Merge "Stop using a regex for setupAppDir."
diff --git a/FsCrypt.cpp b/FsCrypt.cpp
index 4163f4f..0619fba 100644
--- a/FsCrypt.cpp
+++ b/FsCrypt.cpp
@@ -211,6 +211,19 @@
return true;
}
+static bool install_storage_key(const std::string& mountpoint, const EncryptionOptions& options,
+ const KeyBuffer& key, EncryptionPolicy* policy) {
+ KeyBuffer ephemeral_wrapped_key;
+ if (options.use_hw_wrapped_key) {
+ if (!exportWrappedStorageKey(key, &ephemeral_wrapped_key)) {
+ LOG(ERROR) << "Failed to get ephemeral wrapped key";
+ return false;
+ }
+ }
+ return installKey(mountpoint, options, options.use_hw_wrapped_key ? ephemeral_wrapped_key : key,
+ policy);
+}
+
// Retrieve the options to use for encryption policies on adoptable storage.
static bool get_volume_file_encryption_options(EncryptionOptions* options) {
auto contents_mode =
@@ -234,7 +247,7 @@
KeyBuffer ce_key;
if (!read_and_fixate_user_ce_key(user_id, auth, &ce_key)) return false;
EncryptionPolicy ce_policy;
- if (!installKey(DATA_MNT_POINT, options, ce_key, &ce_policy)) return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, ce_key, &ce_policy)) return false;
s_ce_policies[user_id] = ce_policy;
LOG(DEBUG) << "Installed ce key for user " << user_id;
return true;
@@ -264,8 +277,8 @@
EncryptionOptions options;
if (!get_data_file_encryption_options(&options)) return false;
KeyBuffer de_key, ce_key;
- if (!android::vold::randomKey(&de_key)) return false;
- if (!android::vold::randomKey(&ce_key)) return false;
+ if (!generateStorageKey(options, &de_key)) return false;
+ if (!generateStorageKey(options, &ce_key)) return false;
if (create_ephemeral) {
// If the key should be created as ephemeral, don't store it.
s_ephemeral_users.insert(user_id);
@@ -285,10 +298,10 @@
return false;
}
EncryptionPolicy de_policy;
- if (!installKey(DATA_MNT_POINT, options, de_key, &de_policy)) return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, de_key, &de_policy)) return false;
s_de_policies[user_id] = de_policy;
EncryptionPolicy ce_policy;
- if (!installKey(DATA_MNT_POINT, options, ce_key, &ce_policy)) return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, ce_key, &ce_policy)) return false;
s_ce_policies[user_id] = ce_policy;
LOG(DEBUG) << "Created keys for user " << user_id;
return true;
@@ -341,7 +354,7 @@
KeyBuffer de_key;
if (!android::vold::retrieveKey(key_path, kEmptyAuthentication, &de_key)) return false;
EncryptionPolicy de_policy;
- if (!installKey(DATA_MNT_POINT, options, de_key, &de_policy)) return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, de_key, &de_policy)) return false;
s_de_policies[user_id] = de_policy;
LOG(DEBUG) << "Installed de key for user " << user_id;
}
@@ -363,12 +376,11 @@
KeyBuffer device_key;
if (!android::vold::retrieveKey(true, kEmptyAuthentication, device_key_path, device_key_temp,
- &device_key))
+ options, &device_key))
return false;
EncryptionPolicy device_policy;
- if (!android::vold::installKey(DATA_MNT_POINT, options, device_key, &device_policy))
- return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, device_key, &device_policy)) return false;
std::string options_string;
if (!OptionsToString(device_policy.options, &options_string)) {
@@ -383,10 +395,9 @@
LOG(INFO) << "Wrote system DE key reference to:" << ref_filename;
KeyBuffer per_boot_key;
- if (!android::vold::randomKey(&per_boot_key)) return false;
+ if (!generateStorageKey(options, &per_boot_key)) return false;
EncryptionPolicy per_boot_policy;
