2 * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
22 #include <sys/mount.h>
23 #include <sys/reboot.h>
26 #include <tzplatform_config.h>
27 #include <klay/process.h>
28 #include <klay/file-user.h>
29 #include <klay/filesystem.h>
30 #include <klay/dbus/connection.h>
34 #include "progress-bar.h"
35 #include "engine/encryption/dmcrypt-engine.h"
36 #include "key-manager/key-manager.h"
38 #include "rmi/internal-encryption.h"
40 #define INTERNAL_ENGINE DMCryptEngine
41 #define INTERNAL_DEV_PATH "/dev/disk/by-partlabel"
42 #define INTERNAL_DEV_NAME "USER"
43 #define INTERNAL_PATH "/opt/usr"
44 #define INTERNAL_STATE_VCONF_KEY VCONFKEY_ODE_CRYPTO_STATE
45 #define INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY VCONFKEY_ODE_FAST_ENCRYPTION
47 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
49 const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
50 const std::vector<std::string> wipeCommand = {
55 "--dest=com.samsung.factoryreset",
56 "/com/samsung/factoryreset",
57 "com.samsung.factoryreset.start.setting"
64 std::unique_ptr<INTERNAL_ENGINE> engine;
65 KeyManager::data mountKey;
67 void stopKnownSystemdServices() {
68 std::vector<std::string> knownSystemdServices;
69 dbus::Connection& systemDBus = dbus::Connection::getSystem();
70 dbus::VariantIterator iter;
72 systemDBus.methodcall("org.freedesktop.systemd1",
73 "/org/freedesktop/systemd1",
74 "org.freedesktop.systemd1.Manager",
76 -1, "(a(ssssssouso))", "")
77 .get("(a(ssssssouso))", &iter);
80 unsigned int dataUint;
84 ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
85 dataStr + 3, dataStr + 4, dataStr + 5,
86 dataStr + 6, &dataUint, dataStr + 7,
93 std::string service(dataStr[0]);
94 if (service.compare(0, 5, "user@") == 0 ||
95 service == "tlm.service" ||
96 service == "resourced.service") {
97 knownSystemdServices.push_back(service);
101 for (const std::string& service : knownSystemdServices) {
102 INFO(SINK, "Stop service - " + service);
103 systemDBus.methodcall("org.freedesktop.systemd1",
104 "/org/freedesktop/systemd1",
105 "org.freedesktop.systemd1.Manager",
107 -1, "", "(ss)", service.c_str(), "flush");
113 void stopDependedSystemdServices()
115 dbus::Connection& systemDBus = dbus::Connection::getSystem();
116 std::set<std::string> servicesToStop;
118 for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
121 systemDBus.methodcall("org.freedesktop.systemd1",
122 "/org/freedesktop/systemd1",
123 "org.freedesktop.systemd1.Manager",
125 -1, "(o)", "(u)", (unsigned int)pid)
126 .get("(o)", &service);
127 servicesToStop.insert(service);
128 } catch (runtime::Exception &e) {
129 INFO(SINK, "Close process - " + std::to_string(pid));
130 ::kill(pid, SIGKILL);
134 for (const std::string& service : servicesToStop) {
135 INFO(SINK, "Close service - " + service);
136 systemDBus.methodcall("org.freedesktop.systemd1",
138 "org.freedesktop.systemd1.Unit",
140 -1, "", "(s)", "flush");
144 void showProgressUI(const std::string type) {
145 ::tzplatform_set_user(::tzplatform_getuid(TZ_SYS_DEFAULT_USER));
146 std::string defaultUserHome(::tzplatform_getenv(TZ_USER_HOME));
147 ::tzplatform_reset_user();
150 runtime::File shareDirectory("/opt/home/root/share");
151 if (!shareDirectory.exists()) {
152 shareDirectory.makeDirectory(true);
155 runtime::File elmConfigDir(shareDirectory.getPath() + "/.elementary");
156 if (!elmConfigDir.exists()) {
157 runtime::File defaultElmConfigDir(defaultUserHome + "/share/.elementary");
158 defaultElmConfigDir.copyTo(shareDirectory.getPath());
160 } catch (runtime::Exception &e) {
161 ERROR(SINK, "Failed to set up elm configuration");
164 std::vector<std::string> args = {
165 "ode", "progress", type, "Internal"
168 runtime::Process proc("/usr/bin/ode", args);
172 unsigned int getOptions()
174 unsigned int result = 0;
178 ::vconf_get_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, &value);
180 result |= InternalEncryption::Option::IncludeUnusedRegion;
