246 lines
8 KiB
C++
246 lines
8 KiB
C++
/*
|
|
* Copyright (C) 2009 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
//#define LOG_NDEBUG 0
|
|
#define LOG_TAG "keystore"
|
|
|
|
#include <keymaster/keymaster_configuration.h>
|
|
#include <keymaster/soft_keymaster_device.h>
|
|
#include <keymaster/soft_keymaster_logger.h>
|
|
|
|
#include <binder/IPCThreadState.h>
|
|
#include <binder/IServiceManager.h>
|
|
|
|
#include <cutils/log.h>
|
|
|
|
#include "entropy.h"
|
|
#include "key_store_service.h"
|
|
#include "keystore.h"
|
|
#include "permissions.h"
|
|
|
|
/* KeyStore is a secured storage for key-value pairs. In this implementation,
|
|
* each file stores one key-value pair. Keys are encoded in file names, and
|
|
* values are encrypted with checksums. The encryption key is protected by a
|
|
* user-defined password. To keep things simple, buffers are always larger than
|
|
* the maximum space we needed, so boundary checks on buffers are omitted. */
|
|
|
|
using keymaster::AuthorizationSet;
|
|
using keymaster::AuthorizationSetBuilder;
|
|
using keymaster::SoftKeymasterDevice;
|
|
|
|
static int configure_keymaster_devices(keymaster2_device_t* main, keymaster2_device_t* fallback) {
|
|
keymaster_error_t error = keymaster::ConfigureDevice(main);
|
|
if (error != KM_ERROR_OK) {
|
|
return -1;
|
|
}
|
|
|
|
error = keymaster::ConfigureDevice(fallback);
|
|
if (error != KM_ERROR_OK) {
|
|
return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int keymaster0_device_initialize(const hw_module_t* mod, keymaster2_device_t** dev) {
|
|
assert(mod->module_api_version < KEYMASTER_MODULE_API_VERSION_1_0);
|
|
ALOGI("Found keymaster0 module %s, version %x", mod->name, mod->module_api_version);
|
|
|
|
UniquePtr<SoftKeymasterDevice> soft_keymaster(new SoftKeymasterDevice);
|
|
keymaster0_device_t* km0_device = NULL;
|
|
keymaster_error_t error = KM_ERROR_OK;
|
|
|
|
int rc = keymaster0_open(mod, &km0_device);
|
|
if (rc) {
|
|
ALOGE("Error opening keystore keymaster0 device.");
|
|
goto err;
|
|
}
|
|
|
|
if (km0_device->flags & KEYMASTER_SOFTWARE_ONLY) {
|
|
ALOGI("Keymaster0 module is software-only. Using SoftKeymasterDevice instead.");
|
|
km0_device->common.close(&km0_device->common);
|
|
km0_device = NULL;
|
|
// SoftKeymasterDevice will be deleted by keymaster_device_release()
|
|
*dev = soft_keymaster.release()->keymaster2_device();
|
|
return 0;
|
|
}
|
|
|
|
ALOGD("Wrapping keymaster0 module %s with SoftKeymasterDevice", mod->name);
|
|
error = soft_keymaster->SetHardwareDevice(km0_device);
|
|
km0_device = NULL; // SoftKeymasterDevice has taken ownership.
|
|
if (error != KM_ERROR_OK) {
|
|
ALOGE("Got error %d from SetHardwareDevice", error);
|
|
rc = error;
|
|
goto err;
|
|
}
|
|
|
|
// SoftKeymasterDevice will be deleted by keymaster_device_release()
|
|
*dev = soft_keymaster.release()->keymaster2_device();
|
|
return 0;
|
|
|
|
err:
|
|
if (km0_device)
|
|
km0_device->common.close(&km0_device->common);
|
|
*dev = NULL;
|
|
return rc;
|
|
}
|
|
|
|
static int keymaster1_device_initialize(const hw_module_t* mod, keymaster2_device_t** dev) {
|
|
assert(mod->module_api_version >= KEYMASTER_MODULE_API_VERSION_1_0);
|
|
ALOGI("Found keymaster1 module %s, version %x", mod->name, mod->module_api_version);
|
|
|
|
UniquePtr<SoftKeymasterDevice> soft_keymaster(new SoftKeymasterDevice);
|
|
keymaster1_device_t* km1_device = nullptr;
|
|
keymaster_error_t error = KM_ERROR_OK;
|
|
|
|
int rc = keymaster1_open(mod, &km1_device);
|
|
if (rc) {
|
|
ALOGE("Error %d opening keystore keymaster1 device", rc);
|
|
goto err;
|
|
}
|
|
|
|
ALOGD("Wrapping keymaster1 module %s with SofKeymasterDevice", mod->name);
|
|
error = soft_keymaster->SetHardwareDevice(km1_device);
|
|
km1_device = nullptr; // SoftKeymasterDevice has taken ownership.