- if (!android::vold::installKey(DATA_MNT_POINT, options, per_boot_key, &per_boot_policy))
- return false;
+ if (!install_storage_key(DATA_MNT_POINT, options, per_boot_key, &per_boot_policy)) return false;
std::string per_boot_ref_filename = std::string("/data") + fscrypt_key_per_boot_ref;
if (!android::vold::writeStringToFile(per_boot_policy.key_raw_ref, per_boot_ref_filename))
return false;
@@ -593,8 +604,9 @@
EncryptionOptions options;
if (!get_volume_file_encryption_options(&options)) return false;
KeyBuffer key;
- if (!android::vold::retrieveKey(true, auth, key_path, key_path + "_tmp", &key)) return false;
- if (!android::vold::installKey(BuildDataPath(volume_uuid), options, key, policy)) return false;
+ if (!android::vold::retrieveKey(true, auth, key_path, key_path + "_tmp", options, &key))
+ return false;
+ if (!install_storage_key(BuildDataPath(volume_uuid), options, key, policy)) return false;
return true;
}
diff --git a/KeyStorage.cpp b/KeyStorage.cpp
index dbf190d..a7582c2 100644
--- a/KeyStorage.cpp
+++ b/KeyStorage.cpp
@@ -135,6 +135,30 @@
keymaster.generateKey(paramBuilder, key);
}
+bool generateWrappedStorageKey(KeyBuffer* key) {
+ Keymaster keymaster;
+ if (!keymaster) return false;
+ std::string key_temp;
+ auto paramBuilder = km::AuthorizationSetBuilder().AesEncryptionKey(AES_KEY_BYTES * 8);
+ paramBuilder.Authorization(km::TAG_ROLLBACK_RESISTANCE);
+ paramBuilder.Authorization(km::TAG_STORAGE_KEY);
+ if (!keymaster.generateKey(paramBuilder, &key_temp)) return false;
+ *key = KeyBuffer(key_temp.size());
+ memcpy(reinterpret_cast<void*>(key->data()), key_temp.c_str(), key->size());
+ return true;
+}
+
+bool exportWrappedStorageKey(const KeyBuffer& kmKey, KeyBuffer* key) {
+ Keymaster keymaster;
+ if (!keymaster) return false;
+ std::string key_temp;
+
+ if (!keymaster.exportKey(kmKey, &key_temp)) return false;
+ *key = KeyBuffer(key_temp.size());
+ memcpy(reinterpret_cast<void*>(key->data()), key_temp.c_str(), key->size());
+ return true;
+}
+
static std::pair<km::AuthorizationSet, km::HardwareAuthToken> beginParams(
const KeyAuthentication& auth, const std::string& appId) {
auto paramBuilder = km::AuthorizationSetBuilder()
diff --git a/KeyStorage.h b/KeyStorage.h
index 276b6b9..f9d3ec6 100644
--- a/KeyStorage.h
+++ b/KeyStorage.h
@@ -68,6 +68,11 @@
bool destroyKey(const std::string& dir);
bool runSecdiscardSingle(const std::string& file);
+
+// Generate wrapped storage key using keymaster. Uses STORAGE_KEY tag in keymaster.
+bool generateWrappedStorageKey(KeyBuffer* key);
+// Export the per-boot boot wrapped storage key using keymaster.
+bool exportWrappedStorageKey(const KeyBuffer& kmKey, KeyBuffer* key);
} // namespace vold
} // namespace android
diff --git a/KeyUtil.cpp b/KeyUtil.cpp
index d4a653b..ae4d70b 100644
--- a/KeyUtil.cpp
+++ b/KeyUtil.cpp
@@ -29,6 +29,7 @@
#include <android-base/logging.h>
#include <keyutils.h>
+#include <fscrypt_uapi.h>
#include "KeyStorage.h"
#include "Utils.h"
@@ -45,6 +46,13 @@
return true;
}
+bool generateStorageKey(const EncryptionOptions& options, KeyBuffer* key) {
+ if (options.use_hw_wrapped_key) {
+ return generateWrappedStorageKey(key);
+ }
+ return randomKey(key);
+}
+
// Return true if the kernel supports the ioctls to add/remove fscrypt keys
// directly to/from the filesystem.
bool isFsKeyringSupported(void) {
@@ -222,6 +230,7 @@
return false;
}
+ if (options.use_hw_wrapped_key) arg->flags |= FSCRYPT_ADD_KEY_FLAG_WRAPPED;
// Provide the raw key.