186 void setOptions(unsigned int options)
190 if (options & InternalEncryption::Option::IncludeUnusedRegion) {
195 ::vconf_set_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, value);
200 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
203 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::setMountPassword)(std::string));
204 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::mount)());
205 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::umount)());
206 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::encrypt)(std::string, unsigned int));
207 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::decrypt)(std::string));
208 context.expose(this, "", (int)(InternalEncryption::isPasswordInitialized)());
209 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::initPassword)(std::string));
210 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::cleanPassword)(std::string));
211 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::changePassword)(std::string, std::string));
212 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::verifyPassword)(std::string));
213 context.expose(this, "", (int)(InternalEncryption::getState)());
214 context.expose(this, "", (unsigned int)(InternalEncryption::getSupportedOptions)());
216 context.createNotification("InternalEncryption::mount");
218 std::string source = INTERNAL_DEV_PATH "/" INTERNAL_DEV_NAME;
220 runtime::DirectoryIterator iter(INTERNAL_DEV_PATH), end;
222 while (iter != end) {
223 const std::string& path = (*iter).getPath();
224 std::string name = path.substr(path.rfind('/') + 1);
226 upper.reserve(name.size());
227 for (char c : name) {
228 upper += std::toupper(c);
230 if (upper == INTERNAL_DEV_NAME) {
236 } catch (runtime::Exception &e) {}
238 engine.reset(new INTERNAL_ENGINE(
239 source, INTERNAL_PATH,
240 ProgressBar([](int v) {
241 ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
242 std::to_string(v).c_str());
247 InternalEncryption::~InternalEncryption()
251 int InternalEncryption::setMountPassword(const std::string& password)
253 KeyManager::data pwData(password.begin(), password.end());
254 KeyManager keyManager(engine->getKeyMeta());
255 if (!keyManager.verifyPassword(pwData)) {
259 ode::mountKey = keyManager.getMasterKey(pwData);
264 int InternalEncryption::mount()
266 if (getState() != State::Encrypted) {
270 if (engine->isMounted()) {
271 INFO(SINK, "Already mounted");
276 INFO(SINK, "Mount internal storage...");
277 engine->mount(mountKey, getOptions());
280 context.notify("InternalEncryption::mount");
282 runtime::File("/tmp/.lazy_mount").create(O_WRONLY);
283 runtime::File("/tmp/.unlock_mnt").create(O_WRONLY);
284 } catch (runtime::Exception &e) {
285 ERROR(SINK, "Mount failed - " + std::string(e.what()));
292 int InternalEncryption::umount()
294 if (getState() != State::Encrypted) {
298 if (!engine->isMounted()) {
299 INFO(SINK, "Already umounted");
304 INFO(SINK, "Close all processes using internal storage...");
305 stopDependedSystemdServices();
306 INFO(SINK, "Umount internal storage...");
308 } catch (runtime::Exception &e) {
309 ERROR(SINK, "Umount failed - " + std::string(e.what()));
316 int InternalEncryption::encrypt(const std::string& password, unsigned int options)
318 if (getState() != State::Unencrypted) {
322 KeyManager::data pwData(password.begin(), password.end());
323 KeyManager keyManager(engine->getKeyMeta());
325 if (!keyManager.verifyPassword(pwData)) {
329 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
330 auto encryptWorker = [MasterKey, options, this]() {
332 INFO(SINK, "Close all known systemd services that might be using internal storage...");
333 stopKnownSystemdServices();
334 INFO(SINK, "Close all processes using internal storage...");
335 stopDependedSystemdServices();
336 INFO(SINK, "Umount internal storage...");
337 while (::umount(INTERNAL_PATH) == -1) {
