server/internal-encryption.cpp

   1 /*
   2  *  Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *  Licensed under the Apache License, Version 2.0 (the "License");
   5  *  you may not use this file except in compliance with the License.
   6  *  You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *  Unless required by applicable law or agreed to in writing, software
  11  *  distributed under the License is distributed on an "AS IS" BASIS,
  12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *  See the License for the specific language governing permissions and
  14  *  limitations under the License
  15  */
  16 #include <set>
  17
  18 #include <signal.h>
  19 #include <unistd.h>
  20 #include <sys/mount.h>
  21 #include <sys/reboot.h>
  22
  23 #include <vconf.h>
  24 #include <klay/process.h>
  25 #include <klay/file-user.h>
  26 #include <klay/filesystem.h>
  27 #include <klay/dbus/connection.h>
  28 #include <klay/audit/logger.h>
  29
  30 #include "engine/dmcrypt-engine.h"
  31 #include "key-manager/key-manager.h"
  32
  33 #include "rmi/internal-encryption.h"
  34
  35 #define INTERNAL_STORAGE_PATH   "/opt/usr"
  36 #define INTERNAL_STORAGE_VCONF_KEY VCONFKEY_ODE_CRYPTO_STATE
  37
  38 namespace ode {
  39
  40 namespace {
  41
  42 VConfBackend vconfBackend(VCONFKEY_ODE_ENCRYPT_PROGRESS);
  43 ProgressBar progressBar(std::bind(&VConfBackend::update, &vconfBackend, std::placeholders::_1));
  44
  45 DMCryptEngine engine("/dev/mmcblk0p25", INTERNAL_STORAGE_PATH, progressBar);
  46
  47 void stopDependedSystemdServices()
  48 {
  49         dbus::Connection& systemDBus = dbus::Connection::getSystem();
  50         std::set<std::string> servicesToStop;
  51
  52         for (pid_t pid : runtime::FileUser::getList(INTERNAL_STORAGE_PATH, true)) {
  53                 try {
  54                         char *service;
  55                         systemDBus.methodcall("org.freedesktop.systemd1",
  56                                                                         "/org/freedesktop/systemd1",
  57                                                                         "org.freedesktop.systemd1.Manager",
  58                                                                         "GetUnitByPID",
  59                                                                         -1, "(o)", "(u)", (unsigned int)pid)
  60                                                                                 .get("(o)", &service);
  61                         servicesToStop.insert(service);
  62                 } catch (runtime::Exception &e) {
  63                         INFO("Close process - " + std::to_string(pid));
  64                         ::kill(pid, SIGKILL);
  65                 }
  66         }
  67
  68         for (const std::string& service : servicesToStop) {
  69                 INFO("Close service - " + service);
  70                 systemDBus.methodcall("org.freedesktop.systemd1",
  71                                                                 service,
  72                                                                 "org.freedesktop.systemd1.Unit",
  73                                                                 "Stop",
  74                                                                 -1, "", "(s)", "flush");
  75         }
  76 }
  77
  78 void showProgressUI(const std::string type) {
  79         std::vector<std::string> args = {
  80                 "ode-gui", "progress", type, "Internal"
  81         };
  82
  83         runtime::Process proc("/usr/bin/ode-gui", args);
  84         proc.execute();
  85 }
  86
  87 }
  88
  89 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
  90         context(ctx)
  91 {
  92         context.registerParametricMethod(this, "", (int)(InternalEncryption::mount)(std::string));
  93         context.registerNonparametricMethod(this, "", (int)(InternalEncryption::umount));
  94         context.registerParametricMethod(this, "", (int)(InternalEncryption::encrypt)(std::string));
  95         context.registerParametricMethod(this, "", (int)(InternalEncryption::decrypt)(std::string));
  96         context.registerParametricMethod(this, "", (int)(InternalEncryption::changePassword)(std::string, std::string));
  97         context.registerNonparametricMethod(this, "", (int)(InternalEncryption::getState));
  98 }
  99
 100 InternalEncryption::~InternalEncryption()
 101 {
 102 }
 103
 104 int InternalEncryption::mount(const std::string& password)
 105 {
 106         if (getState() != State::Encrypted) {
 107                 return -1;
 108         }
 109
 110         KeyManager::data pwData(password.begin(), password.end());
 111         KeyManager keyManager(engine.getKeyMeta());
 112
 113         if (!keyManager.verifyPassword(pwData)) {
 114                 return -2;
 115         }
 116