arg->raw_size = key.size();
memcpy(arg->raw, key.data(), key.size());
@@ -307,8 +316,8 @@
}
bool retrieveKey(bool create_if_absent, const KeyAuthentication& key_authentication,
- const std::string& key_path, const std::string& tmp_path, KeyBuffer* key,
- bool keepOld) {
+ const std::string& key_path, const std::string& tmp_path,
+ const EncryptionOptions& options, KeyBuffer* key, bool keepOld) {
if (pathExists(key_path)) {
LOG(DEBUG) << "Key exists, using: " << key_path;
if (!retrieveKey(key_path, key_authentication, key, keepOld)) return false;
@@ -318,7 +327,7 @@
return false;
}
LOG(INFO) << "Creating new key in " << key_path;
- if (!randomKey(key)) return false;
+ if (!generateStorageKey(options, key)) return false;
if (!storeKeyAtomically(key_path, tmp_path, key_authentication, *key)) return false;
}
return true;
diff --git a/KeyUtil.h b/KeyUtil.h
index be5a2ed..878b4ab 100644
--- a/KeyUtil.h
+++ b/KeyUtil.h
@@ -32,6 +32,8 @@
bool randomKey(KeyBuffer* key);
+bool generateStorageKey(const EncryptionOptions& options, KeyBuffer* key);
+
bool isFsKeyringSupported(void);
// Install a file-based encryption key to the kernel, for use by encrypted files
@@ -57,8 +59,8 @@
bool evictKey(const std::string& mountpoint, const EncryptionPolicy& policy);
bool retrieveKey(bool create_if_absent, const KeyAuthentication& key_authentication,
- const std::string& key_path, const std::string& tmp_path, KeyBuffer* key,
- bool keepOld = true);
+ const std::string& key_path, const std::string& tmp_path,
+ const EncryptionOptions& options, KeyBuffer* key, bool keepOld = true);
} // namespace vold
} // namespace android
diff --git a/Keymaster.cpp b/Keymaster.cpp
index abee9b2..c3f2912 100644
--- a/Keymaster.cpp
+++ b/Keymaster.cpp
@@ -138,6 +138,27 @@
return true;
}
+bool Keymaster::exportKey(const KeyBuffer& kmKey, std::string* key) {
+ auto kmKeyBlob = km::support::blob2hidlVec(std::string(kmKey.data(), kmKey.size()));
+ km::ErrorCode km_error;
+ auto hidlCb = [&](km::ErrorCode ret, const hidl_vec<uint8_t>& exportedKeyBlob) {
+ km_error = ret;
+ if (km_error != km::ErrorCode::OK) return;
+ if (key)
+ key->assign(reinterpret_cast<const char*>(&exportedKeyBlob[0]), exportedKeyBlob.size());
+ };
+ auto error = mDevice->exportKey(km::KeyFormat::RAW, kmKeyBlob, {}, {}, hidlCb);
+ if (!error.isOk()) {
+ LOG(ERROR) << "export_key failed: " << error.description();
+ return false;
+ }
+ if (km_error != km::ErrorCode::OK) {
+ LOG(ERROR) << "export_key failed, code " << int32_t(km_error);
+ return false;
+ }
+ return true;
+}
+
bool Keymaster::deleteKey(const std::string& key) {
auto keyBlob = km::support::blob2hidlVec(key);
auto error = mDevice->deleteKey(keyBlob);
diff --git a/Keymaster.h b/Keymaster.h
index 78f66a3..4a9ed02 100644
--- a/Keymaster.h
+++ b/Keymaster.h
@@ -114,6 +114,8 @@
explicit operator bool() { return mDevice.get() != nullptr; }
// Generate a key in the keymaster from the given params.
bool generateKey(const km::AuthorizationSet& inParams, std::string* key);
+ // Exports a keymaster key with STORAGE_KEY tag wrapped with a per-boot ephemeral key
+ bool exportKey(const KeyBuffer& kmKey, std::string* key);
// If the keymaster supports it, permanently delete a key.
bool deleteKey(const std::string& key);
// Replace stored key blob in response to KM_ERROR_KEY_REQUIRES_UPGRADE.
diff --git a/MetadataCrypt.cpp b/MetadataCrypt.cpp
index acd5b59..76ea9eb 100644
--- a/MetadataCrypt.cpp
+++ b/MetadataCrypt.cpp
@@ -113,6 +113,23 @@
LOG(INFO) << "Old Key deleted: " << dir;
}
+static bool retrieveMetadataKey(bool create_if_absent, const std::string& key_path,
+ const std::string& tmp_path, KeyBuffer* key, bool keepOld) {
+ if (pathExists(key_path)) {
+ LOG(DEBUG) << "Key exists, using: " << key_path;
+ if (!retrieveKey(key_path, kEmptyAuthentication, key, keepOld)) return false;
+ } else {
+ if (!create_if_absent) {
+ LOG(ERROR) << "No key found in " << key_path;
+ return false;
+ }
+ LOG(INFO) << "Creating new key in " << key_path;
+ if (!randomKey(key)) return false;
+ if (!storeKeyAtomically(key_path, tmp_path, kEmptyAuthentication, *key)) return false;
+ }
+ return true;
+}
+
static bool read_key(const FstabEntry& data_rec, bool create_if_absent, KeyBuffer* key) {
if (data_rec.metadata_key_dir.empty()) {
LOG(ERROR) << "Failed to get metadata_key_dir";
@@ -143,9 +160,7 @@
unlink(newKeyPath.c_str());
}
bool needs_cp = cp_needsCheckpoint();
- if (!android::vold::retrieveKey(create_if_absent, kEmptyAuthentication, dir, temp, key,
- needs_cp))
- return false;
+ if (!retrieveMetadataKey(create_if_absent, dir, temp, key, needs_cp)) return false;
if (needs_cp && pathExists(newKeyPath)) std::thread(commit_key, dir).detach();
return true;
}
diff --git a/VoldNativeService.cpp b/VoldNativeService.cpp
index 3643c74..6aa9670 100644
--- a/VoldNativeService.cpp
+++ b/VoldNativeService.cpp
@@ -458,14 +458,12 @@
