summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--Android.mk11
-rw-r--r--BasePartition.cpp28
-rw-r--r--crypto/ext4crypt/Android.mk2
-rw-r--r--crypto/ext4crypt/Ext4Crypt.cpp3
-rw-r--r--crypto/ext4crypt/Ext4CryptPie.cpp5
-rw-r--r--crypto/ext4crypt/MetadataCrypt.cpp271
-rw-r--r--crypto/ext4crypt/MetadataCrypt.h25
-rw-r--r--partition.cpp202
-rw-r--r--partitionmanager.cpp26
-rw-r--r--partitions.hpp19
-rw-r--r--prebuilt/Android.mk36
11 files changed, 528 insertions, 100 deletions
diff --git a/Android.mk b/Android.mk
index 3b29c7acc..95c190ea8 100644
--- a/Android.mk
+++ b/Android.mk
@@ -196,6 +196,11 @@ LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/sbin
#else
# LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_UI_LIB)
#endif
+ifeq ($(TARGET_RECOVERY_TWRP_LIB),)
+ LOCAL_SRC_FILES += BasePartition.cpp
+else
+ LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_TWRP_LIB)
+endif
LOCAL_C_INCLUDES += system/extras/ext4_utils
@@ -302,6 +307,9 @@ ifeq ($(TW_INCLUDE_CRYPTO), true)
TW_INCLUDE_CRYPTO_FBE := true
LOCAL_CFLAGS += -DTW_INCLUDE_FBE
LOCAL_SHARED_LIBRARIES += libe4crypt
+ ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+ LOCAL_CFLAGS += -DTW_INCLUDE_FBE_METADATA_DECRYPT
+ endif
endif
ifneq ($(TW_CRYPTO_USE_SYSTEM_VOLD),)
ifneq ($(TW_CRYPTO_USE_SYSTEM_VOLD),false)
@@ -482,6 +490,9 @@ ifeq ($(shell test $(CM_PLATFORM_SDK_VERSION) -ge 3; echo $$?),0)
fsck.f2fs \
mkfs.f2fs
endif
+ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+ LOCAL_REQUIRED_MODULES += sload.f2fs
+endif
endif
ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 25; echo $$?),0)
diff --git a/BasePartition.cpp b/BasePartition.cpp
new file mode 100644
index 000000000..3b34d75c2
--- /dev/null
+++ b/BasePartition.cpp
@@ -0,0 +1,28 @@
+/*
+ Copyright 2018 TeamWin
+ This file is part of TWRP/TeamWin Recovery Project.
+
+ TWRP is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ TWRP is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with TWRP. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+
+#include "partitions.hpp"
+
+// On devices that need it, this is supposed to be overridden using
+// TARGET_RECOVERY_TWRP_LIB to allow device-specific pre and post
+// wipe encryption calls.
+
+BasePartition* make_partition() {
+ return new BasePartition();
+}
diff --git a/crypto/ext4crypt/Android.mk b/crypto/ext4crypt/Android.mk
index e589903d9..8e77cdf30 100644
--- a/crypto/ext4crypt/Android.mk
+++ b/crypto/ext4crypt/Android.mk
@@ -21,7 +21,7 @@ ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 26; echo $$?),0)
ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
#9.0 rules
LOCAL_CFLAGS += -DUSE_KEYSTORAGE_4 -Wno-unused-variable -Wno-sign-compare -Wno-unused-parameter -Wno-comment
- LOCAL_SRC_FILES += Ext4CryptPie.cpp Keymaster4.cpp KeyStorage4.cpp KeyUtil.cpp
+ LOCAL_SRC_FILES += Ext4CryptPie.cpp Keymaster4.cpp KeyStorage4.cpp KeyUtil.cpp MetadataCrypt.cpp KeyBuffer.cpp
LOCAL_SHARED_LIBRARIES += android.hardware.keymaster@4.0 libkeymaster4support
LOCAL_SHARED_LIBRARIES += android.hardware.gatekeeper@1.0 libkeystore_parcelables libkeystore_aidl
LOCAL_CFLAGS += -DHAVE_SYNTH_PWD_SUPPORT
diff --git a/crypto/ext4crypt/Ext4Crypt.cpp b/crypto/ext4crypt/Ext4Crypt.cpp
index 15d7d8f32..c9e71fd9b 100644
--- a/crypto/ext4crypt/Ext4Crypt.cpp
+++ b/crypto/ext4crypt/Ext4Crypt.cpp
@@ -317,9 +317,8 @@ bool lookup_key_ref(const std::map<userid_t, std::string>& key_map, userid_t use
}
static bool ensure_policy(const std::string& raw_ref __unused, const std::string& path) {
- LOG(INFO) << "ensure_policy '" << path << "'\n";
return true;
- return access(path.c_str(), F_OK) == 0; // ensure policy will set a policy if one is not set on an empty folder - we don't want to do this in recovery
+ // ensure policy will set a policy if one is not set on an empty folder - we don't want to do this in recovery
