2 * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License
22 #include <sys/mount.h>
23 #include <sys/reboot.h>
24 #include <sys/inotify.h>
27 #include <tzplatform_config.h>
28 #include <klay/process.h>
29 #include <klay/file-user.h>
30 #include <klay/filesystem.h>
31 #include <klay/dbus/connection.h>
35 #include "progress-bar.h"
36 #include "engine/encryption/dmcrypt-engine.h"
37 #include "key-manager/key-manager.h"
39 #include "rmi/internal-encryption.h"
41 #define INTERNAL_ENGINE DMCryptEngine
42 #define INTERNAL_DEV_PATH "/dev/disk/by-partlabel"
43 #define INTERNAL_DEV_NAME "USER"
44 #define INTERNAL_PATH "/opt/usr"
45 #define INTERNAL_STATE_VCONF_KEY VCONFKEY_ODE_CRYPTO_STATE
46 #define INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY VCONFKEY_ODE_FAST_ENCRYPTION
48 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
50 const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
51 const std::vector<std::string> wipeCommand = {
56 "--dest=com.samsung.factoryreset",
57 "/com/samsung/factoryreset",
58 "com.samsung.factoryreset.start.setting"
65 std::unique_ptr<INTERNAL_ENGINE> engine;
66 KeyManager::data mountKey;
68 void stopDependedSystemdServices()
70 runtime::File fileToTouch("/run/.ode-umount-internal");
73 } catch(runtime::Exception &e) {}
74 fileToTouch.create(O_WRONLY);
79 void killDependedProcesses()
81 INFO(SINK, "killDependedProcesses");
82 for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
83 INFO(SINK, "Close process - " + std::to_string(pid));
84 int ret = ::kill(pid, SIGKILL);
86 ERROR(SINK, "Failed to kill process " + std::to_string(pid));
91 void showProgressUI(const std::string type) {
92 runtime::File fileToTouch("/run/.ode-progress-internal@" + type);
95 } catch(runtime::Exception &e) {}
96 fileToTouch.create(O_WRONLY);
99 unsigned int getOptions()
101 unsigned int result = 0;
105 ::vconf_get_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, &value);
107 result |= InternalEncryption::Option::IncludeUnusedRegion;
113 void setOptions(unsigned int options)
117 if (options & InternalEncryption::Option::IncludeUnusedRegion) {
122 ::vconf_set_bool(INTERNAL_OPTION_ONLY_USED_REGION_VCONF_KEY, value);
127 InternalEncryption::InternalEncryption(ODEControlContext& ctx) :
130 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::setMountPassword)(std::string));
131 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::mount)());
132 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::umount)());
133 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::encrypt)(std::string, unsigned int));
134 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::decrypt)(std::string));
135 context.expose(this, "", (int)(InternalEncryption::isPasswordInitialized)());
136 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::initPassword)(std::string));
137 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::cleanPassword)(std::string));
138 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::changePassword)(std::string, std::string));
139 context.expose(this, PRIVILEGE_PLATFORM, (int)(InternalEncryption::verifyPassword)(std::string));
140 context.expose(this, "", (int)(InternalEncryption::getState)());
141 context.expose(this, "", (unsigned int)(InternalEncryption::getSupportedOptions)());
143 context.createNotification("InternalEncryption::mount");
145 std::string source = INTERNAL_DEV_PATH "/" INTERNAL_DEV_NAME;
147 runtime::DirectoryIterator iter(INTERNAL_DEV_PATH), end;
149 while (iter != end) {
150 const std::string& path = (*iter).getPath();
151 std::string name = path.substr(path.rfind('/') + 1);
153 upper.reserve(name.size());
154 for (char c : name) {
155 upper += std::toupper(c);
157 if (upper == INTERNAL_DEV_NAME) {
163 } catch (runtime::Exception &e) {}
165 engine.reset(new INTERNAL_ENGINE(
166 source, INTERNAL_PATH,
167 ProgressBar([](int v) {
168 ::vconf_set_str(VCONFKEY_ODE_ENCRYPT_PROGRESS,
169 std::to_string(v).c_str());
174 InternalEncryption::~InternalEncryption()
178 int InternalEncryption::setMountPassword(const std::string& password)
180 KeyManager::data pwData(password.begin(), password.end());
181 KeyManager keyManager(engine->getKeyMeta());
182 if (!keyManager.verifyPassword(pwData)) {
186 ode::mountKey = keyManager.getMasterKey(pwData);
191 int InternalEncryption::mount()
193 if (getState() != State::Encrypted) {
197 if (engine->isMounted()) {
198 INFO(SINK, "Already mounted");
202 engine->mount(mountKey, getOptions());
205 context.notify("InternalEncryption::mount");
207 runtime::File("/tmp/.lazy_mount").create(O_WRONLY);
208 runtime::File("/tmp/.unlock_mnt").create(O_WRONLY);
213 int InternalEncryption::umount()