return translate(VolumeManager::Instance()->remountUid(uid, remountMode));
}
-binder::Status VoldNativeService::setupAppDir(const std::string& path,
- const std::string& appDirRoot, int32_t appUid) {
+binder::Status VoldNativeService::setupAppDir(const std::string& path, int32_t appUid) {
ENFORCE_SYSTEM_OR_ROOT;
CHECK_ARGUMENT_PATH(path);
- CHECK_ARGUMENT_PATH(appDirRoot);
ACQUIRE_LOCK;
- return translate(VolumeManager::Instance()->setupAppDir(path, appDirRoot, appUid));
+ return translate(VolumeManager::Instance()->setupAppDir(path, appUid));
}
binder::Status VoldNativeService::createObb(const std::string& sourcePath,
@@ -488,9 +486,12 @@
return translate(VolumeManager::Instance()->destroyObb(volId));
}
-binder::Status VoldNativeService::createStubVolume(
- const std::string& sourcePath, const std::string& mountPath, const std::string& fsType,
- const std::string& fsUuid, const std::string& fsLabel, std::string* _aidl_return) {
+binder::Status VoldNativeService::createStubVolume(const std::string& sourcePath,
+ const std::string& mountPath,
+ const std::string& fsType,
+ const std::string& fsUuid,
+ const std::string& fsLabel, int32_t flags,
+ std::string* _aidl_return) {
ENFORCE_SYSTEM_OR_ROOT;
CHECK_ARGUMENT_PATH(sourcePath);
CHECK_ARGUMENT_PATH(mountPath);
@@ -499,8 +500,8 @@
// is quite meaningless.
ACQUIRE_LOCK;
- return translate(VolumeManager::Instance()->createStubVolume(sourcePath, mountPath, fsType,
- fsUuid, fsLabel, _aidl_return));
+ return translate(VolumeManager::Instance()->createStubVolume(
+ sourcePath, mountPath, fsType, fsUuid, fsLabel, flags, _aidl_return));
}
binder::Status VoldNativeService::destroyStubVolume(const std::string& volId) {
diff --git a/VoldNativeService.h b/VoldNativeService.h
index 7de2a67..6d00d2d 100644
--- a/VoldNativeService.h
+++ b/VoldNativeService.h
@@ -65,8 +65,7 @@
binder::Status remountUid(int32_t uid, int32_t remountMode);
- binder::Status setupAppDir(const std::string& path, const std::string& appDirRoot,
- int32_t appUid);
+ binder::Status setupAppDir(const std::string& path, int32_t appUid);
binder::Status createObb(const std::string& sourcePath, const std::string& sourceKey,
int32_t ownerGid, std::string* _aidl_return);
@@ -74,7 +73,8 @@
binder::Status createStubVolume(const std::string& sourcePath, const std::string& mountPath,
const std::string& fsType, const std::string& fsUuid,
- const std::string& fsLabel, std::string* _aidl_return);
+ const std::string& fsLabel, int32_t flags,
+ std::string* _aidl_return);
binder::Status destroyStubVolume(const std::string& volId);
binder::Status fstrim(int32_t fstrimFlags,
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index 67add37..6f15846 100644
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -114,7 +114,7 @@
VolumeManager::VolumeManager() {
mDebug = false;
mNextObbId = 0;
- mNextStubVolumeId = 0;
+ mNextStubId = 0;
// For security reasons, assume that a secure keyguard is
// showing until we hear otherwise
mSecureKeyguardShowing = true;
@@ -340,11 +340,6 @@
return vol;
}
}
- for (const auto& vol : mStubVolumes) {
- if (vol->getId() == id) {
- return vol;
- }
- }
for (const auto& vol : mObbVolumes) {
if (vol->getId() == id) {
return vol;
@@ -767,7 +762,6 @@
}
mInternalEmulatedVolumes.clear();
- mStubVolumes.clear();
mDisks.clear();
mPendingDisks.clear();
android::vold::sSleepOnUnmount = true;
@@ -782,9 +776,6 @@
for (const auto& vol : mInternalEmulatedVolumes) {
vol->unmount();
}
- for (const auto& stub : mStubVolumes) {
- stub->unmount();
- }
for (const auto& disk : mDisks) {
disk->unmountAll();
}
@@ -823,8 +814,7 @@
return 0;
}
-int VolumeManager::setupAppDir(const std::string& path, const std::string& appDirRoot,
- int32_t appUid) {
+int VolumeManager::setupAppDir(const std::string& path, int32_t appUid) {
// Only offer to create directories for paths managed by vold
if (!StartsWith(path, "/storage/")) {
LOG(ERROR) << "Failed to find mounted volume for " << path;
@@ -901,27 +891,31 @@
int VolumeManager::createStubVolume(const std::string& sourcePath, const std::string& mountPath,
const std::string& fsType, const std::string& fsUuid,
- const std::string& fsLabel, std::string* outVolId) {
- int id = mNextStubVolumeId++;
- auto vol = std::shared_ptr<android::vold::VolumeBase>(
- new android::vold::StubVolume(id, sourcePath, mountPath, fsType, fsUuid, fsLabel));
- vol->create();
+ const std::string& fsLabel, int32_t flags,
+ std::string* outVolId) {
+ dev_t stubId = --mNextStubId;
+ auto vol = std::shared_ptr<android::vold::StubVolume>(
+ new android::vold::StubVolume(stubId, sourcePath, mountPath, fsType, fsUuid, fsLabel));
- mStubVolumes.push_back(vol);
+ int32_t passedFlags = android::vold::Disk::Flags::kStub;
+ passedFlags |= (flags & android::vold::Disk::Flags::kUsb);
+ passedFlags |= (flags & android::vold::Disk::Flags::kSd);
+ // StubDisk doesn't have device node corresponds to it. So, a fake device
+ // number is used.