/*if (e4crypt_policy_ensure(path.c_str(), raw_ref.data(), raw_ref.size()) != 0) {
LOG(ERROR) << "Failed to set policy on: " << path << "\n";
return false;
diff --git a/crypto/ext4crypt/Ext4CryptPie.cpp b/crypto/ext4crypt/Ext4CryptPie.cpp
index 615229ea9..d6ea53156 100644
--- a/crypto/ext4crypt/Ext4CryptPie.cpp
+++ b/crypto/ext4crypt/Ext4CryptPie.cpp
@@ -295,9 +295,10 @@ static void get_data_file_encryption_modes(PolicyKeyRef* key_ref) {
}
static bool ensure_policy(const PolicyKeyRef& key_ref, const std::string& path) {
- return e4crypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
+ return true;
+ /*return e4crypt_policy_ensure(path.c_str(), key_ref.key_raw_ref.data(),
key_ref.key_raw_ref.size(), key_ref.contents_mode.c_str(),
- key_ref.filenames_mode.c_str()) == 0;
+ key_ref.filenames_mode.c_str()) == 0;*/
}
static bool is_numeric(const char* name) {
diff --git a/crypto/ext4crypt/MetadataCrypt.cpp b/crypto/ext4crypt/MetadataCrypt.cpp
new file mode 100644
index 000000000..b195fa09e
--- /dev/null
+++ b/crypto/ext4crypt/MetadataCrypt.cpp
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "KeyBuffer.h"
+#include "MetadataCrypt.h"
+
+#include <string>
+#include <thread>
+#include <vector>
+#include <algorithm>
+
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include <linux/dm-ioctl.h>
+
+//#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android-base/unique_fd.h>
+#include <cutils/fs.h>
+//#include <fs_mgr.h>
+
+//#include "EncryptInplace.h"
+#include "KeyStorage4.h"
+#include "KeyUtil.h"
+//#include "secontext.h"
+#include "Utils.h"
+//#include "VoldUtil.h"
+
+#include <iostream>
+#define LOG(x) std::cout
+#define PLOG(x) std::cout
+#include <linux/fs.h>
+
+#define DM_CRYPT_BUF_SIZE 4096
+#define TABLE_LOAD_RETRIES 10
+#define DEFAULT_KEY_TARGET_TYPE "default-key"
+
+using android::vold::KeyBuffer;
+
+static const std::string kDmNameUserdata = "userdata";
+
+void get_blkdev_size(int fd, unsigned long* nr_sec) {
+ if ((ioctl(fd, BLKGETSIZE, nr_sec)) == -1) {
+ *nr_sec = 0;
+ }
+}
+
+static const char* kLookup = "0123456789abcdef";
+
+android::status_t StrToHex(const KeyBuffer& str, KeyBuffer& hex) {
+ hex.clear();
+ for (size_t i = 0; i < str.size(); i++) {
+ hex.push_back(kLookup[(str.data()[i] & 0xF0) >> 4]);
+ hex.push_back(kLookup[str.data()[i] & 0x0F]);
+ }
+ return android::OK;
+}
+
+/*static bool mount_via_fs_mgr(const char* mount_point, const char* blk_device) {
+ // fs_mgr_do_mount runs fsck. Use setexeccon to run trusted
+ // partitions in the fsck domain.
+ if (setexeccon(secontextFsck())) {
+ PLOG(ERROR) << "Failed to setexeccon";
+ return false;
+ }
+ auto mount_rc = fs_mgr_do_mount(fstab_default, const_cast<char*>(mount_point),
+ const_cast<char*>(blk_device), nullptr);
+ if (setexeccon(nullptr)) {
+ PLOG(ERROR) << "Failed to clear setexeccon";
+ return false;
+ }
+ if (mount_rc != 0) {
+ LOG(ERROR) << "fs_mgr_do_mount failed with rc " << mount_rc;
+ return false;
+ }
+ LOG(DEBUG) << "Mounted " << mount_point;
+ return true;
+}*/
+
+static bool read_key(const std::string& key_dir, bool create_if_absent, KeyBuffer* key) {
+ /*if (!data_rec->key_dir) {
+ LOG(ERROR) << "Failed to get key_dir";
+ return false;
+ }
+ std::string key_dir = data_rec->key_dir;*/
+ auto dir = key_dir + "/key";
+ LOG(DEBUG) << "key_dir/key: " << dir << "\n";
+ /*if (fs_mkdirs(dir.c_str(), 0700)) {
+ PLOG(ERROR) << "Creating directories: " << dir;
+ return false;
+ }*/
+ auto temp = key_dir + "/tmp";
+ if (!android::vold::retrieveKey(create_if_absent, dir, temp, key)) return false;
+ return true;
+}
+
+static KeyBuffer default_key_params(const std::string& real_blkdev, const KeyBuffer& key) {
+ KeyBuffer hex_key;
+ if (/*android::vold::*/StrToHex(key, hex_key) != android::OK) {
+ LOG(ERROR) << "Failed to turn key to hex\n";
+ return KeyBuffer();
+ }
+ auto res = KeyBuffer() + "AES-256-XTS " + hex_key + " " + real_blkdev.c_str() + " 0";
