tequilaOS/platform_system_vold
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Create a per-boot key on each boot

Browse source 
Bug: 140882488
Test: Booted twice, checked logs to ensure encryption
    is different each time, adb created files in directory.
Cherry-Picked-From: c8a3ef3f3c
Merged-In: I74077bf8f727dab726c25f512ed7406a74cbe0bf
Change-Id: I74077bf8f727dab726c25f512ed7406a74cbe0bf
This commit is contained in:
Paul Crowley 2019-09-11 15:00:08 -07:00
parent 732faaeb94
commit ccc84dec96
3 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
FsCrypt.cpp
View file

@ -84,7 +84,7 @@ const std::string prepare_subdirs_path = "/system/bin/vold_prepare_subdirs";
const std::string systemwide_volume_key_dir =
std::string() + DATA_MNT_POINT + "/misc/vold/volume_keys";
bool s_global_de_initialized = false;
bool s_systemwide_keys_initialized = false;
// Some users are ephemeral, don't try to wipe their keys from disk
std::set<userid_t> s_ephemeral_users;
@ -335,10 +335,10 @@ static bool load_all_de_keys() {
return true;
}
bool fscrypt_initialize_global_de() {
LOG(INFO) << "fscrypt_initialize_global_de";
bool fscrypt_initialize_systemwide_keys() {
LOG(INFO) << "fscrypt_initialize_systemwide_keys";
if (s_global_de_initialized) {
if (s_systemwide_keys_initialized) {
LOG(INFO) << "Already initialized";
return true;
}
@ -355,11 +355,18 @@ bool fscrypt_initialize_global_de() {
std::string ref_filename = std::string("/data") + fscrypt_key_ref;
if (!android::vold::writeStringToFile(device_ref.key_raw_ref, ref_filename)) return false;
LOG(INFO) << "Wrote system DE key reference to:" << ref_filename;
KeyBuffer per_boot_key;
if (!android::vold::randomKey(&per_boot_key)) return false;
std::string per_boot_raw_ref;
if (!android::vold::installKey(per_boot_key, &per_boot_raw_ref)) return false;
std::string per_boot_ref_filename = std::string("/data") + fscrypt_key_per_boot_ref;
if (!android::vold::writeStringToFile(per_boot_raw_ref, per_boot_ref_filename)) return false;
LOG(INFO) << "Wrote per boot key reference to:" << per_boot_ref_filename;
if (!android::vold::FsyncDirectory(device_key_dir)) return false;
s_global_de_initialized = true;
s_systemwide_keys_initialized = true;
return true;
}

2
FsCrypt.h
View file

@ -18,7 +18,7 @@
#include <cutils/multiuser.h>
bool fscrypt_initialize_global_de();
bool fscrypt_initialize_systemwide_keys();
bool fscrypt_init_user0();
bool fscrypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral);

2
VoldNativeService.cpp
View file

@ -691,7 +691,7 @@ binder::Status VoldNativeService::fbeEnable() {
ENFORCE_UID(AID_SYSTEM);
ACQUIRE_CRYPT_LOCK;
return translateBool(fscrypt_initialize_global_de());
return translateBool(fscrypt_initialize_systemwide_keys());
}
binder::Status VoldNativeService::mountDefaultEncrypted() {