Add APIs to wait the mount of storage
[platform/core/security/ode.git] / server / internal-encryption.cpp
1 /*
2  *  Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
3  *
4  *  Licensed under the Apache License, Version 2.0 (the "License");
5  *  you may not use this file except in compliance with the License.
6  *  You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  *  Unless required by applicable law or agreed to in writing, software
11  *  distributed under the License is distributed on an "AS IS" BASIS,
12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  *  See the License for the specific language governing permissions and
14  *  limitations under the License
15  */
16 #include <set>
17
18 #include <signal.h>
19 #include <unistd.h>
20 #include <sys/mount.h>
21 #include <sys/reboot.h>
22
23 #include <vconf.h>
24 #include <tzplatform_config.h>
25 #include <klay/process.h>
26 #include <klay/file-user.h>
27 #include <klay/filesystem.h>
28 #include <klay/dbus/connection.h>
29 #include <klay/audit/logger.h>
30
31 #include "vconf.h"
32 #include "progress-bar.h"
33 #include "engine/encryption/dmcrypt-engine.h"
34 #include "key-manager/key-manager.h"
35
36 #include "rmi/internal-encryption.h"
37
38 #define INTERNAL_ENGINE DMCryptEngine
39 #define INTERNAL_DEV    "/dev/mmcblk0p25"
40 #define INTERNAL_PATH   "/opt/usr"
41 #define INTERNAL_STATE_VCONF_KEY                                        VCONFKEY_ODE_CRYPTO_STATE
42 #define INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY      VCONFKEY_ODE_FAST_ENCRYPTION
43
44 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
45
46 const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
47 const std::vector<std::string> wipeCommand = {
48     PROG_FACTORY_RESET,
49     "--system",
50     "--type=signal",
51     "--print-reply",
52     "--dest=com.samsung.factoryreset",
53     "/com/samsung/factoryreset",
54     "com.samsung.factoryreset.start.setting"
55 };
56
57 namespace ode {
58
59 namespace {
60
61 std::unique_ptr<INTERNAL_ENGINE> engine;
62
63 void stopSystemdUserSessions() {
64         std::vector<std::string> userSessionServices;
65         dbus::Connection& systemDBus = dbus::Connection::getSystem();
66         dbus::VariantIterator iter;
67
68         systemDBus.methodcall("org.freedesktop.systemd1",
69                                                         "/org/freedesktop/systemd1",
70                                                         "org.freedesktop.systemd1.Manager",
71                                                         "ListUnits",
72                                                         -1, "(a(ssssssouso))", "")
73                                                                 .get("(a(ssssssouso))", &iter);
74
75         while (1) {
76                 unsigned int dataUint;
77                 char *dataStr[9];
78                 int ret;
79
80                 ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
81                                                 dataStr + 3, dataStr + 4, dataStr + 5,
82                                                 dataStr + 6, &dataUint, dataStr + 7,
83                                                 dataStr + 8);
84
85                 if (!ret) {
86                         break;
87                 }
88
89                 std::string service(dataStr[0]);
90                 if (service.compare(0, 5, "user@") == 0) {
91                         userSessionServices.push_back(service);
92                 }
93         }
94
95         for (const std::string& service : userSessionServices) {
96                 INFO("Stop service - " + service);
97                 systemDBus.methodcall("org.freedesktop.systemd1",
98                                                                 "/org/freedesktop/systemd1",
99                                                                 "org.freedesktop.systemd1.Manager",
100                                                                 "StopUnit",
101                                                                 -1, "", "(ss)", service.c_str(), "flush");
102         }
103
104         sleep(1);
105 }
106
107 void stopDependedSystemdServices()
108 {
109         dbus::Connection& systemDBus = dbus::Connection::getSystem();
110         std::set<std::string> servicesToStop;
111
112         for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
113                 try {
114                         char *service;
115                         systemDBus.methodcall("org.freedesktop.systemd1",
116                                                                         "/org/freedesktop/systemd1",
117                                                                         "org.freedesktop.systemd1.Manager",
118                                                                         "GetUnitByPID",
119                                                                         -1, "(o)", "(u)", (unsigned int)pid)
120                                                                                 .get("(o)", &service);
121                         servicesToStop.insert(service);
122                 } catch (runtime::Exception &e) {
123                         INFO("Close process - " + std::to_string(pid));
124                         ::kill(pid, SIGKILL);
125                 }
126         }
127
128         for (const std::string& service : servicesToStop) {
129                 INFO("Close service - " + service);
130                 systemDBus.methodcall("org.freedesktop.systemd1",
131                                                                 service,
132                                                                 "org.freedesktop.systemd1.Unit",
133                                                                 "Stop",
134                                                                 -1, "", "(s)", "flush");
135         }
136 }
137
138 void showProgressUI(const std::string type) {
