Don't use a secdiscardable file for keys encrypted by SP
Storage keys that are encrypted by the user's synthetic password don't need to be securely deletable by vold, since secure deletion is already implemented at a higher level: the synthetic password protectors managed by LockSettingsService. Therefore, remove the use of the secdiscardable file by vold in this case to improve performance. Bug: 232452368 Bug: 251131631 Bug: 251147505 Change-Id: I847d6cd3b289dbeb1ca2760d6e261a78c179cad0
This commit is contained in:
parent
03ad91c3c2
commit
08f4bdfe98
2 changed files with 17 additions and 8 deletions
|
@ -191,9 +191,13 @@ bool createSecdiscardable(const std::string& filename, std::string* hash) {
|
|||
}
|
||||
|
||||
bool readSecdiscardable(const std::string& filename, std::string* hash) {
|
||||
if (pathExists(filename)) {
|
||||
std::string secdiscardable;
|
||||
if (!readFileToString(filename, &secdiscardable)) return false;
|
||||
hashWithPrefix(kHashPrefix_secdiscardable, secdiscardable, hash);
|
||||
} else {
|
||||
*hash = "";
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
|
@ -563,9 +567,12 @@ static bool decryptWithoutKeystore(const std::string& preKey, const std::string&
|
|||
|
||||
// Creates a directory at the given path |dir| and stores |key| in it, in such a
|
||||
// way that it can only be retrieved via Keystore (if no secret is given in
|
||||
// |auth|) or with the given secret (if a secret is given in |auth|), and can be
|
||||
// securely deleted. If a storage binding seed has been set, then the storage
|
||||
// binding seed will be required to retrieve the key as well.
|
||||
// |auth|) or with the given secret (if a secret is given in |auth|). In the
|
||||
// former case, an attempt is made to make the key securely deletable. In the
|
||||
// latter case, secure deletion is expected to be handled at a higher level.
|
||||
//
|
||||
// If a storage binding seed has been set, then the storage binding seed will be
|
||||
// required to retrieve the key as well.
|
||||
static bool storeKey(const std::string& dir, const KeyAuthentication& auth, const KeyBuffer& key) {
|
||||
if (TEMP_FAILURE_RETRY(mkdir(dir.c_str(), 0700)) == -1) {
|
||||
PLOG(ERROR) << "key mkdir " << dir;
|
||||
|
@ -573,7 +580,9 @@ static bool storeKey(const std::string& dir, const KeyAuthentication& auth, cons
|
|||
}
|
||||
if (!writeStringToFile(kCurrentVersion, dir + "/" + kFn_version)) return false;
|
||||
std::string secdiscardable_hash;
|
||||
if (!createSecdiscardable(dir + "/" + kFn_secdiscardable, &secdiscardable_hash)) return false;
|
||||
if (auth.usesKeystore() &&
|
||||
!createSecdiscardable(dir + "/" + kFn_secdiscardable, &secdiscardable_hash))
|
||||
return false;
|
||||
std::string stretching = getStretching(auth);
|
||||
if (!writeStringToFile(stretching, dir + "/" + kFn_stretching)) return false;
|
||||
std::string appId;
|
||||
|
|
|
@ -97,7 +97,7 @@ int main(int argc, const char* const argv[]) {
|
|||
TEMP_FAILURE_RETRY(open(target.c_str(), O_WRONLY | O_CLOEXEC, 0)));
|
||||
if (fd == -1) {
|
||||
LOG(ERROR) << "Secure discard open failed for: " << target;
|
||||
return 0;
|
||||
continue;
|
||||
}
|
||||
__u32 set = 1;
|
||||
ioctl(fd, F2FS_IOC_SET_PIN_FILE, &set);
|
||||
|
|
Loading…
Reference in a new issue