server/internal-encryption.cpp

   1 /*
   2  *  Copyright (c) 2015-2017 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *  Licensed under the Apache License, Version 2.0 (the "License");
   5  *  you may not use this file except in compliance with the License.
   6  *  You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *  Unless required by applicable law or agreed to in writing, software
  11  *  distributed under the License is distributed on an "AS IS" BASIS,
  12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *  See the License for the specific language governing permissions and
  14  *  limitations under the License
  15  */
  16 #include <set>
  17 #include <algorithm>
  18 #include <memory>
  19 #include <mutex>
  20 #include <condition_variable>
  21 #include <list>
  22
  23 #include <fstream>
  24 #include <fcntl.h>
  25 #include <signal.h>
  26 #include <unistd.h>
  27 #include <sys/mount.h>
  28 #include <sys/reboot.h>
  29 #include <limits.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32
  33 #include <vconf.h>
  34 #include <tzplatform_config.h>
  35 #include <device/power.h>
  36 #include <klay/process.h>
  37 #include <klay/file-user.h>
  38 #include <klay/filesystem.h>
  39 #include <klay/dbus/connection.h>
  40 #include <klay/error.h>
  41
  42 #include "misc.h"
  43 #include "logger.h"
  44 #include "progress-bar.h"
  45 #include "rmi/common.h"
  46
  47 #include "ext4-tool.h"
  48 #include "internal-encryption.h"
  49 #include "internal-encryption-common.h"
  50 #include "upgrade-support.h"
  51
  52 namespace ode {
  53
  54 namespace {
  55
  56 const char *PRIVILEGE_PLATFORM  = "http://tizen.org/privilege/internal/default/platform";
  57
  58 // watches systemd jobs
  59 class JobWatch {
  60 public:
  61         explicit JobWatch(dbus::Connection& systemDBus);
  62         ~JobWatch();
  63
  64         bool waitForJob(const std::string& job);
  65
  66 private:
  67         void jobRemoved(const dbus::Variant& parameters);
  68
  69         struct Job {
  70                 Job(uint32_t id,
  71                         const std::string& job,
  72                         const std::string& unit,
  73                         const std::string& result) : id(id), job(job), unit(unit), result(result) {}
  74                 uint32_t id;
  75                 std::string job;
  76                 std::string unit;
  77                 std::string result;
  78         };
  79
  80         dbus::Connection::SubscriptionId id;
  81         dbus::Connection& systemDBus;
  82         std::list<Job> removedJobs;
  83         std::mutex jobsMutex;
  84         std::condition_variable jobsCv;
  85 };
  86
  87 JobWatch::JobWatch(dbus::Connection& systemDBus) : systemDBus(systemDBus) {
  88         auto callback = [this](dbus::Variant parameters) {
  89                 this->jobRemoved(parameters);
  90         };
  91
  92         id = systemDBus.subscribeSignal("",
  93                                                                         "/org/freedesktop/systemd1",
  94                                                                         "org.freedesktop.systemd1.Manager",
  95                                                                         "JobRemoved",
  96                                                                         callback);
  97 }
  98
  99 JobWatch::~JobWatch() {
 100         systemDBus.unsubscribeSignal(id);
 101 }
 102
 103 bool JobWatch::waitForJob(const std::string& job) {
 104         while(true) {
 105                 std::unique_lock<std::mutex> lock(jobsMutex);
 106                 bool timeout = true;
 107                 auto sec = std::chrono::seconds(1);
 108                 jobsCv.wait_for(lock, 5*sec, [this, &timeout]{
 109                                 if (!removedJobs.empty()) {
 110                                         timeout = false;
 111                                         return true;
 112                                 }
 113                                 return false;});
 114
 115                 if (timeout) {
 116                         INFO(SINK, "job: " + job + ", result: time out");
 117                         return false;
 118                 }
 119
 120                 while(!removedJobs.empty()) {
 121                         bool match = (removedJobs.front().job == job);
 122                         bool done = (removedJobs.front().result == "done");
 123                         removedJobs.pop_front();
 124                         if (match)
 125                                 return done;
 126                 }
 127         };
 128 }
 129
 130 void JobWatch::jobRemoved(const dbus::Variant& parameters)
 131 {
 132         uint32_t id;
 133         const char* job;
 134         const char* unit;
 135         const char* result;
 136         parameters.get("(uoss)", &id, &job, &unit, &result);
 137         INFO(SINK, "id:" + std::to_string(id) + " job:" + job + " unit:" + unit + " result:" + result);
 138
 139         {
