Commit graph

2316 commits

Author SHA1 Message Date
Eric Biggers
3a2f7db477 cryptfs: check for errors in create_encrypted_random_key()
When generating the key and salt we weren't checking for an error
opening or reading from /dev/urandom.  Switch to the helper function
ReadRandomBytes() and start checking for errors.

Test: Booted device with FDE.  As a extra sanity check I also
      temporarily added log messages that dump the key and salt,
      and I verified they still appear random.
Change-Id: I01ccee4f1f9910bf9508c8f02a918157393b0e68
2019-01-18 13:26:08 -08:00
Eric Biggers
0ef7bfd59c Utils: correctly handle read() errors in ReadRandomBytes()
read() returns -1 on error, so we need to use a signed type.

Test: Booted device with FDE
Change-Id: Ib44247c1cdfd38674a7439209e333823f2fb6cf8
2019-01-18 13:24:30 -08:00
Xin Li
9f7aa175a0 Merge "DO NOT MERGE - Skip pie-platform-release (PPRL.190105.001) in master" 2019-01-17 21:19:43 +00:00
Sudheer Shanka
2e9aafb620 Merge "Add UnmountTreeWithPrefix util method." 2019-01-17 18:04:27 +00:00
Annie Meng
625203444b Merge "Create subdirs in system_ce/ for multi-user backup" 2019-01-17 15:29:32 +00:00
Annie Meng
66176c55e9 Create subdirs in system_ce/ for multi-user backup
Backup system service bookkeeping is being moved to per-user CE
directories to support multiple users participating in the service.

Accompanies SELinux changes at aosp/873133

Bug: 121197420
Test: 1) Boot device; check dirs created with correct label; run backup
successfully on system user
2) Create secondary user; check dirs created with correct label; run
backup successfully

Change-Id: I3a0fdbfcf18a3c242fc64fba0dd014160b50b2f0
2019-01-17 12:53:16 +00:00
Annie Meng
3cc1866454 Merge "vold_prepare_subdirs: prepare /data/misc_[ce|de]/rollback." 2019-01-17 11:01:00 +00:00
Sudheer Shanka
295fb241e2 Add UnmountTreeWithPrefix util method.
Add a utility method to unmount all mountpoints
that start with a prefix.

Bug: 122905493
Test: manual
Change-Id: I11739e40e7849c1b4ca9e0b90c5c3f243691257a
2019-01-17 01:42:48 -08:00
Treehugger Robot
9ff07121ff Merge "Checkpoints: Support validation and roll forward on fail" 2019-01-17 01:08:20 +00:00
Paul Lawrence
27691c2883 Checkpoints: Support validation and roll forward on fail
Test: Rolls backward, and if you hexedit a BOW page, rolls forward
Change-Id: If99a6c3a3bc3f615bd1445f5af14ea490a58e053
2019-01-16 14:14:48 -08:00
Narayan Kamath
a232fd7fc8 vold_prepare_subdirs: prepare /data/misc_[ce|de]/rollback.
These directories are managed by installd and used to store
snapshots of application data directories in order to roll them
back in the case of bad updates.

Bug: 112431924
Test: make, device boot & manual verification.

Change-Id: Ieaca697a45d013937327e0f16f36b9b1eaad6b22
2019-01-16 15:16:51 +00:00
Xin Li
723b2545d2 DO NOT MERGE - Skip pie-platform-release (PPRL.190105.001) in master
Bug: 122685541
Change-Id: I951a35cc32c6dc0a3b051099d687c89a5e38ebbb
2019-01-15 10:19:51 -08:00
Treehugger Robot
a892eb154e Merge "Fsync directories after creating files" 2019-01-07 20:09:34 +00:00
Paul Crowley
621d9b9732 Fsync directories after creating files
Bug: 120248692
Test: adb shell locksettings set-pin 1111 && \
    adb shell "echo b > /proc/sysrq-trigger"
Change-Id: I53d252942c21365983b4f8b6e0948b1864f195c1
2019-01-07 04:30:08 -08:00
Treehugger Robot
1ea17070fe Merge "cryptfs: Add error messages when remove dm-crypt device is failed" 2019-01-07 09:45:22 +00:00
android-build-team Robot
06084fee42 Merge cherrypicks of [5929407, 5929627, 5929597, 5929598] into pi-platform-release
Change-Id: I71193baac96d5936f6e3dd69a7ee37e70d85f898
2019-01-03 23:49:33 +00:00
Greg Kaiser
13c6f32d77 cryptfs: Allow setting dm-crypt sector size
We add the property ro.crypto.fde_sector_size to allow devices
to pass the "sector_size:<size>" argument to dm-crypt in the kernel.
We also pass "iv_large_sectors" when setting the sector size.