139         ::tzplatform_set_user(::tzplatform_getuid(TZ_SYS_DEFAULT_USER));
140         std::string defaultUserHome(::tzplatform_getenv(TZ_USER_HOME));
141         ::tzplatform_reset_user();
142
143         try {
144                 runtime::File shareDirectory("/opt/home/root/share");
145                 if (!shareDirectory.exists()) {
146                         shareDirectory.makeDirectory(true);
147                 }
148
149                 runtime::File elmConfigDir(shareDirectory.getPath() + "/.elementary");
150                 if (!elmConfigDir.exists()) {
151                         runtime::File defaultElmConfigDir(defaultUserHome + "/share/.elementary");
152                         defaultElmConfigDir.copyTo(shareDirectory.getPath());
153                 }
154         } catch (runtime::Exception &e) {
155                 ERROR("Failed to set up elm configuration");
156         }
157
158         std::vector<std::string> args = {
159                 "ode", "progress", type, "Internal"
160         };
161
162         runtime::Process proc("/usr/bin/ode", args);
163         proc.execute();
164 }
165
166 unsigned int getOptions()
167 {
168         unsigned int result = 0;
169         int value;
170
171         value = 0;
172         ::vconf_get_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, &value);
173         if (value) {
174                 result |= InternalEncryption::Option::IncludeUnusedRegion;
175         }
176
177         return result;
178 }
179
180 void setOptions(unsigned int options)
181 {
182         bool value;
183
184         if (options & InternalEncryption::Option::IncludeUnusedRegion) {
185                 value = true;
186         } else {
187                 value = false;
188         }
189         ::vconf_set_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, value);
190 }
191
192 }
193
194 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
195         context(ctx)
196 {
197         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::mount)(std::string));
198         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::umount)());
199         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::encrypt)(std::string, unsigned int));
200         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::decrypt)(std::string));
201         context.expose(this, "", (int)(InternalEncryption::isPasswordInitialized)());
202         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::initPassword)(std::string));
203         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::cleanPassword)(std::string));
204         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::changePassword)(std::string, std::string));
205         context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::verifyPassword)(std::string));
206         context.expose(this, "", (int)(InternalEncryption::getState)());
207         context.expose(this, "", (unsigned int)(InternalEncryption::getSupportedOptions)());
208
209         context.createNotification("InternalEncryption::mount");
210
211         engine.reset(new INTERNAL_ENGINE(
212                 INTERNAL_DEV, INTERNAL_PATH,
213                 ProgressBar([](int v) {
214                         ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
215                                                         std::to_string(v).c_str());
216                 })
217         ));
218 }
219
220 InternalEncryption::~InternalEncryption()
221 {
222 }
223
224 int InternalEncryption::mount(const std::string& password)
225 {
226         if (getState() != State::Encrypted) {
227                 return -1;
228         }
229
230         KeyManager::data pwData(password.begin(), password.end());
231         KeyManager keyManager(engine->getKeyMeta());
232
233         if (!keyManager.verifyPassword(pwData)) {
234                 return -2;
235         }
236
237         engine->mount(keyManager.getMasterKey(pwData), getOptions());
238         context.notify("InternalEncryption::mount");
239
240         return 0;
241 }
242
243 int InternalEncryption::umount()
244 {
245         if (getState() != State::Encrypted) {
246                 return -1;
247         }
248
249         INFO("Close all processes using internal storage...");
250         stopDependedSystemdServices();
251         INFO("Umount internal storage...");
252         engine->umount();
253
254         return 0;
255 }
256
257 int InternalEncryption::encrypt(const std::string& password, unsigned int options)
258 {
259         if (getState() != State::Unencrypted) {
260                 return -1;
261         }
262
263         KeyManager::data pwData(password.begin(), password.end());
264         KeyManager keyManager(engine->getKeyMeta());
265
266         if (!keyManager.verifyPassword(pwData)) {
267                 return -2;
268         }
269
270         KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
271         auto encryptWorker = [MasterKey, options, this]() {
272                 try {
273                         INFO("Close all user sessions...");
274                         stopSystemdUserSessions();
275                         INFO("Close all processes using internal storage...");
276                         stopDependedSystemdServices();
277                         INFO("Umount internal storage...");
278                         while (::umount(INTERNAL_PATH) == -1) {
279                                 if (errno != EBUSY) {
280                                         throw runtime::Exception("Umount error - " + std::to_string(errno));
281                                 }
282                                 stopDependedSystemdServices();
283                         }
284
285                         showProgressUI("Encrypting");
286
287                         INFO("Encryption started...");
288                         engine->encrypt(MasterKey, options);
