Add systemd unit for external storage mount with smackfs* option

Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
Change-Id: Ia1ff32955fd0760bde1144b5e009af368c972cea

diff --git a/packaging/ode.spec b/packaging/ode.spec
index fe3f58f..b1d1595 100755 (executable)
--- a/packaging/ode.spec
+++ b/packaging/ode.spec
@@ -28,8 +28,12 @@ The ode package provides a daemon which is responsible for encrypting/decryption
 %manifest ode.manifest
 %defattr(644,root,root,755)
 %attr(755,root,root) %{_bindir}/oded
+%attr(700,root,root) %{_sbindir}/ode-mount-external.sh
 %{_unitdir}/ode.service
 %{_unitdir}/multi-user.target.wants/ode.service
+%{_unitdir}/ode-mount-external.path
+%{_unitdir}/ode-mount-external.service
+%{_unitdir}/multi-user.target.wants/ode-mount-external.path
 %attr(700,root,root) %{_sbindir}/ode-admin-cli
 
 %prep
@@ -57,6 +61,7 @@ make %{?jobs:-j%jobs}
 %make_install
 mkdir -p %{buildroot}/%{_unitdir}/multi-user.target.wants
 ln -s ../ode.service %{buildroot}/%{_unitdir}/multi-user.target.wants/ode.service
+ln -s ../ode-mount-external.path %{buildroot}/%{_unitdir}/multi-user.target.wants/ode-mount-external.path
 
 %find_lang secure-erase
 %find_lang ode

diff --git a/server/CMakeLists.txt b/server/CMakeLists.txt
index 7c0ee26..e72b8ca 100644 (file)
--- a/server/CMakeLists.txt
+++ b/server/CMakeLists.txt
@@ -68,6 +68,9 @@ TARGET_COMPILE_DEFINITIONS(${SERVER_NAME} PRIVATE
 )
 
 CONFIGURE_FILE(systemd/${PROJECT_NAME}.service.in systemd/${PROJECT_NAME}.service)
+CONFIGURE_FILE(systemd/${PROJECT_NAME}-mount-external.service.in systemd/${PROJECT_NAME}-mount-external.service)
 
 INSTALL(TARGETS ${SERVER_NAME} DESTINATION ${BIN_DIR})
 INSTALL(FILES systemd/${PROJECT_NAME}.service DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.path DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.service DESTINATION ${SYSTEMD_UNIT_DIR})

diff --git a/server/engine/encryption/ecryptfs-engine.cpp b/server/engine/encryption/ecryptfs-engine.cpp
index e0c5371..ba7b965 100644 (file)
--- a/server/engine/encryption/ecryptfs-engine.cpp
+++ b/server/engine/encryption/ecryptfs-engine.cpp
@@ -24,6 +24,7 @@
 #include <klay/exception.h>
 #include <klay/filesystem.h>
 
+#include "../../key-manager/key-generator.h"
 #include "../../kernel-keyring.h"
 #include "../../file-footer.h"
 #include "../../logger.h"
@@ -280,11 +281,13 @@ void ecryptfsMount(const std::string &source, const std::string &destination, co
        ::memcpy(payload.token.password.sessionKeyEncryptionKey, key.data(),
                                payload.token.password.sessionKeyEncryptionKeySize);
 
+       KeyGenerator::data sigdata = KeyGenerator::MD5(KeyGenerator::data(destination.begin(), destination.end()));
     std::stringstream signature;
     signature<< std::hex << std::setfill('0') << std::setw(2);
-    for (unsigned int byte : key) {
+    for (unsigned int byte : sigdata) {
         signature << byte;
     }
+
        for (int i = key.size(); i < ECRYPTFS_SIGNATURE_SIZE / 2; i++) {
                signature << (unsigned int) 0;
        }

diff --git a/server/external-encryption.cpp b/server/external-encryption.cpp
index 65373a2..29c391a 100644 (file)
--- a/server/external-encryption.cpp
+++ b/server/external-encryption.cpp
@@ -16,6 +16,7 @@
 #include <fstream>
 #include <sstream>
 