 140                 std::lock_guard<std::mutex> guard(jobsMutex);
 141                 removedJobs.emplace_back(id, job, unit, result);
 142         }
 143         jobsCv.notify_one();
 144 }
 145
 146 std::string getDecodedPath(const std::string &path, const std::string &prefix)
 147 {
 148         std::string ret = path;
 149         size_t pos = 0;
 150
 151         pos = ret.find(prefix);
 152         if (pos != std::string::npos)
 153                 ret = ret.substr(prefix.size(), ret.size());
 154
 155         pos = 0;
 156         while ((pos = ret.find("_", pos)) != std::string::npos) {
 157                 int a = std::stoi(std::string(1, ret.at(pos+1)), nullptr, 16);
 158                 int b = std::stoi(std::string(1, ret.at(pos+2)), nullptr, 16);
 159                 if (a < 0 || b < 0)
 160                         ret.replace(pos, 3, "_");
 161                 else
 162                         ret.replace(pos, 3, std::string(1, ((a << 4) | b)));
 163                 pos += 1;
 164         }
 165         return ret;
 166 }
 167
 168 void stopSystemdUnits()
 169 {
 170         dbus::Connection& systemDBus = dbus::Connection::getSystem();
 171         dbus::VariantIterator iter;
 172         std::vector<std::string> preprocessUnits;
 173         std::set<std::string> unitsToStop;
 174
 175         auto stopUnit = [&systemDBus](const std::string &unit) {
 176                 JobWatch watch(systemDBus);
 177                 INFO(SINK, "Stopping unit: " + unit);
 178                 const char* job = NULL;
 179                 try {
 180                         systemDBus.methodcall("org.freedesktop.systemd1",
 181                                                                         "/org/freedesktop/systemd1",
 182                                                                         "org.freedesktop.systemd1.Manager",
 183                                                                         "StopUnit",
 184                                                                         -1, "(o)", "(ss)", unit.c_str(), "flush").get("(o)", &job);
 185                         INFO(SINK, "Waiting for job: " + std::string(job));
 186                         if (!watch.waitForJob(job))
 187                                 ERROR(SINK, "Stopping unit: " + unit + " failed");
 188                 } catch (runtime::Exception &e) {
 189                         ERROR(SINK, std::string(e.what()));
 190                 }
 191         };
 192
 193         try {
 194                 systemDBus.methodcall("org.freedesktop.systemd1",
 195                                                                 "/org/freedesktop/systemd1",
 196                                                                 "org.freedesktop.systemd1.Manager",
 197                                                                 "ListUnits",
 198                                                                 -1, "(a(ssssssouso))", "").get("(a(ssssssouso))", &iter);
 199         } catch (runtime::Exception &e) {
 200                 INFO(SINK, "Get list of systemd unit : " + std::string(e.what()));
 201         }
 202
 203         while (1) {
 204                 unsigned int dataUnit;
 205                 char *dataStr[9];
 206                 int ret;
 207                 ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
 208                                                 dataStr + 3, dataStr + 4, dataStr + 5,
 209                                                 dataStr + 6, &dataUnit, dataStr + 7, dataStr + 8);
 210                 if (!ret)
 211                         break;
 212
 213                 std::string unitName(dataStr[0]);
 214                 if (unitName == "security-manager.socket" ||
 215                                 unitName == "connman.socket" ||
 216                                 unitName == "msg-server.socket") {
 217                         preprocessUnits.insert(preprocessUnits.begin(), unitName);
 218                 } else if (unitName.compare(0, 5, "user@") == 0 ||
 219                                 unitName == "tlm.service" ||
 220                                 unitName == "resourced.service" ||
 221                                 unitName == "security-manager.service") {
 222                         preprocessUnits.push_back(unitName);
 223                 }
 224         }
 225
 226         for (auto unit : preprocessUnits) {
 227                 stopUnit(unit);
 228         }
 229
 230         for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
 231                 try {
 232                         char *unit = nullptr;
 233                         systemDBus.methodcall("org.freedesktop.systemd1",
 234                                                                         "/org/freedesktop/systemd1",
 235                                                                         "org.freedesktop.systemd1.Manager",
 236                                                                         "GetUnitByPID",
