "Unable to move new key to location: "
-                        << device_key_path;
-            return false;
-        }
+        if (!random_key(device_key)) return false;
+        if (!store_key(device_key_path, device_key_temp,
+                kEmptyAuthentication, device_key)) return false;
     }
 
     std::string device_key_ref;
     if (!install_key(device_key, device_key_ref)) {
         LOG(ERROR) << "Failed to install device key";
-        return -1;
+        return false;
     }
 
     std::string ref_filename = std::string("/data") + e4crypt_key_ref;
     if (!android::base::WriteStringToFile(device_key_ref, ref_filename)) {
         PLOG(ERROR) << "Cannot save key reference";
-        return -1;
+        return false;
     }
 
-    s_enabled = true;
-    return 0;
+    s_global_de_initialized = true;
+    return true;
 }
 
-int e4crypt_init_user0() {
+bool e4crypt_init_user0() {
     LOG(DEBUG) << "e4crypt_init_user0";
     if (e4crypt_is_native()) {
-        if (!prepare_dir(user_key_dir, 0700, AID_ROOT, AID_ROOT)) return -1;
-        if (!prepare_dir(user_key_dir + "/ce", 0700, AID_ROOT, AID_ROOT)) return -1;
-        if (!prepare_dir(user_key_dir + "/de", 0700, AID_ROOT, AID_ROOT)) return -1;
+        if (!prepare_dir(user_key_dir, 0700, AID_ROOT, AID_ROOT)) return false;
+        if (!prepare_dir(user_key_dir + "/ce", 0700, AID_ROOT, AID_ROOT)) return false;
+        if (!prepare_dir(user_key_dir + "/de", 0700, AID_ROOT, AID_ROOT)) return false;
         auto de_path = get_de_key_path(0);
         auto ce_path = get_ce_key_path(0);
         if (!path_exists(de_path) || !path_exists(ce_path)) {
@@ -405,18 +393,18 @@
             if (path_exists(ce_path)) {
                 android::vold::destroyKey(ce_path); // Ignore failure
             }
-            if (!create_and_install_user_keys(0, false)) return -1;
+            if (!create_and_install_user_keys(0, false)) return false;
         }
         // TODO: switch to loading only DE_0 here once framework makes
         // explicit calls to install DE keys for secondary users
-        if (!load_all_de_keys()) return -1;
+        if (!load_all_de_keys()) return false;
     }
     // We can only safely prepare DE storage here, since CE keys are probably
     // entangled with user credentials.  The framework will always prepare CE
     // storage once CE keys are installed.
-    if (e4crypt_prepare_user_storage(nullptr, 0, 0, FLAG_STORAGE_DE) != 0) {
+    if (!e4crypt_prepare_user_storage(nullptr, 0, 0, FLAG_STORAGE_DE)) {
         LOG(ERROR) << "Failed to prepare user 0 storage";
-        return -1;
+        return false;
     }
 
     // If this is a non-FBE device that recently left an emulated mode,
@@ -425,26 +413,26 @@
         e4crypt_unlock_user_key(0, 0, "!", "!");
     }
 
-    return 0;
+    return true;
 }
 
-int e4crypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral) {
+bool e4crypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral) {
     LOG(DEBUG) << "e4crypt_vold_create_user_key for " << user_id << " serial " << serial;
     if (!e4crypt_is_native()) {
-        return 0;
+        return true;
     }
     // FIXME test for existence of key that is not loaded yet
     if (s_ce_key_raw_refs.count(user_id) != 0) {
         LOG(ERROR) << "Already exists, can't e4crypt_vold_create_user_key for "
             << user_id << " serial " << serial;
         // FIXME should we fail the command?
-        return 0;
+        return true;
     }
     if (!create_and_install_user_keys(user_id, ephemeral)) {
-        return -1;
+        return false;
     }
     // TODO: create second key for user_de data
-    return 0;
+    return true;
 }
 
 static bool evict_key(const std::string &raw_ref) {
@@ -458,10 +446,10 @@
     return true;
 }
 
