From 171217cb379a67bbd57790b9118b94cab61ad41c Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 2 Apr 2019 11:02:32 -0700
Subject: [PATCH] With native FBE, lock user directories when framework is
 started

If the framework is restarted, the user must unlock their device in the
same way as after a reboot.  But with FBE, vold was never told to lock
the credential-encrypted storage directories, so any that were unlocked
at the time the framework stopped remain unlocked, i.e. their keys are
still in the kernel.  This is unexpected and differs from a reboot.

Fix this by locking all user directories when the framework is started.
This was already done for emulated FBE, but this change extends it to
native FBE too.

Test: Unlock device with PIN.  Then in adb shell: 'stop; start;
      sleep 10; ls /data/data/' shows filenames in ciphertext form.
Change-Id: If993d93d9837b09ff8029642f8641dec69af04e0
---
 .../android/server/StorageManagerService.java | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/services/core/java/com/android/server/StorageManagerService.java b/services/core/java/com/android/server/StorageManagerService.java
index b3a667a5f7c15..bb1df084ea94e 100644
--- a/services/core/java/com/android/server/StorageManagerService.java
+++ b/services/core/java/com/android/server/StorageManagerService.java
@@ -943,13 +943,20 @@ class StorageManagerService extends IStorageManager.Stub
     private void initIfBootedAndConnected() {
         Slog.d(TAG, "Thinking about init, mBootCompleted=" + mBootCompleted
                 + ", mDaemonConnected=" + mDaemonConnected);
-        if (mBootCompleted && mDaemonConnected
-                && !StorageManager.isFileEncryptedNativeOnly()) {
-            // When booting a device without native support, make sure that our
-            // user directories are locked or unlocked based on the current
-            // emulation status.
-            final boolean initLocked = StorageManager.isFileEncryptedEmulatedOnly();
-            Slog.d(TAG, "Setting up emulation state, initlocked=" + initLocked);
+        if (mBootCompleted && mDaemonConnected) {
+            // Tell vold to lock or unlock the user directories based on the
+            // current file-based encryption status.
+            final boolean initLocked;
+            if (StorageManager.isFileEncryptedNativeOrEmulated()) {
+                // For native FBE this is a no-op after reboot, but this is
+                // still needed in case of framework restarts.
+                Slog.d(TAG, "FBE is enabled; ensuring all user directories are locked.");
+                initLocked = true;
+            } else {
+                // This is in case FBE emulation was turned off.
+                Slog.d(TAG, "FBE is disabled; ensuring the FBE emulation state is cleared.");
+                initLocked = false;
+            }
             final List<UserInfo> users = mContext.getSystemService(UserManager.class).getUsers();
             for (UserInfo user : users) {
                 try {