+ auto disk = std::shared_ptr<android::vold::Disk>(
+ new android::vold::Disk("stub", stubId, "stub", passedFlags));
+ disk->initializePartition(vol);
+ handleDiskAdded(disk);
*outVolId = vol->getId();
return android::OK;
}
int VolumeManager::destroyStubVolume(const std::string& volId) {
- auto i = mStubVolumes.begin();
- while (i != mStubVolumes.end()) {
- if ((*i)->getId() == volId) {
- (*i)->destroy();
- i = mStubVolumes.erase(i);
- } else {
- ++i;
- }
- }
+ auto tokens = android::base::Split(volId, ":");
+ CHECK(tokens.size() == 2);
+ dev_t stubId;
+ CHECK(android::base::ParseUint(tokens[1], &stubId));
+ handleDiskRemoved(stubId);
return android::OK;
}
diff --git a/VolumeManager.h b/VolumeManager.h
index eb48736..765349d 100644
--- a/VolumeManager.h
+++ b/VolumeManager.h
@@ -133,20 +133,27 @@
/*
* Creates a directory 'path' for an application, automatically creating
- * directories along the given path if they don't exist yet. 'appDirRoot'
- * is the "root" directory for app-specific directories of this kind;
- * 'path' must always start with 'appDirRoot'.
+ * directories along the given path if they don't exist yet.
*
* Example:
* path = /storage/emulated/0/Android/data/com.foo/files/
- * appDirRoot = /storage/emulated/0/Android/data/
*
- * This function will set the UID of all app-specific directories below
- * 'appDirRoot' to the 'appUid' argument. In the given example, the UID
+ * This function will first match the first part of the path with the volume
+ * root of any known volumes; in this case, "/storage/emulated/0" matches
+ * with the volume root of the emulated volume for user 0.
+ *
+ * The subseqent part of the path must start with one of the well-known
+ * Android/ data directories, /Android/data, /Android/obb or
+ * /Android/media.
+ *
+ * The final part of the path is application specific. This function will
+ * create all directories, including the application-specific ones, and
+ * set the UID of all app-specific directories below the well-known data
+ * directories to the 'appUid' argument. In the given example, the UID
* of /storage/emulated/0/Android/data/com.foo and
* /storage/emulated/0/Android/data/com.foo/files would be set to 'appUid'.
*
- * The UID of the parent directories will be set according to the
+ * The UID/GID of the parent directories will be set according to the
* requirements of the underlying filesystem and are of no concern to the
* caller.
*
@@ -155,7 +162,7 @@
* and ignored, unless the path ends with "/". Also ensures that path
* belongs to a volume managed by vold.
