| /* |
| * Copyright (C) 2016 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include "KeyUtil.h" |
| |
| #include <iomanip> |
| #include <sstream> |
| #include <string> |
| #include <thread> |
| |
| #include <fcntl.h> |
| #include <linux/fscrypt.h> |
| #include <openssl/sha.h> |
| #include <sys/ioctl.h> |
| |
| #include <android-base/file.h> |
| #include <android-base/logging.h> |
| #include <android-base/properties.h> |
| #include <keyutils.h> |
| |
| #include "KeyStorage.h" |
| #include "Utils.h" |
| |
| namespace android { |
| namespace vold { |
| |
| using android::fscrypt::EncryptionOptions; |
| using android::fscrypt::EncryptionPolicy; |
| |
| // This must be acquired before calling fscrypt ioctls that operate on keys. |
| // This prevents race conditions between evicting and reinstalling keys. |
| static std::mutex fscrypt_keyring_mutex; |
| |
| const KeyGeneration neverGen() { |
| return KeyGeneration{0, false, false}; |
| } |
| |
| static bool randomKey(size_t size, KeyBuffer* key) { |
| *key = KeyBuffer(size); |
| if (ReadRandomBytes(key->size(), key->data()) != 0) { |
| // TODO status_t plays badly with PLOG, fix it. |
| LOG(ERROR) << "Random read failed"; |
| return false; |
| } |
| return true; |
| } |
| |
| bool generateStorageKey(const KeyGeneration& gen, KeyBuffer* key) { |
| if (!gen.allow_gen) { |
| LOG(ERROR) << "Generating storage key not allowed"; |
| return false; |
| } |
| if (gen.use_hw_wrapped_key) { |
| if (gen.keysize != FSCRYPT_MAX_KEY_SIZE) { |
| LOG(ERROR) << "Cannot generate a wrapped key " << gen.keysize << " bytes long"; |
| return false; |
| } |
| LOG(DEBUG) << "Generating wrapped storage key"; |
| return generateWrappedStorageKey(key); |
| } else { |
| LOG(DEBUG) << "Generating standard storage key"; |
| return randomKey(gen.keysize, key); |
| } |
| } |
| |
| static bool isFsKeyringSupportedImpl() { |
| android::base::unique_fd fd(open("/data", O_RDONLY | O_DIRECTORY | O_CLOEXEC)); |
| |
| // FS_IOC_ADD_ENCRYPTION_KEY with a NULL argument will fail with ENOTTY if |
| // the ioctl isn't supported. Otherwise it will fail with another error |
| // code such as EFAULT. |
| // |
| // Note that there's no need to check for FS_IOC_REMOVE_ENCRYPTION_KEY, |
| // since it's guaranteed to be available if FS_IOC_ADD_ENCRYPTION_KEY is. |
| // There's also no need to check for support on external volumes separately |
| // from /data, since either the kernel supports the ioctls on all |
| // fscrypt-capable filesystems or it doesn't. |
| errno = 0; |
| (void)ioctl(fd, FS_IOC_ADD_ENCRYPTION_KEY, NULL); |
| if (errno == ENOTTY) { |
| LOG(INFO) << "Kernel doesn't support FS_IOC_ADD_ENCRYPTION_KEY. Falling back to " |
| "session keyring"; |
| return false; |
| } |
| if (errno != EFAULT) { |
| PLOG(WARNING) << "Unexpected error from FS_IOC_ADD_ENCRYPTION_KEY"; |
| } |
| LOG(DEBUG) << "Detected support for FS_IOC_ADD_ENCRYPTION_KEY"; |
| android::base::SetProperty("ro.crypto.uses_fs_ioc_add_encryption_key", "true"); |
| return true; |
| } |
| |
| // Return true if the kernel supports the ioctls to add/remove fscrypt keys |
| // directly to/from the filesystem. |
| bool isFsKeyringSupported(void) { |
| static bool supported = isFsKeyringSupportedImpl(); |
| return supported; |
| } |
| |
| // Get raw keyref - used to make keyname and to pass to ioctl |
| static std::string generateKeyRef(const uint8_t* key, int length) { |
| SHA512_CTX c; |
| |
| SHA512_Init(&c); |
| SHA512_Update(&c, key, length); |
| unsigned char key_ref1[SHA512_DIGEST_LENGTH]; |
| SHA512_Final(key_ref1, &c); |
| |
| SHA512_Init(&c); |
| SHA512_Update(&c, key_ref1, SHA512_DIGEST_LENGTH); |
| unsigned char key_ref2[SHA512_DIGEST_LENGTH]; |
| SHA512_Final(key_ref2, &c); |
| |
| static_assert(FSCRYPT_KEY_DESCRIPTOR_SIZE <= SHA512_DIGEST_LENGTH, |
| "Hash too short for descriptor"); |
| return std::string((char*)key_ref2, FSCRYPT_KEY_DESCRIPTOR_SIZE); |
| } |
| |
| static bool fillKey(const KeyBuffer& key, fscrypt_key* fs_key) { |
