83a73d7d50
Add support for setting v2 encryption policies when configured in the
fstab (for internal storage) or in system properties (for adoptable
storage), and for installing and evicting the keys for such policies.
v2 policies support the same encryption modes and flags as v1 policies,
but internally they use a more standard, secure, and flexible KDF. Due
to this, some future features will be supported by v2 policies only.
Bug: 140500999
Test: Configured a device to use v2 encryption policies (applied the
needed kernel patches and added
"fileencryption=aes-256-xts:aes-256-cts:v2" to fstab, and set the
corresponding system properties for adoptable storage). Wiped
userdata, booted device and checked logs to verify that v2
policies were being used.
Also enabled virtual SD card and formatted as adoptable storage;
verified it works and that v2 policies were being used on it.
Also created, started, and stopped a 2nd user and verified their
keys were evicted.
Also verified that the device comes up again after rebooting.
Also verified that a device using v1 encryption policies continues
to work, both with and without an updated kernel -- including
stopping a user so that their keys get evicted.
Change-Id: If64028d8580584b2c33c614cabd5d6b93657f608
46 lines
1.6 KiB
C++
46 lines
1.6 KiB
C++
/*
|
|
* Copyright (C) 2016 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#ifndef ANDROID_VOLD_KEYUTIL_H
|
|
#define ANDROID_VOLD_KEYUTIL_H
|
|
|
|
#include "KeyBuffer.h"
|
|
#include "KeyStorage.h"
|
|
|
|
#include <memory>
|
|
#include <string>
|
|
|
|
namespace android {
|
|
namespace vold {
|
|
|
|
bool randomKey(KeyBuffer* key);
|
|
|
|
bool isFsKeyringSupported(void);
|
|
|
|
bool installKey(const KeyBuffer& key, const std::string& mountpoint, int policy_version,
|
|
std::string* raw_ref);
|
|
bool evictKey(const std::string& mountpoint, const std::string& raw_ref, int policy_version);
|
|
bool retrieveAndInstallKey(bool create_if_absent, const KeyAuthentication& key_authentication,
|
|
const std::string& key_path, const std::string& tmp_path,
|
|
const std::string& volume_uuid, int policy_version,
|
|
std::string* key_ref);
|
|
bool retrieveKey(bool create_if_absent, const std::string& key_path, const std::string& tmp_path,
|
|
KeyBuffer* key, bool keepOld = true);
|
|
|
|
} // namespace vold
|
|
} // namespace android
|
|
|
|
#endif
|