blob: 2f9c876b5c521d77bae2cd1bd9bc93d921cf5b32 [file] [log] [blame]
Paul Crowleyf71ace32016-06-02 11:01:19 -07001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include "KeyUtil.h"
18
19#include <iomanip>
20#include <sstream>
21#include <string>
22
Eric Biggersf3dc4202019-09-30 13:05:58 -070023#include <fcntl.h>
Eric Biggers3e9c9962019-12-16 15:55:12 -080024#include <linux/fscrypt.h>
Paul Crowleyf71ace32016-06-02 11:01:19 -070025#include <openssl/sha.h>
Eric Biggersf3dc4202019-09-30 13:05:58 -070026#include <sys/ioctl.h>
Paul Crowleyf71ace32016-06-02 11:01:19 -070027
28#include <android-base/file.h>
29#include <android-base/logging.h>
Nikita Ioffeeea8bd32020-04-20 22:21:49 +010030#include <android-base/properties.h>
Elliott Hughesc3bda182017-05-09 17:01:04 -070031#include <keyutils.h>
Paul Crowleyf71ace32016-06-02 11:01:19 -070032
33#include "KeyStorage.h"
34#include "Utils.h"
35
36namespace android {
37namespace vold {
38
Paul Crowleyf4430382020-04-05 19:34:31 -070039using android::fscrypt::EncryptionOptions;
40using android::fscrypt::EncryptionPolicy;
41
Paul Crowley4eac2642020-02-12 11:04:05 -080042const KeyGeneration neverGen() {
43 return KeyGeneration{0, false, false};
44}
45
46static bool randomKey(size_t size, KeyBuffer* key) {
47 *key = KeyBuffer(size);
Pavel Grafove2e2d302017-08-01 17:15:53 +010048 if (ReadRandomBytes(key->size(), key->data()) != 0) {
Paul Crowleyf71ace32016-06-02 11:01:19 -070049 // TODO status_t plays badly with PLOG, fix it.
50 LOG(ERROR) << "Random read failed";
51 return false;
52 }
53 return true;
54}
55
Paul Crowley4eac2642020-02-12 11:04:05 -080056bool generateStorageKey(const KeyGeneration& gen, KeyBuffer* key) {
57 if (!gen.allow_gen) return false;
58 if (gen.use_hw_wrapped_key) {
59 if (gen.keysize != FSCRYPT_MAX_KEY_SIZE) {
60 LOG(ERROR) << "Cannot generate a wrapped key " << gen.keysize << " bytes long";
61 return false;
62 }
Eric Biggersb2024e02021-03-15 12:44:36 -070063 LOG(DEBUG) << "Generating wrapped storage key";
Barani Muthukumaran3dfb0942020-02-03 13:06:45 -080064 return generateWrappedStorageKey(key);
Paul Crowley4eac2642020-02-12 11:04:05 -080065 } else {
Eric Biggersb2024e02021-03-15 12:44:36 -070066 LOG(DEBUG) << "Generating standard storage key";
Paul Crowley4eac2642020-02-12 11:04:05 -080067 return randomKey(gen.keysize, key);
Barani Muthukumaran3dfb0942020-02-03 13:06:45 -080068 }
Barani Muthukumaran3dfb0942020-02-03 13:06:45 -080069}
70
Eric Biggers7604eb92020-07-16 14:29:59 -070071static bool isFsKeyringSupportedImpl() {
72 android::base::unique_fd fd(open("/data", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
73
74 // FS_IOC_ADD_ENCRYPTION_KEY with a NULL argument will fail with ENOTTY if
75 // the ioctl isn't supported. Otherwise it will fail with another error
76 // code such as EFAULT.
77 //
78 // Note that there's no need to check for FS_IOC_REMOVE_ENCRYPTION_KEY,
79 // since it's guaranteed to be available if FS_IOC_ADD_ENCRYPTION_KEY is.
80 // There's also no need to check for support on external volumes separately
81 // from /data, since either the kernel supports the ioctls on all
82 // fscrypt-capable filesystems or it doesn't.