215 if (getState() != State::Encrypted) {
219 if (!engine->isMounted()) {
220 INFO(SINK, "Already umounted");
224 INFO(SINK, "Close all processes that use internal storage...");
225 stopDependedSystemdServices();
226 killDependedProcesses();
227 INFO(SINK, "Umount internal storage...");
233 int InternalEncryption::encrypt(const std::string& password, unsigned int options)
235 if (getState() != State::Unencrypted) {
239 KeyManager::data pwData(password.begin(), password.end());
240 KeyManager keyManager(engine->getKeyMeta());
242 if (!keyManager.verifyPassword(pwData)) {
246 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
247 auto encryptWorker = [MasterKey, options, this]() {
250 INFO(SINK, "Close all processes that use internal storage...");
251 stopDependedSystemdServices();
252 killDependedProcesses();
253 INFO(SINK, "Umount internal storage...");
254 while (::umount(INTERNAL_PATH) == -1) {
255 if (errno != EBUSY) {
256 throw runtime::Exception("Umount error - " + std::to_string(errno));
258 killDependedProcesses();
261 showProgressUI("Encrypting");
263 INFO(SINK, "Encryption started...");
264 engine->encrypt(MasterKey, options);
265 setOptions(options & getSupportedOptions());
266 INFO(SINK, "Sync disk...");
268 INFO(SINK, "Encryption completed");
270 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "encrypted");
271 context.notify("InternalEncryption::mount");
272 ::reboot(RB_AUTOBOOT);
273 } catch (runtime::Exception &e) {
274 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
275 ERROR(SINK, "Encryption failed - " + std::string(e.what()));
280 std::thread asyncWork(encryptWorker);
286 int InternalEncryption::decrypt(const std::string& password)
288 if (getState() != State::Encrypted) {
292 KeyManager::data pwData(password.begin(), password.end());
293 KeyManager keyManager(engine->getKeyMeta());
295 if (!keyManager.verifyPassword(pwData)) {
299 KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
300 auto decryptWorker = [MasterKey, this]() {
303 INFO(SINK, "Umount internal storage...");
304 stopDependedSystemdServices();
305 killDependedProcesses();
306 INFO(SINK, "Umount internal storage...");
311 } catch (runtime::Exception& e) {
312 killDependedProcesses();
316 showProgressUI("Decrypting");
318 INFO(SINK, "Decryption started...");
319 engine->decrypt(MasterKey, getOptions());
320 INFO(SINK, "Sync disk...");
322 INFO(SINK, "Decryption completed");
324 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "unencrypted");
325 ::reboot(RB_AUTOBOOT);
326 } catch (runtime::Exception &e) {
327 ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
328 ERROR(SINK, "Decryption failed - " + std::string(e.what()));
333 std::thread asyncWork(decryptWorker);
339 int InternalEncryption::recovery()
341 if (getState() != State::Unencrypted) {
346 runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
347 if (proc.execute() == -1) {
348 ERROR(SINK, "Failed to launch factory-reset");
355 int InternalEncryption::isPasswordInitialized()
357 if (engine->isKeyMetaSet()) {
363 int InternalEncryption::initPassword(const std::string& password)
365 KeyManager::data pwData(password.begin(), password.end());
366 KeyManager keyManager;
368 keyManager.initPassword(pwData);
369 engine->setKeyMeta(keyManager.serialize());
373 int InternalEncryption::cleanPassword(const std::string& password)
375 KeyManager::data pwData(password.begin(), password.end());
376 KeyManager keyManager(engine->getKeyMeta());
378 if (!keyManager.verifyPassword(pwData)) {
382 engine->clearKeyMeta();
386 int InternalEncryption::changePassword(const std::string& oldPassword,
387 const std::string& newPassword)
389 KeyManager::data oldPwData(oldPassword.begin(), oldPassword.end());
390 KeyManager::data newPwData(newPassword.begin(), newPassword.end());
391 KeyManager keyManager(engine->getKeyMeta());
393 if (!keyManager.verifyPassword(oldPwData)) {
397 keyManager.changePassword(oldPwData, newPwData);
398 engine->setKeyMeta(keyManager.serialize());
403 int InternalEncryption::verifyPassword(const std::string& password)
405 KeyManager::data pwData(password.begin(), password.end());
406 KeyManager keyManager(engine->getKeyMeta());
408 if (keyManager.verifyPassword(pwData)) {
414 int InternalEncryption::getState()
416 char *value = ::vconf_get_str(INTERNAL_STATE_VCONF_KEY);
418 throw runtime::Exception("Failed to get vconf value");
421 std::string valueStr(value);
424 if (valueStr == "encrypted") {
425 return State::Encrypted;
426 } else if (valueStr == "unencrypted") {
427 return State::Unencrypted;
429 return State::Corrupted;
435 unsigned int InternalEncryption::getSupportedOptions()
437 return engine->getSupportedOptions();