338 if (errno != EBUSY) {
339 throw runtime::Exception("Umount error - " + std::to_string(errno));
341 stopDependedSystemdServices();
344 showProgressUI("Encrypting");
346 INFO(SINK, "Encryption started...");
347 engine->encrypt(MasterKey, options);
348 setOptions(options & getSupportedOptions());
350 INFO(SINK, "Encryption completed");
351 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "encrypted");
352 context.notify("InternalEncryption::mount");
354 INFO(SINK, "Syncing disk and rebooting...");
356 ::reboot(RB_AUTOBOOT);
357 } catch (runtime::Exception &e) {
358 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
359 ERROR(SINK, "Encryption failed - " + std::string(e.what()));
363 std::thread asyncWork(encryptWorker);
369 int InternalEncryption::decrypt(const std::string& password)
371 if (getState() != State::Encrypted) {
375 KeyManager::data pwData(password.begin(), password.end());
376 KeyManager keyManager(engine->getKeyMeta());
378 if (!keyManager.verifyPassword(pwData)) {
382 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
383 auto decryptWorker = [MasterKey, this]() {
385 INFO(SINK, "Close all known systemd services that might be using internal storage...");
386 stopKnownSystemdServices();
387 INFO(SINK, "Close all processes using internal storage...");
388 stopDependedSystemdServices();
389 INFO(SINK, "Umount internal storage...");
394 } catch (runtime::Exception& e) {
395 stopDependedSystemdServices();
399 showProgressUI("Decrypting");
401 INFO(SINK, "Decryption started...");
402 engine->decrypt(MasterKey, getOptions());
404 INFO(SINK, "Decryption completed");
405 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "unencrypted");
407 INFO(SINK, "Syncing disk and rebooting...");
409 ::reboot(RB_AUTOBOOT);
410 } catch (runtime::Exception &e) {
411 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
412 ERROR(SINK, "Decryption failed - " + std::string(e.what()));
416 std::thread asyncWork(decryptWorker);
422 int InternalEncryption::recovery()
424 if (getState() != State::Unencrypted) {
429 runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
430 if (proc.execute() == -1) {
431 ERROR(SINK, "Failed to launch factory-reset");
438 int InternalEncryption::isPasswordInitialized()
440 if (engine->isKeyMetaSet()) {
446 int InternalEncryption::initPassword(const std::string& password)
448 KeyManager::data pwData(password.begin(), password.end());
449 KeyManager keyManager;
451 keyManager.initPassword(pwData);
452 engine->setKeyMeta(keyManager.serialize());
456 int InternalEncryption::cleanPassword(const std::string& password)
458 KeyManager::data pwData(password.begin(), password.end());
459 KeyManager keyManager(engine->getKeyMeta());
461 if (!keyManager.verifyPassword(pwData)) {
465 engine->clearKeyMeta();
469 int InternalEncryption::changePassword(const std::string& oldPassword,
470 const std::string& newPassword)
472 KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
473 KeyManager::data newPwData(newPassword.begin(), newPassword.end());
474 KeyManager keyManager(engine->getKeyMeta());
476 if (!keyManager.verifyPassword(oldPwData)) {
480 keyManager.changePassword(oldPwData, newPwData);
481 engine->setKeyMeta(keyManager.serialize());
486 int InternalEncryption::verifyPassword(const std::string& password)
488 KeyManager::data pwData(password.begin(), password.end());
489 KeyManager keyManager(engine->getKeyMeta());
491 if (keyManager.verifyPassword(pwData)) {
497 int InternalEncryption::getState()
499 char *value = ::vconf_get_str(INTERNAL_STATE_VCONF_KEY);
501 throw runtime::Exception("Failed to get vconf value");
504 std::string valueStr(value);
507 if (valueStr == "encrypted") {
508 return State::Encrypted;
509 } else if (valueStr == "unencrypted") {
510 return State::Unencrypted;
512 return State::Corrupted;
518 unsigned int InternalEncryption::getSupportedOptions()
520 return engine->getSupportedOptions();