83 errno = 0;
84 (void)ioctl(fd, FS_IOC_ADD_ENCRYPTION_KEY, NULL);
85 if (errno == ENOTTY) {
86 LOG(INFO) << "Kernel doesn't support FS_IOC_ADD_ENCRYPTION_KEY. Falling back to "
87 "session keyring";
88 return false;
89 }
90 if (errno != EFAULT) {
91 PLOG(WARNING) << "Unexpected error from FS_IOC_ADD_ENCRYPTION_KEY";
92 }
93 LOG(DEBUG) << "Detected support for FS_IOC_ADD_ENCRYPTION_KEY";
94 android::base::SetProperty("ro.crypto.uses_fs_ioc_add_encryption_key", "true");
95 return true;
96}
97
Eric Biggersf3dc4202019-09-30 13:05:58 -070098// Return true if the kernel supports the ioctls to add/remove fscrypt keys
99// directly to/from the filesystem.
100bool isFsKeyringSupported(void) {
Eric Biggers7604eb92020-07-16 14:29:59 -0700101 static bool supported = isFsKeyringSupportedImpl();
Eric Biggersf3dc4202019-09-30 13:05:58 -0700102 return supported;
103}
104
Paul Crowleyf71ace32016-06-02 11:01:19 -0700105// Get raw keyref - used to make keyname and to pass to ioctl
Eric Biggersba997ee2018-10-23 13:07:43 -0700106static std::string generateKeyRef(const uint8_t* key, int length) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700107 SHA512_CTX c;
108
109 SHA512_Init(&c);
110 SHA512_Update(&c, key, length);
111 unsigned char key_ref1[SHA512_DIGEST_LENGTH];
112 SHA512_Final(key_ref1, &c);
113
114 SHA512_Init(&c);
115 SHA512_Update(&c, key_ref1, SHA512_DIGEST_LENGTH);
116 unsigned char key_ref2[SHA512_DIGEST_LENGTH];
117 SHA512_Final(key_ref2, &c);
118
Eric Biggers506342f2019-12-17 13:11:25 -0800119 static_assert(FSCRYPT_KEY_DESCRIPTOR_SIZE <= SHA512_DIGEST_LENGTH,
120 "Hash too short for descriptor");
121 return std::string((char*)key_ref2, FSCRYPT_KEY_DESCRIPTOR_SIZE);
Paul Crowleyf71ace32016-06-02 11:01:19 -0700122}
123
Eric Biggersa701c452018-10-23 13:06:55 -0700124static bool fillKey(const KeyBuffer& key, fscrypt_key* fs_key) {
Eric Biggers506342f2019-12-17 13:11:25 -0800125 if (key.size() != FSCRYPT_MAX_KEY_SIZE) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700126 LOG(ERROR) << "Wrong size key " << key.size();
127 return false;
128 }
Eric Biggers506342f2019-12-17 13:11:25 -0800129 static_assert(FSCRYPT_MAX_KEY_SIZE == sizeof(fs_key->raw), "Mismatch of max key sizes");
130 fs_key->mode = 0; // unused by kernel
Eric Biggersa701c452018-10-23 13:06:55 -0700131 memcpy(fs_key->raw, key.data(), key.size());
Eric Biggers506342f2019-12-17 13:11:25 -0800132 fs_key->size = key.size();
Paul Crowleyf71ace32016-06-02 11:01:19 -0700133 return true;
134}
135
Paul Crowley14c8c072018-09-18 13:30:21 -0700136static char const* const NAME_PREFIXES[] = {"ext4", "f2fs", "fscrypt", nullptr};
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700137
Eric Biggersf3dc4202019-09-30 13:05:58 -0700138static std::string keyrefstring(const std::string& raw_ref) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700139 std::ostringstream o;
Chen, Luhai5744dfe2017-08-18 14:49:45 +0800140 for (unsigned char i : raw_ref) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700141 o << std::hex << std::setw(2) << std::setfill('0') << (int)i;
142 }
143 return o.str();
144}
145
Eric Biggersf3dc4202019-09-30 13:05:58 -0700146static std::string buildLegacyKeyName(const std::string& prefix, const std::string& raw_ref) {
147 return prefix + ":" + keyrefstring(raw_ref);
148}
149
150// Get the ID of the keyring we store all fscrypt keys in when the kernel is too
151// old to support FS_IOC_ADD_ENCRYPTION_KEY and FS_IOC_REMOVE_ENCRYPTION_KEY.
Eric Biggersa701c452018-10-23 13:06:55 -0700152static bool fscryptKeyring(key_serial_t* device_keyring) {
153 *device_keyring = keyctl_search(KEY_SPEC_SESSION_KEYRING, "keyring", "fscrypt", 0);
Paul Crowleyf71ace32016-06-02 11:01:19 -0700154 if (*device_keyring == -1) {
155 PLOG(ERROR) << "Unable to find device keyring";
156 return false;
157 }
158 return true;
159}
160
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000161// Add an encryption key of type "logon" to the global session keyring.
