Merge "Remove obsolete support for emulated FBE" am: d96c8701dd am: 5f2aa0bd19

Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/2101871

Change-Id: Idd5e502f12216c2de212b68682fb97a4bb28e874
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

cmds/sm/src/com/android/commands/sm/Sm.java

@@ -94,8 +94,6 @@ public final class Sm {
             runBenchmark();
         } else if ("forget".equals(op)) {
             runForget();
-        } else if ("set-emulate-fbe".equals(op)) {
-            runSetEmulateFbe();
         } else if ("get-fbe-mode".equals(op)) {
             runGetFbeMode();
         } else if ("idle-maint".equals(op)) {
@@ -191,17 +189,9 @@ public final class Sm {
         }
     }
 
-    public void runSetEmulateFbe() throws RemoteException {
-        final boolean emulateFbe = Boolean.parseBoolean(nextArg());
-        mSm.setDebugFlags(emulateFbe ? StorageManager.DEBUG_EMULATE_FBE : 0,
-                StorageManager.DEBUG_EMULATE_FBE);
-    }
-
     public void runGetFbeMode() {
-        if (StorageManager.isFileEncryptedNativeOnly()) {
+        if (StorageManager.isFileEncrypted()) {
             System.out.println("native");
-        } else if (StorageManager.isFileEncryptedEmulatedOnly()) {
-            System.out.println("emulated");
         } else {
             System.out.println("none");
         }
@@ -358,8 +348,6 @@ public final class Sm {
         System.err.println("");
         System.err.println("       sm forget [UUID|all]");
         System.err.println("");
-        System.err.println("       sm set-emulate-fbe [true|false]");
-        System.err.println("");
         System.err.println("       sm start-checkpoint <num-retries>");
         System.err.println("");
         System.err.println("       sm supports-checkpoint");

core/java/android/os/storage/StorageManager.java

@@ -153,8 +153,6 @@ public class StorageManager {
     /** {@hide} */
     public static final String PROP_ADOPTABLE = "persist.sys.adoptable";
     /** {@hide} */
-    public static final String PROP_EMULATE_FBE = "persist.sys.emulate_fbe";
-    /** {@hide} */
     public static final String PROP_SDCARDFS = "persist.sys.sdcardfs";
     /** {@hide} */
     public static final String PROP_VIRTUAL_DISK = "persist.sys.virtual_disk";
@@ -258,13 +256,11 @@ public class StorageManager {
     /** {@hide} */
     public static final int DEBUG_ADOPTABLE_FORCE_OFF = 1 << 1;
     /** {@hide} */
-    public static final int DEBUG_EMULATE_FBE = 1 << 2;
+    public static final int DEBUG_SDCARDFS_FORCE_ON = 1 << 2;
     /** {@hide} */
-    public static final int DEBUG_SDCARDFS_FORCE_ON = 1 << 3;
+    public static final int DEBUG_SDCARDFS_FORCE_OFF = 1 << 3;
     /** {@hide} */
-    public static final int DEBUG_SDCARDFS_FORCE_OFF = 1 << 4;
+    public static final int DEBUG_VIRTUAL_DISK = 1 << 4;
-    /** {@hide} */
-    public static final int DEBUG_VIRTUAL_DISK = 1 << 5;
 
     /** {@hide} */
     public static final int FLAG_STORAGE_DE = IInstalld.FLAG_STORAGE_DE;
@@ -1694,30 +1690,31 @@ public class StorageManager {
     }
 
     /** {@hide}
-     * Is this device file encrypted?
+     * Does this device have file-based encryption (FBE) enabled?
-     * @return true for file encrypted. (Implies isEncrypted() == true)
+     * @return true if the device has file-based encryption enabled.
-     *         false not encrypted or using "managed" encryption
      */
-    @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
+    public static boolean isFileEncrypted() {
-    public static boolean isFileEncryptedNativeOnly() {
         if (!isEncrypted()) {
             return false;
         }
         return RoSystemProperties.CRYPTO_FILE_ENCRYPTED;
     }
 
-    /** {@hide} */
+    /** {@hide}
-    public static boolean isFileEncryptedEmulatedOnly() {
+     * @deprecated Use {@link #isFileEncrypted} instead, since emulated FBE is no longer supported.
-        return SystemProperties.getBoolean(StorageManager.PROP_EMULATE_FBE, false);
+     */
+    @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
+    @Deprecated
+    public static boolean isFileEncryptedNativeOnly() {
+        return isFileEncrypted();
     }
 
