gatekeeperd/gatekeeperd.cpp - platform/system/core - Gitiles

 /*
  * Copyright (C) 2015 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #define LOG_TAG "gatekeeperd"

 #include "IGateKeeperService.h"

 #include <errno.h>
 #include <stdint.h>
 #include <inttypes.h>
 #include <fcntl.h>
 #include <unistd.h>

 #include <cutils/log.h>
 #include <utils/Log.h>

 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
 #include <binder/PermissionCache.h>
 #include <utils/String16.h>
 #include <utils/Log.h>

 #include <keystore/IKeystoreService.h>
 #include <keystore/keystore.h> // For error code
 #include <gatekeeper/password_handle.h> // for password_handle_t
 #include <hardware/gatekeeper.h>
 #include <hardware/hw_auth_token.h>

 #include "SoftGateKeeperDevice.h"
 #include "IUserManager.h"

 namespace android {

 static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SECURE_STORAGE");
 static const String16 DUMP_PERMISSION("android.permission.DUMP");

 class GateKeeperProxy : public BnGateKeeperService {
 public:
     GateKeeperProxy() {
         int ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &module);
         device = NULL;

         if (ret < 0) {
             ALOGW("falling back to software GateKeeper");
             soft_device.reset(new SoftGateKeeperDevice());
         } else {
             ret = gatekeeper_open(module, &device);
             if (ret < 0)
                 LOG_ALWAYS_FATAL_IF(ret < 0, "Unable to open GateKeeper HAL");
         }

         if (mark_cold_boot()) {
             ALOGI("cold boot: clearing state");
             if (device != NULL && device->delete_all_users != NULL) {
                 device->delete_all_users(device);
             }
         }
     }

     virtual ~GateKeeperProxy() {
         if (device) gatekeeper_close(device);
     }

     void store_sid(uint32_t uid, uint64_t sid) {
         char filename[21];
         snprintf(filename, sizeof(filename), "%u", uid);
         int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
         if (fd < 0) {
             ALOGE("could not open file: %s: %s", filename, strerror(errno));
             return;
         }
         write(fd, &sid, sizeof(sid));
         close(fd);
     }

     bool mark_cold_boot() {
         const char *filename = ".coldboot";
         if (access(filename, F_OK) == -1) {
             int fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
             if (fd < 0) {
                 ALOGE("could not open file: %s : %s", filename, strerror(errno));
                 return false;
             }
             close(fd);
             return true;
         }
         return false;
     }

     void maybe_store_sid(uint32_t uid, uint64_t sid) {
         char filename[21];
         snprintf(filename, sizeof(filename), "%u", uid);
         if (access(filename, F_OK) == -1) {
             store_sid(uid, sid);
         }
     }

     uint64_t read_sid(uint32_t uid) {
         char filename[21];
         uint64_t sid;
         snprintf(filename, sizeof(filename), "%u", uid);
         int fd = open(filename, O_RDONLY);
         if (fd < 0) return 0;
         read(fd, &sid, sizeof(sid));
         close(fd);
         return sid;
     }

     void clear_sid(uint32_t uid) {
         char filename[21];
         snprintf(filename, sizeof(filename), "%u", uid);
         if (remove(filename) < 0) {
             ALOGE("%s: could not remove file [%s], attempting 0 write", __func__, strerror(errno));
             store_sid(uid, 0);
         }
     }

     virtual int enroll(uint32_t uid,
             const uint8_t *current_password_handle, uint32_t current_password_handle_length,
             const uint8_t *current_password, uint32_t current_password_length,
             const uint8_t *desired_password, uint32_t desired_password_length,
             uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length) {
         IPCThreadState* ipc = IPCThreadState::self();
         const int calling_pid = ipc->getCallingPid();
         const int calling_uid = ipc->getCallingUid();
         if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
             return PERMISSION_DENIED;
         }