| if (key.size() != FSCRYPT_MAX_KEY_SIZE) { |
| LOG(ERROR) << "Wrong size key " << key.size(); |
| return false; |
| } |
| static_assert(FSCRYPT_MAX_KEY_SIZE == sizeof(fs_key->raw), "Mismatch of max key sizes"); |
| fs_key->mode = 0; // unused by kernel |
| memcpy(fs_key->raw, key.data(), key.size()); |
| fs_key->size = key.size(); |
| return true; |
| } |
| |
| static char const* const NAME_PREFIXES[] = {"ext4", "f2fs", "fscrypt", nullptr}; |
| |
| static std::string keyrefstring(const std::string& raw_ref) { |
| std::ostringstream o; |
| for (unsigned char i : raw_ref) { |
| o << std::hex << std::setw(2) << std::setfill('0') << (int)i; |
| } |
| return o.str(); |
| } |
| |
| static std::string buildLegacyKeyName(const std::string& prefix, const std::string& raw_ref) { |
| return prefix + ":" + keyrefstring(raw_ref); |
| } |
| |
| // Get the ID of the keyring we store all fscrypt keys in when the kernel is too |
| // old to support FS_IOC_ADD_ENCRYPTION_KEY and FS_IOC_REMOVE_ENCRYPTION_KEY. |
| static bool fscryptKeyring(key_serial_t* device_keyring) { |
| *device_keyring = keyctl_search(KEY_SPEC_SESSION_KEYRING, "keyring", "fscrypt", 0); |
| if (*device_keyring == -1) { |
| PLOG(ERROR) << "Unable to find device keyring"; |
| return false; |
| } |
| return true; |
| } |
| |
| // Add an encryption key of type "logon" to the global session keyring. |
| static bool installKeyLegacy(const KeyBuffer& key, const std::string& raw_ref) { |
| // Place fscrypt_key into automatically zeroing buffer. |
| KeyBuffer fsKeyBuffer(sizeof(fscrypt_key)); |
| fscrypt_key& fs_key = *reinterpret_cast<fscrypt_key*>(fsKeyBuffer.data()); |
| |
| if (!fillKey(key, &fs_key)) return false; |
| key_serial_t device_keyring; |
| if (!fscryptKeyring(&device_keyring)) return false; |
| for (char const* const* name_prefix = NAME_PREFIXES; *name_prefix != nullptr; name_prefix++) { |
| auto ref = buildLegacyKeyName(*name_prefix, raw_ref); |
| key_serial_t key_id = |
| add_key("logon", ref.c_str(), (void*)&fs_key, sizeof(fs_key), device_keyring); |
| if (key_id == -1) { |
| PLOG(ERROR) << "Failed to insert key into keyring " << device_keyring; |
| return false; |
| } |
| LOG(DEBUG) << "Added key " << key_id << " (" << ref << ") to keyring " << device_keyring |
| << " in process " << getpid(); |
| } |
| return true; |
| } |
| |
| // Installs fscrypt-provisioning key into session level kernel keyring. |
| // This allows for the given key to be installed back into filesystem keyring. |
| // For more context see reloadKeyFromSessionKeyring. |
| static bool installProvisioningKey(const KeyBuffer& key, const std::string& ref, |
| const fscrypt_key_specifier& key_spec) { |
| key_serial_t device_keyring; |
| if (!fscryptKeyring(&device_keyring)) return false; |
| |
| // Place fscrypt_provisioning_key_payload into automatically zeroing buffer. |
| KeyBuffer buf(sizeof(fscrypt_provisioning_key_payload) + key.size(), 0); |
| fscrypt_provisioning_key_payload& provisioning_key = |
| *reinterpret_cast<fscrypt_provisioning_key_payload*>(buf.data()); |
| memcpy(provisioning_key.raw, key.data(), key.size()); |
| provisioning_key.type = key_spec.type; |
| |
| key_serial_t key_id = add_key("fscrypt-provisioning", ref.c_str(), (void*)&provisioning_key, |
| buf.size(), device_keyring); |
| if (key_id == -1) { |
| PLOG(ERROR) << "Failed to insert fscrypt-provisioning key for " << ref |
| << " into session keyring"; |
| return false; |
| } |
| LOG(DEBUG) << "Added fscrypt-provisioning key for " << ref << " to session keyring"; |
| return true; |
| } |
| |
| // Build a struct fscrypt_key_specifier for use in the key management ioctls. |
| static bool buildKeySpecifier(fscrypt_key_specifier* spec, const EncryptionPolicy& policy) { |
| switch (policy.options.version) { |
| case 1: |
| if (policy.key_raw_ref.size() != FSCRYPT_KEY_DESCRIPTOR_SIZE) { |
| LOG(ERROR) << "Invalid key specifier size for v1 encryption policy: " |
| << policy.key_raw_ref.size(); |
