Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

With native FBE, lock user directories when framework is started

Browse Source 
If the framework is restarted, the user must unlock their device in the
same way as after a reboot.  But with FBE, vold was never told to lock
the credential-encrypted storage directories, so any that were unlocked
at the time the framework stopped remain unlocked, i.e. their keys are
still in the kernel.  This is unexpected and differs from a reboot.

Fix this by locking all user directories when the framework is started.
This was already done for emulated FBE, but this change extends it to
native FBE too.

Test: Unlock device with PIN.  Then in adb shell: 'stop; start;
      sleep 10; ls /data/data/' shows filenames in ciphertext form.
Change-Id: If993d93d9837b09ff8029642f8641dec69af04e0
This commit is contained in:
Eric Biggers
2019-04-02 11:02:32 -07:00
parent 1279c3ffe9
commit 171217cb37
1 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/core/java/com/android/server/StorageManagerService.java
View File

@@ -943,13 +943,20 @@ class StorageManagerService extends IStorageManager.Stub
private void initIfBootedAndConnected() {
Slog.d(TAG, "Thinking about init, mBootCompleted=" + mBootCompleted
+ ", mDaemonConnected=" + mDaemonConnected);
if (mBootCompleted && mDaemonConnected
&& !StorageManager.isFileEncryptedNativeOnly()) {
// When booting a device without native support, make sure that our
// user directories are locked or unlocked based on the current
// emulation status.
final boolean initLocked = StorageManager.isFileEncryptedEmulatedOnly();
Slog.d(TAG, "Setting up emulation state, initlocked=" + initLocked);
if (mBootCompleted && mDaemonConnected) {
// Tell vold to lock or unlock the user directories based on the
// current file-based encryption status.
final boolean initLocked;
if (StorageManager.isFileEncryptedNativeOrEmulated()) {
// For native FBE this is a no-op after reboot, but this is
// still needed in case of framework restarts.
Slog.d(TAG, "FBE is enabled; ensuring all user directories are locked.");
initLocked = true;
} else {
// This is in case FBE emulation was turned off.
Slog.d(TAG, "FBE is disabled; ensuring the FBE emulation state is cleared.");
initLocked = false;
}
final List<UserInfo> users = mContext.getSystemService(UserManager.class).getUsers();
for (UserInfo user : users) {
try {