+ return res;
+}
+
+static bool get_number_of_sectors(const std::string& real_blkdev, uint64_t *nr_sec) {
+ android::base::unique_fd dev_fd(TEMP_FAILURE_RETRY(open(
+ real_blkdev.c_str(), O_RDONLY | O_CLOEXEC, 0)));
+ if (dev_fd == -1) {
+ PLOG(ERROR) << "Unable to open " << real_blkdev << " to measure size\n";
+ return false;
+ }
+ unsigned long res;
+ // TODO: should use BLKGETSIZE64
+ get_blkdev_size(dev_fd.get(), &res);
+ if (res == 0) {
+ PLOG(ERROR) << "Unable to measure size of " << real_blkdev << "\n";
+ return false;
+ }
+ *nr_sec = res;
+ return true;
+}
+
+static struct dm_ioctl* dm_ioctl_init(char *buffer, size_t buffer_size,
+ const std::string& dm_name) {
+ if (buffer_size < sizeof(dm_ioctl)) {
+ LOG(ERROR) << "dm_ioctl buffer too small\n";
+ return nullptr;
+ }
+
+ memset(buffer, 0, buffer_size);
+ struct dm_ioctl* io = (struct dm_ioctl*) buffer;
+ io->data_size = buffer_size;
+ io->data_start = sizeof(struct dm_ioctl);
+ io->version[0] = 4;
+ io->version[1] = 0;
+ io->version[2] = 0;
+ io->flags = 0;
+ dm_name.copy(io->name, sizeof(io->name));
+ return io;
+}
+
+static bool create_crypto_blk_dev(const std::string& dm_name, uint64_t nr_sec,
+ const std::string& target_type, const KeyBuffer& crypt_params,
+ std::string* crypto_blkdev) {
+ PLOG(INFO) << "starting create_crypto_blk_dev\n";
+ android::base::unique_fd dm_fd(TEMP_FAILURE_RETRY(open(
+ "/dev/device-mapper", O_RDWR | O_CLOEXEC, 0)));
+ if (dm_fd == -1) {
+ PLOG(ERROR) << "Cannot open device-mapper\n";
+ return false;
+ }
+ alignas(struct dm_ioctl) char buffer[DM_CRYPT_BUF_SIZE];
+ auto io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+ if (!io || ioctl(dm_fd.get(), DM_DEV_CREATE, io) != 0) {
+ PLOG(ERROR) << "Cannot create dm-crypt device " << dm_name << "\n";
+ return false;
+ }
+
+ // Get the device status, in particular, the name of its device file
+ io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+ if (ioctl(dm_fd.get(), DM_DEV_STATUS, io) != 0) {
+ PLOG(ERROR) << "Cannot retrieve dm-crypt device status " << dm_name << "\n";
+ return false;
+ }
+ *crypto_blkdev = std::string() + "/dev/block/dm-" + std::to_string(
+ (io->dev & 0xff) | ((io->dev >> 12) & 0xfff00));
+
+ io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+ size_t paramix = io->data_start + sizeof(struct dm_target_spec);
+ size_t nullix = paramix + crypt_params.size();
+ size_t endix = (nullix + 1 + 7) & 8; // Add room for \0 and align to 8 byte boundary
+
+ if (endix > sizeof(buffer)) {
+ LOG(ERROR) << "crypt_params too big for DM_CRYPT_BUF_SIZE\n";
+ return false;
+ }
+
+ io->target_count = 1;
+ auto tgt = (struct dm_target_spec *) (buffer + io->data_start);
+ tgt->status = 0;
+ tgt->sector_start = 0;
+ tgt->length = nr_sec;
+ target_type.copy(tgt->target_type, sizeof(tgt->target_type));
+ memcpy(buffer + paramix, crypt_params.data(),
+ std::min(crypt_params.size(), sizeof(buffer) - paramix));
+ buffer[nullix] = '\0';
+ tgt->next = endix;
+
+ for (int i = 0; ; i++) {
+ if (ioctl(dm_fd.get(), DM_TABLE_LOAD, io) == 0) {
+ break;
+ }
+ if (i+1 >= TABLE_LOAD_RETRIES) {
+ PLOG(ERROR) << "DM_TABLE_LOAD ioctl failed\n";
+ return false;
+ }
+ PLOG(INFO) << "DM_TABLE_LOAD ioctl failed, retrying\n";
+ usleep(500000);
+ }
+
+ // Resume this device to activate it
+ io = dm_ioctl_init(buffer, sizeof(buffer), dm_name);
+ if (ioctl(dm_fd.get(), DM_DEV_SUSPEND, io)) {
+ PLOG(ERROR) << "Cannot resume dm-crypt device " << dm_name << "\n";
+ return false;
+ }
+ return true;
+}
+
+bool e4crypt_mount_metadata_encrypted(const std::string& mount_point, bool needs_encrypt, const std::string& key_dir, const std::string& blk_device, std::string* crypto_blkdev) {
+ LOG(DEBUG) << "e4crypt_mount_metadata_encrypted: " << mount_point << " " << needs_encrypt << "\n";
+ /*auto encrypted_state = android::base::GetProperty("ro.crypto.state", "");
+ if (encrypted_state != "") {