| return false; |
| } |
| spec->type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR; |
| memcpy(spec->u.descriptor, policy.key_raw_ref.c_str(), FSCRYPT_KEY_DESCRIPTOR_SIZE); |
| return true; |
| case 2: |
| if (policy.key_raw_ref.size() != FSCRYPT_KEY_IDENTIFIER_SIZE) { |
| LOG(ERROR) << "Invalid key specifier size for v2 encryption policy: " |
| << policy.key_raw_ref.size(); |
| return false; |
| } |
| spec->type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; |
| memcpy(spec->u.identifier, policy.key_raw_ref.c_str(), FSCRYPT_KEY_IDENTIFIER_SIZE); |
| return true; |
| default: |
| LOG(ERROR) << "Invalid encryption policy version: " << policy.options.version; |
| return false; |
| } |
| } |
| |
| // Installs key into keyring of a filesystem mounted on |mountpoint|. |
| // |
| // It's callers responsibility to fill key specifier, and either arg->raw or arg->key_id. |
| // |
| // In case arg->key_spec.type equals to FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER |
| // arg->key_spec.u.identifier will be populated with raw key reference generated |
| // by kernel. |
| // |
| // For documentation on difference between arg->raw and arg->key_id see |
| // https://www.kernel.org/doc/html/latest/filesystems/fscrypt.html#fs-ioc-add-encryption-key |
| static bool installFsKeyringKey(const std::string& mountpoint, const EncryptionOptions& options, |
| fscrypt_add_key_arg* arg) { |
| if (options.use_hw_wrapped_key) arg->__flags |= __FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED; |
| |
| android::base::unique_fd fd(open(mountpoint.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC)); |
| if (fd == -1) { |
| PLOG(ERROR) << "Failed to open " << mountpoint << " to install key"; |
| return false; |
| } |
| |
| if (ioctl(fd, FS_IOC_ADD_ENCRYPTION_KEY, arg) != 0) { |
| PLOG(ERROR) << "Failed to install fscrypt key to " << mountpoint; |
| return false; |
| } |
| |
| return true; |
| } |
| |
| bool installKey(const std::string& mountpoint, const EncryptionOptions& options, |
| const KeyBuffer& key, EncryptionPolicy* policy) { |
| const std::lock_guard<std::mutex> lock(fscrypt_keyring_mutex); |
| policy->options = options; |
| // Put the fscrypt_add_key_arg in an automatically-zeroing buffer, since we |
| // have to copy the raw key into it. |
| KeyBuffer arg_buf(sizeof(struct fscrypt_add_key_arg) + key.size(), 0); |
| struct fscrypt_add_key_arg* arg = (struct fscrypt_add_key_arg*)arg_buf.data(); |
| |
| // Initialize the "key specifier", which is like a name for the key. |
| switch (options.version) { |
| case 1: |
| // A key for a v1 policy is specified by an arbitrary 8-byte |
| // "descriptor", which must be provided by userspace. We use the |
| // first 8 bytes from the double SHA-512 of the key itself. |
| policy->key_raw_ref = generateKeyRef((const uint8_t*)key.data(), key.size()); |
| if (!isFsKeyringSupported()) { |
| return installKeyLegacy(key, policy->key_raw_ref); |
| } |
| if (!buildKeySpecifier(&arg->key_spec, *policy)) { |
| return false; |
| } |
| break; |
| case 2: |
| // A key for a v2 policy is specified by an 16-byte "identifier", |
| // which is a cryptographic hash of the key itself which the kernel |
| // computes and returns. Any user-provided value is ignored; we |
| // just need to set the specifier type to indicate that we're adding |
| // this type of key. |
| arg->key_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; |
| break; |
| default: |
| LOG(ERROR) << "Invalid encryption policy version: " << options.version; |
| return false; |
| } |
| |
| arg->raw_size = key.size(); |
| memcpy(arg->raw, key.data(), key.size()); |
| |
| if (!installFsKeyringKey(mountpoint, options, arg)) return false; |
| |
| if (arg->key_spec.type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) { |
| // Retrieve the key identifier that the kernel computed. |
| policy->key_raw_ref = |
| std::string((char*)arg->key_spec.u.identifier, FSCRYPT_KEY_IDENTIFIER_SIZE); |
| } |
