server/internal-encryption.cpp

   1 /*
   2  *  Copyright (c) 2015-2017 Samsung Electronics Co., Ltd All Rights Reserved
   3  *
   4  *  Licensed under the Apache License, Version 2.0 (the "License");
   5  *  you may not use this file except in compliance with the License.
   6  *  You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  *  Unless required by applicable law or agreed to in writing, software
  11  *  distributed under the License is distributed on an "AS IS" BASIS,
  12  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  *  See the License for the specific language governing permissions and
  14  *  limitations under the License
  15  */
  16 #include <set>
  17 #include <algorithm>
  18 #include <memory>
  19 #include <mutex>
  20 #include <condition_variable>
  21 #include <list>
  22
  23 #include <fstream>
  24 #include <fcntl.h>
  25 #include <signal.h>
  26 #include <unistd.h>
  27 #include <sys/mount.h>
  28 #include <sys/reboot.h>
  29 #include <limits.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32
  33 #include <vconf.h>
  34 #include <tzplatform_config.h>
  35 #include <device/power.h>
  36 #include <klay/process.h>
  37 #include <klay/file-user.h>
  38 #include <klay/filesystem.h>
  39 #include <klay/dbus/connection.h>
  40 #include <klay/error.h>
  41
  42 #include "misc.h"
  43 #include "logger.h"
  44 #include "progress-bar.h"
  45 #include "rmi/common.h"
  46
  47 #include "ext4-tool.h"
  48 #include "internal-encryption.h"
  49 #include "internal-encryption-common.h"
  50 #include "upgrade-support.h"
  51
  52 namespace ode {
  53
  54 namespace {
  55
  56 const char *PRIVILEGE_PLATFORM  = "http://tizen.org/privilege/internal/default/platform";
  57
  58 // watches systemd jobs
  59 class JobWatch {
  60 public:
  61         explicit JobWatch(dbus::Connection& systemDBus);
  62         ~JobWatch();
  63
  64         bool waitForJob(const std::string& job);
  65
  66 private:
  67         void jobRemoved(const dbus::Variant& parameters);
  68
  69         struct Job {
  70                 Job(uint32_t id,
  71                         const std::string& job,
  72                         const std::string& unit,
  73                         const std::string& result) : id(id), job(job), unit(unit), result(result) {}
  74                 uint32_t id;
  75                 std::string job;
  76                 std::string unit;
  77                 std::string result;
  78         };
  79
  80         dbus::Connection::SubscriptionId id;
  81         dbus::Connection& systemDBus;
  82         std::list<Job> removedJobs;
  83         std::mutex jobsMutex;
  84         std::condition_variable jobsCv;
  85 };
  86
  87 JobWatch::JobWatch(dbus::Connection& systemDBus) : systemDBus(systemDBus) {
  88         auto callback = [this](dbus::Variant parameters) {
  89                 this->jobRemoved(parameters);
  90         };
  91
  92         id = systemDBus.subscribeSignal("",
  93                                                                         "/org/freedesktop/systemd1",
  94                                                                         "org.freedesktop.systemd1.Manager",
  95                                                                         "JobRemoved",
  96                                                                         callback);
  97 }
  98
  99 JobWatch::~JobWatch() {
 100         systemDBus.unsubscribeSignal(id);
 101 }
 102
 103 bool JobWatch::waitForJob(const std::string& job) {
 104         while(true) {
 105                 std::unique_lock<std::mutex> lock(jobsMutex);
 106                 bool timeout = true;
 107                 auto sec = std::chrono::seconds(1);
 108                 jobsCv.wait_for(lock, 5*sec, [this, &timeout]{
 109                                 if (!removedJobs.empty()) {
 110                                         timeout = false;
 111                                         return true;
 112                                 }
 113                                 return false;});
 114
 115                 if (timeout) {
 116                         INFO(SINK, "job: " + job + ", result: time out");
 117                         return false;
 118                 }
 119
 120                 while(!removedJobs.empty()) {
 121                         bool match = (removedJobs.front().job == job);
 122                         bool done = (removedJobs.front().result == "done");
 123                         removedJobs.pop_front();
 124                         if (match)
 125                                 return done;
 126                 }
 127         };
 128 }
 129
 130 void JobWatch::jobRemoved(const dbus::Variant& parameters)
 131 {
 132         uint32_t id;
 133         const char* job;
 134         const char* unit;
 135         const char* result;
 136         parameters.get("(uoss)", &id, &job, &unit, &result);
 137         INFO(SINK, "id:" + std::to_string(id) + " job:" + job + " unit:" + unit + " result:" + result);
 138
 139         {