 117         engine.mount(keyManager.getMasterKey(pwData));
 118         return 0;
 119 }
 120
 121 int InternalEncryption::umount()
 122 {
 123         if (getState() != State::Encrypted) {
 124                 return -1;
 125         }
 126
 127         INFO("Close all processes using internal storage...");
 128         stopDependedSystemdServices();
 129         INFO("Umount internal storage...");
 130         engine.umount();
 131
 132         return 0;
 133 }
 134
 135 int InternalEncryption::encrypt(const std::string& password)
 136 {
 137         if (getState() != State::Unencrypted) {
 138                 return -1;
 139         }
 140
 141         KeyManager::data pwData(password.begin(), password.end());
 142         KeyManager keyManager;
 143
 144         keyManager.initPassword(pwData);
 145         engine.setKeyMeta(keyManager.serialize());
 146
 147         KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
 148         auto encryptWorker = [MasterKey, this]() {
 149                 showProgressUI("Encrypting");
 150
 151                 INFO("Close all processes using internal storage...");
 152                 stopDependedSystemdServices();
 153                 INFO("Umount internal storage...");
 154                 while (::umount(INTERNAL_STORAGE_PATH) == -1) {
 155                         if (errno != EBUSY) {
 156                                 break;
 157                         }
 158                 }
 159
 160                 INFO("Encryption started...");
 161                 ::vconf_set_str(INTERNAL_STORAGE_VCONF_KEY, "error_partially_encrypted");
 162                 engine.encrypt(MasterKey);
 163                 INFO("Sync disk...");
 164                 sync();
 165                 INFO("Encryption completed");
 166
 167                 ::vconf_set_str(INTERNAL_STORAGE_VCONF_KEY, "encrypted");
 168                 ::reboot(RB_AUTOBOOT);
 169         };
 170
 171         std::thread asyncWork(encryptWorker);
 172         asyncWork.detach();
 173
 174         return 0;
 175 }
 176
 177 int InternalEncryption::decrypt(const std::string& password)
 178 {
 179         if (getState() != State::Encrypted) {
 180                 return -1;
 181         }
 182
 183         KeyManager::data pwData(password.begin(), password.end());
 184         KeyManager keyManager(engine.getKeyMeta());
 185
 186         if (!keyManager.verifyPassword(pwData)) {
 187                 return -2;
 188         }
 189
 190         KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
 191         auto decryptWorker = [MasterKey, this]() {
 192                 showProgressUI("Decrypting");
 193
 194                 INFO("Close all processes using internal storage...");
 195                 stopDependedSystemdServices();
 196                 INFO("Umount internal storage...");
 197                 try {
 198                         engine.umount();
 199                 } catch (runtime::Exception& e) {}
 200
 201                 INFO("Decryption started...");
 202                 ::vconf_set_str(INTERNAL_STORAGE_VCONF_KEY, "error_partially_encrypted");
 203                 engine.decrypt(MasterKey);
 204                 INFO("Sync disk...");
 205                 sync();
 206                 INFO("Decryption completed");
 207
 208                 ::vconf_set_str(INTERNAL_STORAGE_VCONF_KEY, "unencrypted");
 209                 ::reboot(RB_AUTOBOOT);
 210         };
 211
 212         std::thread asyncWork(decryptWorker);
 213         asyncWork.detach();
 214
 215         return 0;
 216 }
 217
 218 int InternalEncryption::changePassword(const std::string& oldPassword,
 219                                                                                 const std::string& newPassword)
 220 {
 221         KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
 222         KeyManager::data newPwData(newPassword.begin(), newPassword.end());
 223         KeyManager keyManager(engine.getKeyMeta());
 224
 225         if (!keyManager.verifyPassword(oldPwData)) {
 226                 return -2;
 227         }
 228
 229         keyManager.changePassword(oldPwData, newPwData);
 230         engine.setKeyMeta(keyManager.serialize());
 231
 232         return 0;
 233 }
 234
 235 int InternalEncryption::getState()
 236 {
 237         char *value = ::vconf_get_str(INTERNAL_STORAGE_VCONF_KEY);
 238         if (value == NULL) {
 239                 throw runtime::Exception("Failed to get vconf value");
 240         }
 241
 242         std::string valueStr(value);
 243         free(value);
 244
 245         if (valueStr == "encrypted") {
 246                 return State::Encrypted;
 247         } else if (valueStr == "unencrypted") {
 248                 return State::Unencrypted;
 249         } else {
 250                 return State::Corrupted;
 251         }
 252
 253         return 0;
 254 }
 255
 256 } // namespace ode