2 * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
20 #include <sys/mount.h>
21 #include <sys/reboot.h>
24 #include <klay/process.h>
25 #include <klay/file-user.h>
26 #include <klay/filesystem.h>
27 #include <klay/dbus/connection.h>
28 #include <klay/audit/logger.h>
31 #include "progress-bar.h"
32 #include "engine/encryption/dmcrypt-engine.h"
33 #include "key-manager/key-manager.h"
35 #include "rmi/internal-encryption.h"
37 #define INTERNAL_ENGINE DMCryptEngine
38 #define INTERNAL_DEV "/dev/mmcblk0p25"
39 #define INTERNAL_PATH "/opt/usr"
40 #define INTERNAL_STATE_VCONF_KEY VCONFKEY_ODE_CRYPTO_STATE
41 #define INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY VCONFKEY_ODE_FAST_ENCRYPTION
43 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
45 const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
46 const std::vector<std::string> wipeCommand = {
51 "--dest=com.samsung.factoryreset",
52 "/com/samsung/factoryreset",
53 "com.samsung.factoryreset.start.setting"
60 std::unique_ptr<INTERNAL_ENGINE> engine;
62 void stopDependedSystemdServices()
64 dbus::Connection& systemDBus = dbus::Connection::getSystem();
65 std::set<std::string> servicesToStop;
67 for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
70 systemDBus.methodcall("org.freedesktop.systemd1",
71 "/org/freedesktop/systemd1",
72 "org.freedesktop.systemd1.Manager",
74 -1, "(o)", "(u)", (unsigned int)pid)
75 .get("(o)", &service);
76 servicesToStop.insert(service);
77 } catch (runtime::Exception &e) {
78 INFO("Close process - " + std::to_string(pid));
83 for (const std::string& service : servicesToStop) {
84 INFO("Close service - " + service);
85 systemDBus.methodcall("org.freedesktop.systemd1",
87 "org.freedesktop.systemd1.Unit",
89 -1, "", "(s)", "flush");
93 void showProgressUI(const std::string type) {
94 std::vector<std::string> args = {
95 "ode", "progress", type, "Internal"
98 runtime::Process proc("/usr/bin/ode", args);
102 unsigned int getOptions()
104 unsigned int result = 0;
108 ::vconf_get_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, &value);
110 result |= InternalEncryption::Option::IncludeUnusedRegion;
116 void setOptions(unsigned int options)
120 if (options & InternalEncryption::Option::IncludeUnusedRegion) {
125 ::vconf_set_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, value);
130 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
133 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::mount)(std::string));
134 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::umount)());
135 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::encrypt)(std::string, unsigned int));
136 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::decrypt)(std::string));
137 context.expose(this, "", (int)(InternalEncryption::isPasswordInitialized)());
138 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::initPassword)(std::string));
139 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::cleanPassword)(std::string));
140 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::changePassword)(std::string, std::string));
141 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::verifyPassword)(std::string));
142 context.expose(this, "", (int)(InternalEncryption::getState)());
143 context.expose(this, "", (unsigned int)(InternalEncryption::getSupportedOptions)());
145 engine.reset(new INTERNAL_ENGINE(
146 INTERNAL_DEV, INTERNAL_PATH,
147 ProgressBar([](int v) {
148 ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
149 std::to_string(v).c_str());
154 InternalEncryption::~InternalEncryption()
158 int InternalEncryption::mount(const std::string& password)
160 if (getState() != State::Encrypted) {
164 KeyManager::data pwData(password.begin(), password.end());
165 KeyManager keyManager(engine->getKeyMeta());
167 if (!keyManager.verifyPassword(pwData)) {
171 engine->mount(keyManager.getMasterKey(pwData), getOptions());
175 int InternalEncryption::umount()
177 if (getState() != State::Encrypted) {
181 INFO("Close all processes using internal storage...");
182 stopDependedSystemdServices();
183 INFO("Umount internal storage...");
189 int InternalEncryption::encrypt(const std::string& password, unsigned int options)