+ LOG(DEBUG) << "e4crypt_enable_crypto got unexpected starting state: " << encrypted_state;
+ return false;
+ }
+ auto data_rec = fs_mgr_get_entry_for_mount_point(fstab_default, mount_point);
+ if (!data_rec) {
+ LOG(ERROR) << "Failed to get data_rec";
+ return false;
+ }*/
+ KeyBuffer key;
+ if (!read_key(key_dir, needs_encrypt, &key)) return false;
+ uint64_t nr_sec;
+ if (!get_number_of_sectors(blk_device, &nr_sec)) return false;
+ //std::string crypto_blkdev;
+ if (!create_crypto_blk_dev(kDmNameUserdata, nr_sec, DEFAULT_KEY_TARGET_TYPE,
+ default_key_params(blk_device, key), /*&*/crypto_blkdev))
+ return false;
+ // FIXME handle the corrupt case
+ /*if (needs_encrypt) {
+ LOG(INFO) << "Beginning inplace encryption, nr_sec: " << nr_sec;
+ off64_t size_already_done = 0;
+ auto rc =
+ cryptfs_enable_inplace(const_cast<char*>(crypto_blkdev.c_str()), data_rec->blk_device,
+ nr_sec, &size_already_done, nr_sec, 0, false);
+ if (rc != 0) {
+ LOG(ERROR) << "Inplace crypto failed with code: " << rc;
+ return false;
+ }
+ if (static_cast<uint64_t>(size_already_done) != nr_sec) {
+ LOG(ERROR) << "Inplace crypto only got up to sector: " << size_already_done;
+ return false;
+ }
+ LOG(INFO) << "Inplace encryption complete";
+ }
+
+ LOG(DEBUG) << "Mounting metadata-encrypted filesystem:" << mount_point;
+ mount_via_fs_mgr(data_rec->mount_point, crypto_blkdev.c_str());*/
+ LOG(DEBUG) << "crypto block device '" << *crypto_blkdev << "\n";
+ return true;
+}
diff --git a/crypto/ext4crypt/MetadataCrypt.h b/crypto/ext4crypt/MetadataCrypt.h
new file mode 100644
index 000000000..69addf318
--- /dev/null
+++ b/crypto/ext4crypt/MetadataCrypt.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _METADATA_CRYPT_H
+#define _METADATA_CRYPT_H
+
+#include <string>
+__BEGIN_DECLS
+bool e4crypt_mount_metadata_encrypted(const std::string& mount_point, bool needs_encrypt, const std::string& key_dir, const std::string& blk_device, std::string* crypto_blkdev);
+__END_DECLS
+
+#endif
diff --git a/partition.cpp b/partition.cpp
index 1bdb91a35..ee346863d 100644
--- a/partition.cpp
+++ b/partition.cpp
@@ -114,6 +114,8 @@ const struct flag_list mount_flags[] = {
const char *ignored_mount_items[] = {
"defaults=",
"errors=",
+ "latemount",
+ "sysfs_path=",
NULL
};
@@ -154,6 +156,7 @@ enum TW_FSTAB_FLAGS {
TWFLAG_VOLDMANAGED,
TWFLAG_FORMATTABLE,
TWFLAG_RESIZE,
+ TWFLAG_KEYDIRECTORY,
};
/* Flags without a trailing '=' are considered dual format flags and can be
@@ -197,6 +200,7 @@ const struct flag_list tw_flags[] = {
{ "voldmanaged=", TWFLAG_VOLDMANAGED },
{ "formattable", TWFLAG_FORMATTABLE },
{ "resize", TWFLAG_RESIZE },
+ { "keydirectory=", TWFLAG_KEYDIRECTORY },
{ 0, 0 },
};
@@ -260,6 +264,7 @@ TWPartition::TWPartition() {
Is_Adopted_Storage = false;
Adopted_GUID = "";
SlotSelect = false;
+ Key_Directory = "";
}
TWPartition::~TWPartition(void) {
@@ -624,80 +629,39 @@ void TWPartition::Setup_Data_Partition(bool Display_Error) {
DataManager::SetValue(TW_IS_DECRYPTED, 1);
Is_Encrypted = true;
Is_Decrypted = true;
- Is_FBE = false;
+ if (Key_Directory.empty())
+ Is_FBE = false;
+ else
+ Is_FBE = true;
DataManager::SetValue(TW_IS_FBE, 0);
Decrypted_Block_Device = crypto_blkdev;
LOGINFO("Data already decrypted, new block device: '%s'\n", crypto_blkdev);
} else if (!Mount(false)) {
if (Is_Present) {
- set_partition_data(Actual_Block_Device.c_str(), Crypto_Key_Location.c_str(), Fstab_File_System.c_str());
- if (cryptfs_check_footer() == 0) {
+ if (Key_Directory.empty()) {
+ set_partition_data(Actual_Block_Device.c_str(), Crypto_Key_Location.c_str(), Fstab_File_System.c_str());
+ if (cryptfs_check_footer() == 0) {
+ Is_Encrypted = true;
+ Is_Decrypted = false;
+ Can_Be_Mounted = false;
+ Current_File_System = "emmc";
+ Setup_Image();
+ DataManager::SetValue(TW_IS_ENCRYPTED, 1);
+ DataManager::SetValue(TW_CRYPTO_PWTYPE, cryptfs_get_password_type());
+ DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
+ DataManager::SetValue("tw_crypto_display", "");
+ } else {
+ gui_err("mount_data_footer=Could not mount /data and unable to find crypto footer.");
+ }
+ } else {
Is_Encrypted = true;
Is_Decrypted = false;
- Can_Be_Mounted = false;
- Current_File_System = "emmc";
- Setup_Image();
- DataManager::SetValue(TW_IS_ENCRYPTED, 1);
- DataManager::SetValue(TW_CRYPTO_PWTYPE, cryptfs_get_password_type());
- DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
- DataManager::SetValue("tw_crypto_display", "");
- } else {
- gui_err("mount_data_footer=Could not mount /data and unable to find crypto footer.");
}
- } else {
+ } else if (Key_Directory.empty()) {
LOGERR("Primary block device '%s' for mount point '%s' is not present!\n", Primary_Block_Device.c_str(), Mount_Point.c_str());
}
} else {
- if (TWFunc::Path_Exists("/data/unencrypted/key/version")) {
- LOGINFO("File Based Encryption is present\n");
-#ifdef TW_INCLUDE_FBE
- ExcludeAll(Mount_Point + "/convert_fbe");
- ExcludeAll(Mount_Point + "/unencrypted");
- //ExcludeAll(Mount_Point + "/system/users/0"); // we WILL need to retain some of this if multiple users are present or we just need to delete more folders for the extra users somewhere else
- ExcludeAll(Mount_Point + "/misc/vold/user_keys");
- //ExcludeAll(Mount_Point + "/system_ce");
- //ExcludeAll(Mount_Point + "/system_de");
- //ExcludeAll(Mount_Point + "/misc_ce");
- //ExcludeAll(Mount_Point + "/misc_de");
- ExcludeAll(Mount_Point + "/system/gatekeeper.password.key");
- ExcludeAll(Mount_Point + "/system/gatekeeper.pattern.key");
- ExcludeAll(Mount_Point + "/system/locksettings.db");
- //ExcludeAll(Mount_Point + "/system/locksettings.db-shm"); // don't seem to need this one, but the other 2 are needed
- ExcludeAll(Mount_Point + "/system/locksettings.db-wal");
- //ExcludeAll(Mount_Point + "/user_de");
- //ExcludeAll(Mount_Point + "/misc/profiles/cur/0"); // might be important later
- ExcludeAll(Mount_Point + "/misc/gatekeeper");
- ExcludeAll(Mount_Point + "/misc/keystore");
- ExcludeAll(Mount_Point + "/drm/kek.dat");
- ExcludeAll(Mount_Point + "/system_de/0/spblob"); // contains data needed to decrypt pixel 2
- int retry_count = 3;
- while (!Decrypt_DE() && --retry_count)
- usleep(2000);
- if (retry_count > 0) {
- property_set("ro.crypto.state", "encrypted");
- Is_Encrypted = true;
- Is_Decrypted = false;
- Is_FBE = true;
- DataManager::SetValue(TW_IS_FBE, 1);
- DataManager::SetValue(TW_IS_ENCRYPTED, 1);
- string filename;
- int pwd_type = Get_Password_Type(0, filename);
- if (pwd_type < 0) {
- LOGERR("This TWRP does not have synthetic password decrypt support\n");
- pwd_type = 0; // default password
- }
- DataManager::SetValue(TW_CRYPTO_PWTYPE, pwd_type);
- DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
- DataManager::SetValue("tw_crypto_display", "");
- }
-#else
- LOGERR("FBE found but FBE support not present in TWRP\n");
-#endif
- } else {
- // Filesystem is not encrypted and the mount succeeded, so return to
- // the original unmounted state
- UnMount(false);
- }
+ Decrypt_FBE_DE();
}
if (datamedia && (!Is_Encrypted || (Is_Encrypted && Is_Decrypted))) {
Setup_Data_Media();
@@ -711,6 +675,57 @@ void TWPartition::Setup_Data_Partition(bool Display_Error) {
#endif
}
+bool TWPartition::Decrypt_FBE_DE() {
+if (TWFunc::Path_Exists("/data/unencrypted/key/version")) {
+ LOGINFO("File Based Encryption is present\n");
+#ifdef TW_INCLUDE_FBE
+ ExcludeAll(Mount_Point + "/convert_fbe");
+ ExcludeAll(Mount_Point + "/unencrypted");
+ //ExcludeAll(Mount_Point + "/system/users/0"); // we WILL need to retain some of this if multiple users are present or we just need to delete more folders for the extra users somewhere else
+ ExcludeAll(Mount_Point + "/misc/vold/user_keys");
+ //ExcludeAll(Mount_Point + "/system_ce");
+ //ExcludeAll(Mount_Point + "/system_de");