Using 4096-byte sectors rather than the default of 512 improves
dm-crypt performance, especially when the Adiantum encryption mode
is used.

Bug: 112010205
Test: Run on a device
Change-Id: I144ec7088a0aad3430369dc7158370d7ff3ef5d2
Merged-In: I144ec7088a0aad3430369dc7158370d7ff3ef5d2
(cherry picked from commit 88738e8b6f59e307a2120d352843759025588539)
2019-01-03 23:49:28 +00:00
Greg Kaiser
7f0c5e4754 cryptfs: Add Adiantum support
Adiantum is a crypto method Android is supporting for devices
which don't have AES CPU instructions.  See the paper
"Adiantum: length-preserving encryption for entry-level processors"
(https://eprint.iacr.org/2018/720.pdf) for more details.

We add Adiantum to our list of supported crypto types.

Bug: 112010205
Test: Tested on a device
Change-Id: Ic190a9b90fc8bc077fdc7d60c9d5ae8d8f555025
Merged-In: Ic190a9b90fc8bc077fdc7d60c9d5ae8d8f555025
(cherry picked from commit 18824ec6cc9cd0f16530de2e034a7fe5b8fd17be)
2019-01-03 23:49:25 +00:00
Yue Hu
9d6cc18bf1 cryptfs: Add error messages when remove dm-crypt device is failed
We do not know what happened if remove dm-crypt device is failed, so
the error status added is useful to debug failed ioctl.

Change-Id: I49be91b9087ef2a213a706dd6b2a07eb6dafe6e6
Signed-off-by: Yue Hu <zbestahu@gmail.com>
2019-01-03 14:20:27 +08:00
Greg Kaiser
2374693556 Merge changes I1c50546e,I8254cb6b,Ib179299a,Iec1c2801
* changes:
  EncryptInplace: Rename variable
  Checkpoint: Assure proper buffer alignment
  vold: Pass std::string by const reference
  vold: const-ify some of the API
2018-12-21 00:10:42 +00:00
Greg Kaiser
e0691cc674 EncryptInplace: Rename variable
We rename our 'buf' in the inner scope to avoid confusion with
the 'buf' in the outer scope which is used immediately after
exiting the inner scope.

Test: TreeHugger
Change-Id: I1c50546e86c680e963eedcbda26138f8b43e55e9
2018-12-20 10:38:31 -08:00
Greg Kaiser
8859c9c9e7 Checkpoint: Assure proper buffer alignment
We have a char buffer on the stack, which we then cast to a
struct, and then proceed to access elements in the struct.
This is not safe across all platforms, as some platforms
may require a certain alignment for members of the struct.
We fix this by assuring an appropriate alignment for our
char buffer.

We also use C++ casting, and rename our buffer to differenciate
it from the other 'buffer' variable in this function.

Test: TreeHugger
Change-Id: I8254cb6b8124e394bd805afd1ccca0faedb27ffa
2018-12-20 10:38:31 -08:00
Greg Kaiser
8ae16db72a vold: Pass std::string by const reference
In a couple places, we change to pass a std::string argument
instead of by copy.

Test: TreeHugger
Change-Id: Ib179299a2322fcbab4e6d192051218823ad66a36
2018-12-20 10:38:31 -08:00
Greg Kaiser
ef9abab5ee vold: const-ify some of the API
We make some of the C++ member functions 'const', to reflect how
they (don't) affect the state of the class.