-int e4crypt_destroy_user_key(userid_t user_id) {
+bool e4crypt_destroy_user_key(userid_t user_id) {
     LOG(DEBUG) << "e4crypt_destroy_user_key(" << user_id << ")";
     if (!e4crypt_is_native()) {
-        return 0;
+        return true;
     }
     bool success = true;
     s_ce_keys.erase(user_id);
@@ -477,37 +465,37 @@
         success &= android::vold::destroyKey(get_ce_key_path(user_id));
         success &= android::vold::destroyKey(get_de_key_path(user_id));
     }
-    return success ? 0 : -1;
+    return success;
 }
 
-static int emulated_lock(const std::string& path) {
+static bool emulated_lock(const std::string& path) {
     if (chmod(path.c_str(), 0000) != 0) {
         PLOG(ERROR) << "Failed to chmod " << path;
-        return -1;
+        return false;
     }
 #if EMULATED_USES_SELINUX
     if (setfilecon(path.c_str(), "u:object_r:storage_stub_file:s0") != 0) {
         PLOG(WARNING) << "Failed to setfilecon " << path;
-        return -1;
+        return false;
     }
 #endif
-    return 0;
+    return true;
 }
 
-static int emulated_unlock(const std::string& path, mode_t mode) {
+static bool emulated_unlock(const std::string& path, mode_t mode) {
     if (chmod(path.c_str(), mode) != 0) {
         PLOG(ERROR) << "Failed to chmod " << path;
         // FIXME temporary workaround for b/26713622
-        if (e4crypt_is_emulated()) return -1;
+        if (e4crypt_is_emulated()) return false;
     }
 #if EMULATED_USES_SELINUX
     if (selinux_android_restorecon(path.c_str(), SELINUX_ANDROID_RESTORECON_FORCE) != 0) {
         PLOG(WARNING) << "Failed to restorecon " << path;
         // FIXME temporary workaround for b/26713622
-        if (e4crypt_is_emulated()) return -1;
+        if (e4crypt_is_emulated()) return false;
     }
 #endif
-    return 0;
+    return true;
 }
 
 static bool parse_hex(const char *hex, std::string &result) {
@@ -522,40 +510,40 @@
     return true;
 }
 
-int e4crypt_change_user_key(userid_t user_id, int serial,
+bool e4crypt_change_user_key(userid_t user_id, int serial,
         const char* token_hex, const char* old_secret_hex, const char* new_secret_hex) {
     LOG(DEBUG) << "e4crypt_change_user_key " << user_id << " serial=" << serial <<
         " token_present=" << (strcmp(token_hex, "!") != 0);
-    if (!e4crypt_is_native()) return 0;
-    if (s_ephemeral_users.count(user_id) != 0) return 0;
+    if (!e4crypt_is_native()) return true;
+    if (s_ephemeral_users.count(user_id) != 0) return true;
     std::string token, old_secret, new_secret;
-    if (!parse_hex(token_hex, token)) return -1;
-    if (!parse_hex(old_secret_hex, old_secret)) return -1;
-    if (!parse_hex(new_secret_hex, new_secret)) return -1;
+    if (!parse_hex(token_hex, token)) return false;
+    if (!parse_hex(old_secret_hex, old_secret)) return false;
+    if (!parse_hex(new_secret_hex, new_secret)) return false;
     auto auth = new_secret.empty()
         ? kEmptyAuthentication
         : android::vold::KeyAuthentication(token, new_secret);
     auto it = s_ce_keys.find(user_id);
     if (it == s_ce_keys.end()) {
         LOG(ERROR) << "Key not loaded into memory, can't change for user " << user_id;
-        return -1;
+        return false;
     }
     auto ce_key = it->second;
     auto ce_key_path = get_ce_key_path(user_id);
     android::vold::destroyKey(ce_key_path);
-    if (!store_key(ce_key_path, auth, ce_key)) return -1;
-    return 0;
+    if (!store_key(ce_key_path, user_key_temp, auth, ce_key)) return false;
+    return true;
 }
 