+#include <fcntl.h>
 #include <signal.h>
 #include <unistd.h>
 #include <sys/mount.h>
@@ -43,6 +44,7 @@
 #define EXTERNAL_STATE_VCONF_KEY VCONFKEY_SDE_CRYPTO_STATE
 #define EXTERNAL_OPTION_ONLY_NEW_FILE_VCONF_KEY VCONFKEY_SDE_ENCRYPT_NEWFILE
 #define EXTERNAL_OPTION_EXCEPT_FOR_MEDIA_FILE_VCONF_KEY VCONFKEY_SDE_EXCLUDE_MEDIAFILE
+#define EXTERNAL_SYSTEMD_UNIT  "ode-mount-external.service"
 
 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
 
@@ -265,6 +267,13 @@ int ExternalEncryption::mount()
        engine->mount(mountKey, getOptions());
        mountKey.clear();
 
+       //For smackfsroot, smackfsdef option without CAP_MAC_ADMIN
+       runtime::File fileToTouch("/tmp/.ode-mount-external");
+       try {
+               fileToTouch.remove();
+       } catch(runtime::Exception &e) {}
+       fileToTouch.create(O_WRONLY);
+
        context.notify("ExternalEncryption::mount");
 
        return 0;

diff --git a/server/internal-encryption.cpp b/server/internal-encryption.cpp
index 897a6fd..192c275 100644 (file)
--- a/server/internal-encryption.cpp
+++ b/server/internal-encryption.cpp
@@ -292,6 +292,8 @@ int InternalEncryption::umount()
                return 0;
        }
 
+       INFO(SINK, "Close all user sessions...");
+       stopSystemdUserSessions();
        INFO(SINK, "Close all processes using internal storage...");
        stopDependedSystemdServices();
        INFO(SINK, "Umount internal storage...");

diff --git a/server/systemd/ode-mount-external.path b/server/systemd/ode-mount-external.path
new file mode 100644 (file)
index 0000000..e36fad7
--- /dev/null
+++ b/server/systemd/ode-mount-external.path
@@ -0,0 +1,2 @@
+[Path]
+PathExists=/tmp/.ode-mount-external

diff --git a/server/systemd/ode-mount-external.service.in b/server/systemd/ode-mount-external.service.in
new file mode 100644 (file)
index 0000000..4e121bf
--- /dev/null
+++ b/server/systemd/ode-mount-external.service.in
@@ -0,0 +1,9 @@
+[Unit]
+Description=@PROJECT_NAME@ mount for external encrypted storage
+After=@PROJECT_NAME@.service
+
+[Service]
+Type=oneshot
+SmackProcessLabel=System::Privileged
+ExecStart=/sbin/ode-mount-external.sh
+CapabilityBoundingSet=~CAP_MAC_OVERRIDE

diff --git a/tools/cli/CMakeLists.txt b/tools/cli/CMakeLists.txt
index ae42a87..efde6cd 100644 (file)
--- a/tools/cli/CMakeLists.txt
+++ b/tools/cli/CMakeLists.txt
@@ -35,3 +35,4 @@ INCLUDE_DIRECTORIES(SYSTEM ${CLI_DEPS_INCLUDE_DIRS} ${ODE_LIB})
 TARGET_LINK_LIBRARIES(${CLI_NAME} ${CLI_DEPS_LIBRARIES} ${PROJECT_NAME} ode)
 
 INSTALL(TARGETS ${CLI_NAME} DESTINATION sbin)
+INSTALL(FILES ${PROJECT_NAME}-mount-external.sh DESTINATION sbin)

diff --git a/tools/cli/ode-mount-external.sh b/tools/cli/ode-mount-external.sh
new file mode 100644 (file)
index 0000000..d4e00f6
--- /dev/null
+++ b/tools/cli/ode-mount-external.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+PATH="/usr/bin:/bin:/usr/sbin:/sbin"
+
+STORAGE="/opt/media/SDCardA1"
+
+OPTION=`cat /proc/mounts | grep "${STORAGE} ${STORAGE} ecryptfs" | gawk '{print $4}'`
+
+if [ -z ${OPTION} ]; then
+       exit -1
+fi
+
+umount ${STORAGE}
+
+mount -t ecryptfs -o ${OPTION},smackfsroot=*,smackfsdef=* ${STORAGE} ${STORAGE}