From: Sungbae Yoo Date: Mon, 13 Feb 2017 09:52:13 +0000 (+0900) Subject: Add recovery APIs to use when there is something wrong with encryption X-Git-Tag: accepted/tizen/common/20170214.173822~4 X-Git-Url: http://review.tizen.org/git/?p=platform%2Fcore%2Fsecurity%2Fode.git;a=commitdiff_plain;h=e7905d044fbeeb9f169b8c4106122cdf7ef142ca Add recovery APIs to use when there is something wrong with encryption Signed-off-by: Sungbae Yoo Change-Id: I6fccb22edc22e12165d7c80e43a86812ef0db804 --- diff --git a/lib/external-encryption.cpp b/lib/external-encryption.cpp index d17b444..fd0308c 100644 --- a/lib/external-encryption.cpp +++ b/lib/external-encryption.cpp @@ -62,6 +62,15 @@ int ExternalEncryption::decrypt(const std::string& password) } } +int ExternalEncryption::recovery() +{ + try { + return context->methodCall("ExternalEncryption::recovery"); + } catch (runtime::Exception& e) { + return -1; + } +} + int ExternalEncryption::isPasswordInitialized() { try { diff --git a/lib/internal-encryption.cpp b/lib/internal-encryption.cpp index d1ac2e0..c1bf9e3 100644 --- a/lib/internal-encryption.cpp +++ b/lib/internal-encryption.cpp @@ -62,6 +62,15 @@ int InternalEncryption::decrypt(const std::string& password) } } +int InternalEncryption::recovery() +{ + try { + return context->methodCall("InternalEncryption::recovery"); + } catch (runtime::Exception& e) { + return -1; + } +} + int InternalEncryption::isPasswordInitialized() { try { diff --git a/lib/ode/external-encryption.cpp b/lib/ode/external-encryption.cpp index 64ba04f..e578c65 100644 --- a/lib/ode/external-encryption.cpp +++ b/lib/ode/external-encryption.cpp @@ -64,6 +64,15 @@ int ode_external_encryption_decrypt(const char* password) return external.decrypt(password); } +int ode_external_encryption_recovery() +{ + ODEContext client; + RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED); + ExternalEncryption external = client.createInterface(); + + return external.recovery(); +} + int ode_external_encryption_is_password_initialized(bool* result) { RET_ON_FAILURE(result, ODE_ERROR_INVALID_PARAMETER); diff --git a/lib/ode/external-encryption.h b/lib/ode/external-encryption.h index e4c6d1b..5ab67c3 100644 --- a/lib/ode/external-encryption.h +++ b/lib/ode/external-encryption.h @@ -40,7 +40,6 @@ extern "C" { * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter * @retval #ODE_ERROR_TIMED_OUT Time out * @retval #ODE_ERROR_KEY_REJECTED Password doen't match - * @retval #ODE_ERROR_NO_SUCH_FILE No such file or directory * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have * the privilege to call this API @@ -59,7 +58,6 @@ ODE_API int ode_external_encryption_mount(const char* password); * @retval #ODE_ERROR_NONE Successful * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter * @retval #ODE_ERROR_TIMED_OUT Time out - * @retval #ODE_ERROR_NO_SUCH_FILE No such file or directory * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have * the privilege to call this API @@ -108,6 +106,24 @@ ODE_API int ode_external_encryption_encrypt(const char* password, unsigned int o ODE_API int ode_external_encryption_decrypt(const char* password); /** + * @brief Recovery external encryption when there is something wrong. + * @details Administrator can use this API to recovery encrypted external + * storage when the password is missing or the encryption is + * corrupted. Note that this API will be erase all the contents + * in external storage. + * @since_tizen 3.0 + * @return #ODE_ERROR_NONE on success, otherwise a negative value + * @retval #ODE_ERROR_NONE Successful + * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter + * @retval #ODE_ERROR_TIMED_OUT Time out + * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted + * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have + * the privilege to call this API + * @see ode_external_encryption_encrypt() + */ +ODE_API int ode_external_encryption_recovery(); + +/** * @brief Checks whether the external encryption password was created * @details Administrator can use this API to check if the password that will be used for external storage encryption/decryption diff --git a/lib/ode/internal-encryption.cpp b/lib/ode/internal-encryption.cpp index 16947f8..9c8aee8 100644 --- a/lib/ode/internal-encryption.cpp +++ b/lib/ode/internal-encryption.cpp @@ -64,6 +64,15 @@ int ode_internal_encryption_decrypt(const char* password) return internal.decrypt(password); } +int ode_internal_encryption_recovery() +{ + ODEContext client; + RET_ON_FAILURE(client.connect() == 0, ODE_ERROR_CONNECTION_REFUSED); + InternalEncryption internal = client.createInterface(); + + return internal.recovery(); +} + int ode_internal_encryption_is_password_initialized(bool* result) { RET_ON_FAILURE(result, ODE_ERROR_INVALID_PARAMETER); diff --git a/lib/ode/internal-encryption.h b/lib/ode/internal-encryption.h index 76d6220..45b7bbd 100644 --- a/lib/ode/internal-encryption.h +++ b/lib/ode/internal-encryption.h @@ -39,7 +39,6 @@ extern "C" { * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter * @retval #ODE_ERROR_TIMED_OUT Time out * @retval #ODE_ERROR_KEY_REJECTED Password doen't match - * @retval #ODE_ERROR_NO_SUCH_FILE No such file or directory * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have * the privilege to call this API @@ -58,7 +57,6 @@ ODE_API int ode_internal_encryption_mount(const char* password); * @retval #ODE_ERROR_NONE Successful * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter * @retval #ODE_ERROR_TIMED_OUT Time out - * @retval #ODE_ERROR_NO_SUCH_FILE No such file or directory * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have * the privilege to call this API @@ -109,6 +107,24 @@ ODE_API int ode_internal_encryption_encrypt(const char* password, unsigned int o ODE_API int ode_internal_encryption_decrypt(const char* password); /** + * @brief Recovery internal encryption when there is something wrong. + * @details Administrator can use this API to recovery encrypted internal + * storage when the password is missing or the encryption is + * corrupted. Note that this API will be erase all the contents + * in internal storage. + * @since_tizen 3.0 + * @return #ODE_ERROR_NONE on success, otherwise a negative value + * @retval #ODE_ERROR_NONE Successful + * @retval #ODE_ERROR_INVALID_PARAMETER Invalid parameter + * @retval #ODE_ERROR_TIMED_OUT Time out + * @retval #ODE_ERROR_NOT_PERMITTED Operation not permitted + * @retval #ODE_ERROR_PERMISSION_DENIED The application does not have + * the privilege to call this API + * @see ode_internal_encryption_encrypt() + */ +ODE_API int ode_intternal_encryption_recovery(); + +/** * @brief Checks whether the internal encryption password was created * @details Administrator can use this API to check if the password that will be used for internal storage encryption/decryption @@ -238,7 +254,7 @@ typedef enum { /** * @brief Get supported options for encryption of internal storage. * @details Administrator can use this API to get which options are - supported for encryption of external storage. + supported for encryption of internal storage. * @since_tizen 3.0 * @param[out] option The logical OR of supported options in internal storage * @return #ODE_ERROR_NONE on success, otherwise a negative value diff --git a/rmi/external-encryption.h b/rmi/external-encryption.h index da1c9c5..b935018 100644 --- a/rmi/external-encryption.h +++ b/rmi/external-encryption.h @@ -39,6 +39,8 @@ public: int encrypt(const std::string& password, unsigned int options); int decrypt(const std::string& password); + int recovery(); + int isPasswordInitialized(); int initPassword(const std::string& password); int cleanPassword(const std::string& password); diff --git a/rmi/internal-encryption.h b/rmi/internal-encryption.h index d6c3d85..8b04e82 100644 --- a/rmi/internal-encryption.h +++ b/rmi/internal-encryption.h @@ -36,6 +36,8 @@ public: int encrypt(const std::string& password, unsigned int options); int decrypt(const std::string& password); + int recovery(); + int isPasswordInitialized(); int initPassword(const std::string& password); int cleanPassword(const std::string& password); diff --git a/server/external-encryption.cpp b/server/external-encryption.cpp index 173323a..932b83e 100644 --- a/server/external-encryption.cpp +++ b/server/external-encryption.cpp @@ -300,6 +300,23 @@ int ExternalEncryption::decrypt(const std::string &password) return 0; } +int ExternalEncryption::recovery() +{ + if (getState() == State::Unencrypted) { + return -1; + } + + for (runtime::DirectoryIterator iter(engine->getSource()), end; + iter != end; ++iter) { + iter->remove(true); + } + + engine->clearKeyMeta(); + ::vconf_set_str(EXTERNAL_STATE_VCONF_KEY, "unencrypted"); + + return 0; +} + int ExternalEncryption::isPasswordInitialized() { if (engine->isKeyMetaSet()) { diff --git a/server/internal-encryption.cpp b/server/internal-encryption.cpp index f294f20..d015184 100644 --- a/server/internal-encryption.cpp +++ b/server/internal-encryption.cpp @@ -42,6 +42,17 @@ #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform" +const std::string PROG_FACTORY_RESET = "/usr/bin/dbus-send"; +const std::vector wipeCommand = { + PROG_FACTORY_RESET, + "--system", + "--type=signal", + "--print-reply", + "--dest=com.samsung.factoryreset", + "/com/samsung/factoryreset", + "com.samsung.factoryreset.start.setting" +}; + namespace ode { namespace { @@ -274,6 +285,22 @@ int InternalEncryption::decrypt(const std::string& password) return 0; } +int InternalEncryption::recovery() +{ + if (getState() != State::Unencrypted) { + return -1; + } + + //TODO + runtime::Process proc(PROG_FACTORY_RESET, wipeCommand); + if (proc.execute() == -1) { + ERROR("Failed to launch factory-reset"); + return -2; + } + + return 0; +} + int InternalEncryption::isPasswordInitialized() { if (engine->isKeyMetaSet()) { diff --git a/tools/apps/ode/src/reset-sdcard.c b/tools/apps/ode/src/reset-sdcard.c index 5b22336..3338fa7 100644 --- a/tools/apps/ode/src/reset-sdcard.c +++ b/tools/apps/ode/src/reset-sdcard.c @@ -46,7 +46,8 @@ static void popup_confirm_cb(void *data, Evas_Object *obj, void *event_info) evas_object_del(popup_data->popup); popup_data->popup = NULL; - /* [TBD] erase external storage data */ + ode_external_encryption_recovery(); + return; }