summaryrefslogtreecommitdiffstats
path: root/fs_mgr
diff options
context:
space:
mode:
Diffstat (limited to 'fs_mgr')
-rw-r--r--fs_mgr/fs_mgr.c78
-rw-r--r--fs_mgr/fs_mgr_fstab.c8
-rw-r--r--fs_mgr/fs_mgr_priv.h1
-rw-r--r--fs_mgr/fs_mgr_verity.c31
4 files changed, 90 insertions, 28 deletions
diff --git a/fs_mgr/fs_mgr.c b/fs_mgr/fs_mgr.c
index dcda005bc..ee3cbf92d 100644
--- a/fs_mgr/fs_mgr.c
+++ b/fs_mgr/fs_mgr.c
@@ -208,16 +208,25 @@ static int fs_match(char *in1, char *in2)
return ret;
}
+static int device_is_debuggable() {
+ int ret = -1;
+ char value[PROP_VALUE_MAX];
+ ret = __system_property_get("ro.debuggable", value);
+ if (ret < 0)
+ return ret;
+ return strcmp(value, "1") ? 0 : 1;
+}
+
int fs_mgr_mount_all(struct fstab *fstab)
{
int i = 0;
- int encrypted = 0;
- int ret = -1;
+ int encryptable = 0;
+ int error_count = 0;
int mret;
int mount_errno;
if (!fstab) {
- return ret;
+ return -1;
}
for (i = 0; i < fstab->num_entries; i++) {
@@ -242,7 +251,8 @@ int fs_mgr_mount_all(struct fstab *fstab)
fstab->recs[i].mount_point);
}
- if (fstab->recs[i].fs_mgr_flags & MF_VERIFY) {
+ if ((fstab->recs[i].fs_mgr_flags & MF_VERIFY) &&
+ !device_is_debuggable()) {
if (fs_mgr_setup_verity(&fstab->recs[i]) < 0) {
ERROR("Could not set up verified partition, skipping!");
continue;
@@ -250,47 +260,62 @@ int fs_mgr_mount_all(struct fstab *fstab)
}
mret = __mount(fstab->recs[i].blk_device, fstab->recs[i].mount_point,
- fstab->recs[i].fs_type, fstab->recs[i].flags,
- fstab->recs[i].fs_options);
+ fstab->recs[i].fs_type, fstab->recs[i].flags,
+ fstab->recs[i].fs_options);
if (!mret) {
+ /* If this is encryptable, need to trigger encryption */
+ if ((fstab->recs[i].fs_mgr_flags & MF_FORCECRYPT)) {
+ if (umount(fstab->recs[i].mount_point) == 0) {
+ if (!encryptable) {
+ encryptable = 2;
+ } else {
+ ERROR("Only one encryptable/encrypted partition supported");
+ encryptable = 1;
+ }
+ } else {
+ INFO("Could not umount %s - allow continue unencrypted",
+ fstab->recs[i].mount_point);
+ continue;
+ }
+ }
+
/* Success! Go get the next one */
continue;
}
/* back up errno as partition_wipe clobbers the value */
mount_errno = errno;
-
- /* mount(2) returned an error, check if it's encrypted and deal with it */
- if ((fstab->recs[i].fs_mgr_flags & MF_CRYPT) &&
+ /* mount(2) returned an error, check if it's encryptable and deal with it */
+ if (mount_errno != EBUSY && mount_errno != EACCES &&
+ (fstab->recs[i].fs_mgr_flags & (MF_CRYPT | MF_FORCECRYPT)) &&
!partition_wiped(fstab->recs[i].blk_device)) {
/* Need to mount a tmpfs at this mountpoint for now, and set
* properties that vold will query later for decrypting
*/
if (mount("tmpfs", fstab->recs[i].mount_point, "tmpfs",
- MS_NOATIME | MS_NOSUID | MS_NODEV, CRYPTO_TMPFS_OPTIONS) < 0) {
- ERROR("Cannot mount tmpfs filesystem for encrypted fs at %s error: %s\n",
- fstab->recs[i].mount_point, strerror(errno));
- goto out;
+ MS_NOATIME | MS_NOSUID | MS_NODEV, CRYPTO_TMPFS_OPTIONS) < 0) {
+ ERROR("Cannot mount tmpfs filesystem for encryptable fs at %s error: %s\n",
+ fstab->recs[i].mount_point, strerror(errno));
+ ++error_count;
+ continue;
}
- encrypted = 1;
+ encryptable = 1;
} else {
ERROR("Failed to mount an un-encryptable or wiped partition on"
- "%s at %s options: %s error: %s\n",
- fstab->recs[i].blk_device, fstab->recs[i].mount_point,
- fstab->recs[i].fs_options, strerror(mount_errno));
- goto out;
+ "%s at %s options: %s error: %s\n",
+ fstab->recs[i].blk_device, fstab->recs[i].mount_point,
+ fstab->recs[i].fs_options, strerror(mount_errno));
+ ++error_count;
+ continue;
}
}
- if (encrypted) {
- ret = 1;
+ if (error_count) {
+ return -1;
} else {
- ret = 0;
+ return encryptable;
}
-
-out:
- return ret;
}
/* If tmp_mount_point is non-null, mount the filesystem there. This is for the
@@ -332,7 +357,8 @@ int fs_mgr_do_mount(struct fstab *fstab, char *n_name, char *n_blk_device,