     /** {@hide}
-     * Is this device running in a file encrypted mode, either native or emulated?
+     * @deprecated Use {@link #isFileEncrypted} instead, since emulated FBE is no longer supported.
-     * @return true for file encrypted, false otherwise
      */
+    @Deprecated
     public static boolean isFileEncryptedNativeOrEmulated() {
-        return isFileEncryptedNativeOnly()
+        return isFileEncrypted();
-               || isFileEncryptedEmulatedOnly();
     }
 
     /** {@hide} */

services/core/java/com/android/server/StorageManagerService.java

@@ -96,7 +96,6 @@ import android.os.Message;
 import android.os.ParcelFileDescriptor;
 import android.os.ParcelableException;
 import android.os.PersistableBundle;
-import android.os.PowerManager;
 import android.os.Process;
 import android.os.RemoteCallbackList;
 import android.os.RemoteException;
@@ -295,15 +294,6 @@ class StorageManagerService extends IStorageManager.Stub
      */
     private static final boolean WATCHDOG_ENABLE = true;
 
-    /**
-     * Our goal is for all Android devices to be usable as development devices,
-     * which includes the new Direct Boot mode added in N. For devices that
-     * don't have native FBE support, we offer an emulation mode for developer
-     * testing purposes, but if it's prohibitively difficult to support this
-     * mode, it can be disabled for specific products using this flag.
-     */
-    private static final boolean EMULATE_FBE_SUPPORTED = true;
-
     private static final String TAG = "StorageManagerService";
     private static final boolean LOCAL_LOGV = Log.isLoggable(TAG, Log.VERBOSE);
 
@@ -1108,31 +1098,6 @@ class StorageManagerService extends IStorageManager.Stub
         mVolumes.put(internal.id, internal);
     }
 
-    private void initIfBootedAndConnected() {
-        Slog.d(TAG, "Thinking about init, mBootCompleted=" + mBootCompleted
-                + ", mDaemonConnected=" + mDaemonConnected);
-        if (mBootCompleted && mDaemonConnected
-                && !StorageManager.isFileEncryptedNativeOnly()) {
-            // When booting a device without native support, make sure that our
-            // user directories are locked or unlocked based on the current
-            // emulation status.
-            final boolean initLocked = StorageManager.isFileEncryptedEmulatedOnly();
-            Slog.d(TAG, "Setting up emulation state, initlocked=" + initLocked);
-            final List<UserInfo> users = mContext.getSystemService(UserManager.class).getUsers();
-            for (UserInfo user : users) {
-                try {
-                    if (initLocked) {
-                        mVold.lockUserKey(user.id);
-                    } else {
-                        mVold.unlockUserKey(user.id, user.serialNumber, encodeBytes(null));
-                    }
-                } catch (Exception e) {
-                    Slog.wtf(TAG, e);
-                }
-            }
-        }
-    }
-
     private void resetIfBootedAndConnected() {
         Slog.d(TAG, "Thinking about reset, mBootCompleted=" + mBootCompleted
                 + ", mDaemonConnected=" + mDaemonConnected);
@@ -1392,7 +1357,6 @@ class StorageManagerService extends IStorageManager.Stub
     }
 
     private void handleDaemonConnected() {
-        initIfBootedAndConnected();
         resetIfBootedAndConnected();
     }
 
@@ -2174,7 +2138,6 @@ class StorageManagerService extends IStorageManager.Stub
     }
 
     private void handleBootCompleted() {
-        initIfBootedAndConnected();
         resetIfBootedAndConnected();
     }
 
@@ -2869,32 +2832,6 @@ class StorageManagerService extends IStorageManager.Stub
     public void setDebugFlags(int flags, int mask) {
         enforcePermission(android.Manifest.permission.MOUNT_UNMOUNT_FILESYSTEMS);
 