         // need a desired password to enroll
         if (desired_password_length == 0) return -EINVAL;

         int ret;
         if (device) {
             const gatekeeper::password_handle_t *handle =
                     reinterpret_cast<const gatekeeper::password_handle_t *>(current_password_handle);

             if (handle != NULL && handle->version != 0 && !handle->hardware_backed) {
                 // handle is being re-enrolled from a software version. HAL probably won't accept
                 // the handle as valid, so we nullify it and enroll from scratch
                 current_password_handle = NULL;
                 current_password_handle_length = 0;
                 current_password = NULL;
                 current_password_length = 0;
             }

             ret = device->enroll(device, uid, current_password_handle, current_password_handle_length,
                     current_password, current_password_length,
                     desired_password, desired_password_length,
                     enrolled_password_handle, enrolled_password_handle_length);
         } else {
             ret = soft_device->enroll(uid,
                     current_password_handle, current_password_handle_length,
                     current_password, current_password_length,
                     desired_password, desired_password_length,
                     enrolled_password_handle, enrolled_password_handle_length);
         }

         if (ret == 0) {
             gatekeeper::password_handle_t *handle =
                     reinterpret_cast<gatekeeper::password_handle_t *>(*enrolled_password_handle);
             store_sid(uid, handle->user_id);
             bool rr;

             // immediately verify this password so we don't ask the user to enter it again
             // if they just created it.
             verify(uid, *enrolled_password_handle, sizeof(password_handle_t), desired_password,
                     desired_password_length, &rr);
         }

         return ret;
     }

     virtual int verify(uint32_t uid,
             const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
             const uint8_t *provided_password, uint32_t provided_password_length, bool *request_reenroll) {
         uint8_t *auth_token;
         uint32_t auth_token_length;
         return verifyChallenge(uid, 0, enrolled_password_handle, enrolled_password_handle_length,
                 provided_password, provided_password_length,
                 &auth_token, &auth_token_length, request_reenroll);
     }

     virtual int verifyChallenge(uint32_t uid, uint64_t challenge,
             const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
             const uint8_t *provided_password, uint32_t provided_password_length,
             uint8_t **auth_token, uint32_t *auth_token_length, bool *request_reenroll) {
         IPCThreadState* ipc = IPCThreadState::self();
         const int calling_pid = ipc->getCallingPid();
         const int calling_uid = ipc->getCallingUid();
         if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
             return PERMISSION_DENIED;
         }

         // can't verify if we're missing either param
         if ((enrolled_password_handle_length | provided_password_length) == 0)
             return -EINVAL;

         int ret;
         if (device) {
             const gatekeeper::password_handle_t *handle =
                     reinterpret_cast<const gatekeeper::password_handle_t *>(enrolled_password_handle);
             // handle version 0 does not have hardware backed flag, and thus cannot be upgraded to
             // a HAL if there was none before
             if (handle->version == 0 || handle->hardware_backed) {
                 ret = device->verify(device, uid, challenge,
                     enrolled_password_handle, enrolled_password_handle_length,
                     provided_password, provided_password_length, auth_token, auth_token_length,
                     request_reenroll);
             } else {
                 // upgrade scenario, a HAL has been added to this device where there was none before
                 SoftGateKeeperDevice soft_dev;
                 ret = soft_dev.verify(uid, challenge,
                     enrolled_password_handle, enrolled_password_handle_length,
                     provided_password, provided_password_length, auth_token, auth_token_length,
                     request_reenroll);

                 if (ret == 0) {
                     // success! re-enroll with HAL
                     *request_reenroll = true;
                 }
             }
         } else {
             ret = soft_device->verify(uid, challenge,
                 enrolled_password_handle, enrolled_password_handle_length,
                 provided_password, provided_password_length, auth_token, auth_token_length,
                 request_reenroll);
         }

         if (ret == 0 && *auth_token != NULL && *auth_token_length > 0) {
             // TODO: cache service?
             sp<IServiceManager> sm = defaultServiceManager();
             sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
             sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
             if (service != NULL) {
                 status_t ret = service->addAuthToken(*auth_token, *auth_token_length);
                 if (ret != ResponseCode::NO_ERROR) {
                     ALOGE("Falure sending auth token to KeyStore: %d", ret);
                 }
             } else {
                 ALOGE("Unable to communicate with KeyStore");
             }
         }

         if (ret == 0) {
             maybe_store_sid(uid, reinterpret_cast<const gatekeeper::password_handle_t *>(
                         enrolled_password_handle)->user_id);
         }

         return ret;
     }

     virtual uint64_t getSecureUserId(uint32_t uid) {
         uint64_t sid = read_sid(uid);
          if (sid == 0) {
             // might be a work profile, look up the parent
             sp<IServiceManager> sm = defaultServiceManager();
             sp<IBinder> binder = sm->getService(String16("user"));
             sp<IUserManager> um = interface_cast<IUserManager>(binder);
             int32_t parent = um->getCredentialOwnerProfile(uid);
             if (parent < 0) {
                 return 0;
             } else if (parent != (int32_t) uid) {
                 return read_sid(parent);
             }
         }
         return sid;