|
|
if (error != KM_ERROR_OK) {
|
|
ALOGE("Got error %d from SetHardwareDevice", error);
|
|
rc = error;
|
|
goto err;
|
|
}
|
|
|
|
// SoftKeymasterDevice will be deleted by keymaster_device_release()
|
|
*dev = soft_keymaster.release()->keymaster2_device();
|
|
return 0;
|
|
|
|
err:
|
|
if (km1_device)
|
|
km1_device->common.close(&km1_device->common);
|
|
*dev = NULL;
|
|
return rc;
|
|
}
|
|
|
|
static int keymaster2_device_initialize(const hw_module_t* mod, keymaster2_device_t** dev) {
|
|
assert(mod->module_api_version >= KEYMASTER_MODULE_API_VERSION_2_0);
|
|
ALOGI("Found keymaster2 module %s, version %x", mod->name, mod->module_api_version);
|
|
|
|
UniquePtr<SoftKeymasterDevice> soft_keymaster(new SoftKeymasterDevice);
|
|
keymaster2_device_t* km2_device = nullptr;
|
|
|
|
int rc = keymaster2_open(mod, &km2_device);
|
|
if (rc) {
|
|
ALOGE("Error %d opening keystore keymaster2 device", rc);
|
|
goto err;
|
|
}
|
|
|
|
*dev = km2_device;
|
|
return 0;
|
|
|
|
err:
|
|
if (km2_device)
|
|
km2_device->common.close(&km2_device->common);
|
|
*dev = nullptr;
|
|
return rc;
|
|
}
|
|
|
|
static int keymaster_device_initialize(keymaster2_device_t** dev) {
|
|
const hw_module_t* mod;
|
|
|
|
int rc = hw_get_module_by_class(KEYSTORE_HARDWARE_MODULE_ID, NULL, &mod);
|
|
if (rc) {
|
|
ALOGI("Could not find any keystore module, using software-only implementation.");
|
|
// SoftKeymasterDevice will be deleted by keymaster_device_release()
|
|
*dev = (new SoftKeymasterDevice)->keymaster2_device();
|
|
return 0;
|
|
}
|
|
|
|
if (mod->module_api_version < KEYMASTER_MODULE_API_VERSION_1_0) {
|
|
return keymaster0_device_initialize(mod, dev);
|
|
} else if (mod->module_api_version == KEYMASTER_MODULE_API_VERSION_1_0) {
|
|
return keymaster1_device_initialize(mod, dev);
|
|
} else {
|
|
return keymaster2_device_initialize(mod, dev);
|
|
}
|
|
}
|
|
|
|
// softkeymaster_logger appears not to be used in keystore, but it installs itself as the
|
|
// logger used by SoftKeymasterDevice.
|
|
static keymaster::SoftKeymasterLogger softkeymaster_logger;
|
|
|
|
static int fallback_keymaster_device_initialize(keymaster2_device_t** dev) {
|
|
*dev = (new SoftKeymasterDevice)->keymaster2_device();
|
|
// SoftKeymasterDevice will be deleted by keymaster_device_release()
|
|
return 0;
|
|
}
|
|
|
|
static void keymaster_device_release(keymaster2_device_t* dev) {
|
|
dev->common.close(&dev->common);
|
|
}
|
|
|
|
int main(int argc, char* argv[]) {
|
|
if (argc < 2) {
|
|
ALOGE("A directory must be specified!");
|
|
return 1;
|
|
}
|
|
if (chdir(argv[1]) == -1) {
|
|
ALOGE("chdir: %s: %s", argv[1], strerror(errno));
|
|
return 1;
|
|
}
|
|
|
|
Entropy entropy;
|
|
if (!entropy.open()) {
|
|
return 1;
|
|
}
|
|
|
|
keymaster2_device_t* dev;
|
|
if (keymaster_device_initialize(&dev)) {
|
|
ALOGE("keystore keymaster could not be initialized; exiting");
|
|
return 1;
|
|
}
|
|
|
|
keymaster2_device_t* fallback;
|
|
if (fallback_keymaster_device_initialize(&fallback)) {
|
|
ALOGE("software keymaster could not be initialized; exiting");
|
|
return 1;
|
|
}
|
|
|
|
if (configure_keymaster_devices(dev, fallback)) {
|
|
ALOGE("Keymaster devices could not be configured; exiting");
|
|
return 1;
|
|
}
|
|
|
|
if (configure_selinux() == -1) {
|
|
return -1;
|
|
}
|
|
|
|
KeyStore keyStore(&entropy, dev, fallback);
|
|
keyStore.initialize();
|
|
android::sp<android::IServiceManager> sm = android::defaultServiceManager();
|
|
android::sp<android::KeyStoreService> service = new android::KeyStoreService(&keyStore);
|
|
android::status_t ret = sm->addService(android::String16("android.security.keystore"), service);
|
|
if (ret != android::OK) {
|
|
ALOGE("Couldn't register binder service!");
|
|
return -1;
|
|
}
|
|
|
|
/*
|
|
* We're the only thread in existence, so we're just going to process
|
|
* Binder transaction as a single-threaded program.
|
|
*/
|
|
android::IPCThreadState::self()->joinThreadPool();
|
|
|
|
keymaster_device_release(dev);
|
|
return 1;
|
|
}
|