-        if ((mask & StorageManager.DEBUG_EMULATE_FBE) != 0) {
-            if (!EMULATE_FBE_SUPPORTED) {
-                throw new IllegalStateException(
-                        "Emulation not supported on this device");
-            }
-            if (StorageManager.isFileEncryptedNativeOnly()) {
-                throw new IllegalStateException(
-                        "Emulation not supported on device with native FBE");
-            }
-            if (mLockPatternUtils.isCredentialRequiredToDecrypt(false)) {
-                throw new IllegalStateException(
-                        "Emulation requires disabling 'Secure start-up' in Settings > Security");
-            }
-
-            final long token = Binder.clearCallingIdentity();
-            try {
-                final boolean emulateFbe = (flags & StorageManager.DEBUG_EMULATE_FBE) != 0;
-                SystemProperties.set(StorageManager.PROP_EMULATE_FBE, Boolean.toString(emulateFbe));
-
-                // Perform hard reboot to kick policy into place
-                mContext.getSystemService(PowerManager.class).reboot(null);
-            } finally {
-                Binder.restoreCallingIdentity(token);
-            }
-        }
-
         if ((mask & (StorageManager.DEBUG_ADOPTABLE_FORCE_ON
                 | StorageManager.DEBUG_ADOPTABLE_FORCE_OFF)) != 0) {
             final String value;
@@ -2982,8 +2919,7 @@ class StorageManagerService extends IStorageManager.Stub
             // We need all the users unlocked to move their primary storage
             final List<UserInfo> users = mContext.getSystemService(UserManager.class).getUsers();
             for (UserInfo user : users) {
-                if (StorageManager.isFileEncryptedNativeOrEmulated()
+                if (StorageManager.isFileEncrypted() && !isUserKeyUnlocked(user.id)) {
-                        && !isUserKeyUnlocked(user.id)) {
                     Slog.w(TAG, "Failing move due to locked user " + user.id);
                     onMoveStatusLocked(PackageManager.MOVE_FAILED_LOCKED_USER);
                     return;
@@ -3274,9 +3210,9 @@ class StorageManagerService extends IStorageManager.Stub
 
     @Override
     public void unlockUserKey(int userId, int serialNumber, byte[] secret) {
-        boolean isFsEncrypted = StorageManager.isFileEncryptedNativeOrEmulated();
+        boolean isFileEncrypted = StorageManager.isFileEncrypted();
         Slog.d(TAG, "unlockUserKey: " + userId
-                + " isFileEncryptedNativeOrEmulated: " + isFsEncrypted
+                + " isFileEncrypted: " + isFileEncrypted
                 + " hasSecret: " + (secret != null));
         enforcePermission(android.Manifest.permission.STORAGE_INTERNAL);
 
@@ -3285,11 +3221,10 @@ class StorageManagerService extends IStorageManager.Stub
             return;
         }
 
-        if (isFsEncrypted) {
+        if (isFileEncrypted) {
             // When a user has a secure lock screen, a secret is required to
             // unlock the key, so don't bother trying to unlock it without one.
-            // This prevents misleading error messages from being logged.  This
+            // This prevents misleading error messages from being logged.
-            // is also needed for emulated FBE to behave like native FBE.
             if (mLockPatternUtils.isSecure(userId) && ArrayUtils.isEmpty(secret)) {
                 Slog.d(TAG, "Not unlocking user " + userId
                         + "'s CE storage yet because a secret is needed");

services/core/java/com/android/server/pm/UserDataPreparer.java

@@ -289,11 +289,6 @@ class UserDataPreparer {
         return Environment.getDataUserDeDirectory(volumeUuid, userId);
     }
 
-    @VisibleForTesting
-    protected boolean isFileEncryptedEmulatedOnly() {
-        return StorageManager.isFileEncryptedEmulatedOnly();
-    }
-
     /**
      * Enforce that serial number stored in user directory inode matches the
      * given expected value. Gracefully sets the serial number if currently
@@ -303,14 +298,6 @@ class UserDataPreparer {
      *             number is mismatched.
      */
     void enforceSerialNumber(File file, int serialNumber) throws IOException {
-        if (isFileEncryptedEmulatedOnly()) {
-            // When we're emulating FBE, the directory may have been chmod
-            // 000'ed, meaning we can't read the serial number to enforce it;
-            // instead of destroying the user, just log a warning.
-            Slog.w(TAG, "Device is emulating FBE; assuming current serial number is valid");
-            return;
-        }
-
         final int foundSerial = getSerialNumber(file);
         Slog.v(TAG, "Found " + file + " with serial number " + foundSerial);
 

services/tests/servicestests/src/com/android/server/pm/UserDataPreparerTest.java

@@ -261,11 +261,6 @@ public class UserDataPreparerTest {
         protected File getDataUserDeDirectory(String volumeUuid, int userId) {
             return new File(testDir, "user_de_" + userId);
         }
-
-        @Override
-        protected boolean isFileEncryptedEmulatedOnly() {
-            return false;
-        }
     }
 
 }