| std::string ref = keyrefstring(policy->key_raw_ref); |
| LOG(DEBUG) << "Installed fscrypt key with ref " << ref << " to " << mountpoint; |
| |
| if (!installProvisioningKey(key, ref, arg->key_spec)) return false; |
| return true; |
| } |
| |
| // Remove an encryption key of type "logon" from the global session keyring. |
| static bool evictKeyLegacy(const std::string& raw_ref) { |
| key_serial_t device_keyring; |
| if (!fscryptKeyring(&device_keyring)) return false; |
| bool success = true; |
| for (char const* const* name_prefix = NAME_PREFIXES; *name_prefix != nullptr; name_prefix++) { |
| auto ref = buildLegacyKeyName(*name_prefix, raw_ref); |
| auto key_serial = keyctl_search(device_keyring, "logon", ref.c_str(), 0); |
| |
| // Unlink the key from the keyring. Prefer unlinking to revoking or |
| // invalidating, since unlinking is actually no less secure currently, and |
| // it avoids bugs in certain kernel versions where the keyring key is |
| // referenced from places it shouldn't be. |
| if (keyctl_unlink(key_serial, device_keyring) != 0) { |
| PLOG(ERROR) << "Failed to unlink key with serial " << key_serial << " ref " << ref; |
| success = false; |
| } else { |
| LOG(DEBUG) << "Unlinked key with serial " << key_serial << " ref " << ref; |
| } |
| } |
| return success; |
| } |
| |
| static bool evictProvisioningKey(const std::string& ref) { |
| key_serial_t device_keyring; |
| if (!fscryptKeyring(&device_keyring)) { |
| return false; |
| } |
| |
| auto key_serial = keyctl_search(device_keyring, "fscrypt-provisioning", ref.c_str(), 0); |
| if (key_serial == -1 && errno != ENOKEY) { |
| PLOG(ERROR) << "Error searching session keyring for fscrypt-provisioning key for " << ref; |
| return false; |
| } |
| |
| if (key_serial != -1 && keyctl_unlink(key_serial, device_keyring) != 0) { |
| PLOG(ERROR) << "Failed to unlink fscrypt-provisioning key for " << ref |
| << " from session keyring"; |
| return false; |
| } |
| return true; |
| } |
| |
| static void waitForBusyFiles(const struct fscrypt_key_specifier key_spec, const std::string ref, |
| const std::string mountpoint) { |
| android::base::unique_fd fd(open(mountpoint.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC)); |
| if (fd == -1) { |
| PLOG(ERROR) << "Failed to open " << mountpoint << " to evict key"; |
| return; |
| } |
| |
| std::chrono::milliseconds wait_time(3200); |
| std::chrono::milliseconds total_wait_time(0); |
| while (wait_time <= std::chrono::milliseconds(51200)) { |
| total_wait_time += wait_time; |
| std::this_thread::sleep_for(wait_time); |
| |
| const std::lock_guard<std::mutex> lock(fscrypt_keyring_mutex); |
| |
| struct fscrypt_get_key_status_arg get_arg; |
| memset(&get_arg, 0, sizeof(get_arg)); |
| get_arg.key_spec = key_spec; |
| |
| if (ioctl(fd, FS_IOC_GET_ENCRYPTION_KEY_STATUS, &get_arg) != 0) { |
| PLOG(ERROR) << "Failed to get status for fscrypt key with ref " << ref << " from " |
| << mountpoint; |
| return; |
| } |
| if (get_arg.status != FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED) { |
| LOG(DEBUG) << "Key status changed, cancelling busy file cleanup for key with ref " |
| << ref << "."; |
| return; |
| } |
| |
| struct fscrypt_remove_key_arg remove_arg; |
| memset(&remove_arg, 0, sizeof(remove_arg)); |
| remove_arg.key_spec = key_spec; |
| |
| if (ioctl(fd, FS_IOC_REMOVE_ENCRYPTION_KEY, &remove_arg) != 0) { |
| PLOG(ERROR) << "Failed to clean up busy files for fscrypt key with ref " << ref |
| << " from " << mountpoint; |
| return; |
| } |
| if (remove_arg.removal_status_flags & FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS) { |
| // Should never happen because keys are only added/removed as root. |
| LOG(ERROR) << "Unexpected case: key with ref " << ref |
| << " is still added by other users!"; |
| } else if (!(remove_arg.removal_status_flags & |
| FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY)) { |
| LOG(INFO) << "Successfully cleaned up busy files for key with ref " << ref |