Test: TreeHugger
Change-Id: Iec1c2801bfe721e2741406ed1ac0ef95662840a6
Merged-In: Iec1c2801bfe721e2741406ed1ac0ef95662840a6
2018-12-20 10:38:15 -08:00
Treehugger Robot
03d3856c90 Merge changes from topic "checkpoint-enable"
* changes:
  Add Support for metadata key with rollback
  Add property for checkpointing
2018-12-15 04:39:51 +00:00
Daniel Rosenberg
690d6de5bf Add Support for metadata key with rollback
This adds the ability to upgrade a key and retain the
old one for rollback purposes. We delete the old key
if we boot successfully and delete the new key if we
do not.

Test: Enable checkpointing and test rolling back
      between two versions
Bug: 111020314

Change-Id: I19f31a1ac06a811c0644fc956e61b5ca84e7241a
2018-12-14 14:55:28 -08:00
Daniel Rosenberg
ffa1bb0370 Add property for checkpointing
We set a property when we commit a chackpoint to signal
to anyone who wants to do post commit cleanup.

Test: Boot to homescreen and check getprop for vold.checkpoint_committed
Bug: 111020314
Change-Id: Idf35e3abf9d24eb40c6926a30a8403064c05e10a
2018-12-14 14:55:16 -08:00
Greg Kaiser
7adca74263 Merge changes from topic "userspace_adiantum_support"
* changes:
  cryptfs: Allow setting dm-crypt sector size
  cryptfs: Add Adiantum support
2018-12-12 04:59:25 +00:00
Greg Kaiser
ab1e84ad5f cryptfs: Allow setting dm-crypt sector size
We add the property ro.crypto.fde_sector_size to allow devices
to pass the "sector_size:<size>" argument to dm-crypt in the kernel.
We also pass "iv_large_sectors" when setting the sector size.

Using 4096-byte sectors rather than the default of 512 improves
dm-crypt performance, especially when the Adiantum encryption mode
is used.

Bug: 112010205
Test: Run on a device
Change-Id: I144ec7088a0aad3430369dc7158370d7ff3ef5d2
2018-12-11 17:22:00 -08:00
Greg Kaiser
8cb4c9ff78 cryptfs: Add Adiantum support
Adiantum is a crypto method Android is supporting for devices
which don't have AES CPU instructions.  See the paper
"Adiantum: length-preserving encryption for entry-level processors"
(https://eprint.iacr.org/2018/720.pdf) for more details.

We add Adiantum to our list of supported crypto types.

Bug: 112010205
Test: Tested on a device
Change-Id: Ic190a9b90fc8bc077fdc7d60c9d5ae8d8f555025
2018-12-11 15:41:17 -08:00
Treehugger Robot
595172d1e6 Merge "DO NOT MERGE" 2018-12-10 17:20:41 +00:00
Treehugger Robot
b1166633b6 Merge "Check for errors in dup2" 2018-12-08 02:03:37 +00:00
Xin Li
e6ba0cc34a DO NOT MERGE
Merge pie-platform-release (PPRL.181205.001, history only) into master

Bug: 120502534
Change-Id: I087ef5ac78dc1c42448b7c8d50864a412afd3154
2018-12-07 16:14:54 -08:00
Paul Crowley
be857bfd9b Check for errors in dup2
Bug: 26735063
Test: adb shell sm partition disk:7,3 private && adb logcat -d
Change-Id: I3aa8d1f6183dd5e77f54f422482a54ea8197d768
2018-12-07 12:23:25 -08:00
Treehugger Robot
b46a2f7dea Merge "Fix signedness mismatch and integer underflow" 2018-12-07 11:05:17 +00:00
Paul Crowley
53b0d95903 Merge "Do lazy-unmount to /storage directly" 2018-12-07 06:35:48 +00:00
Treehugger Robot
a33b765ca0 Merge "Clean up use of pipe" 2018-12-07 00:10:45 +00:00
LongPing.WEI
4df104f335 Do lazy-unmount to /storage directly
From man 2 umount:
MNT_DETACH (since Linux 2.4.11)

Perform a lazy unmount: make the mount point unavailable for new
accesses, immediately disconnect the filesystem and all filesystems
mounted below it from each other and from the mount table, and
actually perform the unmount when the mount point ceases to be busy.