 140                 std::lock_guard<std::mutex> guard(jobsMutex);
 141                 removedJobs.emplace_back(id, job, unit, result);
 142         }
 143         jobsCv.notify_one();
 144 }
 145
 146 std::string getDecodedPath(const std::string &path, const std::string &prefix)
 147 {
 148         std::string ret = path;
 149         size_t pos = 0;
 150
 151         pos = ret.find(prefix);
 152         if (pos != std::string::npos)
 153                 ret = ret.substr(prefix.size(), ret.size());
 154
 155         pos = 0;
 156         while ((pos = ret.find("_", pos)) != std::string::npos) {
 157                 int a = std::stoi(std::string(1, ret.at(pos+1)), nullptr, 16);
 158                 int b = std::stoi(std::string(1, ret.at(pos+2)), nullptr, 16);
 159                 if (a < 0 || b < 0)
 160                         ret.replace(pos, 3, "_");
 161                 else
 162                         ret.replace(pos, 3, std::string(1, ((a << 4) | b)));
 163                 pos += 1;
 164         }
 165         return ret;
 166 }
 167
 168 void stopSystemdUnits()
 169 {
 170         dbus::Connection& systemDBus = dbus::Connection::getSystem();
 171         dbus::VariantIterator iter;
 172         std::vector<std::string> preprocessUnits;
 173         std::set<std::string> unitsToStop;
 174
 175         auto stopUnit = [&systemDBus](const std::string &unit) {
 176                 JobWatch watch(systemDBus);
 177                 INFO(SINK, "Stopping unit: " + unit);
 178                 const char* job = NULL;
 179                 try {
 180                         systemDBus.methodcall("org.freedesktop.systemd1",
 181                                                                         "/org/freedesktop/systemd1",
 182                                                                         "org.freedesktop.systemd1.Manager",
 183                                                                         "StopUnit",
 184                                                                         -1, "(o)", "(ss)", unit.c_str(), "flush").get("(o)", &job);
 185                         INFO(SINK, "Waiting for job: " + std::string(job));
 186                         if (!watch.waitForJob(job))
 187                                 ERROR(SINK, "Stopping unit: " + unit + " failed");
 188                 } catch (runtime::Exception &e) {
 189                         ERROR(SINK, std::string(e.what()));
 190                 }
 191         };
 192
 193         try {
 194                 systemDBus.methodcall("org.freedesktop.systemd1",
 195                                                                 "/org/freedesktop/systemd1",
 196                                                                 "org.freedesktop.systemd1.Manager",
 197                                                                 "ListUnits",
 198                                                                 -1, "(a(ssssssouso))", "").get("(a(ssssssouso))", &iter);
 199         } catch (runtime::Exception &e) {
 200                 INFO(SINK, "Get list of systemd unit : " + std::string(e.what()));
 201         }
 202
 203         while (1) {
 204                 unsigned int dataUnit;
 205                 char *dataStr[9];
 206                 int ret;
 207                 ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
 208                                                 dataStr + 3, dataStr + 4, dataStr + 5,
 209                                                 dataStr + 6, &dataUnit, dataStr + 7, dataStr + 8);
 210                 if (!ret)
 211                         break;
 212
 213                 std::string unitName(dataStr[0]);
 214                 if (unitName == "security-manager.socket" ||
 215                                 unitName == "connman.socket" ||
 216                                 unitName == "msg-server.socket") {
 217                         preprocessUnits.insert(preprocessUnits.begin(), unitName);
 218                 } else if (unitName.compare(0, 5, "user@") == 0 ||
 219                                 unitName == "tlm.service" ||
 220                                 unitName == "resourced.service" ||
 221                                 unitName == "security-manager.service") {
 222                         preprocessUnits.push_back(unitName);
 223                 }
 224         }
 225
 226         for (auto unit : preprocessUnits) {
 227                 stopUnit(unit);
 228         }
 229
 230         for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
 231                 try {
 232                         char *unit = nullptr;
 233                         systemDBus.methodcall("org.freedesktop.systemd1",
 234                                                                         "/org/freedesktop/systemd1",
 235                                                                         "org.freedesktop.systemd1.Manager",
 236                                                                         "GetUnitByPID",