 237                                                                         -1, "(o)", "(u)", (unsigned int)pid)
 238                                                                                 .get("(o)", &unit);
 239
 240                         auto unescapedName = getDecodedPath(unit, "/org/freedesktop/systemd1/unit/");
 241                         unitsToStop.insert(unescapedName);
 242                 } catch (runtime::Exception &e) {
 243                         INFO(SINK, "Killing process: " + std::to_string(pid));
 244                         ::kill(pid, SIGKILL);
 245                 }
 246         }
 247
 248         for (auto unit : unitsToStop) {
 249                 stopUnit(unit);
 250         }
 251 }
 252
 253 void showProgressUI(const std::string type)
 254 {
 255         dbus::Connection& systemDBus = dbus::Connection::getSystem();
 256         std::string unit("ode-progress-ui@"+type+".service");
 257
 258         JobWatch watch(systemDBus);
 259         INFO(SINK, "Start unit: " + unit);
 260
 261         const char* job = NULL;
 262         systemDBus.methodcall("org.freedesktop.systemd1",
 263                                                         "/org/freedesktop/systemd1",
 264                                                         "org.freedesktop.systemd1.Manager",
 265                                                         "StartUnit",
 266                                                         -1, "(o)", "(ss)", unit.c_str(), "replace").get("(o)", &job);
 267
 268         INFO(SINK, "Waiting for job: " + std::string(job));
 269         if (!watch.waitForJob(job))
 270                 ERROR(SINK, "Starting unit: " + unit + " failed");
 271 }
 272
 273 unsigned int getOptions()
 274 {
 275         unsigned int result = 0;
 276         int value;
 277
 278         value = 0;
 279         ::vconf_get_bool(VCONFKEY_ODE_FAST_ENCRYPTION, &value);
 280         if (value) {
 281                 result |= InternalEncryption::Option::IncludeUnusedRegion;
 282         }
 283
 284         return result;
 285 }
 286
 287 void setOptions(unsigned int options)
 288 {
 289         bool value;
 290
 291         if (options & InternalEncryption::Option::IncludeUnusedRegion) {
 292                 value = true;
 293         } else {
 294                 value = false;
 295         }
 296         ::vconf_set_bool(VCONFKEY_ODE_FAST_ENCRYPTION, value);
 297 }
 298
 299 void execAndWait(const std::string &path, std::vector<std::string> &args)
 300 {
 301         runtime::Process proc(path, args);
 302         int ret = proc.execute();
 303         if (ret < 0)
 304                 ERROR(SINK, path + " failed for " + args.back());
 305
 306         ret = proc.waitForFinished();
 307         if (ret < 0 || !WIFEXITED(ret) || WEXITSTATUS(ret) != 0)
 308                 ERROR(SINK, path + " failed for " + args.back());
 309 }
 310
 311 bool isPartitionTerminated(const std::string &partition)
 312 {
 313         bool ret = true;
 314         const std::string cmd("fuser -m " + partition + " | grep -o '[0-9]*'");
 315         char *line = nullptr;
 316         size_t len = 0;
 317
 318         FILE *fp = ::popen(cmd.c_str(), "r");
 319         if (fp == nullptr) {
 320                 ERROR(SINK, "Failed to get processes on partition");
 321                 return false;
 322         }
 323
 324         if (::getline(&line, &len, fp) != -1)
 325                 ret = false;
 326
 327         ::free(line);
 328         ::pclose(fp);
 329
 330         return ret;
 331 }
 332
 333 void unmountInternalStorage(const std::string& source)
 334 {
 335         if (::umount2("/opt/usr", MNT_DETACH) == -1) {
 336                 if (errno != EBUSY && errno != EINVAL) {
 337                         throw runtime::Exception("umount() error : " + runtime::GetSystemErrorMessage());
 338                 }
 339         }
 340
 341         do {
 342                 ::sync();
 343                 static const char *fuserPath = "/usr/bin/fuser";
 344                 std::vector<std::string> args = {
 345                         fuserPath, "-m", "-k", "-s", "-SIGTERM", source,
 346                 };
 347                 execAndWait(fuserPath, args);
 348                 ::usleep((useconds_t)((unsigned int)(500)*1000));
 349
 350                 args[4] = "-SIGKILL";
 351                 execAndWait(fuserPath, args);
 352                 ::usleep((useconds_t)((unsigned int)(200)*1000));
 353         } while (!isPartitionTerminated(source));
 354 }
 355
 356 }
 357
 358 InternalEncryptionServer::InternalEncryptionServer(ServerContext& srv,
 359                                                                                                    KeyServer& key) :
 360         server(srv),
 361         keyServer(key)
 362 {
 363         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::setMountPassword)(std::string));
 364         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::mount)(std::vector<unsigned char>, unsigned int));
 365         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::umount)());