Eric Biggersf3dc4202019-09-30 13:05:58 -0700162static bool installKeyLegacy(const KeyBuffer& key, const std::string& raw_ref) {
Eric Biggersa701c452018-10-23 13:06:55 -0700163 // Place fscrypt_key into automatically zeroing buffer.
164 KeyBuffer fsKeyBuffer(sizeof(fscrypt_key));
165 fscrypt_key& fs_key = *reinterpret_cast<fscrypt_key*>(fsKeyBuffer.data());
Pavel Grafove2e2d302017-08-01 17:15:53 +0100166
Eric Biggersa701c452018-10-23 13:06:55 -0700167 if (!fillKey(key, &fs_key)) return false;
Paul Crowleyf71ace32016-06-02 11:01:19 -0700168 key_serial_t device_keyring;
Eric Biggersa701c452018-10-23 13:06:55 -0700169 if (!fscryptKeyring(&device_keyring)) return false;
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700170 for (char const* const* name_prefix = NAME_PREFIXES; *name_prefix != nullptr; name_prefix++) {
Eric Biggersf3dc4202019-09-30 13:05:58 -0700171 auto ref = buildLegacyKeyName(*name_prefix, raw_ref);
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700172 key_serial_t key_id =
Eric Biggersa701c452018-10-23 13:06:55 -0700173 add_key("logon", ref.c_str(), (void*)&fs_key, sizeof(fs_key), device_keyring);
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700174 if (key_id == -1) {
175 PLOG(ERROR) << "Failed to insert key into keyring " << device_keyring;
176 return false;
177 }
178 LOG(DEBUG) << "Added key " << key_id << " (" << ref << ") to keyring " << device_keyring
179 << " in process " << getpid();
Paul Crowleyf71ace32016-06-02 11:01:19 -0700180 }
Paul Crowleyf71ace32016-06-02 11:01:19 -0700181 return true;
182}
183
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000184// Installs fscrypt-provisioning key into session level kernel keyring.
185// This allows for the given key to be installed back into filesystem keyring.
186// For more context see reloadKeyFromSessionKeyring.
187static bool installProvisioningKey(const KeyBuffer& key, const std::string& ref,
188 const fscrypt_key_specifier& key_spec) {
189 key_serial_t device_keyring;
190 if (!fscryptKeyring(&device_keyring)) return false;
191
192 // Place fscrypt_provisioning_key_payload into automatically zeroing buffer.
193 KeyBuffer buf(sizeof(fscrypt_provisioning_key_payload) + key.size(), 0);
194 fscrypt_provisioning_key_payload& provisioning_key =
195 *reinterpret_cast<fscrypt_provisioning_key_payload*>(buf.data());
196 memcpy(provisioning_key.raw, key.data(), key.size());
197 provisioning_key.type = key_spec.type;
198
199 key_serial_t key_id = add_key("fscrypt-provisioning", ref.c_str(), (void*)&provisioning_key,
200 buf.size(), device_keyring);
201 if (key_id == -1) {
202 PLOG(ERROR) << "Failed to insert fscrypt-provisioning key for " << ref
203 << " into session keyring";
204 return false;
205 }
206 LOG(DEBUG) << "Added fscrypt-provisioning key for " << ref << " to session keyring";
207 return true;
208}
209
Eric Biggers83a73d72019-09-30 13:06:47 -0700210// Build a struct fscrypt_key_specifier for use in the key management ioctls.
