Add recovery APIs to use when there is something wrong with encryption

Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
Change-Id: I6fccb22edc22e12165d7c80e43a86812ef0db804

diff --git a/lib/external-encryption.cpp b/lib/external-encryption.cpp
index d17b444..fd0308c 100644 (file)
--- a/lib/external-encryption.cpp
+++ b/lib/external-encryption.cpp
@@ -62,6 +62,15 @@ int ExternalEncryption::decrypt(const std::string& password)
        }
 }
 
+int ExternalEncryption::recovery()
+{
+       try {
+               return context->methodCall<int>("ExternalEncryption::recovery");
+       } catch (runtime::Exception& e) {
+               return -1;
+       }
+}
+
 int ExternalEncryption::isPasswordInitialized()
 {
        try {

diff --git a/lib/internal-encryption.cpp b/lib/internal-encryption.cpp
index d1ac2e0..c1bf9e3 100644 (file)
--- a/lib/internal-encryption.cpp
+++ b/lib/internal-encryption.cpp
@@ -62,6 +62,15 @@ int InternalEncryption::decrypt(const std::string& password)
        }
 }
 
+int InternalEncryption::recovery()
+{
+       try {
+               return context->methodCall<int>("InternalEncryption::recovery");
+       } catch (runtime::Exception& e) {
+               return -1;
+       }
+}
+
 int InternalEncryption::isPasswordInitialized()
 {
        try {

diff --git a/lib/ode/external-encryption.cpp b/lib/ode/external-encryption.cpp
index 64ba04f..e578c65 100644 (file)
--- a/lib/ode/external-encryption.cpp
+++ b/lib/ode/external-encryption.cpp
@@ -64,6 +64,15 @@ int ode_external_encryption_decrypt(const char* password)
        return external.decrypt(password);
 }
 
+int ode_external_encryption_recovery()
+{
+       ODEContext client;
+       RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED);
+       ExternalEncryption external = client.createInterface<ExternalEncryption>();
+
+       return external.recovery();
+}
+
 int ode_external_encryption_is_password_initialized(bool* result)
 {
        RET_ON_FAILURE(result, ODE_ERROR_INVALID_PARAMETER);

diff --git a/lib/ode/external-encryption.h b/lib/ode/external-encryption.h
index e4c6d1b..5ab67c3 100644 (file)
--- a/lib/ode/external-encryption.h
+++ b/lib/ode/external-encryption.h
@@ -40,7 +40,6 @@ extern "C" {
  * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
  * @retval      #ODE_ERROR_TIMED_OUT Time out
  * @retval      #ODE_ERROR_KEY_REJECTED Password doen't match
- * @retval      #ODE_ERROR_NO_SUCH_FILE No such file or directory
  * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
  * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
  *              the privilege to call this API
@@ -59,7 +58,6 @@ ODE_API int ode_external_encryption_mount(const char* password);
  * @retval      #ODE_ERROR_NONE Successful
  * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
  * @retval      #ODE_ERROR_TIMED_OUT Time out
- * @retval      #ODE_ERROR_NO_SUCH_FILE No such file or directory
  * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
  * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
  *              the privilege to call this API
@@ -108,6 +106,24 @@ ODE_API int ode_external_encryption_encrypt(const char* password, unsigned int o
 ODE_API int ode_external_encryption_decrypt(const char* password);
 
 /**
+ * @brief       Recovery external encryption when there is something wrong.
+ * @details     Administrator can use this API to recovery encrypted external
+ *              storage when the password is missing or the encryption is
+ *              corrupted. Note that this API will be erase all the contents
+ *              in external storage.
+ * @since_tizen 3.0
+ * @return      #ODE_ERROR_NONE on success, otherwise a negative value
+ * @retval      #ODE_ERROR_NONE Successful
+ * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
+ * @retval      #ODE_ERROR_TIMED_OUT Time out
+ * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
+ * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
+ *              the privilege to call this API
+ * @see         ode_external_encryption_encrypt()
+ */
+ODE_API int ode_external_encryption_recovery();
+
+/**
  * @brief       Checks whether the external encryption password was created
  * @details     Administrator can use this API to check if the password that
                 will be used for external storage encryption/decryption

diff --git a/lib/ode/internal-encryption.cpp b/lib/ode/internal-encryption.cpp
index 16947f8..9c8aee8 100644 (file)
--- a/lib/ode/internal-encryption.cpp
+++ b/lib/ode/internal-encryption.cpp
@@ -64,6 +64,15 @@ int ode_internal_encryption_decrypt(const char* password)
        return internal.decrypt(password);
 }
 
+int ode_internal_encryption_recovery()
+{
+       ODEContext client;
+       RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED);
+       InternalEncryption internal = client.createInterface<InternalEncryption>();
+
+       return internal.recovery();
+}
+
 int ode_internal_encryption_is_password_initialized(bool* result)
 {
     RET_ON_FAILURE(result, ODE_ERROR_INVALID_PARAMETER);

diff --git a/lib/ode/internal-encryption.h b/lib/ode/internal-encryption.h
index 76d6220..45b7bbd 100644 (file)
--- a/lib/ode/internal-encryption.h
+++ b/lib/ode/internal-encryption.h
@@ -39,7 +39,6 @@ extern "C" {
  * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
  * @retval      #ODE_ERROR_TIMED_OUT Time out
  * @retval      #ODE_ERROR_KEY_REJECTED Password doen't match
- * @retval      #ODE_ERROR_NO_SUCH_FILE No such file or directory
  * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
  * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
  *              the privilege to call this API
@@ -58,7 +57,6 @@ ODE_API int ode_internal_encryption_mount(const char* password);
  * @retval      #ODE_ERROR_NONE Successful
  * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
  * @retval      #ODE_ERROR_TIMED_OUT Time out
- * @retval      #ODE_ERROR_NO_SUCH_FILE No such file or directory
  * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
  * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
  *              the privilege to call this API
@@ -109,6 +107,24 @@ ODE_API int ode_internal_encryption_encrypt(const char* password, unsigned int o
 ODE_API int ode_internal_encryption_decrypt(const char* password);
 