*/
- int setupAppDir(const std::string& path, const std::string& appDirRoot, int32_t appUid);
+ int setupAppDir(const std::string& path, int32_t appUid);
int createObb(const std::string& path, const std::string& key, int32_t ownerGid,
std::string* outVolId);
@@ -163,7 +170,7 @@
int createStubVolume(const std::string& sourcePath, const std::string& mountPath,
const std::string& fsType, const std::string& fsUuid,
- const std::string& fsLabel, std::string* outVolId);
+ const std::string& fsLabel, int32_t flags, std::string* outVolId);
int destroyStubVolume(const std::string& volId);
int mountAppFuse(uid_t uid, int mountId, android::base::unique_fd* device_fd);
@@ -192,7 +199,6 @@
std::list<std::shared_ptr<android::vold::Disk>> mDisks;
std::list<std::shared_ptr<android::vold::Disk>> mPendingDisks;
std::list<std::shared_ptr<android::vold::VolumeBase>> mObbVolumes;
- std::list<std::shared_ptr<android::vold::VolumeBase>> mStubVolumes;
std::list<std::shared_ptr<android::vold::VolumeBase>> mInternalEmulatedVolumes;
std::unordered_map<userid_t, int> mAddedUsers;
@@ -205,7 +211,7 @@
std::shared_ptr<android::vold::VolumeBase> mPrimary;
int mNextObbId;
- int mNextStubVolumeId;
+ int mNextStubId;
bool mSecureKeyguardShowing;
};
diff --git a/binder/android/os/IVold.aidl b/binder/android/os/IVold.aidl
index f1e463a..78598b3 100644
--- a/binder/android/os/IVold.aidl
+++ b/binder/android/os/IVold.aidl
@@ -54,7 +54,7 @@
void remountUid(int uid, int remountMode);
- void setupAppDir(@utf8InCpp String path, @utf8InCpp String appDirRoot, int appUid);
+ void setupAppDir(@utf8InCpp String path, int appUid);
@utf8InCpp String createObb(@utf8InCpp String sourcePath, @utf8InCpp String sourceKey,
int ownerGid);
@@ -125,7 +125,7 @@
@utf8InCpp String createStubVolume(@utf8InCpp String sourcePath,
@utf8InCpp String mountPath, @utf8InCpp String fsType,
- @utf8InCpp String fsUuid, @utf8InCpp String fsLabel);
+ @utf8InCpp String fsUuid, @utf8InCpp String fsLabel, int flags);
void destroyStubVolume(@utf8InCpp String volId);
FileDescriptor openAppFuseFile(int uid, int mountId, int fileId, int flags);
diff --git a/cryptfs.cpp b/cryptfs.cpp
index c06de0a..def306d 100644
--- a/cryptfs.cpp
+++ b/cryptfs.cpp
@@ -74,6 +74,7 @@
using android::base::ParseUint;
using android::base::StringPrintf;
using android::fs_mgr::GetEntryForMountPoint;
+using android::vold::KeyBuffer;
using namespace android::dm;
using namespace std::chrono_literals;
@@ -1926,8 +1927,13 @@
* as any metadata is been stored in a separate, small partition. We
* assume it must be using our same crypt type and keysize.
*/
-int cryptfs_setup_ext_volume(const char* label, const char* real_blkdev, const unsigned char* key,
+int cryptfs_setup_ext_volume(const char* label, const char* real_blkdev, const KeyBuffer& key,
std::string* out_crypto_blkdev) {
+ if (key.size() != cryptfs_get_keysize()) {
+ SLOGE("Raw keysize %zu does not match crypt keysize %" PRIu32, key.size(),
+ cryptfs_get_keysize());
+ return -1;
+ }
uint64_t nr_sec = 0;
if (android::vold::GetBlockDev512Sectors(real_blkdev, &nr_sec) != android::OK) {
SLOGE("Failed to get size of %s: %s", real_blkdev, strerror(errno));
@@ -1945,15 +1951,8 @@
android::base::GetBoolProperty("ro.crypto.allow_encrypt_override", false))
flags |= CREATE_CRYPTO_BLK_DEV_FLAGS_ALLOW_ENCRYPT_OVERRIDE;
- return create_crypto_blk_dev(&ext_crypt_ftr, key, real_blkdev, out_crypto_blkdev, label, flags);
-}
-
-/*
- * Called by vold when it's asked to unmount an encrypted external
- * storage volume.