Paul Crowley77df7f22020-01-23 15:29:30 -0800211static bool buildKeySpecifier(fscrypt_key_specifier* spec, const EncryptionPolicy& policy) {
212 switch (policy.options.version) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700213 case 1:
Paul Crowley77df7f22020-01-23 15:29:30 -0800214 if (policy.key_raw_ref.size() != FSCRYPT_KEY_DESCRIPTOR_SIZE) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700215 LOG(ERROR) << "Invalid key specifier size for v1 encryption policy: "
Paul Crowley77df7f22020-01-23 15:29:30 -0800216 << policy.key_raw_ref.size();
Eric Biggers83a73d72019-09-30 13:06:47 -0700217 return false;
218 }
219 spec->type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR;
Paul Crowley77df7f22020-01-23 15:29:30 -0800220 memcpy(spec->u.descriptor, policy.key_raw_ref.c_str(), FSCRYPT_KEY_DESCRIPTOR_SIZE);
Eric Biggers83a73d72019-09-30 13:06:47 -0700221 return true;
222 case 2:
Paul Crowley77df7f22020-01-23 15:29:30 -0800223 if (policy.key_raw_ref.size() != FSCRYPT_KEY_IDENTIFIER_SIZE) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700224 LOG(ERROR) << "Invalid key specifier size for v2 encryption policy: "
Paul Crowley77df7f22020-01-23 15:29:30 -0800225 << policy.key_raw_ref.size();
Eric Biggers83a73d72019-09-30 13:06:47 -0700226 return false;
227 }
228 spec->type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER;
Paul Crowley77df7f22020-01-23 15:29:30 -0800229 memcpy(spec->u.identifier, policy.key_raw_ref.c_str(), FSCRYPT_KEY_IDENTIFIER_SIZE);
Eric Biggers83a73d72019-09-30 13:06:47 -0700230 return true;
231 default:
Paul Crowley77df7f22020-01-23 15:29:30 -0800232 LOG(ERROR) << "Invalid encryption policy version: " << policy.options.version;
Eric Biggers83a73d72019-09-30 13:06:47 -0700233 return false;
234 }
235}
236
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000237// Installs key into keyring of a filesystem mounted on |mountpoint|.
238//
239// It's callers responsibility to fill key specifier, and either arg->raw or arg->key_id.
240//
241// In case arg->key_spec.type equals to FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER
242// arg->key_spec.u.identifier will be populated with raw key reference generated
243// by kernel.
244//
245// For documentation on difference between arg->raw and arg->key_id see
246// https://www.kernel.org/doc/html/latest/filesystems/fscrypt.html#fs-ioc-add-encryption-key
247static bool installFsKeyringKey(const std::string& mountpoint, const EncryptionOptions& options,
248 fscrypt_add_key_arg* arg) {
Eric Biggerse0217d72020-07-16 16:31:00 -0700249 if (options.use_hw_wrapped_key) arg->__flags |= __FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED;
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000250
251 android::base::unique_fd fd(open(mountpoint.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC));
252 if (fd == -1) {
253 PLOG(ERROR) << "Failed to open " << mountpoint << " to install key";
254 return false;
255 }
256
257 if (ioctl(fd, FS_IOC_ADD_ENCRYPTION_KEY, arg) != 0) {
258 PLOG(ERROR) << "Failed to install fscrypt key to " << mountpoint;
259 return false;
260 }
261
262 return true;
263}
264
Paul Crowley77df7f22020-01-23 15:29:30 -0800265bool installKey(const std::string& mountpoint, const EncryptionOptions& options,
266 const KeyBuffer& key, EncryptionPolicy* policy) {
267 policy->options = options;
Eric Biggersf3dc4202019-09-30 13:05:58 -0700268 // Put the fscrypt_add_key_arg in an automatically-zeroing buffer, since we
269 // have to copy the raw key into it.
270 KeyBuffer arg_buf(sizeof(struct fscrypt_add_key_arg) + key.size(), 0);
271 struct fscrypt_add_key_arg* arg = (struct fscrypt_add_key_arg*)arg_buf.data();
272
Eric Biggers83a73d72019-09-30 13:06:47 -0700273 // Initialize the "key specifier", which is like a name for the key.
Paul Crowley77df7f22020-01-23 15:29:30 -0800274 switch (options.version) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700275 case 1:
276 // A key for a v1 policy is specified by an arbitrary 8-byte
277 // "descriptor", which must be provided by userspace. We use the
278 // first 8 bytes from the double SHA-512 of the key itself.
Paul Crowley77df7f22020-01-23 15:29:30 -0800279 policy->key_raw_ref = generateKeyRef((const uint8_t*)key.data(), key.size());
Eric Biggers83a73d72019-09-30 13:06:47 -0700280 if (!isFsKeyringSupported()) {
Paul Crowley77df7f22020-01-23 15:29:30 -0800281 return installKeyLegacy(key, policy->key_raw_ref);
Eric Biggers83a73d72019-09-30 13:06:47 -0700282 }
Paul Crowley77df7f22020-01-23 15:29:30 -0800283 if (!buildKeySpecifier(&arg->key_spec, *policy)) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700284 return false;
285 }
286 break;
287 case 2:
288 // A key for a v2 policy is specified by an 16-byte "identifier",
289 // which is a cryptographic hash of the key itself which the kernel
290 // computes and returns. Any user-provided value is ignored; we
291 // just need to set the specifier type to indicate that we're adding
292 // this type of key.
