Encryption API full implementation using ext4 and keyring

Change-Id: Ife5dbdedac8d3c6402f54a871b007d8421a7e908

diff --git a/src/client/client-security-manager.cpp b/src/client/client-security-manager.cpp
index 3bbd6c2409a9aea173a7378119030373a295d32d..a026289363e830e795ee536e522197b6ca7c7b85 100644 (file)
--- a/src/client/client-security-manager.cpp
+++ b/src/client/client-security-manager.cpp
@@ -57,6 +57,9 @@
 #include <service_impl.h>
 #include <check-proper-drop.h>
 #include <utils.h>
+#include <ext4.h>
+#include <keyring.h>
+#include <yaca-lifetime.h>
 
 #include <security-manager.h>
 #include <client-offline.h>
@@ -1672,12 +1675,14 @@ int security_manager_app_unlock(const char *app_id, const char *password)
     return try_catch([&]() -> int {
         std::vector<char> fek;
 
-        // get key from key manager
+        // get FEK from key manager
         int ret = security_manager_get_fek(app_id, password, fek);
         if (ret != SECURITY_MANAGER_SUCCESS)
             return ret;
 
-        // TODO insert it into process keyring
+        // insert FEK into process keyring
+        EXT4::Key fekKey(fek);
+        fekKey.insertIntoKeyring(KeyRing::PROCESS_KEYRING);
 
         return SECURITY_MANAGER_SUCCESS;
     });

diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp
index 268e5bd64a68e2caac05d3bd1cf288c401072a24..9e0817ee4c1d0ab03ce9be6f5a7395e92ae60729 100644 (file)
--- a/src/common/service_impl.cpp
+++ b/src/common/service_impl.cpp
@@ -43,6 +43,9 @@
 
 #include <sys/smack.h>
 
+#include <yaca_crypto.h>
+#include <yaca_error.h>
+
 #include <config.h>
 #include "protocols.h"
 #include "privilege_db.h"
@@ -57,6 +60,9 @@
 #include "privilege-info.h"
 #include "fek-manager.h"
 #include "encryption-access.h"
+#include "ext4.h"
+#include "keyring.h"
+#include "yaca-lifetime.h"
 
 #include "service_impl.h"
 
@@ -105,7 +111,6 @@ ServiceImpl::ServiceImpl()
 
 ServiceImpl::~ServiceImpl()
 {
-    // TODO cleanup yaca if necessary
 }
 
 int ServiceImpl::validatePolicy(const Credentials &creds, policy_entry &policyEntry, CynaraAdminPolicy &cyap)
@@ -1804,20 +1809,32 @@ int ServiceImpl::appChangePassword(const Credentials &creds,
             // enable encryption
 
             // generate FEK
-            std::vector<char> fek(64, 0);
+            std::vector<char> fek(EXT4::KEY_SIZE, 0);
 
-            // TODO initialize yaca (on demand)
+            // initialize yaca for ext4 key operations
+            if (g_yacaLifetime.initialize() != YACA_ERROR_NONE)
+                return SECURITY_MANAGER_ERROR_UNKNOWN;
 
-            // TODO randomize FEK
+            // randomize FEK
+            ret = yaca_randomize_bytes(fek.data(), EXT4::KEY_SIZE);
+            if (ret != YACA_ERROR_NONE)
+                return SECURITY_MANAGER_ERROR_UNKNOWN;
 
-            // TODO insert FEK into keyring
+            // insert FEK into keyring
+            EXT4::Key fekKey(fek);
+            const std::string fekHash = fekKey.getHash();
+            int32_t fekId = fekKey.insertIntoKeyring(KeyRing::PROCESS_KEYRING);
 
             for (const auto& p : paths) {
-                (void)p;
-                // TODO set policy for path
+                // encrypt directory
+                EXT4::Directory dir(p);
+                dir.encrypt(fekHash);
             }
 
-            // TODO remove FEK from keyring
+            // remove FEK from keyring
+            KeyRing::Key key(fekId);
+            key.revoke();
+            key.unlink(KeyRing::PROCESS_KEYRING);
 
             // store FEK protected with password
             return FEKmanager::saveFEK(creds.uid, creds.label, appName, newPw, fek);
@@ -1832,13 +1849,19 @@ int ServiceImpl::appChangePassword(const Credentials &creds,
                 return ret;
 
             // insert FEK into keyring to decrypt existing data
+            EXT4::Key fekKey(fek);
+            int32_t fekId = fekKey.insertIntoKeyring(KeyRing::PROCESS_KEYRING);
 
             for (const auto& p : paths) {
-                (void)p;
-                // TODO remove/decrypt directory
+                // decrypt directory
+                EXT4::Directory dir(p);
+                dir.decrypt();
             }
 
-            // TODO remove FEK from keyring
+            // remove FEK from keyring
+            KeyRing::Key key(fekId);
+            key.revoke();
+            key.unlink(KeyRing::PROCESS_KEYRING);
 
             // remove FEK from key manager
             return FEKmanager::removeFEK(creds.uid, creds.label, appName);