 366         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::isMounted)());
 367         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::encrypt)(std::string, unsigned int));
 368         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::decrypt)(std::string));
 369         server.expose(this, "", (int)(InternalEncryptionServer::isPasswordInitialized)());
 370         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::recovery)());
 371         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::initPassword)(std::string));
 372         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::cleanPassword)(std::string));
 373         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::changePassword)(std::string, std::string));
 374         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::verifyPassword)(std::string));
 375         server.expose(this, "", (int)(InternalEncryptionServer::getState)());
 376         server.expose(this, "", (unsigned int)(InternalEncryptionServer::getSupportedOptions)());
 377         server.expose(this, "", (std::string)(InternalEncryptionServer::getDevicePath)());
 378
 379         server.createNotification("InternalEncryptionServer::mount");
 380
 381         std::string source = findDevPath();
 382
 383         engine.reset(new INTERNAL_ENGINE(
 384                 source, INTERNAL_PATH,
 385                 ProgressBar([](int v) {
 386                         ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
 387                                                         std::to_string(v).c_str());
 388                 })
 389         ));
 390 }
 391
 392 InternalEncryptionServer::~InternalEncryptionServer()
 393 {
 394 }
 395
 396 int InternalEncryptionServer::migrateMasterKey(const std::string& dev, const std::string& password)
 397 {
 398         try {
 399                 BinaryData masterKey = UpgradeSupport::loadMasterKey(dev);
 400
 401                 // encrypt the master key with given password
 402                 return keyServer.changePassword2(dev, masterKey, password);
 403         } catch (const runtime::Exception&) {
 404                 INFO("Failed to load the master key stored during upgrade.");
 405         }
 406
 407         return error::Unknown;
 408 }
 409
 410 int InternalEncryptionServer::setMountPassword(const std::string& password)
 411 {
 412         const std::string& dev = engine->getSource();
 413
 414         // check if upgrade flag exists
 415         if (UpgradeSupport::checkUpgradeFlag()) {
 416                 INFO("Upgrade flag detected.");
 417
 418                 int rc = migrateMasterKey(dev, password);
 419                 if (rc != error::None)
 420                         return rc;
 421                 UpgradeSupport::removeUpgradeFlag();
 422         }
 423
 424         return keyServer.get(dev, password, mountKey);
 425 }
 426
 427 int InternalEncryptionServer::mount(const std::vector<unsigned char> &mk, unsigned int options)
 428 {
 429         if (mountKey.empty() && mk.empty()) {
 430                 ERROR(SINK, "You need to set master key first.");
 431                 return error::NoData;
 432         }
 433
 434         BinaryData key = mk.empty() ? mountKey : mk;
 435         mountKey.clear();
 436
 437         if (getState() != State::Encrypted) {
 438                 INFO(SINK, "Cannot mount, SD partition's state incorrect.");
 439                 return error::NoSuchDevice;
 440         }
 441
 442         if (engine->isMounted()) {
 443                 INFO(SINK, "Partition already mounted.");
 444                 return error::None;
 445         }
 446
 447         INFO(SINK, "Mounting internal storage.");
 448         try {
 449                 engine->mount(key, getOptions());
 450
 451                 server.notify("InternalEncryptionServer::mount");
 452
 453                 runtime::File("/tmp/.lazy_mount").create(O_WRONLY);
 454                 runtime::File("/tmp/.unlock_mnt").create(O_WRONLY);
 455         } catch (runtime::Exception &e) {
 456                 ERROR(SINK, "Mount failed: " + std::string(e.what()));
 457                 return error::Unknown;
 458         }
 459
 460         return error::None;
 461 }
 462
 463 int InternalEncryptionServer::isMounted()
 464 {
 465         int ret = 0;
 466         try {
 467                 ret = engine->isMounted() ? 1 : 0;
 468         } catch (runtime::Exception &e) {
 469                 ERROR(SINK, "Failed to access the mount flag");
 470                 return error::Unknown;
 471         }
 472         return ret;
 473 }
 474
 475 int InternalEncryptionServer::umount()
 476 {
 477         if (getState() != State::Encrypted) {
 478                 ERROR(SINK, "Cannot umount, partition's state incorrect.");
 479                 return error::NoSuchDevice;
 480         }
 481
 482         if (!engine->isMounted()) {
 483                 INFO(SINK, "Partition already umounted.");
 484                 return error::None;
 485         }
 486