 237                                                                         -1, "(o)", "(u)", (unsigned int)pid)
 238                                                                                 .get("(o)", &unit);
 239
 240                         auto unescapedName = getDecodedPath(unit, "/org/freedesktop/systemd1/unit/");
 241                         unitsToStop.insert(unescapedName);
 242                 } catch (runtime::Exception &e) {
 243                         INFO(SINK, "Killing process: " + std::to_string(pid));
 244                         ::kill(pid, SIGKILL);
 245                 }
 246         }
 247
 248         for (auto unit : unitsToStop) {
 249                 stopUnit(unit);
 250         }
 251 }
 252
 253 void showProgressUI(const std::string type)
 254 {
 255         dbus::Connection& systemDBus = dbus::Connection::getSystem();
 256         std::string unit("ode-progress-ui@"+type+".service");
 257
 258         JobWatch watch(systemDBus);
 259         INFO(SINK, "Start unit: " + unit);
 260
 261         const char* job = NULL;
 262         systemDBus.methodcall("org.freedesktop.systemd1",
 263                                                         "/org/freedesktop/systemd1",
 264                                                         "org.freedesktop.systemd1.Manager",
 265                                                         "StartUnit",
 266                                                         -1, "(o)", "(ss)", unit.c_str(), "replace").get("(o)", &job);
 267
 268         INFO(SINK, "Waiting for job: " + std::string(job));
 269         if (!watch.waitForJob(job))
 270                 ERROR(SINK, "Starting unit: " + unit + " failed");
 271 }
 272
 273 unsigned int getOptions()
 274 {
 275         unsigned int result = 0;
 276         int value;
 277
 278         value = 0;
 279         ::vconf_get_bool(VCONFKEY_ODE_FAST_ENCRYPTION, &value);
 280         if (value) {
 281                 result |= InternalEncryption::Option::IncludeUnusedRegion;
 282         }
 283
 284         return result;
 285 }
 286
 287 void setOptions(unsigned int options)
 288 {
 289         bool value;
 290
 291         if (options & InternalEncryption::Option::IncludeUnusedRegion) {
 292                 value = true;
 293         } else {
 294                 value = false;
 295         }
 296         ::vconf_set_bool(VCONFKEY_ODE_FAST_ENCRYPTION, value);
 297 }
 298
 299 void execAndWait(const std::string &path, std::vector<std::string> &args)
 300 {
 301         runtime::Process proc(path, args);
 302         int ret = proc.execute();
 303         if (ret < 0)
 304                 ERROR(SINK, path + " failed for " + args.back());
 305
 306         ret = proc.waitForFinished();
 307         if (ret < 0 || !WIFEXITED(ret) || WEXITSTATUS(ret) != 0)
 308                 ERROR(SINK, path + " failed for " + args.back());
 309 }
 310
 311 bool isPartitionTerminated(const std::string &partition)
 312 {
 313         bool ret = true;
 314         const std::string cmd("fuser -m " + partition + " | grep -o '[0-9]*'");
 315         char *line = nullptr;
 316         size_t len = 0;
 317
 318         FILE *fp = ::popen(cmd.c_str(), "r");
 319         if (fp == nullptr) {
 320                 ERROR(SINK, "Failed to get processes on partition");
 321                 return false;
 322         }
 323
 324         if (::getline(&line, &len, fp) != -1)
 325                 ret = false;
 326
 327         ::free(line);
 328         ::pclose(fp);
 329
 330         return ret;
 331 }
 332
 333 void unmountInternalStorage(const std::string& source)
 334 {
 335         if (::umount2("/opt/usr", MNT_DETACH) == -1) {
 336                 if (errno != EBUSY && errno != EINVAL) {
 337                         throw runtime::Exception("umount() error : " + runtime::GetSystemErrorMessage());
 338                 }
 339         }
 340
 341         do {
 342                 ::sync();
 343                 static const char *fuserPath = "/usr/bin/fuser";
 344                 std::vector<std::string> args = {
 345                         fuserPath, "-m", "-k", "-s", "-SIGTERM", source,
 346                 };
 347                 execAndWait(fuserPath, args);
 348                 ::usleep((useconds_t)((unsigned int)(500)*1000));
 349
 350                 args[4] = "-SIGKILL";
 351                 execAndWait(fuserPath, args);
 352                 ::usleep((useconds_t)((unsigned int)(200)*1000));
 353         } while (!isPartitionTerminated(source));
 354 }
 355
 356 }
 357
 358 InternalEncryptionServer::InternalEncryptionServer(ServerContext& srv,
 359                                                                                                    KeyServer& key) :
 360         server(srv),
 361         keyServer(key)
 362 {
 363         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::setMountPassword)(std::string));
 364         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::mount)(std::vector<unsigned char>, unsigned int));
 365         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::umount)());