 // TODO: rename to 'install' for consistency, and take flags to know which keys to install
-int e4crypt_unlock_user_key(userid_t user_id, int serial,
+bool e4crypt_unlock_user_key(userid_t user_id, int serial,
         const char* token_hex, const char* secret_hex) {
     LOG(DEBUG) << "e4crypt_unlock_user_key " << user_id << " serial=" << serial <<
         " token_present=" << (strcmp(token_hex, "!") != 0);
     if (e4crypt_is_native()) {
         if (s_ce_key_raw_refs.count(user_id) != 0) {
             LOG(WARNING) << "Tried to unlock already-unlocked key for user " << user_id;
-            return 0;
+            return true;
         }
         std::string token, secret;
         if (!parse_hex(token_hex, token)) return false;
@@ -563,42 +551,42 @@
         android::vold::KeyAuthentication auth(token, secret);
         if (!read_and_install_user_ce_key(user_id, auth)) {
             LOG(ERROR) << "Couldn't read key for " << user_id;
-            return -1;
+            return false;
         }
     } else {
         // When in emulation mode, we just use chmod. However, we also
         // unlock directories when not in emulation mode, to bring devices
         // back into a known-good state.
-        if (emulated_unlock(android::vold::BuildDataSystemCePath(user_id), 0771) ||
-                emulated_unlock(android::vold::BuildDataMiscCePath(user_id), 01771) ||
-                emulated_unlock(android::vold::BuildDataMediaPath(nullptr, user_id), 0770) ||
-                emulated_unlock(android::vold::BuildDataUserPath(nullptr, user_id), 0771)) {
+        if (!emulated_unlock(android::vold::BuildDataSystemCePath(user_id), 0771) ||
+                !emulated_unlock(android::vold::BuildDataMiscCePath(user_id), 01771) ||
+                !emulated_unlock(android::vold::BuildDataMediaPath(nullptr, user_id), 0770) ||
+                !emulated_unlock(android::vold::BuildDataUserPath(nullptr, user_id), 0771)) {
             LOG(ERROR) << "Failed to unlock user " << user_id;
-            return -1;
+            return false;
         }
     }
-    return 0;
+    return true;
 }
 
 // TODO: rename to 'evict' for consistency
-int e4crypt_lock_user_key(userid_t user_id) {
+bool e4crypt_lock_user_key(userid_t user_id) {
     if (e4crypt_is_native()) {
         // TODO: remove from kernel keyring
     } else if (e4crypt_is_emulated()) {
         // When in emulation mode, we just use chmod
-        if (emulated_lock(android::vold::BuildDataSystemCePath(user_id)) ||
-                emulated_lock(android::vold::BuildDataMiscCePath(user_id)) ||
-                emulated_lock(android::vold::BuildDataMediaPath(nullptr, user_id)) ||
-                emulated_lock(android::vold::BuildDataUserPath(nullptr, user_id))) {
-            PLOG(ERROR) << "Failed to lock user " << user_id;
-            return -1;
+        if (!emulated_lock(android::vold::BuildDataSystemCePath(user_id)) ||
+                !emulated_lock(android::vold::BuildDataMiscCePath(user_id)) ||
+                !emulated_lock(android::vold::BuildDataMediaPath(nullptr, user_id)) ||
+                !emulated_lock(android::vold::BuildDataUserPath(nullptr, user_id))) {
+            LOG(ERROR) << "Failed to lock user " << user_id;
+            return false;
         }
     }
 
-    return 0;
+    return true;
 }
 
-int e4crypt_prepare_user_storage(const char* volume_uuid, userid_t user_id,
+bool e4crypt_prepare_user_storage(const char* volume_uuid, userid_t user_id,
         int serial, int flags) {
     LOG(DEBUG) << "e4crypt_prepare_user_storage for volume " << escape_null(volume_uuid)
             << ", user " << user_id << ", serial " << serial << ", flags " << flags;
@@ -608,16 +596,16 @@
         auto misc_de_path = android::vold::BuildDataMiscDePath(user_id);
         auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);
 