- */
-int cryptfs_revert_ext_volume(const char* label) {
- return delete_crypto_blk_dev(label);
+ return create_crypto_blk_dev(&ext_crypt_ftr, reinterpret_cast<const unsigned char*>(key.data()),
+ real_blkdev, out_crypto_blkdev, label, flags);
}
int cryptfs_crypto_complete(void) {
diff --git a/cryptfs.h b/cryptfs.h
index 98ba7d6..9b5eae7 100644
--- a/cryptfs.h
+++ b/cryptfs.h
@@ -25,6 +25,8 @@
#include <cutils/properties.h>
+#include "KeyBuffer.h"
+
#define CRYPT_FOOTER_OFFSET 0x4000
/* Return values for cryptfs_crypto_complete */
@@ -62,9 +64,8 @@
int cryptfs_enable(int type, const char* passwd, int no_ui);
int cryptfs_changepw(int type, const char* newpw);
int cryptfs_enable_default(int no_ui);
-int cryptfs_setup_ext_volume(const char* label, const char* real_blkdev, const unsigned char* key,
- std::string* out_crypto_blkdev);
-int cryptfs_revert_ext_volume(const char* label);
+int cryptfs_setup_ext_volume(const char* label, const char* real_blkdev,
+ const android::vold::KeyBuffer& key, std::string* out_crypto_blkdev);
int cryptfs_getfield(const char* fieldname, char* value, int len);
int cryptfs_setfield(const char* fieldname, const char* value);
int cryptfs_mount_default_encrypted(void);
diff --git a/fscrypt_uapi.h b/fscrypt_uapi.h
new file mode 100644
index 0000000..08592e0
--- /dev/null
+++ b/fscrypt_uapi.h
@@ -0,0 +1,19 @@
+#ifndef _UAPI_LINUX_FSCRYPT_VOLD_H
+#define _UAPI_LINUX_FSCRYPT_VOLD_H
+
+#include <linux/fscrypt.h>
+#include <linux/types.h>
+
+#define FSCRYPT_ADD_KEY_FLAG_WRAPPED 0x01
+
+struct sys_fscrypt_add_key_arg {
+ struct fscrypt_key_specifier key_spec;
+ __u32 raw_size;
+ __u32 __reserved[8];
+ __u32 flags;
+ __u8 raw[];
+};
+
+#define fscrypt_add_key_arg sys_fscrypt_add_key_arg
+
+#endif //_UAPI_LINUX_FSCRYPT_VOLD_H
diff --git a/model/Disk.cpp b/model/Disk.cpp
index f8357a9..7ecc89e 100644
--- a/model/Disk.cpp
+++ b/model/Disk.cpp
@@ -180,6 +180,10 @@
auto listener = VolumeManager::Instance()->getListener();
if (listener) listener->onDiskCreated(getId(), mFlags);
+ if (isStub()) {
+ createStubVolume();
+ return OK;
+ }
readMetadata();
readPartitions();
return OK;
@@ -227,7 +231,8 @@
LOG(DEBUG) << "Found key for GUID " << normalizedGuid;
- auto vol = std::shared_ptr<VolumeBase>(new PrivateVolume(device, keyRaw));
+ auto keyBuffer = KeyBuffer(keyRaw.begin(), keyRaw.end());
+ auto vol = std::shared_ptr<VolumeBase>(new PrivateVolume(device, keyBuffer));
if (mJustPartitioned) {
LOG(DEBUG) << "Device just partitioned; silently formatting";
vol->setSilent(true);
@@ -243,6 +248,15 @@
vol->create();
}
+void Disk::createStubVolume() {
+ CHECK(mVolumes.size() == 1);
+ auto listener = VolumeManager::Instance()->getListener();
+ if (listener) listener->onDiskMetadataChanged(getId(), mSize, mLabel, mSysPath);
+ if (listener) listener->onDiskScanned(getId());
+ mVolumes[0]->setDiskId(getId());
+ mVolumes[0]->create();
+}
+
void Disk::destroyAllVolumes() {
for (const auto& vol : mVolumes) {
vol->destroy();
@@ -443,6 +457,12 @@
return OK;
}
+void Disk::initializePartition(std::shared_ptr<StubVolume> vol) {
+ CHECK(isStub());
+ CHECK(mVolumes.empty());
+ mVolumes.push_back(vol);
+}
+
status_t Disk::unmountAll() {
for (const auto& vol : mVolumes) {
vol->unmount();
diff --git a/model/Disk.h b/model/Disk.h
index d82d141..99c98fc 100644
--- a/model/Disk.h
+++ b/model/Disk.h
@@ -17,6 +17,7 @@
#ifndef ANDROID_VOLD_DISK_H
#define ANDROID_VOLD_DISK_H
+#include "StubVolume.h"
#include "Utils.h"
#include "VolumeBase.h"
@@ -52,6 +53,9 @@
kUsb = 1 << 3,
/* Flag that disk is EMMC internal */
kEmmc = 1 << 4,
+ /* Flag that disk is Stub disk, i.e., disk that is managed from outside
+ * Android (e.g., ARC++). */
+ kStub = 1 << 5,
};
const std::string& getId() const { return mId; }
@@ -74,6 +78,7 @@
status_t readMetadata();
status_t readPartitions();
+ void initializePartition(std::shared_ptr<StubVolume> vol);
status_t unmountAll();
@@ -109,11 +114,14 @@
void createPublicVolume(dev_t device);
void createPrivateVolume(dev_t device, const std::string& partGuid);
+ void createStubVolume();
void destroyAllVolumes();
int getMaxMinors();