+ //ExcludeAll(Mount_Point + "/misc_ce");
+ //ExcludeAll(Mount_Point + "/misc_de");
+ ExcludeAll(Mount_Point + "/system/gatekeeper.password.key");
+ ExcludeAll(Mount_Point + "/system/gatekeeper.pattern.key");
+ ExcludeAll(Mount_Point + "/system/locksettings.db");
+ //ExcludeAll(Mount_Point + "/system/locksettings.db-shm"); // don't seem to need this one, but the other 2 are needed
+ ExcludeAll(Mount_Point + "/system/locksettings.db-wal");
+ //ExcludeAll(Mount_Point + "/user_de");
+ //ExcludeAll(Mount_Point + "/misc/profiles/cur/0"); // might be important later
+ ExcludeAll(Mount_Point + "/misc/gatekeeper");
+ ExcludeAll(Mount_Point + "/misc/keystore");
+ ExcludeAll(Mount_Point + "/drm/kek.dat");
+ ExcludeAll(Mount_Point + "/system_de/0/spblob"); // contains data needed to decrypt pixel 2
+ int retry_count = 3;
+ while (!Decrypt_DE() && --retry_count)
+ usleep(2000);
+ if (retry_count > 0) {
+ property_set("ro.crypto.state", "encrypted");
+ Is_Encrypted = true;
+ Is_Decrypted = false;
+ Is_FBE = true;
+ DataManager::SetValue(TW_IS_FBE, 1);
+ DataManager::SetValue(TW_IS_ENCRYPTED, 1);
+ string filename;
+ int pwd_type = Get_Password_Type(0, filename);
+ if (pwd_type < 0) {
+ LOGERR("This TWRP does not have synthetic password decrypt support\n");
+ pwd_type = 0; // default password
+ }
+ DataManager::SetValue(TW_CRYPTO_PWTYPE, pwd_type);
+ DataManager::SetValue(TW_CRYPTO_PASSWORD, "");
+ DataManager::SetValue("tw_crypto_display", "");
+ return true;
+ }
+#else
+ LOGERR("FBE found but FBE support not present in TWRP\n");
+#endif
+ }
+ return false;
+}
+
void TWPartition::Setup_Cache_Partition(bool Display_Error __unused) {
if (Mount_Point != "/cache")
return;
@@ -826,12 +841,14 @@ void TWPartition::Apply_TW_Flag(const unsigned flag, const char* str, const bool
// fileencryption=ice:aes-256-heh
{
std::string FBE = str;
- std::string FBE_contents, FBE_filenames;
size_t colon_loc = FBE.find(":");
if (colon_loc == std::string::npos) {
- LOGINFO("Invalid fileencryption fstab flag: '%s'\n", str);
+ property_set("fbe.contents", FBE.c_str());
+ property_set("fbe.filenames", "");
+ LOGINFO("FBE contents '%s', filenames ''\n", FBE.c_str());
break;
}
+ std::string FBE_contents, FBE_filenames;
FBE_contents = FBE.substr(0, colon_loc);
FBE_filenames = FBE.substr(colon_loc + 1);
property_set("fbe.contents", FBE_contents.c_str());
@@ -905,6 +922,8 @@ void TWPartition::Apply_TW_Flag(const unsigned flag, const char* str, const bool
case TWFLAG_ALTDEVICE:
Alternate_Block_Device = str;
break;
+ case TWFLAG_KEYDIRECTORY:
+ Key_Directory = str;
default:
// Should not get here
LOGINFO("Flag identified for processing, but later unmatched: %i\n", flag);
@@ -1904,21 +1923,26 @@ bool TWPartition::Decrypt(string Password) {
bool TWPartition::Wipe_Encryption() {
bool Save_Data_Media = Has_Data_Media;
+ bool ret = false;
+ BasePartition* base_partition = make_partition();
+
+ if (!base_partition->PreWipeEncryption())
+ goto exit;
if (!UnMount(true))
- return false;
+ goto exit;
Has_Data_Media = false;
- Decrypted_Block_Device = "";
#ifdef TW_INCLUDE_CRYPTO
if (Is_Decrypted && !Decrypted_Block_Device.empty()) {
if (!UnMount(true))
- return false;
+ goto exit;
if (delete_crypto_blk_dev((char*)("userdata")) != 0) {
LOGERR("Error deleting crypto block device, continuing anyway.\n");
}
}
#endif
+ Decrypted_Block_Device = "";
Is_Decrypted = false;
Is_Encrypted = false;
Find_Actual_Block_Device();
@@ -1978,15 +2002,22 @@ bool TWPartition::Wipe_Encryption() {
#ifndef TW_OEM_BUILD
gui_msg("format_data_msg=You may need to reboot recovery to be able to use /data again.");
#endif
- return true;
+ ret = true;
+ if (!Key_Directory.empty())
+ ret = PartitionManager.Wipe_By_Path(Key_Directory);
+ if (ret)
+ ret = base_partition->PostWipeEncryption();
+ goto exit;
} else {
Has_Data_Media = Save_Data_Media;
gui_err("format_data_err=Unable to format to remove encryption.");