191 if (getState() != State::Unencrypted) {
195 KeyManager::data pwData(password.begin(), password.end());
196 KeyManager keyManager(engine->getKeyMeta());
198 if (!keyManager.verifyPassword(pwData)) {
202 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
203 auto encryptWorker = [MasterKey, options, this]() {
205 showProgressUI("Encrypting");
207 INFO("Close all processes using internal storage...");
208 stopDependedSystemdServices();
209 INFO("Umount internal storage...");
210 while (::umount(INTERNAL_PATH) == -1) {
211 if (errno != EBUSY) {
212 throw runtime::Exception("Umount error - " + std::to_string(errno));
214 stopDependedSystemdServices();
217 INFO("Encryption started...");
218 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
219 engine->encrypt(MasterKey, options);
220 setOptions(options & getSupportedOptions());
221 INFO("Sync disk...");
223 INFO("Encryption completed");
225 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "encrypted");
226 } catch (runtime::Exception &e) {
227 ERROR("Encryption failed - " + std::string(e.what()));
229 ::reboot(RB_AUTOBOOT);
232 std::thread asyncWork(encryptWorker);
238 int InternalEncryption::decrypt(const std::string& password)
240 if (getState() != State::Encrypted) {
244 KeyManager::data pwData(password.begin(), password.end());
245 KeyManager keyManager(engine->getKeyMeta());
247 if (!keyManager.verifyPassword(pwData)) {
251 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
252 auto decryptWorker = [MasterKey, this]() {
254 showProgressUI("Decrypting");
256 INFO("Close all processes using internal storage...");
257 stopDependedSystemdServices();
258 INFO("Umount internal storage...");
263 } catch (runtime::Exception& e) {
264 stopDependedSystemdServices();
268 INFO("Decryption started...");
269 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
270 engine->decrypt(MasterKey, getOptions());
271 INFO("Sync disk...");
273 INFO("Decryption completed");
275 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "unencrypted");
276 } catch (runtime::Exception &e) {
277 ERROR("Decryption failed - " + std::string(e.what()));
279 ::reboot(RB_AUTOBOOT);
282 std::thread asyncWork(decryptWorker);
288 int InternalEncryption::recovery()
290 if (getState() != State::Unencrypted) {
295 runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
296 if (proc.execute() == -1) {
297 ERROR("Failed to launch factory-reset");
304 int InternalEncryption::isPasswordInitialized()
306 if (engine->isKeyMetaSet()) {
312 int InternalEncryption::initPassword(const std::string& password)
314 KeyManager::data pwData(password.begin(), password.end());
315 KeyManager keyManager;
317 keyManager.initPassword(pwData);
318 engine->setKeyMeta(keyManager.serialize());
322 int InternalEncryption::cleanPassword(const std::string& password)
324 KeyManager::data pwData(password.begin(), password.end());
325 KeyManager keyManager(engine->getKeyMeta());
327 if (!keyManager.verifyPassword(pwData)) {
331 engine->clearKeyMeta();
335 int InternalEncryption::changePassword(const std::string& oldPassword,
336 const std::string& newPassword)
338 KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
339 KeyManager::data newPwData(newPassword.begin(), newPassword.end());
340 KeyManager keyManager(engine->getKeyMeta());
342 if (!keyManager.verifyPassword(oldPwData)) {
346 keyManager.changePassword(oldPwData, newPwData);
347 engine->setKeyMeta(keyManager.serialize());
352 int InternalEncryption::verifyPassword(const std::string& password)
354 KeyManager::data pwData(password.begin(), password.end());
355 KeyManager keyManager(engine->getKeyMeta());
357 if (keyManager.verifyPassword(pwData)) {
363 int InternalEncryption::getState()
365 char *value = ::vconf_get_str(INTERNAL_STATE_VCONF_KEY);
367 throw runtime::Exception("Failed to get vconf value");
370 std::string valueStr(value);
373 if (valueStr == "encrypted") {
374 return State::Encrypted;
375 } else if (valueStr == "unencrypted") {
376 return State::Unencrypted;
378 return State::Corrupted;
384 unsigned int InternalEncryption::getSupportedOptions()
386 return engine->getSupportedOptions();