2 * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
22 #include <sys/mount.h>
23 #include <sys/reboot.h>
24 #include <sys/inotify.h>
27 #include <tzplatform_config.h>
28 #include <klay/process.h>
29 #include <klay/file-user.h>
30 #include <klay/filesystem.h>
31 #include <klay/dbus/connection.h>
35 #include "progress-bar.h"
36 #include "engine/encryption/dmcrypt-engine.h"
37 #include "key-manager/key-manager.h"
39 #include "rmi/internal-encryption.h"
41 #define INTERNAL_ENGINE DMCryptEngine
42 #define INTERNAL_DEV_PATH "/dev/disk/by-partlabel"
43 #define INTERNAL_DEV_NAME "USER"
44 #define INTERNAL_PATH "/opt/usr"
45 #define INTERNAL_STATE_VCONF_KEY VCONFKEY_ODE_CRYPTO_STATE
46 #define INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY VCONFKEY_ODE_FAST_ENCRYPTION
48 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
50 const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
51 const std::vector<std::string> wipeCommand = {
56 "--dest=com.samsung.factoryreset",
57 "/com/samsung/factoryreset",
58 "com.samsung.factoryreset.start.setting"
65 std::unique_ptr<INTERNAL_ENGINE> engine;
66 KeyManager::data mountKey;
68 void stopDependedSystemdServices()
70 runtime::File fileToTouch("/tmp/.ode-umount-internal");
73 } catch(runtime::Exception &e) {}
74 fileToTouch.create(O_WRONLY);
79 void killDependedProcesses()
81 INFO(SINK, "killDependedProcesses");
82 for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
83 INFO(SINK, "Close process - " + std::to_string(pid));
84 int ret = ::kill(pid, SIGKILL);
85 INFO(SINK, "Ret - " + std::to_string(ret));
89 void showProgressUI(const std::string type) {
90 runtime::File fileToTouch("/tmp/.ode-progress-internal@" + type);
93 } catch(runtime::Exception &e) {}
94 fileToTouch.create(O_WRONLY);
97 unsigned int getOptions()
99 unsigned int result = 0;
103 ::vconf_get_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, &value);
105 result |= InternalEncryption::Option::IncludeUnusedRegion;
111 void setOptions(unsigned int options)
115 if (options & InternalEncryption::Option::IncludeUnusedRegion) {
120 ::vconf_set_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, value);
125 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
128 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::setMountPassword)(std::string));
129 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::mount)());
130 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::umount)());
131 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::encrypt)(std::string, unsigned int));
132 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::decrypt)(std::string));
133 context.expose(this, "", (int)(InternalEncryption::isPasswordInitialized)());
134 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::initPassword)(std::string));
135 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::cleanPassword)(std::string));
136 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::changePassword)(std::string, std::string));
137 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::verifyPassword)(std::string));
138 context.expose(this, "", (int)(InternalEncryption::getState)());
139 context.expose(this, "", (unsigned int)(InternalEncryption::getSupportedOptions)());
141 context.createNotification("InternalEncryption::mount");
143 std::string source = INTERNAL_DEV_PATH "/" INTERNAL_DEV_NAME;
145 runtime::DirectoryIterator iter(INTERNAL_DEV_PATH), end;
147 while (iter != end) {
148 const std::string& path = (*iter).getPath();
149 std::string name = path.substr(path.rfind('/') + 1);
151 upper.reserve(name.size());
152 for (char c : name) {
153 upper += std::toupper(c);
155 if (upper == INTERNAL_DEV_NAME) {
161 } catch (runtime::Exception &e) {}
163 engine.reset(new INTERNAL_ENGINE(
164 source, INTERNAL_PATH,
165 ProgressBar([](int v) {
166 ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
167 std::to_string(v).c_str());
172 InternalEncryption::~InternalEncryption()
176 int InternalEncryption::setMountPassword(const std::string& password)
178 KeyManager::data pwData(password.begin(), password.end());
179 KeyManager keyManager(engine->getKeyMeta());
180 if (!keyManager.verifyPassword(pwData)) {
184 ode::mountKey = keyManager.getMasterKey(pwData);
189 int InternalEncryption::mount()
191 if (getState() != State::Encrypted) {
195 if (engine->isMounted()) {
196 INFO(SINK, "Already mounted");
200 engine->mount(mountKey, getOptions());
203 context.notify("InternalEncryption::mount");
205 runtime::File("/tmp/.lazy_mount").create(O_WRONLY);
206 runtime::File("/tmp/.unlock_mnt").create(O_WRONLY);
211 int InternalEncryption::umount()
