diff options
-rw-r--r-- | ext4_utils/ext4_crypt.cpp | 37 | ||||
-rw-r--r-- | ext4_utils/ext4_crypt.h | 5 | ||||
-rw-r--r-- | ext4_utils/ext4_crypt_init_extensions.cpp | 10 | ||||
-rw-r--r-- | perfprofd/Android.mk | 6 | ||||
-rw-r--r-- | perfprofd/tests/Android.mk | 4 | ||||
-rwxr-xr-x | squashfs_utils/mksquashfsimage.sh | 2 |
6 files changed, 47 insertions, 17 deletions
diff --git a/ext4_utils/ext4_crypt.cpp b/ext4_utils/ext4_crypt.cpp index be77b791..6e7b2d20 100644 --- a/ext4_utils/ext4_crypt.cpp +++ b/ext4_utils/ext4_crypt.cpp @@ -27,6 +27,7 @@ #include <sys/stat.h> #include <sys/types.h> +#include <android-base/file.h> #include <android-base/logging.h> #include <cutils/properties.h> @@ -48,6 +49,7 @@ struct ext4_encryption_policy { #define EXT4_ENCRYPTION_MODE_AES_256_XTS 1 #define EXT4_ENCRYPTION_MODE_AES_256_CTS 4 +#define EXT4_ENCRYPTION_MODE_PRIVATE 127 // ext4enc:TODO Get value from somewhere sensible #define EXT4_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct ext4_encryption_policy) @@ -99,7 +101,8 @@ static bool is_dir_empty(const char *dirname, bool *is_empty) return true; } -static bool e4crypt_policy_set(const char *directory, const char *policy, size_t policy_length) { +static bool e4crypt_policy_set(const char *directory, const char *policy, + size_t policy_length, int contents_encryption_mode) { if (policy_length != EXT4_KEY_DESCRIPTOR_SIZE) { LOG(ERROR) << "Policy wrong length: " << policy_length; return false; @@ -112,7 +115,7 @@ static bool e4crypt_policy_set(const char *directory, const char *policy, size_t ext4_encryption_policy eep; eep.version = 0; - eep.contents_encryption_mode = EXT4_ENCRYPTION_MODE_AES_256_XTS; + eep.contents_encryption_mode = contents_encryption_mode; eep.filenames_encryption_mode = EXT4_ENCRYPTION_MODE_AES_256_CTS; eep.flags = 0; memcpy(eep.master_key_descriptor, policy, EXT4_KEY_DESCRIPTOR_SIZE); @@ -129,7 +132,8 @@ static bool e4crypt_policy_set(const char *directory, const char *policy, size_t return true; } -static bool e4crypt_policy_get(const char *directory, char *policy, size_t policy_length) { +static bool e4crypt_policy_get(const char *directory, char *policy, + size_t policy_length, int contents_encryption_mode) { if (policy_length != EXT4_KEY_DESCRIPTOR_SIZE) { LOG(ERROR) << "Policy wrong length: " << policy_length; return false; @@ -151,7 +155,7 @@ static bool e4crypt_policy_get(const char *directory, char *policy, size_t polic close(fd); if ((eep.version != 0) - || (eep.contents_encryption_mode != EXT4_ENCRYPTION_MODE_AES_256_XTS) + || (eep.contents_encryption_mode != contents_encryption_mode) || (eep.filenames_encryption_mode != EXT4_ENCRYPTION_MODE_AES_256_CTS) || (eep.flags != 0)) { LOG(ERROR) << "Failed to find matching encryption policy for " << directory; @@ -162,13 +166,15 @@ static bool e4crypt_policy_get(const char *directory, char *policy, size_t polic return true; } -static bool e4crypt_policy_check(const char *directory, const char *policy, size_t policy_length) { +static bool e4crypt_policy_check(const char *directory, const char *policy, + size_t policy_length, int contents_encryption_mode) { if (policy_length != EXT4_KEY_DESCRIPTOR_SIZE) { LOG(ERROR) << "Policy wrong length: " << policy_length; return false; } char existing_policy[EXT4_KEY_DESCRIPTOR_SIZE]; - if (!e4crypt_policy_get(directory, existing_policy, EXT4_KEY_DESCRIPTOR_SIZE)) return false; + if (!e4crypt_policy_get(directory, existing_policy, EXT4_KEY_DESCRIPTOR_SIZE, + contents_encryption_mode)) return false; char existing_policy_hex[EXT4_KEY_DESCRIPTOR_SIZE_HEX]; policy_to_hex(existing_policy, existing_policy_hex); @@ -185,13 +191,26 @@ static bool e4crypt_policy_check(const char *directory, const char *policy, size return true; } -int e4crypt_policy_ensure(const char *directory, const char *policy, size_t policy_length) { +int e4crypt_policy_ensure(const char *directory, const char *policy, + size_t policy_length, const char* contents_encryption_mode) { + int mode = 0; + if (!strcmp(contents_encryption_mode, "software")) { + mode = EXT4_ENCRYPTION_MODE_AES_256_XTS; + } else if (!strcmp(contents_encryption_mode, "ice")) { + mode = EXT4_ENCRYPTION_MODE_PRIVATE; + } else { + LOG(ERROR) << "Invalid encryption mode"; + return -1; + } + bool is_empty; if (!is_dir_empty(directory, &is_empty)) return -1; if (is_empty) { - if (!e4crypt_policy_set(directory, policy, policy_length)) return -1; + if (!e4crypt_policy_set(directory, policy, policy_length, + mode)) return -1; } else { - if (!e4crypt_policy_check(directory, policy, policy_length)) return -1; + if (!e4crypt_policy_check(directory, policy, policy_length, + mode)) return -1; } return 0; } diff --git a/ext4_utils/ext4_crypt.h b/ext4_utils/ext4_crypt.h index ddc09a71..c306ce80 100644 --- a/ext4_utils/ext4_crypt.h +++ b/ext4_utils/ext4_crypt.h @@ -22,9 +22,12 @@ __BEGIN_DECLS bool e4crypt_is_native(); -int e4crypt_policy_ensure(const char *directory, const char* policy, size_t policy_length); +int e4crypt_policy_ensure(const char *directory, + const char* policy, size_t policy_length, + const char* contents_encryption_mode); static const char* e4crypt_unencrypted_folder = "/unencrypted"; static const char* e4crypt_key_ref = "/unencrypted/ref"; +static const char* e4crypt_key_mode = "/unencrypted/mode"; __END_DECLS diff --git a/ext4_utils/ext4_crypt_init_extensions.cpp b/ext4_utils/ext4_crypt_init_extensions.cpp index c6baea74..70b17507 100644 --- a/ext4_utils/ext4_crypt_init_extensions.cpp +++ b/ext4_utils/ext4_crypt_init_extensions.cpp @@ -141,8 +141,16 @@ int e4crypt_set_directory_policy(const char* dir) KLOG_ERROR(TAG, "Unable to read system policy to set on %s\n", dir); return -1; } + + auto type_filename = std::string("/data") + e4crypt_key_mode; + std::string contents_encryption_mode; + if (!android::base::ReadFileToString(type_filename, &contents_encryption_mode)) { + LOG(ERROR) << "Cannot read mode"; + } + KLOG_INFO(TAG, "Setting policy on %s\n", dir); - int result = e4crypt_policy_ensure(dir, policy.c_str(), policy.size()); + int result = e4crypt_policy_ensure(dir, policy.c_str(), policy.length(), + contents_encryption_mode.c_str()); if (result) { KLOG_ERROR(TAG, "Setting %02x%02x%02x%02x policy on %s failed!\n", policy[0], policy[1], policy[2], policy[3], dir); diff --git a/perfprofd/Android.mk b/perfprofd/Android.mk index 99d6c663..6409f834 100644 --- a/perfprofd/Android.mk +++ b/perfprofd/Android.mk @@ -12,7 +12,7 @@ perfprofd_cppflags := \ # include $(CLEAR_VARS) LOCAL_CLANG := true -LOCAL_CPP_EXTENSION := cc +LOCAL_CPP_EXTENSION := .cc LOCAL_MODULE := libperfprofdcore LOCAL_MODULE_CLASS := STATIC_LIBRARIES LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES) @@ -41,7 +41,7 @@ include $(BUILD_STATIC_LIBRARY) # include $(CLEAR_VARS) LOCAL_CLANG := true -LOCAL_CPP_EXTENSION := cc +LOCAL_CPP_EXTENSION := .cc LOCAL_CXX_STL := libc++ LOCAL_MODULE := libperfprofdutils LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES) @@ -55,7 +55,7 @@ include $(BUILD_STATIC_LIBRARY) # include $(CLEAR_VARS) LOCAL_CLANG := true -LOCAL_CPP_EXTENSION := cc +LOCAL_CPP_EXTENSION := .cc LOCAL_CXX_STL := libc++ LOCAL_SRC_FILES := perfprofdmain.cc LOCAL_STATIC_LIBRARIES := libperfprofdcore libperfprofdutils diff --git a/perfprofd/tests/Android.mk b/perfprofd/tests/Android.mk index 7d372c4b..bdd82e07 100644 --- a/perfprofd/tests/Android.mk +++ b/perfprofd/tests/Android.mk @@ -8,7 +8,7 @@ perfprofd_test_cppflags := -Wall -Wno-sign-compare -Wno-unused-parameter -Werror # include $(CLEAR_VARS) LOCAL_CLANG := true -LOCAL_CPP_EXTENSION := cc +LOCAL_CPP_EXTENSION := .cc LOCAL_CXX_STL := libc++ LOCAL_C_INCLUDES += system/extras/perfprofd LOCAL_MODULE := libperfprofdmockutils @@ -32,7 +32,7 @@ include $(BUILD_PREBUILT) # include $(CLEAR_VARS) LOCAL_CLANG := true -LOCAL_CPP_EXTENSION := cc +LOCAL_CPP_EXTENSION := .cc LOCAL_CXX_STL := libc++ LOCAL_STATIC_LIBRARIES := libperfprofdcore libperfprofdmockutils libgtest libbase LOCAL_SHARED_LIBRARIES := libprotobuf-cpp-lite diff --git a/squashfs_utils/mksquashfsimage.sh b/squashfs_utils/mksquashfsimage.sh index 5f8cfeab..0079f6ef 100755 --- a/squashfs_utils/mksquashfsimage.sh +++ b/squashfs_utils/mksquashfsimage.sh @@ -90,7 +90,7 @@ if [ -n "$BLOCK_SIZE" ]; then OPT="$OPT -b $BLOCK_SIZE" fi -MAKE_SQUASHFS_CMD="mksquashfs $SRC_DIR/ $OUTPUT_FILE -no-progress -comp $COMPRESSOR $COMPRESSOR_OPT -no-exports -noappend -no-recovery -android-fs-config $OPT" +MAKE_SQUASHFS_CMD="mksquashfs $SRC_DIR/ $OUTPUT_FILE -no-progress -comp $COMPRESSOR $COMPRESSOR_OPT -no-exports -noappend -no-recovery -android-fs-config -no-fragments $OPT" echo $MAKE_SQUASHFS_CMD $MAKE_SQUASHFS_CMD |