+ bool isStub() { return mFlags & kStub; }
+
DISALLOW_COPY_AND_ASSIGN(Disk);
};
diff --git a/model/PrivateVolume.cpp b/model/PrivateVolume.cpp
index 03aa5fa..9f1f089 100644
--- a/model/PrivateVolume.cpp
+++ b/model/PrivateVolume.cpp
@@ -25,6 +25,7 @@
#include <android-base/logging.h>
#include <android-base/stringprintf.h>
#include <cutils/fs.h>
+#include <libdm/dm.h>
#include <private/android_filesystem_config.h>
#include <fcntl.h>
@@ -43,7 +44,7 @@
static const unsigned int kMajorBlockMmc = 179;
-PrivateVolume::PrivateVolume(dev_t device, const std::string& keyRaw)
+PrivateVolume::PrivateVolume(dev_t device, const KeyBuffer& keyRaw)
: VolumeBase(Type::kPrivate), mRawDevice(device), mKeyRaw(keyRaw) {
setId(StringPrintf("private:%u,%u", major(device), minor(device)));
mRawDevPath = StringPrintf("/dev/block/vold/%s", getId().c_str());
@@ -64,19 +65,17 @@
if (CreateDeviceNode(mRawDevPath, mRawDevice)) {
return -EIO;
}
- if (mKeyRaw.size() != cryptfs_get_keysize()) {
- PLOG(ERROR) << getId() << " Raw keysize " << mKeyRaw.size()
- << " does not match crypt keysize " << cryptfs_get_keysize();
+
+ // Recover from stale vold by tearing down any old mappings
+ auto& dm = dm::DeviceMapper::Instance();
+ if (!dm.DeleteDeviceIfExists(getId())) {
+ PLOG(ERROR) << "Cannot remove dm device " << getId();
return -EIO;
}
- // Recover from stale vold by tearing down any old mappings
- cryptfs_revert_ext_volume(getId().c_str());
-
// TODO: figure out better SELinux labels for private volumes
- unsigned char* key = (unsigned char*)mKeyRaw.data();
- int res = cryptfs_setup_ext_volume(getId().c_str(), mRawDevPath.c_str(), key, &mDmDevPath);
+ int res = cryptfs_setup_ext_volume(getId().c_str(), mRawDevPath.c_str(), mKeyRaw, &mDmDevPath);
if (res != 0) {
PLOG(ERROR) << getId() << " failed to setup cryptfs";
return -EIO;
@@ -86,8 +85,10 @@
}
status_t PrivateVolume::doDestroy() {
- if (cryptfs_revert_ext_volume(getId().c_str())) {
- LOG(ERROR) << getId() << " failed to revert cryptfs";
+ auto& dm = dm::DeviceMapper::Instance();
+ if (!dm.DeleteDevice(getId())) {
+ PLOG(ERROR) << "Cannot remove dm device " << getId();
+ return -EIO;
}
return DestroyDeviceNode(mRawDevPath);
}
diff --git a/model/PrivateVolume.h b/model/PrivateVolume.h
index 656172f..9780485 100644
--- a/model/PrivateVolume.h
+++ b/model/PrivateVolume.h
@@ -37,7 +37,7 @@
*/
class PrivateVolume : public VolumeBase {
public:
- PrivateVolume(dev_t device, const std::string& keyRaw);
+ PrivateVolume(dev_t device, const KeyBuffer& keyRaw);
virtual ~PrivateVolume();
const std::string& getFsType() const { return mFsType; };
const std::string& getRawDevPath() const { return mRawDevPath; };
@@ -65,7 +65,7 @@
std::string mPath;
/* Encryption key as raw bytes */
- std::string mKeyRaw;
+ KeyBuffer mKeyRaw;
/* Filesystem type */
std::string mFsType;
diff --git a/model/StubVolume.cpp b/model/StubVolume.cpp
index edd0861..d2cd8a8 100644
--- a/model/StubVolume.cpp
+++ b/model/StubVolume.cpp
@@ -16,6 +16,8 @@
#include "StubVolume.h"
+#include <inttypes.h>
+
#include <android-base/logging.h>
#include <android-base/stringprintf.h>
@@ -24,7 +26,7 @@
namespace android {
namespace vold {
-StubVolume::StubVolume(int id, const std::string& sourcePath, const std::string& mountPath,
+StubVolume::StubVolume(dev_t id, const std::string& sourcePath, const std::string& mountPath,
const std::string& fsType, const std::string& fsUuid,
const std::string& fsLabel)
: VolumeBase(Type::kStub),
@@ -33,7 +35,7 @@
mFsType(fsType),
mFsUuid(fsUuid),
mFsLabel(fsLabel) {
- setId(StringPrintf("stub:%d", id));
+ setId(StringPrintf("stub:%llu", (unsigned long long)id));
}
StubVolume::~StubVolume() {}
diff --git a/model/StubVolume.h b/model/StubVolume.h
index 538cae9..3697b53 100644
--- a/model/StubVolume.h
+++ b/model/StubVolume.h
@@ -31,7 +31,7 @@
*/
class StubVolume : public VolumeBase {
public:
- StubVolume(int id, const std::string& sourcePath, const std::string& mountPath,
+ StubVolume(dev_t id, const std::string& sourcePath, const std::string& mountPath,
const std::string& fsType, const std::string& fsUuid, const std::string& fsLabel);
virtual ~StubVolume();