 366         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::isMounted)());
 367         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::encrypt)(std::string, unsigned int));
 368         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::decrypt)(std::string));
 369         server.expose(this, "", (int)(InternalEncryptionServer::isPasswordInitialized)());
 370         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::recovery)());
 371         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::initPassword)(std::string));
 372         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::cleanPassword)(std::string));
 373         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::changePassword)(std::string, std::string));
 374         server.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryptionServer::verifyPassword)(std::string));
 375         server.expose(this, "", (int)(InternalEncryptionServer::getState)());
 376         server.expose(this, "", (unsigned int)(InternalEncryptionServer::getSupportedOptions)());
 377         server.expose(this, "", (std::string)(InternalEncryptionServer::getDevicePath)());
 378
 379         server.createNotification("InternalEncryptionServer::mount");
 380
 381         std::string source = findDevPath();
 382
 383         engine.reset(new INTERNAL_ENGINE(
 384                 source, INTERNAL_PATH,
 385                 ProgressBar([](int v) {
 386                         ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
 387                                                         std::to_string(v).c_str());
 388                 })
 389         ));
 390 }
 391
 392 InternalEncryptionServer::~InternalEncryptionServer()
 393 {
 394 }
 395
 396 int InternalEncryptionServer::migrateMasterKey(const std::string& dev, const std::string& password)
 397 {
 398         try {
 399                 BinaryData masterKey = UpgradeSupport::loadMasterKey(dev);
 400
 401                 // encrypt the master key with given password
 402                 return keyServer.changePassword2(dev, masterKey, password);
 403         } catch (const runtime::Exception&) {
 404                 INFO("Failed to load the master key stored during upgrade.");
 405         }
 406
 407         return error::Unknown;
 408 }
 409
 410 int InternalEncryptionServer::setMountPassword(const std::string& password)
 411 {
 412         const std::string& dev = engine->getSource();
 413
 414         // check if upgrade flag exists
 415         if (UpgradeSupport::checkUpgradeFlag()) {
 416                 INFO("Upgrade flag detected.");
 417
 418                 int rc = migrateMasterKey(dev, password);
 419                 if (rc == error::None)
 420                         UpgradeSupport::removeUpgradeFlag();
 421
 422                 return rc;
 423         }
 424
 425         return keyServer.get(dev, password, mountKey);
 426 }
 427
 428 int InternalEncryptionServer::mount(const std::vector<unsigned char> &mk, unsigned int options)
 429 {
 430         if (mountKey.empty() && mk.empty()) {
 431                 ERROR(SINK, "You need to set master key first.");
 432                 return error::NoData;
 433         }
 434
 435         BinaryData key = mk.empty() ? mountKey : mk;
 436         mountKey.clear();
 437
 438         if (getState() != State::Encrypted) {
 439                 INFO(SINK, "Cannot mount, SD partition's state incorrect.");
 440                 return error::NoSuchDevice;
 441         }
 442
 443         if (engine->isMounted()) {
 444                 INFO(SINK, "Partition already mounted.");
 445                 return error::None;
 446         }
 447
 448         INFO(SINK, "Mounting internal storage.");
 449         try {
 450                 engine->mount(key, getOptions());
 451
 452                 server.notify("InternalEncryptionServer::mount");
 453
 454                 runtime::File("/tmp/.lazy_mount").create(O_WRONLY);
 455                 runtime::File("/tmp/.unlock_mnt").create(O_WRONLY);
 456         } catch (runtime::Exception &e) {
 457                 ERROR(SINK, "Mount failed: " + std::string(e.what()));
 458                 return error::Unknown;
 459         }
 460
 461         return error::None;
 462 }
 463
 464 int InternalEncryptionServer::isMounted()
 465 {
 466         int ret = 0;
 467         try {
 468                 ret = engine->isMounted() ? 1 : 0;
 469         } catch (runtime::Exception &e) {
 470                 ERROR(SINK, "Failed to access the mount flag");
 471                 return error::Unknown;
 472         }
 473         return ret;
 474 }
 475
 476 int InternalEncryptionServer::umount()
 477 {
 478         if (getState() != State::Encrypted) {
 479                 ERROR(SINK, "Cannot umount, partition's state incorrect.");
 480                 return error::NoSuchDevice;
 481         }
 482
 483         if (!engine->isMounted()) {
 484                 INFO(SINK, "Partition already umounted.");
 485                 return error::None;
 486         }
 487