if (Has_Data_Media && Mount(false))
PartitionManager.Add_MTP_Storage(MTP_Storage_ID);
- return false;
+ goto exit;
}
- return false;
+exit:
+ delete base_partition;
+ return ret;
}
void TWPartition::Check_FS_Type() {
@@ -2233,18 +2264,23 @@ bool TWPartition::Wipe_F2FS() {
gui_msg(Msg("formatting_using=Formatting {1} using {2}...")(Display_Name)("mkfs.f2fs"));
Find_Actual_Block_Device();
- command = "mkfs.f2fs -t 0";
- if (!Is_Decrypted && Length != 0) {
- // Only use length if we're not decrypted
- char len[32];
- int mod_length = Length;
- if (Length < 0)
- mod_length *= -1;
- sprintf(len, "%i", mod_length);
- command += " -r ";
- command += len;
- }
- command += " " + Actual_Block_Device;
+ if (!TWFunc::Path_Exists("/sbin/sload.f2fs")) {
+ command = "mkfs.f2fs -t 0";
+ if (!Is_Decrypted && Length != 0) {
+ // Only use length if we're not decrypted
+ char len[32];
+ int mod_length = Length;
+ if (Length < 0)
+ mod_length *= -1;
+ sprintf(len, "%i", mod_length);
+ command += " -r ";
+ command += len;
+ }
+ command += " " + Actual_Block_Device;
+ } else {
+ unsigned long long size = IOCTL_Get_Block_Size() + Length;
+ command = "mkfs.f2fs -d1 -f -O encrypt -O quota -O verity -w 4096 " + Actual_Block_Device + " " + std::to_string(size / 4096) + " && sload.f2fs -t /data " + Actual_Block_Device;
+ }
if (TWFunc::Exec_Cmd(command) == 0) {
Recreate_AndSec_Folder();
gui_msg("done=Done.");
diff --git a/partitionmanager.cpp b/partitionmanager.cpp
index da407fa69..45460d1dc 100644
--- a/partitionmanager.cpp
+++ b/partitionmanager.cpp
@@ -71,6 +71,9 @@ extern "C" {
#include "gui/pages.hpp"
#ifdef TW_INCLUDE_FBE
#include "crypto/ext4crypt/Decrypt.h"
+ #ifdef TW_INCLUDE_FBE_METADATA_DECRYPT
+ #include "crypto/ext4crypt/MetadataCrypt.h"
+ #endif
#endif
#ifdef TW_CRYPTO_USE_SYSTEM_VOLD
#include "crypto/vold_decrypt/vold_decrypt.h"
@@ -277,6 +280,27 @@ int TWPartitionManager::Process_Fstab(string Fstab_Filename, bool Display_Error)
#ifdef TW_INCLUDE_CRYPTO
TWPartition* Decrypt_Data = Find_Partition_By_Path("/data");
if (Decrypt_Data && Decrypt_Data->Is_Encrypted && !Decrypt_Data->Is_Decrypted) {
+ if (!Decrypt_Data->Key_Directory.empty() && Mount_By_Path(Decrypt_Data->Key_Directory, false)) {
+#ifdef TW_INCLUDE_FBE_METADATA_DECRYPT
+ if (e4crypt_mount_metadata_encrypted(Decrypt_Data->Mount_Point, false, Decrypt_Data->Key_Directory, Decrypt_Data->Actual_Block_Device, &Decrypt_Data->Decrypted_Block_Device)) {
+ LOGINFO("Successfully decrypted metadata encrypted data partition with new block device: '%s'\n", Decrypt_Data->Decrypted_Block_Device.c_str());
+ property_set("ro.crypto.state", "encrypted");
+ Decrypt_Data->Is_Decrypted = true; // Needed to make the mount function work correctly
+ int retry_count = 10;
+ while (!Decrypt_Data->Mount(false) && --retry_count)
+ usleep(500);
+ if (Decrypt_Data->Mount(false)) {
+ Decrypt_Data->Decrypt_FBE_DE();
+ } else {
+ LOGINFO("Failed to mount data after metadata decrypt\n");
+ }
+ } else {
+ LOGINFO("Unable to decrypt metadata encryption\n");
+ }
+#else
+ LOGERR("Metadata FBE decrypt support not present in this TWRP\n");
+#endif
+ }
if (Decrypt_Data->Is_FBE) {
if (DataManager::GetIntValue(TW_CRYPTO_PWTYPE) == 0) {
if (Decrypt_Device("!") == 0) {
@@ -467,6 +491,8 @@ void TWPartitionManager::Output_Partition(TWPartition* Part) {
printf(" Mount_Flags: %i, Mount_Options: %s\n", Part->Mount_Flags, Part->Mount_Options.c_str());
if (Part->MTP_Storage_ID)
printf(" MTP_Storage_ID: %i\n", Part->MTP_Storage_ID);
+ if (!Part->Key_Directory.empty())
+ printf(" Metadata Key Directory: %s\n", Part->Key_Directory.c_str());
printf("\n");
}
diff --git a/partitions.hpp b/partitions.hpp
index 094c718de..a8fd70b40 100644
--- a/partitions.hpp
+++ b/partitions.hpp
@@ -31,6 +31,23 @@
using namespace std;
+// BasePartition is used for overriding so we can run custom, device
+// specific code.