So we don't need to unmount the filesystems under it one by one.

Bug: 113796163
Test: atest android.appsecurity.cts.PermissionsHostTest#testInteractiveGrant23
Change-Id: I6a0422466a9865ff6d17122505ca73d041de9d54
2018-12-06 15:56:05 -08:00
Rubin Xu
f83cc61c1f Fix signedness mismatch and integer underflow
persist_get_max_entries() is supposed to return an unsigned integer as the
maximum number of entries but it also wrongly returns "-1" as an error
condition. Also fix an issue where an unsigned subtraction in this routine
could lead to integer underflow.

Bug: 112731440
Test: manual
Change-Id: I9672e39bef2c12156dda7806a08c52044962c178
2018-12-06 14:17:48 -08:00
Paul Crowley
e6d7663889 Clean up use of pipe
Don't duplicate what's already in unique_fd.h
Also, code that tries to handle weird stdout condition won't work
because of cloexec; just don't try that.

My tests:
- Ensure Marlin device boots and vold_prepare_subdirs is called
successfully
- Try adb shell sm set-virtual-disk true, see that eg sgdisk output is
logged.

Bug: 26735063
Bug: 113796163
Test: details in commit
Change-Id: I5698ba0b4c8bd692a740a1bd445e677ad4815d11
2018-12-06 14:02:30 -08:00
Paul Crowley
6aaedb0dca Merge "Refactor ForkExecvp to improve locking behaviour" 2018-12-06 20:03:31 +00:00
Paul Crowley
de2d6201ab Refactor ForkExecvp to improve locking behaviour
Do our own fork/exec rather than using a library. This leads to
many improvements:

- unite the output recording path with the other path
- never concatenate arguments with spaces
- never use the shell
- move setexeccon after fork, so we don't need to take the lock
- general code refactor while we're there

My tests:
- Ensure Marlin device boots and vold_prepare_subdirs is called
successfully
- Try adb shell sm set-virtual-disk true, see that eg sgdisk output is
logged.

weilongping@huawei.com's tests:
- unlock a user's de and ce directory;
- connect to a OTG storage device or a sdcard and ensure the mount logic be successful

Bug: 26735063
Bug: 113796163
Test: details in commit
Change-Id: I0976413529d7cbeebf5b8649660a385f9b036f04
2018-12-06 09:37:02 -08:00
Xin Li
80647cf607 Merge "Merge pie-platform-release (PPRL.181105.017, history only) into master" 2018-12-04 22:09:27 +00:00
Bill Rassieur
d9aa87ecee Merge PQ1A.181205.006 from Pi-QPR1-Release into ToT for Pi-Platform release.\n\nBUG: 120448245
Change-Id: I65b3aa4e1ad1d95464f0b4cd1af211be4fb1ddbc
2018-12-04 17:00:13 +00:00
Andrey Kulikov
cac8b13023 Merge "Remove dependency on libparcelfiledescriptor" 2018-12-04 12:28:53 +00:00
Michael Wright
ad232d6f84 Remove dependency on libparcelfiledescriptor
This library doesn't actually exist outside of ARC specific branches,
so it will break any ARC product builds.

Test: None
Change-Id: Ic73f470c93ea7d3590dc2b273624988291612344
2018-12-04 12:22:47 +00:00
Xin Li
925b0cf764 Merge pie-platform-release (PPRL.181105.017, history only) into master
Bug: 118454372
Change-Id: Ibc7ddf231ff61272439b9a621490acaff27ce563
2018-12-03 15:33:24 -08:00
Treehugger Robot
e7a9d5fbbd Merge "ARC++ swap for AppFuseUtil" 2018-12-01 07:22:19 +00:00
Treehugger Robot
13755d81be Merge "Includes new static libfs_avb" 2018-11-30 06:59:38 +00:00
Treehugger Robot
7be8a7ee1d Merge "Extract AppFuse as a util" 2018-11-30 05:05:10 +00:00