 488         INFO(SINK, "Closing all processes using internal storage.");
 489         try {
 490                 stopSystemdUnits();
 491                 INFO(SINK, "Umounting internal storage.");
 492                 unmountInternalStorage("/dev/mapper/userdata");
 493                 engine->umount();
 494         } catch (runtime::Exception &e) {
 495                 ERROR(SINK, "Umount failed: " + std::string(e.what()));
 496                 return error::Unknown;
 497         }
 498
 499         return error::None;
 500 }
 501
 502 int InternalEncryptionServer::encrypt(const std::string& password, unsigned int options)
 503 {
 504         if (getState() != State::Unencrypted) {
 505                 ERROR(SINK, "Cannot encrypt, partition's state incorrect.");
 506                 return error::NoSuchDevice;
 507         }
 508
 509         BinaryData masterKey;
 510         int ret = keyServer.get(engine->getSource(), password, masterKey);
 511         if (ret != error::None)
 512                 return ret;
 513
 514         auto encryptWorker = [masterKey, options, this]() {
 515                 try {
 516                         if (::device_power_request_lock(POWER_LOCK_DISPLAY, 0) != 0)
 517                                 ERROR(SINK, "Failed to request to lock display");
 518
 519                         showProgressUI("encrypt");
 520                         ::sleep(1);
 521
 522                         runtime::File file("/opt/etc/.odeprogress");
 523                         file.create(0640);
 524
 525                         std::string source = engine->getSource();
 526                         auto mntPaths = findMountPointsByDevice(source);
 527
 528                         if (!mntPaths.empty()) {
 529                                 INFO(SINK, "Closing all processes using internal storage.");
 530                                 stopSystemdUnits();
 531
 532                                 INFO(SINK, "Unmounting internal storage.");
 533                                 unmountInternalStorage(source);
 534                         }
 535
 536                         INFO(SINK, "Encryption started.");
 537                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "error_partially_encrypted");
 538                         try {
 539                                 engine->encrypt(masterKey, options);
 540                         } catch (runtime::Exception &e) {
 541                                 ERROR(SINK, e.what());
 542                                 if (!engine->isStarted()) {
 543                                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "unencrypted");
 544                                         file.remove();
 545                                 }
 546                                 ::sync();
 547                                 ::reboot(RB_AUTOBOOT);
 548                         }
 549                         setOptions(options & getSupportedOptions());
 550
 551                         INFO(SINK, "Encryption completed.");
 552                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "encrypted");
 553                         server.notify("InternalEncryptionServer::mount");
 554
 555                         file.remove();
 556
 557                         INFO(SINK, "Syncing disk and rebooting.");
 558                         ::sync();
 559                         ::reboot(RB_AUTOBOOT);
 560                 } catch (runtime::Exception &e) {
 561                         ERROR(SINK, "Encryption failed: " + std::string(e.what()));
 562                 }
 563         };
 564
 565         std::thread asyncWork(encryptWorker);
 566         asyncWork.detach();
 567
 568         return error::None;
 569 }
 570
 571 int InternalEncryptionServer::decrypt(const std::string& password)
 572 {
 573         if (getState() != State::Encrypted) {
 574                 ERROR(SINK, "Cannot decrypt, partition's state incorrect.");
 575                 return error::NoSuchDevice;
 576         }
 577
 578         // check if key migration is needed
 579         if (UpgradeSupport::checkUpgradeFlag()) {
 580                 INFO("Upgrade flag detected.");
 581                 const std::string& dev = engine->getSource();
 582                 int rc = migrateMasterKey(dev, password);
 583                 if (rc == error::None)
 584                         UpgradeSupport::removeUpgradeFlag();
 585         }
 586
 587         BinaryData masterKey;
 588         int ret = keyServer.get(engine->getSource(), password, masterKey);
 589         if (ret != error::None)
 590                 return ret;
 591
 592         auto decryptWorker = [masterKey, this]() {
 593                 try {
 594                         if (::device_power_request_lock(POWER_LOCK_DISPLAY, 0) != 0)
 595                                 ERROR(SINK, "Failed to request to lock display");
 596
 597                         showProgressUI("decrypt");
 598                         ::sleep(1);
 599
 600                         runtime::File file("/opt/etc/.odeprogress");