fstab->recs[i].mount_point);
}
- if (fstab->recs[i].fs_mgr_flags & MF_VERIFY) {
+ if ((fstab->recs[i].fs_mgr_flags & MF_VERIFY) &&
+ !device_is_debuggable()) {
if (fs_mgr_setup_verity(&fstab->recs[i]) < 0) {
ERROR("Could not set up verified partition, skipping!");
continue;
@@ -504,7 +530,7 @@ int fs_mgr_get_crypt_info(struct fstab *fstab, char *key_loc, char *real_blk_dev
if (fstab->recs[i].fs_mgr_flags & MF_VOLDMANAGED) {
continue;
}
- if (!(fstab->recs[i].fs_mgr_flags & MF_CRYPT)) {
+ if (!(fstab->recs[i].fs_mgr_flags & (MF_CRYPT | MF_FORCECRYPT))) {
continue;
}
diff --git a/fs_mgr/fs_mgr_fstab.c b/fs_mgr/fs_mgr_fstab.c
index 45bbfdc37..98a2af47d 100644
--- a/fs_mgr/fs_mgr_fstab.c
+++ b/fs_mgr/fs_mgr_fstab.c
@@ -59,6 +59,7 @@ static struct flag_list fs_mgr_flags[] = {
{ "wait", MF_WAIT },
{ "check", MF_CHECK },
{ "encryptable=",MF_CRYPT },
+ { "forceencrypt=",MF_FORCECRYPT },
{ "nonremovable",MF_NONREMOVABLE },
{ "voldmanaged=",MF_VOLDMANAGED},
{ "length=", MF_LENGTH },
@@ -106,6 +107,11 @@ static int parse_flags(char *flags, struct flag_list *fl,
* location of the keys. Get it and return it.
*/
flag_vals->key_loc = strdup(strchr(p, '=') + 1);
+ } else if ((fl[i].flag == MF_FORCECRYPT) && flag_vals) {
+ /* The forceencrypt flag is followed by an = and the
+ * location of the keys. Get it and return it.
+ */
+ flag_vals->key_loc = strdup(strchr(p, '=') + 1);
} else if ((fl[i].flag == MF_LENGTH) && flag_vals) {
/* The length flag is followed by an = and the
* size of the partition. Get it and return it.
@@ -394,7 +400,7 @@ int fs_mgr_is_nonremovable(struct fstab_rec *fstab)
int fs_mgr_is_encryptable(struct fstab_rec *fstab)
{
- return fstab->fs_mgr_flags & MF_CRYPT;
+ return fstab->fs_mgr_flags & (MF_CRYPT | MF_FORCECRYPT);
}
int fs_mgr_is_noemulatedsd(struct fstab_rec *fstab)
diff --git a/fs_mgr/fs_mgr_priv.h b/fs_mgr/fs_mgr_priv.h
index 59ffd785c..6bb568a02 100644
--- a/fs_mgr/fs_mgr_priv.h
+++ b/fs_mgr/fs_mgr_priv.h
@@ -72,6 +72,7 @@
#define MF_SWAPPRIO 0x80
#define MF_ZRAMSIZE 0x100
#define MF_VERIFY 0x200
+#define MF_FORCECRYPT 0x400
/*
* There is no emulated sdcard daemon running on /data/media on this device,
* so treat the physical SD card as the only external storage device,
diff --git a/fs_mgr/fs_mgr_verity.c b/fs_mgr/fs_mgr_verity.c
index 40bc2ecde..aa3b1dd29 100644
--- a/fs_mgr/fs_mgr_verity.c
+++ b/fs_mgr/fs_mgr_verity.c
@@ -30,6 +30,7 @@
#include <time.h>
#include <private/android_filesystem_config.h>
+#include <cutils/properties.h>
#include <logwrap/logwrap.h>
#include "mincrypt/rsa.h"
@@ -335,6 +336,26 @@ static int test_access(char *device) {
return -1;
}
+static int set_verified_property(char *name) {
+ int ret;
+ char *key;
+ ret = asprintf(&key, "partition.%s.verified", name);
+ if (ret < 0) {
+ ERROR("Error formatting verified property");
+ return ret;
+ }
+ ret = PROP_NAME_MAX - strlen(key);
+ if (ret < 0) {
+ ERROR("Verified property name is too long");
+ return -1;
+ }
+ ret = property_set(key, "1");
+ if (ret < 0)
+ ERROR("Error setting verified property %s: %d", key, ret);
+ free(key);
+ return ret;
+}
+
int fs_mgr_setup_verity(struct fstab_rec *fstab) {
int retval = -1;
@@ -351,6 +372,13 @@ int fs_mgr_setup_verity(struct fstab_rec *fstab) {
io->flags |= 1;
io->target_count = 1;
+ // check to ensure that the verity device is ext4
+ // TODO: support non-ext4 filesystems
+ if (strcmp(fstab->fs_type, "ext4")) {
+ ERROR("Cannot verify non-ext4 device (%s)", fstab->fs_type);
+ return retval;
+ }
+
// get the device mapper fd
int fd;
if ((fd = open("/dev/device-mapper", O_RDWR)) < 0) {
@@ -403,7 +431,8 @@ int fs_mgr_setup_verity(struct fstab_rec *fstab) {
goto out;
}
- retval = 0;
+ // set the property indicating that the partition is verified
+ retval = set_verified_property(mount_point);
out:
close(fd);
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-06 01:16:50 +0000