| << ". After waiting " << total_wait_time.count() << "ms."; |
| return; |
| } |
| LOG(WARNING) << "Files still open after waiting " << total_wait_time.count() |
| << "ms. Key with ref " << ref << " still has unlocked files!"; |
| wait_time *= 2; |
| } |
| LOG(ERROR) << "Waiting for files to close never completed. Files using key with ref " << ref |
| << " were not locked!"; |
| } |
| |
| bool evictKey(const std::string& mountpoint, const EncryptionPolicy& policy) { |
| const std::lock_guard<std::mutex> lock(fscrypt_keyring_mutex); |
| if (policy.options.version == 1 && !isFsKeyringSupported()) { |
| return evictKeyLegacy(policy.key_raw_ref); |
| } |
| |
| android::base::unique_fd fd(open(mountpoint.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC)); |
| if (fd == -1) { |
| PLOG(ERROR) << "Failed to open " << mountpoint << " to evict key"; |
| return false; |
| } |
| |
| struct fscrypt_remove_key_arg arg; |
| memset(&arg, 0, sizeof(arg)); |
| |
| if (!buildKeySpecifier(&arg.key_spec, policy)) { |
| return false; |
| } |
| |
| std::string ref = keyrefstring(policy.key_raw_ref); |
| |
| if (ioctl(fd, FS_IOC_REMOVE_ENCRYPTION_KEY, &arg) != 0) { |
| PLOG(ERROR) << "Failed to evict fscrypt key with ref " << ref << " from " << mountpoint; |
| return false; |
| } |
| |
| LOG(DEBUG) << "Evicted fscrypt key with ref " << ref << " from " << mountpoint; |
| if (arg.removal_status_flags & FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS) { |
| // Should never happen because keys are only added/removed as root. |
| LOG(ERROR) << "Unexpected case: key with ref " << ref << " is still added by other users!"; |
| } else if (arg.removal_status_flags & FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY) { |
| LOG(WARNING) |
| << "Files still open after removing key with ref " << ref |
| << ". These files were not locked! Punting busy file clean up to worker thread."; |
| // Processes are killed asynchronously in ActivityManagerService due to performance issues |
| // with synchronous kills. If there were busy files they will probably be killed soon. Wait |
| // for them asynchronously. |
| std::thread busyFilesThread(waitForBusyFiles, arg.key_spec, ref, mountpoint); |
| busyFilesThread.detach(); |
| } |
| |
| if (!evictProvisioningKey(ref)) return false; |
| return true; |
| } |
| |
| bool retrieveOrGenerateKey(const std::string& key_path, const std::string& tmp_path, |
| const KeyAuthentication& key_authentication, const KeyGeneration& gen, |
| KeyBuffer* key) { |
| if (pathExists(key_path)) { |
| LOG(DEBUG) << "Key exists, using: " << key_path; |
| if (!retrieveKey(key_path, key_authentication, key)) return false; |
| } else { |
| if (!gen.allow_gen) { |
| LOG(ERROR) << "No key found in " << key_path; |
| return false; |
| } |
| LOG(INFO) << "Creating new key in " << key_path; |
| if (!generateStorageKey(gen, key)) return false; |
| if (!storeKeyAtomically(key_path, tmp_path, key_authentication, *key)) return false; |
| } |
| return true; |
| } |
| |
| bool reloadKeyFromSessionKeyring(const std::string& mountpoint, const EncryptionPolicy& policy) { |
| key_serial_t device_keyring; |
| if (!fscryptKeyring(&device_keyring)) { |
| return false; |
| } |
| |
| std::string ref = keyrefstring(policy.key_raw_ref); |
| auto key_serial = keyctl_search(device_keyring, "fscrypt-provisioning", ref.c_str(), 0); |
| if (key_serial == -1) { |
| PLOG(ERROR) << "Failed to find fscrypt-provisioning key for " << ref |
| << " in session keyring"; |
| return false; |
| } |
| |
| LOG(DEBUG) << "Installing fscrypt-provisioning key for " << ref << " back into " << mountpoint |
| << " fs-keyring"; |
| |
| struct fscrypt_add_key_arg arg; |
| memset(&arg, 0, sizeof(arg)); |
| if (!buildKeySpecifier(&arg.key_spec, policy)) return false; |
| arg.key_id = key_serial; |
| if (!installFsKeyringKey(mountpoint, policy.options, &arg)) return false; |
| |
| return true; |
| } |
| |
| } // namespace vold |
| } // namespace android |