 /**
+ * @brief       Recovery internal encryption when there is something wrong.
+ * @details     Administrator can use this API to recovery encrypted internal
+ *              storage when the password is missing or the encryption is
+ *              corrupted. Note that this API will be erase all the contents
+ *              in internal storage.
+ * @since_tizen 3.0
+ * @return      #ODE_ERROR_NONE on success, otherwise a negative value
+ * @retval      #ODE_ERROR_NONE Successful
+ * @retval      #ODE_ERROR_INVALID_PARAMETER Invalid parameter
+ * @retval      #ODE_ERROR_TIMED_OUT Time out
+ * @retval      #ODE_ERROR_NOT_PERMITTED Operation not permitted
+ * @retval      #ODE_ERROR_PERMISSION_DENIED The application does not have
+ *              the privilege to call this API
+ * @see         ode_internal_encryption_encrypt()
+ */
+ODE_API int ode_intternal_encryption_recovery();
+
+/**
  * @brief       Checks whether the internal encryption password was created
  * @details     Administrator can use this API to check if the password that
                 will be used for internal storage encryption/decryption
@@ -238,7 +254,7 @@ typedef enum {
 /**
  * @brief       Get supported options for encryption of internal storage.
  * @details     Administrator can use this API to get which options are
-                supported for encryption of external storage.
+                supported for encryption of internal storage.
  * @since_tizen 3.0
  * @param[out]  option The logical OR of supported options in internal storage
  * @return      #ODE_ERROR_NONE on success, otherwise a negative value

diff --git a/rmi/external-encryption.h b/rmi/external-encryption.h
index da1c9c5..b935018 100644 (file)
--- a/rmi/external-encryption.h
+++ b/rmi/external-encryption.h
@@ -39,6 +39,8 @@ public:
        int encrypt(const std::string& password, unsigned int options);
        int decrypt(const std::string& password);
 
+       int recovery();
+
        int isPasswordInitialized();
        int initPassword(const std::string& password);
        int cleanPassword(const std::string& password);

diff --git a/rmi/internal-encryption.h b/rmi/internal-encryption.h
index d6c3d85..8b04e82 100644 (file)
--- a/rmi/internal-encryption.h
+++ b/rmi/internal-encryption.h
@@ -36,6 +36,8 @@ public:
        int encrypt(const std::string& password, unsigned int options);
        int decrypt(const std::string& password);
 
+       int recovery();
+
        int isPasswordInitialized();
        int initPassword(const std::string& password);
        int cleanPassword(const std::string& password);

diff --git a/server/external-encryption.cpp b/server/external-encryption.cpp
index 173323a..932b83e 100644 (file)
--- a/server/external-encryption.cpp
+++ b/server/external-encryption.cpp
@@ -300,6 +300,23 @@ int ExternalEncryption::decrypt(const std::string &password)
        return 0;
 }
 
+int ExternalEncryption::recovery()
+{
+       if (getState() == State::Unencrypted) {
+               return -1;
+       }
+
+       for (runtime::DirectoryIterator iter(engine->getSource()), end;
+                       iter != end; ++iter) {
+               iter->remove(true);
+       }
+
+       engine->clearKeyMeta();
+       ::vconf_set_str(EXTERNAL_STATE_VCONF_KEY, "unencrypted");
+
+       return 0;
+}
+
 int ExternalEncryption::isPasswordInitialized()
 {
        if (engine->isKeyMetaSet()) {

diff --git a/server/internal-encryption.cpp b/server/internal-encryption.cpp
index f294f20..d015184 100644 (file)
--- a/server/internal-encryption.cpp
+++ b/server/internal-encryption.cpp
@@ -42,6 +42,17 @@
 
 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
 
+const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send";
+const std::vector<std::string> wipeCommand = {
+    PROG_FACTORY_RESET,
+    "--system",
+    "--type=signal",
+    "--print-reply",
+    "--dest=com.samsung.factoryreset",
+    "/com/samsung/factoryreset",
+    "com.samsung.factoryreset.start.setting"
+};
+
 namespace ode {
 
 namespace {
@@ -274,6 +285,22 @@ int InternalEncryption::decrypt(const std::string& password)
        return 0;
 }
 
+int InternalEncryption::recovery()
+{
+       if (getState() != State::Unencrypted) {
+               return -1;
+       }
+
+       //TODO
+       runtime::Process proc(PROG_FACTORY_RESET, wipeCommand);
+       if (proc.execute() == -1) {
+               ERROR("Failed to launch factory-reset");
+               return -2;
+       }
+
+       return 0;
+}
+
 int InternalEncryption::isPasswordInitialized()
 {
        if (engine->isKeyMetaSet()) {

diff --git a/tools/apps/ode/src/reset-sdcard.c b/tools/apps/ode/src/reset-sdcard.c
index 5b22336..3338fa7 100644 (file)
--- a/tools/apps/ode/src/reset-sdcard.c
+++ b/tools/apps/ode/src/reset-sdcard.c
@@ -46,7 +46,8 @@ static void popup_confirm_cb(void *data, Evas_Object *obj, void *event_info)
        evas_object_del(popup_data->popup);
        popup_data->popup = NULL;
 
-       /* [TBD] erase external storage data */
+       ode_external_encryption_recovery();
+
        return;
 }