289                         setOptions(options & getSupportedOptions());
290                         INFO("Sync disk...");
291                         sync();
292                         INFO("Encryption completed");
293
294                         ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "encrypted");
295                         ::reboot(RB_AUTOBOOT);
296                 } catch (runtime::Exception &e) {
297                         ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
298                         ERROR("Encryption failed - " + std::string(e.what()));
299                 }
300         };
301
302         std::thread asyncWork(encryptWorker);
303         asyncWork.detach();
304
305         return 0;
306 }
307
308 int InternalEncryption::decrypt(const std::string& password)
309 {
310         if (getState() != State::Encrypted) {
311                 return -1;
312         }
313
314         KeyManager::data pwData(password.begin(), password.end());
315         KeyManager keyManager(engine->getKeyMeta());
316
317         if (!keyManager.verifyPassword(pwData)) {
318                 return -2;
319         }
320
321         KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
322         auto decryptWorker = [MasterKey, this]() {
323                 try {
324                         INFO("Close all user sessions...");
325                         stopSystemdUserSessions();
326                         INFO("Close all processes using internal storage...");
327                         stopDependedSystemdServices();
328                         INFO("Umount internal storage...");
329                         while (1) {
330                                 try {
331                                         engine->umount();
332                                         break;
333                                 } catch (runtime::Exception& e) {
334                                         stopDependedSystemdServices();
335                                 }
336                         }
337
338                         showProgressUI("Decrypting");
339
340                         INFO("Decryption started...");
341                         engine->decrypt(MasterKey, getOptions());
342                         INFO("Sync disk...");
343                         sync();
344                         INFO("Decryption completed");
345
346                         ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "unencrypted");
347                         ::reboot(RB_AUTOBOOT);
348                 } catch (runtime::Exception &e) {
349                         ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
350                         ERROR("Decryption failed - " + std::string(e.what()));
351                 }
352         };
353
354         std::thread asyncWork(decryptWorker);
355         asyncWork.detach();
356
357         return 0;
358 }
359
360 int InternalEncryption::recovery()
361 {
362         if (getState() != State::Unencrypted) {
363                 return -1;
364         }
365
366         //TODO
367         runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
368         if (proc.execute() == -1) {
369                 ERROR("Failed to launch factory-reset");
370                 return -2;
371         }
372
373         return 0;
374 }
375
376 int InternalEncryption::isPasswordInitialized()
377 {
378         if (engine->isKeyMetaSet()) {
379                 return 1;
380         }
381         return 0;
382 }
383
384 int InternalEncryption::initPassword(const std::string& password)
385 {
386         KeyManager::data pwData(password.begin(), password.end());
387         KeyManager keyManager;
388
389         keyManager.initPassword(pwData);
390         engine->setKeyMeta(keyManager.serialize());
391         return 0;
392 }
393
394 int InternalEncryption::cleanPassword(const std::string& password)
395 {
396         KeyManager::data pwData(password.begin(), password.end());
397         KeyManager keyManager(engine->getKeyMeta());
398
399         if (!keyManager.verifyPassword(pwData)) {
400                 return -2;
401         }
402
403         engine->clearKeyMeta();
404         return 0;
405 }
406
407 int InternalEncryption::changePassword(const std::string& oldPassword,
408                                                                                 const std::string& newPassword)
409 {
410         KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
411         KeyManager::data newPwData(newPassword.begin(), newPassword.end());
412         KeyManager keyManager(engine->getKeyMeta());
413
414         if (!keyManager.verifyPassword(oldPwData)) {
415                 return -2;
416         }
417
418         keyManager.changePassword(oldPwData, newPwData);
419         engine->setKeyMeta(keyManager.serialize());
420
421         return 0;
422 }
423
424 int InternalEncryption::verifyPassword(const std::string& password)
425 {
426         KeyManager::data pwData(password.begin(), password.end());
427         KeyManager keyManager(engine->getKeyMeta());
428
429         if (keyManager.verifyPassword(pwData)) {
430                 return 1;
431         }
432         return 0;
433 }
434
435 int InternalEncryption::getState()
436 {
437         char *value = ::vconf_get_str(INTERNAL_STATE_VCONF_KEY);
438         if (value == NULL) {
439                 throw runtime::Exception("Failed to get vconf value");
440         }
441
442         std::string valueStr(value);
443         free(value);
444
445         if (valueStr == "encrypted") {
446                 return State::Encrypted;
447         } else if (valueStr == "unencrypted") {
448                 return State::Unencrypted;
449         } else {
450                 return State::Corrupted;
451         }
452
453         return 0;
454 }
455
456 unsigned int InternalEncryption::getSupportedOptions()
457 {
458         return engine->getSupportedOptions();
459 }
460
461 } // namespace ode