-        if (!prepare_dir(system_de_path, 0770, AID_SYSTEM, AID_SYSTEM)) return -1;
-        if (!prepare_dir(misc_de_path, 01771, AID_SYSTEM, AID_MISC)) return -1;
-        if (!prepare_dir(user_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return -1;
+        if (!prepare_dir(system_de_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
+        if (!prepare_dir(misc_de_path, 01771, AID_SYSTEM, AID_MISC)) return false;
+        if (!prepare_dir(user_de_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
 
-        if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+        if (e4crypt_is_native()) {
             std::string de_raw_ref;
-            if (!lookup_key_ref(s_de_key_raw_refs, user_id, de_raw_ref)) return -1;
-            if (!ensure_policy(de_raw_ref, system_de_path)) return -1;
-            if (!ensure_policy(de_raw_ref, misc_de_path)) return -1;
-            if (!ensure_policy(de_raw_ref, user_de_path)) return -1;
+            if (!lookup_key_ref(s_de_key_raw_refs, user_id, de_raw_ref)) return false;
+            if (!ensure_policy(de_raw_ref, system_de_path)) return false;
+            if (!ensure_policy(de_raw_ref, misc_de_path)) return false;
+            if (!ensure_policy(de_raw_ref, user_de_path)) return false;
         }
     }
 
@@ -627,20 +615,20 @@
         auto media_ce_path = android::vold::BuildDataMediaPath(volume_uuid, user_id);
         auto user_ce_path = android::vold::BuildDataUserPath(volume_uuid, user_id);
 
-        if (!prepare_dir(system_ce_path, 0770, AID_SYSTEM, AID_SYSTEM)) return -1;
-        if (!prepare_dir(misc_ce_path, 01771, AID_SYSTEM, AID_MISC)) return -1;
-        if (!prepare_dir(media_ce_path, 0770, AID_MEDIA_RW, AID_MEDIA_RW)) return -1;
-        if (!prepare_dir(user_ce_path, 0771, AID_SYSTEM, AID_SYSTEM)) return -1;
+        if (!prepare_dir(system_ce_path, 0770, AID_SYSTEM, AID_SYSTEM)) return false;
+        if (!prepare_dir(misc_ce_path, 01771, AID_SYSTEM, AID_MISC)) return false;
+        if (!prepare_dir(media_ce_path, 0770, AID_MEDIA_RW, AID_MEDIA_RW)) return false;
+        if (!prepare_dir(user_ce_path, 0771, AID_SYSTEM, AID_SYSTEM)) return false;
 
-        if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+        if (e4crypt_is_native()) {
             std::string ce_raw_ref;
-            if (!lookup_key_ref(s_ce_key_raw_refs, user_id, ce_raw_ref)) return -1;
-            if (!ensure_policy(ce_raw_ref, system_ce_path)) return -1;
-            if (!ensure_policy(ce_raw_ref, misc_ce_path)) return -1;
-            if (!ensure_policy(ce_raw_ref, media_ce_path)) return -1;
-            if (!ensure_policy(ce_raw_ref, user_ce_path)) return -1;
+            if (!lookup_key_ref(s_ce_key_raw_refs, user_id, ce_raw_ref)) return false;
+            if (!ensure_policy(ce_raw_ref, system_ce_path)) return false;
+            if (!ensure_policy(ce_raw_ref, misc_ce_path)) return false;
+            if (!ensure_policy(ce_raw_ref, media_ce_path)) return false;
+            if (!ensure_policy(ce_raw_ref, user_ce_path)) return false;
         }
     }
 
-    return 0;
+    return true;
 }
diff --git a/Ext4Crypt.h b/Ext4Crypt.h
index 80838c8..f183c58 100644
--- a/Ext4Crypt.h
+++ b/Ext4Crypt.h
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#include <stddef.h>
+#include <stdbool.h>
 #include <sys/cdefs.h>
 
 #include <cutils/multiuser.h>
@@ -22,20 +22,20 @@
 __BEGIN_DECLS
 
 // General functions
-int e4crypt_enable(const char* path);
-int e4crypt_crypto_complete(const char* path);
+bool e4crypt_is_native();
+bool e4crypt_initialize_global_de();
 