 601                         file.create(0640);
 602
 603                         if (engine->isMounted()) {
 604                                 INFO(SINK, "Closing all processes using internal storage.");
 605                                 stopSystemdUnits();
 606
 607                                 INFO(SINK, "Umounting internal storage.");
 608                                 unmountInternalStorage("/dev/mapper/userdata");
 609                                 engine->umount();
 610                         }
 611
 612                         INFO(SINK, "Decryption started.");
 613                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "error_partially_decrypted");
 614                         try {
 615                                 engine->decrypt(masterKey, getOptions());
 616                         } catch (runtime::Exception &e) {
 617                                 ERROR(SINK, e.what());
 618                                 if (!engine->isStarted()) {
 619                                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "encrypted");
 620                                         file.remove();
 621                                 }
 622                                 ::sync();
 623                                 ::reboot(RB_AUTOBOOT);
 624                         }
 625
 626                         INFO(SINK, "Decryption complete.");
 627                         ::vconf_set_str(VCONFKEY_ODE_CRYPTO_STATE, "unencrypted");
 628
 629                         file.remove();
 630
 631                         INFO(SINK, "Syncing disk and rebooting.");
 632                         ::sync();
 633                         ::reboot(RB_AUTOBOOT);
 634                 } catch (runtime::Exception &e) {
 635                         ERROR(SINK, "Decryption failed: " + std::string(e.what()));
 636                 }
 637         };
 638
 639         std::thread asyncWork(decryptWorker);
 640         asyncWork.detach();
 641
 642         return error::None;
 643 }
 644
 645 int InternalEncryptionServer::recovery()
 646 {
 647         int state = getState();
 648
 649         if (state == State::Unencrypted)
 650                 return error::NoSuchDevice;
 651
 652         runtime::File file("/opt/.factoryreset");
 653         file.create(0640);
 654
 655         ::sync();
 656         try {
 657                 dbus::Connection& systemDBus = dbus::Connection::getSystem();
 658                 systemDBus.methodcall("org.tizen.system.deviced",
 659                                                                 "/Org/Tizen/System/DeviceD/Power",
 660                                                                 "org.tizen.system.deviced.power",
 661                                                                 "reboot",
 662                                                                 -1, "()", "(si)", "reboot", 0);
 663         } catch (runtime::Exception &e) {
 664                 ::reboot(RB_AUTOBOOT);
 665         }
 666         return error::None;
 667 }
 668
 669 int InternalEncryptionServer::isPasswordInitialized()
 670 {
 671         return keyServer.isInitialized(engine->getSource());
 672 }
 673
 674 int InternalEncryptionServer::initPassword(const std::string& password)
 675 {
 676         return keyServer.init(engine->getSource(), password, Key::DEFAULT_256BIT);
 677 }
 678
 679 int InternalEncryptionServer::cleanPassword(const std::string& password)
 680 {
 681         return keyServer.remove(engine->getSource(), password);
 682 }
 683
 684 int InternalEncryptionServer::changePassword(const std::string& oldPassword,
 685                                                                                 const std::string& newPassword)
 686 {
 687         return keyServer.changePassword(engine->getSource(), oldPassword, newPassword);
 688 }
 689
 690 int InternalEncryptionServer::verifyPassword(const std::string& password)
 691 {
 692         return keyServer.verifyPassword(engine->getSource(), password);
 693 }
 694
 695 int InternalEncryptionServer::getState()
 696 {
 697         char *value = ::vconf_get_str(VCONFKEY_ODE_CRYPTO_STATE);
 698         if (value == NULL) {
 699                 throw runtime::Exception("Failed to get vconf value.");
 700         }
 701
 702         std::string valueStr(value);
 703         free(value);
 704
 705         if (valueStr == "encrypted")
 706                 return State::Encrypted;
 707         else if (valueStr == "unencrypted")
 708                 return State::Unencrypted;
 709         else if (valueStr == "error_partially_encrypted" || valueStr == "error_partially_decrypted")
 710                 return State::Corrupted;
 711
 712         return State::NotSupported;
 713 }
 714
 715 unsigned int InternalEncryptionServer::getSupportedOptions()
 716 {
 717         return engine->getSupportedOptions();
 718 }
 719
 720 std::string InternalEncryptionServer::getDevicePath() const
 721 {
 722         return engine->getSource();
 723 }
 724
 725 } // namespace ode