Android-x86
Fork
Donation

  • R/O
  • HTTP
  • SSH
  • HTTPS

system-extras: Commit

system/extras


Commit MetaInfo

Revisionef17b323e8be065ed9fbcd1ea863d72e63488fc0 (tree)
Time2019-09-18 03:44:15
AuthorPaul Crowley <paulcrowley@goog...>
CommiterPaul Crowley

Log Message

Add a per-boot-key policy reference, apply to per_boot

Includes changes picked from aosp/1119783
570d20d2ac875198416dff280b7a4b7adaacac81 in platform/system/core

Bug: 140882488
Test: Booted twice, checked logs to ensure encryption

is different each time, adb created files in directory.

Cherry-Picked-From: ab3085004e35cff9517fcedb03317f3f1ac84cf9
Merged-In: I5c962edb316d160dd09c0df893912c6b257d7810
Change-Id: I5c962edb316d160dd09c0df893912c6b257d7810

Change Summary

Incremental Difference

--- a/libfscrypt/fscrypt_init_extensions.cpp
+++ b/libfscrypt/fscrypt_init_extensions.cpp
@@ -39,7 +39,7 @@
3939
4040 static const std::string arbitrary_sequence_number = "42";
4141
42-static int set_system_de_policy_on(char const* dir);
42+static int set_policy_on(char const* ref_basename, char const* dir);
4343
4444 int fscrypt_install_keyring()
4545 {
@@ -65,7 +65,7 @@ int fscrypt_set_directory_policy(const char* dir)
6565 // Special-case /data/media/obb per b/64566063
6666 if (strcmp(dir, "/data/media/obb") == 0) {
6767 // Try to set policy on this directory, but if it is non-empty this may fail.
68- set_system_de_policy_on(dir);
68+ set_policy_on(fscrypt_key_ref, dir);
6969 return 0;
7070 }
7171
@@ -97,11 +97,20 @@ int fscrypt_set_directory_policy(const char* dir)
9797 return 0;
9898 }
9999 }
100- return set_system_de_policy_on(dir);
100+ std::vector<std::string> per_boot_directories = {
101+ "per_boot",
102+ };
103+ for (const auto& d : per_boot_directories) {
104+ if ((prefix + d) == dir) {
105+ LOG(INFO) << "Setting per_boot key on " << dir;
106+ return set_policy_on(fscrypt_key_per_boot_ref, dir);
107+ }
108+ }
109+ return set_policy_on(fscrypt_key_ref, dir);
101110 }
102111
103-static int set_system_de_policy_on(char const* dir) {
104- std::string ref_filename = std::string("/data") + fscrypt_key_ref;
112+static int set_policy_on(char const* ref_basename, char const* dir) {
113+ std::string ref_filename = std::string("/data") + ref_basename;
105114 std::string policy;
106115 if (!android::base::ReadFileToString(ref_filename, &policy)) {
107116 LOG(ERROR) << "Unable to read system policy to set on " << dir;
--- a/libfscrypt/include/fscrypt/fscrypt.h
+++ b/libfscrypt/include/fscrypt/fscrypt.h
@@ -32,6 +32,7 @@ int fscrypt_policy_ensure(const char *directory, const char *policy,
3232
3333 static const char* fscrypt_unencrypted_folder = "/unencrypted";
3434 static const char* fscrypt_key_ref = "/unencrypted/ref";
35+static const char* fscrypt_key_per_boot_ref = "/unencrypted/per_boot_ref";
3536 static const char* fscrypt_key_mode = "/unencrypted/mode";
3637
3738 __END_DECLS
Show on old repository browser