293 arg->key_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER;
294 break;
295 default:
Paul Crowley77df7f22020-01-23 15:29:30 -0800296 LOG(ERROR) << "Invalid encryption policy version: " << options.version;
Eric Biggers83a73d72019-09-30 13:06:47 -0700297 return false;
298 }
Eric Biggersf3dc4202019-09-30 13:05:58 -0700299
300 arg->raw_size = key.size();
301 memcpy(arg->raw, key.data(), key.size());
302
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000303 if (!installFsKeyringKey(mountpoint, options, arg)) return false;
Eric Biggersf3dc4202019-09-30 13:05:58 -0700304
Eric Biggers83a73d72019-09-30 13:06:47 -0700305 if (arg->key_spec.type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) {
306 // Retrieve the key identifier that the kernel computed.
Paul Crowley77df7f22020-01-23 15:29:30 -0800307 policy->key_raw_ref =
308 std::string((char*)arg->key_spec.u.identifier, FSCRYPT_KEY_IDENTIFIER_SIZE);
Eric Biggers83a73d72019-09-30 13:06:47 -0700309 }
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000310 std::string ref = keyrefstring(policy->key_raw_ref);
311 LOG(DEBUG) << "Installed fscrypt key with ref " << ref << " to " << mountpoint;
312
313 if (!installProvisioningKey(key, ref, arg->key_spec)) return false;
Eric Biggersf3dc4202019-09-30 13:05:58 -0700314 return true;
315}
316
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000317// Remove an encryption key of type "logon" from the global session keyring.
Eric Biggersf3dc4202019-09-30 13:05:58 -0700318static bool evictKeyLegacy(const std::string& raw_ref) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700319 key_serial_t device_keyring;
Eric Biggersa701c452018-10-23 13:06:55 -0700320 if (!fscryptKeyring(&device_keyring)) return false;
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700321 bool success = true;
322 for (char const* const* name_prefix = NAME_PREFIXES; *name_prefix != nullptr; name_prefix++) {
Eric Biggersf3dc4202019-09-30 13:05:58 -0700323 auto ref = buildLegacyKeyName(*name_prefix, raw_ref);
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700324 auto key_serial = keyctl_search(device_keyring, "logon", ref.c_str(), 0);
Paul Crowleyf71ace32016-06-02 11:01:19 -0700325
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700326 // Unlink the key from the keyring. Prefer unlinking to revoking or
327 // invalidating, since unlinking is actually no less secure currently, and
328 // it avoids bugs in certain kernel versions where the keyring key is
329 // referenced from places it shouldn't be.
330 if (keyctl_unlink(key_serial, device_keyring) != 0) {
331 PLOG(ERROR) << "Failed to unlink key with serial " << key_serial << " ref " << ref;
332 success = false;
333 } else {
334 LOG(DEBUG) << "Unlinked key with serial " << key_serial << " ref " << ref;
335 }
Paul Crowleyf71ace32016-06-02 11:01:19 -0700336 }
Paul Crowleycd8bfe32017-06-19 16:05:55 -0700337 return success;
Paul Crowleyf71ace32016-06-02 11:01:19 -0700338}
339
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000340static bool evictProvisioningKey(const std::string& ref) {
341 key_serial_t device_keyring;
342 if (!fscryptKeyring(&device_keyring)) {
343 return false;
344 }
345
346 auto key_serial = keyctl_search(device_keyring, "fscrypt-provisioning", ref.c_str(), 0);
347 if (key_serial == -1 && errno != ENOKEY) {
348 PLOG(ERROR) << "Error searching session keyring for fscrypt-provisioning key for " << ref;
349 return false;
350 }
351
352 if (key_serial != -1 && keyctl_unlink(key_serial, device_keyring) != 0) {
353 PLOG(ERROR) << "Failed to unlink fscrypt-provisioning key for " << ref
354 << " from session keyring";
355 return false;
356 }
357 return true;
358}
359
Paul Crowley77df7f22020-01-23 15:29:30 -0800360bool evictKey(const std::string& mountpoint, const EncryptionPolicy& policy) {
361 if (policy.options.version == 1 && !isFsKeyringSupported()) {
362 return evictKeyLegacy(policy.key_raw_ref);
Eric Biggersf3dc4202019-09-30 13:05:58 -0700363 }
364
365 android::base::unique_fd fd(open(mountpoint.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC));
366 if (fd == -1) {
367 PLOG(ERROR) << "Failed to open " << mountpoint << " to evict key";
368 return false;
369 }
370
371 struct fscrypt_remove_key_arg arg;
372 memset(&arg, 0, sizeof(arg));
373
Paul Crowley77df7f22020-01-23 15:29:30 -0800374 if (!buildKeySpecifier(&arg.key_spec, policy)) {
Eric Biggers83a73d72019-09-30 13:06:47 -0700375 return false;
376 }
Eric Biggersf3dc4202019-09-30 13:05:58 -0700377
Paul Crowley77df7f22020-01-23 15:29:30 -0800378 std::string ref = keyrefstring(policy.key_raw_ref);
Eric Biggersf3dc4202019-09-30 13:05:58 -0700379
380 if (ioctl(fd, FS_IOC_REMOVE_ENCRYPTION_KEY, &arg) != 0) {
381 PLOG(ERROR) << "Failed to evict fscrypt key with ref " << ref << " from " << mountpoint;
382 return false;
383 }
384
385 LOG(DEBUG) << "Evicted fscrypt key with ref " << ref << " from " << mountpoint;
386 if (arg.removal_status_flags & FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS) {
387 // Should never happen because keys are only added/removed as root.
