8c1659e271
When generating a CE key, don't persist it immediately with
kEmptyAuthentication. Instead, cache it in memory and persist it later
when the secret to protect it with is given. This is needed to make it
so that the CE key is always encrypted by the user's synthetic password
while it is stored on-disk. See the corresponding system_server changes
for more information about this design change and its motivation.
As part of this, simplify vold's Binder interface by replacing the three
methods addUserKeyAuth(), clearUserKeyAuth(), and
fixateNewestUserKeyAuth() with a single method setUserKeyProtection().
setUserKeyProtection() handles persisting the key for a new user or
re-encrypting the default-encrypted key for an existing unsecured user.
Bug: 232452368
Ignore-AOSP-First: This depends on frameworks/base changes that can only
be submitted to internal master, due to conflicts.
Test: see Ia753ea21bbaca8ef7a90c03fe73b66c896b1536e
Change-Id: Id36ba8ee343ccb6de7ec892c3f600abd636f6ce5
38 lines
1.5 KiB
C++
38 lines
1.5 KiB
C++
/*
|
|
* Copyright (C) 2015 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <cutils/multiuser.h>
|
|
|
|
bool fscrypt_initialize_systemwide_keys();
|
|
|
|
bool fscrypt_init_user0();
|
|
extern bool fscrypt_init_user0_done;
|
|
bool fscrypt_vold_create_user_key(userid_t user_id, int serial, bool ephemeral);
|
|
bool fscrypt_destroy_user_key(userid_t user_id);
|
|
bool fscrypt_set_user_key_protection(userid_t user_id, const std::string& secret);
|
|
|
|
std::vector<int> fscrypt_get_unlocked_users();
|
|
bool fscrypt_unlock_user_key(userid_t user_id, int serial, const std::string& secret);
|
|
bool fscrypt_lock_user_key(userid_t user_id);
|
|
|
|
bool fscrypt_prepare_user_storage(const std::string& volume_uuid, userid_t user_id, int serial,
|
|
int flags);
|
|
bool fscrypt_destroy_user_storage(const std::string& volume_uuid, userid_t user_id, int flags);
|
|
|
|
bool fscrypt_destroy_volume_keys(const std::string& volume_uuid);
|