 487         INFO(SINK, "Closing all processes using internal storage.");
 488         try {
 489                 stopSystemdUnits();
 490                 INFO(SINK, "Umounting internal storage.");
 491                 unmountInternalStorage("/dev/mapper/userdata");
 492                 engine->umount();
 493         } catch (runtime::Exception &e) {
 494                 ERROR(SINK, "Umount failed: " + std::string(e.what()));
 495                 return error::Unknown;
 496         }
 497
 498         return error::None;
 499 }
 500
 501 int InternalEncryptionServer::encrypt(const std::string& password, unsigned int options)
 502 {
 503         if (getState() != State::Unencrypted) {
 504                 ERROR(SINK, "Cannot encrypt, partition's state incorrect.");
 505                 return error::NoSuchDevice;
 506         }
 507
 508         BinaryData masterKey;
 509         int ret = keyServer.get(engine->getSource(), password, masterKey);
 510         if (ret != error::None)
 511                 return ret;
 512
 513         auto encryptWorker = [masterKey, options, this]() {
 514                 try {
 515                         if (::device_power_request_lock(POWER_LOCK_DISPLAY, 0) != 0)
 516                                 ERROR(SINK, "Failed to request to lock display");
 517
 518                         showProgressUI("encrypt");
 519                         ::sleep(1);
 520
 521                         runtime::File file("/opt/etc/.odeprogress");
 522                         file.create(0640);
 523
 524                         std::string source = engine->getSource();
 525                         auto mntPaths = findMountPointsByDevice(source);
 526
 527                         if (!mntPaths.empty()) {
 528                                 INFO(SINK, "Closing all processes using internal storage.");
 529                                 stopSystemdUnits();
 530
 531                                 INFO(SINK, "Unmounting internal storage.");
 532                                 unmountInternalStorage(source);
 533                         }
 534
 535                         INFO(SINK, "Encryption started.");
 536                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "error_partially_encrypted");
 537                         try {
 538                                 engine->encrypt(masterKey, options);
 539                         } catch (runtime::Exception &e) {
 540                                 ERROR(SINK, e.what());
 541                                 if (!engine->isStarted()) {
 542                                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "unencrypted");
 543                                         file.remove();
 544                                 }
 545                                 ::sync();
 546                                 ::reboot(RB_AUTOBOOT);
 547                         }
 548                         setOptions(options & getSupportedOptions());
 549
 550                         INFO(SINK, "Encryption completed.");
 551                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "encrypted");
 552                         server.notify("InternalEncryptionServer::mount");
 553
 554                         file.remove();
 555
 556                         INFO(SINK, "Syncing disk and rebooting.");
 557                         ::sync();
 558                         ::reboot(RB_AUTOBOOT);
 559                 } catch (runtime::Exception &e) {
 560                         ERROR(SINK, "Encryption failed: " + std::string(e.what()));
 561                 }
 562         };
 563
 564         std::thread asyncWork(encryptWorker);
 565         asyncWork.detach();
 566
 567         return error::None;
 568 }
 569
 570 int InternalEncryptionServer::decrypt(const std::string& password)
 571 {
 572         if (getState() != State::Encrypted) {
 573                 ERROR(SINK, "Cannot decrypt, partition's state incorrect.");
 574                 return error::NoSuchDevice;
 575         }
 576
 577         // check if key migration is needed
 578         if (UpgradeSupport::checkUpgradeFlag()) {
 579                 INFO("Upgrade flag detected.");
 580                 const std::string& dev = engine->getSource();
 581                 int rc = migrateMasterKey(dev, password);
 582                 if (rc == error::None)
 583                         UpgradeSupport::removeUpgradeFlag();
 584         }
 585
 586         BinaryData masterKey;
 587         int ret = keyServer.get(engine->getSource(), password, masterKey);
 588         if (ret != error::None)
 589                 return ret;
 590
 591         auto decryptWorker = [masterKey, this]() {
 592                 try {
 593                         if (::device_power_request_lock(POWER_LOCK_DISPLAY, 0) != 0)
 594                                 ERROR(SINK, "Failed to request to lock display");
 595
 596                         showProgressUI("decrypt");
 597                         ::sleep(1);
 598
 599                         runtime::File file("/opt/etc/.odeprogress");