388 LOG(ERROR) << "Unexpected case: key with ref " << ref << " is still added by other users!";
389 } else if (arg.removal_status_flags & FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY) {
390 LOG(ERROR) << "Files still open after removing key with ref " << ref
391 << ". These files were not locked!";
392 }
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000393
394 if (!evictProvisioningKey(ref)) return false;
Eric Biggersf3dc4202019-09-30 13:05:58 -0700395 return true;
396}
397
Paul Crowley4eac2642020-02-12 11:04:05 -0800398bool retrieveOrGenerateKey(const std::string& key_path, const std::string& tmp_path,
399 const KeyAuthentication& key_authentication, const KeyGeneration& gen,
Eric Biggersf74373b2020-11-05 19:58:26 -0800400 KeyBuffer* key) {
Paul Crowleyf71ace32016-06-02 11:01:19 -0700401 if (pathExists(key_path)) {
402 LOG(DEBUG) << "Key exists, using: " << key_path;
Eric Biggersf74373b2020-11-05 19:58:26 -0800403 if (!retrieveKey(key_path, key_authentication, key)) return false;
Paul Crowleyd5759812016-06-02 11:04:27 -0700404 } else {
Paul Crowley4eac2642020-02-12 11:04:05 -0800405 if (!gen.allow_gen) {
Paul Crowley14c8c072018-09-18 13:30:21 -0700406 LOG(ERROR) << "No key found in " << key_path;
407 return false;
Paul Crowleyd5759812016-06-02 11:04:27 -0700408 }
409 LOG(INFO) << "Creating new key in " << key_path;
Paul Crowley4eac2642020-02-12 11:04:05 -0800410 if (!generateStorageKey(gen, key)) return false;
Paul Crowley77df7f22020-01-23 15:29:30 -0800411 if (!storeKeyAtomically(key_path, tmp_path, key_authentication, *key)) return false;
Paul Crowleyd5759812016-06-02 11:04:27 -0700412 }
413 return true;
414}
415
Nikita Ioffe1c6731c2020-02-28 19:50:31 +0000416bool reloadKeyFromSessionKeyring(const std::string& mountpoint, const EncryptionPolicy& policy) {
417 key_serial_t device_keyring;
418 if (!fscryptKeyring(&device_keyring)) {
419 return false;
420 }
421
422 std::string ref = keyrefstring(policy.key_raw_ref);
423 auto key_serial = keyctl_search(device_keyring, "fscrypt-provisioning", ref.c_str(), 0);
424 if (key_serial == -1) {
425 PLOG(ERROR) << "Failed to find fscrypt-provisioning key for " << ref
426 << " in session keyring";
427 return false;
428 }
429
430 LOG(DEBUG) << "Installing fscrypt-provisioning key for " << ref << " back into " << mountpoint
431 << " fs-keyring";
432
433 struct fscrypt_add_key_arg arg;
434 memset(&arg, 0, sizeof(arg));
435 if (!buildKeySpecifier(&arg.key_spec, policy)) return false;
436 arg.key_id = key_serial;
437 if (!installFsKeyringKey(mountpoint, policy.options, &arg)) return false;
438
439 return true;
440}
441
Paul Crowleyf71ace32016-06-02 11:01:19 -0700442} // namespace vold
443} // namespace android