213 if (getState() != State::Encrypted) {
217 if (!engine->isMounted()) {
218 INFO(SINK, "Already umounted");
222 INFO(SINK, "Close all processes that use internal storage...");
223 stopDependedSystemdServices();
224 killDependedProcesses();
225 INFO(SINK, "Umount internal storage...");
231 int InternalEncryption::encrypt(const std::string& password, unsigned int options)
233 if (getState() != State::Unencrypted) {
237 KeyManager::data pwData(password.begin(), password.end());
238 KeyManager keyManager(engine->getKeyMeta());
240 if (!keyManager.verifyPassword(pwData)) {
244 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
245 auto encryptWorker = [MasterKey, options, this]() {
247 INFO(SINK, "Close all processes that use internal storage...");
248 stopDependedSystemdServices();
249 killDependedProcesses();
250 INFO(SINK, "Umount internal storage...");
251 while (::umount(INTERNAL_PATH) == -1) {
252 if (errno != EBUSY) {
253 throw runtime::Exception("Umount error - " + std::to_string(errno));
255 killDependedProcesses();
258 showProgressUI("Encrypting");
260 INFO(SINK, "Encryption started...");
261 engine->encrypt(MasterKey, options);
262 setOptions(options & getSupportedOptions());
263 INFO(SINK, "Sync disk...");
265 INFO(SINK, "Encryption completed");
267 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "encrypted");
268 context.notify("InternalEncryption::mount");
269 ::reboot(RB_AUTOBOOT);
270 } catch (runtime::Exception &e) {
271 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
272 ERROR(SINK, "Encryption failed - " + std::string(e.what()));
276 std::thread asyncWork(encryptWorker);
282 int InternalEncryption::decrypt(const std::string& password)
284 if (getState() != State::Encrypted) {
288 KeyManager::data pwData(password.begin(), password.end());
289 KeyManager keyManager(engine->getKeyMeta());
291 if (!keyManager.verifyPassword(pwData)) {
295 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
296 auto decryptWorker = [MasterKey, this]() {
298 INFO(SINK, "Umount internal storage...");
299 stopDependedSystemdServices();
300 killDependedProcesses();
301 INFO(SINK, "Umount internal storage...");
306 } catch (runtime::Exception& e) {
307 killDependedProcesses();
311 showProgressUI("Decrypting");
313 INFO(SINK, "Decryption started...");
314 engine->decrypt(MasterKey, getOptions());
315 INFO(SINK, "Sync disk...");
317 INFO(SINK, "Decryption completed");
319 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "unencrypted");
320 ::reboot(RB_AUTOBOOT);
321 } catch (runtime::Exception &e) {
322 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
323 ERROR(SINK, "Decryption failed - " + std::string(e.what()));
327 std::thread asyncWork(decryptWorker);
333 int InternalEncryption::recovery()
335 if (getState() != State::Unencrypted) {
340 runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
341 if (proc.execute() == -1) {
342 ERROR(SINK, "Failed to launch factory-reset");
349 int InternalEncryption::isPasswordInitialized()
351 if (engine->isKeyMetaSet()) {
357 int InternalEncryption::initPassword(const std::string& password)
359 KeyManager::data pwData(password.begin(), password.end());
360 KeyManager keyManager;
362 keyManager.initPassword(pwData);
363 engine->setKeyMeta(keyManager.serialize());
367 int InternalEncryption::cleanPassword(const std::string& password)
369 KeyManager::data pwData(password.begin(), password.end());
370 KeyManager keyManager(engine->getKeyMeta());
372 if (!keyManager.verifyPassword(pwData)) {
376 engine->clearKeyMeta();
380 int InternalEncryption::changePassword(const std::string& oldPassword,
381 const std::string& newPassword)
383 KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
384 KeyManager::data newPwData(newPassword.begin(), newPassword.end());
385 KeyManager keyManager(engine->getKeyMeta());
387 if (!keyManager.verifyPassword(oldPwData)) {
391 keyManager.changePassword(oldPwData, newPwData);
392 engine->setKeyMeta(keyManager.serialize());
397 int InternalEncryption::verifyPassword(const std::string& password)
399 KeyManager::data pwData(password.begin(), password.end());
400 KeyManager keyManager(engine->getKeyMeta());
402 if (keyManager.verifyPassword(pwData)) {
408 int InternalEncryption::getState()
410 char *value = ::vconf_get_str(INTERNAL_STATE_VCONF_KEY);
412 throw runtime::Exception("Failed to get vconf value");
415 std::string valueStr(value);
418 if (valueStr == "encrypted") {
419 return State::Encrypted;
420 } else if (valueStr == "unencrypted") {
421 return State::Unencrypted;
423 return State::Corrupted;
429 unsigned int InternalEncryption::getSupportedOptions()
431 return engine->getSupportedOptions();