+class BasePartition {
+ public:
+ explicit BasePartition() {}
+ virtual ~BasePartition() {}
+
+ virtual bool PreWipeEncryption() {
+ return true;
+ }
+
+ virtual bool PostWipeEncryption() {
+ return true;
+ }
+};
+BasePartition* make_partition();
+
struct PartitionList {
std::string Display_Name;
std::string Mount_Point;
@@ -128,6 +145,7 @@ public:
void Partition_Post_Processing(bool Display_Error); // Apply partition specific settings after fstab processed
void Set_Backup_FileName(string fname); // Set Backup_FileName for partition
string Get_Backup_Name(); // Get Backup_Name for partition
+ bool Decrypt_FBE_DE(); // If FBE is present, backup exclusions are set up and DE decrypt is attempted
public:
string Current_File_System; // Current file system
@@ -246,6 +264,7 @@ private:
bool SlotSelect; // Partition has A/B slots
TWExclude backup_exclusions; // Exclusions for file based backups
TWExclude wipe_exclusions; // Exclusions for file based wipes (data/media devices only)
+ string Key_Directory; // Metadata key directory needed for mounting FBE encrypted data partitions using metadata encryption
struct partition_fs_flags_struct { // This struct is used to store mount flags and options for different file systems for the same partition
string File_System;
diff --git a/prebuilt/Android.mk b/prebuilt/Android.mk
index e7bf8017e..235b77c86 100644
--- a/prebuilt/Android.mk
+++ b/prebuilt/Android.mk
@@ -16,19 +16,22 @@ RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/flash_image
RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/erase_image
RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/bu
ifneq ($(TW_USE_TOOLBOX), true)
- RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/busybox
+ RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/busybox
else
- RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/sh
- RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libcrypto.so
- ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 23; echo $$?),0)
- RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/toybox
- ifneq ($(wildcard external/zip/Android.mk),)
- RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/zip
- endif
- ifneq ($(wildcard external/unzip/Android.mk),)
- RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/unzip
- endif
- endif
+ RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/sh
+ RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libcrypto.so
+ ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 23; echo $$?),0)
+ RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/toybox
+ ifneq ($(wildcard external/zip/Android.mk),)
+ RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/zip
+ endif
+ ifneq ($(wildcard external/unzip/Android.mk),)
+ RELINK_SOURCE_FILES += $(TARGET_OUT_OPTIONAL_EXECUTABLES)/unzip
+ endif
+ ifneq ($(wildcard system/core/libziparchive/Android.bp),)
+ RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/unzip
+ endif
+ endif
endif
RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/pigz
RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/fsck.fat
@@ -229,6 +232,11 @@ ifeq ($(TW_INCLUDE_CRYPTO), true)
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libservices.so
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libkeymaster_portable.so
endif
+ # lshal can be useful for seeing if you have things like the keymaster working properly, but it isn't needed for TWRP to work
+ #RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/lshal
+ #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/liblshal.so
+ #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libssl.so
+ #RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libhidl-gen-hash.so
endif
endif
ifeq ($(AB_OTA_UPDATER), true)
@@ -255,6 +263,9 @@ ifeq ($(TARGET_USERIMAGES_USE_F2FS), true)
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libf2fs.so
else ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 26; echo $$?),0)
RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/mkfs.f2fs
+ ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 28; echo $$?),0)
+ RELINK_SOURCE_FILES += $(TARGET_RECOVERY_ROOT_OUT)/sbin/sload.f2fs
+ endif
else ifeq ($(shell test $(PLATFORM_SDK_VERSION) -ge 24; echo $$?),0)
RELINK_SOURCE_FILES += $(TARGET_OUT_EXECUTABLES)/mkfs.f2fs
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libf2fs.so
@@ -337,6 +348,7 @@ endif
ifeq ($(shell test $(PLATFORM_SDK_VERSION) -gt 27; echo $$?),0)
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libclang_rt.ubsan_standalone-aarch64-android.so
RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/liblogwrap.so
+ RELINK_SOURCE_FILES += $(TARGET_OUT_SHARED_LIBRARIES)/libext2_misc.so
endif
TW_BB_SYMLINKS :=
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-13 02:44:47 +0100