-int e4crypt_init_user0();
-int e4crypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral);
-int e4crypt_destroy_user_key(userid_t user_id);
-int e4crypt_change_user_key(userid_t user_id, int serial,
+bool e4crypt_init_user0();
+bool e4crypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral);
+bool e4crypt_destroy_user_key(userid_t user_id);
+bool e4crypt_change_user_key(userid_t user_id, int serial,
     const char* token, const char* old_secret, const char* new_secret);
 
-int e4crypt_unlock_user_key(userid_t user_id, int serial,
+bool e4crypt_unlock_user_key(userid_t user_id, int serial,
     const char* token, const char* secret);
-int e4crypt_lock_user_key(userid_t user_id);
+bool e4crypt_lock_user_key(userid_t user_id);
 
-int e4crypt_prepare_user_storage(const char* volume_uuid, userid_t user_id,
+bool e4crypt_prepare_user_storage(const char* volume_uuid, userid_t user_id,
         int serial, int flags);
 
 __END_DECLS
diff --git a/cryptfs.c b/cryptfs.c
index bd5807f..65acb60 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -56,7 +56,6 @@
 #include "VoldUtil.h"
 #include "crypto_scrypt.h"
 #include "Ext4Crypt.h"
-#include "ext4_crypt_init_extensions.h"
 #include "ext4_utils.h"
 #include "f2fs_sparseblock.h"
 #include "CheckBattery.h"
@@ -1782,7 +1781,7 @@
 int cryptfs_restart(void)
 {
     SLOGI("cryptfs_restart");
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("cryptfs_restart not valid for file encryption:");
         return -1;
     }
@@ -1804,7 +1803,7 @@
   }
 
   // crypto_complete is full disk encrypted status
-  if (e4crypt_crypto_complete(mount_point) == 0) {
+  if (e4crypt_is_native()) {
     return CRYPTO_COMPLETE_NOT_ENCRYPTED;
   }
 
@@ -2057,7 +2056,7 @@
 int cryptfs_check_passwd(char *passwd)
 {
     SLOGI("cryptfs_check_passwd");
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("cryptfs_check_passwd not valid for file encryption");
         return -1;
     }
@@ -3349,7 +3348,7 @@
 
 int cryptfs_changepw(int crypt_type, const char *newpw)
 {
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("cryptfs_changepw not valid for file encryption");
         return -1;
     }
@@ -3575,7 +3574,7 @@
 /* Return the value of the specified field. */
 int cryptfs_getfield(const char *fieldname, char *value, int len)
 {
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("Cannot get field when file encrypted");
         return -1;
     }
@@ -3641,7 +3640,7 @@
 /* Set the value of the specified field. */
 int cryptfs_setfield(const char *fieldname, const char *value)
 {
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("Cannot set field when file encrypted");
         return -1;
     }
@@ -3768,7 +3767,7 @@
  */
 int cryptfs_get_password_type(void)
 {
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("cryptfs_get_password_type not valid for file encryption");
         return -1;
     }
@@ -3789,7 +3788,7 @@
 
 const char* cryptfs_get_password()
 {
-    if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
+    if (e4crypt_is_native()) {
         SLOGE("cryptfs_get_password not valid for file encryption");
         return 0;
     }
@@ -3817,7 +3816,7 @@
 
 int cryptfs_enable_file()
 {
-    return e4crypt_enable(DATA_MNT_POINT);
+    return e4crypt_initialize_global_de();
 }
 
 int cryptfs_isConvertibleToFBE()
diff --git a/main.cpp b/main.cpp
index 6d94818..9cbcf88 100644
--- a/main.cpp
+++ b/main.cpp
@@ -18,7 +18,6 @@
 #include "VolumeManager.h"
 #include "CommandListener.h"
 #include "CryptCommandListener.h"
-#include "Ext4Crypt.h"
 #include "NetlinkManager.h"
 #include "cryptfs.h"
 #include "sehandle.h"