 600                         file.create(0640);
 601
 602                         if (engine->isMounted()) {
 603                                 INFO(SINK, "Closing all processes using internal storage.");
 604                                 stopSystemdUnits();
 605
 606                                 INFO(SINK, "Umounting internal storage.");
 607                                 unmountInternalStorage("/dev/mapper/userdata");
 608                                 engine->umount();
 609                         }
 610
 611                         INFO(SINK, "Decryption started.");
 612                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "error_partially_decrypted");
 613                         try {
 614                                 engine->decrypt(masterKey, getOptions());
 615                         } catch (runtime::Exception &e) {
 616                                 ERROR(SINK, e.what());
 617                                 if (!engine->isStarted()) {
 618                                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "encrypted");
 619                                         file.remove();
 620                                 }
 621                                 ::sync();
 622                                 ::reboot(RB_AUTOBOOT);
 623                         }
 624
 625                         INFO(SINK, "Decryption complete.");
 626                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "unencrypted");
 627
 628                         file.remove();
 629
 630                         INFO(SINK, "Syncing disk and rebooting.");
 631                         ::sync();
 632                         ::reboot(RB_AUTOBOOT);
 633                 } catch (runtime::Exception &e) {
 634                         ERROR(SINK, "Decryption failed: " + std::string(e.what()));
 635                 }
 636         };
 637
 638         std::thread asyncWork(decryptWorker);
 639         asyncWork.detach();
 640
 641         return error::None;
 642 }
 643
 644 int InternalEncryptionServer::recovery()
 645 {
 646         int state = getState();
 647
 648         if (state == State::Unencrypted)
 649                 return error::NoSuchDevice;
 650
 651         runtime::File file("/opt/.factoryreset");
 652         file.create(0640);
 653
 654         ::sync();
 655         try {
 656                 dbus::Connection& systemDBus = dbus::Connection::getSystem();
 657                 systemDBus.methodcall("org.tizen.system.deviced",
 658                                                                 "/Org/Tizen/System/DeviceD/Power",
 659                                                                 "org.tizen.system.deviced.power",
 660                                                                 "reboot",
 661                                                                 -1, "()", "(si)", "reboot", 0);
 662         } catch (runtime::Exception &e) {
 663                 ::reboot(RB_AUTOBOOT);
 664         }
 665         return error::None;
 666 }
 667
 668 int InternalEncryptionServer::isPasswordInitialized()
 669 {
 670         return keyServer.isInitialized(engine->getSource());
 671 }
 672
 673 int InternalEncryptionServer::initPassword(const std::string& password)
 674 {
 675         return keyServer.init(engine->getSource(), password, Key::DEFAULT_256BIT);
 676 }
 677
 678 int InternalEncryptionServer::cleanPassword(const std::string& password)
 679 {
 680         return keyServer.remove(engine->getSource(), password);
 681 }
 682
 683 int InternalEncryptionServer::changePassword(const std::string& oldPassword,
 684                                                                                 const std::string& newPassword)
 685 {
 686         return keyServer.changePassword(engine->getSource(), oldPassword, newPassword);
 687 }
 688
 689 int InternalEncryptionServer::verifyPassword(const std::string& password)
 690 {
 691         return keyServer.verifyPassword(engine->getSource(), password);
 692 }
 693
 694 int InternalEncryptionServer::getState()
 695 {
 696         char *value = ::vconf_get_str(VCONFKEY_ODE_CRYPTO_STATE);
 697         if (value == NULL) {
 698                 throw runtime::Exception("Failed to get vconf value.");
 699         }
 700
 701         std::string valueStr(value);
 702         free(value);
 703
 704         if (valueStr == "encrypted")
 705                 return State::Encrypted;
 706         else if (valueStr == "unencrypted")
 707                 return State::Unencrypted;
 708         else if (valueStr == "error_partially_encrypted" || valueStr == "error_partially_decrypted")
 709                 return State::Corrupted;
 710
 711         return State::NotSupported;
 712 }
 713
 714 unsigned int InternalEncryptionServer::getSupportedOptions()
 715 {
 716         return engine->getSupportedOptions();
 717 }
 718
 719 std::string InternalEncryptionServer::getDevicePath() const
 720 {
 721         return engine->getSource();
 722 }
 723
 724 } // namespace ode