     }

     virtual void clearSecureUserId(uint32_t uid) {
         IPCThreadState* ipc = IPCThreadState::self();
         const int calling_pid = ipc->getCallingPid();
         const int calling_uid = ipc->getCallingUid();
         if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
             ALOGE("%s: permission denied for [%d:%d]", __func__, calling_pid, calling_uid);
             return;
         }
         clear_sid(uid);

         if (device != NULL && device->delete_user != NULL) {
             device->delete_user(device, uid);
         }
     }

     virtual status_t dump(int fd, const Vector<String16> &) {
         IPCThreadState* ipc = IPCThreadState::self();
         const int pid = ipc->getCallingPid();
         const int uid = ipc->getCallingUid();
         if (!PermissionCache::checkPermission(DUMP_PERMISSION, pid, uid)) {
             return PERMISSION_DENIED;
         }

         if (device == NULL) {
             const char *result = "Device not available";
             write(fd, result, strlen(result) + 1);
         } else {
             const char *result = "OK";
             write(fd, result, strlen(result) + 1);
         }

         return NO_ERROR;
     }

 private:
     gatekeeper_device_t *device;
     UniquePtr<SoftGateKeeperDevice> soft_device;
     const hw_module_t *module;
 };
 }// namespace android

 int main(int argc, char* argv[]) {
     ALOGI("Starting gatekeeperd...");
     if (argc < 2) {
         ALOGE("A directory must be specified!");
         return 1;
     }
     if (chdir(argv[1]) == -1) {
         ALOGE("chdir: %s: %s", argv[1], strerror(errno));
         return 1;
     }

     android::sp<android::IServiceManager> sm = android::defaultServiceManager();
     android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy();
     android::status_t ret = sm->addService(
             android::String16("android.service.gatekeeper.IGateKeeperService"), proxy);
     if (ret != android::OK) {
         ALOGE("Couldn't register binder service!");
         return -1;
     }

     /*
      * We're the only thread in existence, so we're just going to process
      * Binder transaction as a single-threaded program.
      */
     android::IPCThreadState::self()->joinThreadPool();
     return 0;
 }
	/*
	* Copyright (C) 2015 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#define LOG_TAG "gatekeeperd"

	#include "IGateKeeperService.h"

	#include <errno.h>
	#include <stdint.h>
	#include <inttypes.h>
	#include <fcntl.h>
	#include <unistd.h>

	#include <cutils/log.h>
	#include <utils/Log.h>

	#include <binder/IPCThreadState.h>
	#include <binder/IServiceManager.h>
	#include <binder/PermissionCache.h>
	#include <utils/String16.h>
	#include <utils/Log.h>

	#include <keystore/IKeystoreService.h>
	#include <keystore/keystore.h> // For error code
	#include <gatekeeper/password_handle.h> // for password_handle_t
	#include <hardware/gatekeeper.h>
	#include <hardware/hw_auth_token.h>

	#include "SoftGateKeeperDevice.h"
	#include "IUserManager.h"

	namespace android {

	static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SECURE_STORAGE");
	static const String16 DUMP_PERMISSION("android.permission.DUMP");

	class GateKeeperProxy : public BnGateKeeperService {
	public:
	GateKeeperProxy() {
	int ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &module);
	device = NULL;

	if (ret < 0) {
	ALOGW("falling back to software GateKeeper");
	soft_device.reset(new SoftGateKeeperDevice());
	} else {
	ret = gatekeeper_open(module, &device);
	if (ret < 0)
	LOG_ALWAYS_FATAL_IF(ret < 0, "Unable to open GateKeeper HAL");
	}

	if (mark_cold_boot()) {
	ALOGI("cold boot: clearing state");
	if (device != NULL && device->delete_all_users != NULL) {
	device->delete_all_users(device);
	}
	}
	}

	virtual ~GateKeeperProxy() {
	if (device) gatekeeper_close(device);
	}

	void store_sid(uint32_t uid, uint64_t sid) {
	char filename[21];
	snprintf(filename, sizeof(filename), "%u", uid);
	int fd = open(filename, O_WRONLY \| O_TRUNC \| O_CREAT, S_IRUSR \| S_IWUSR);
	if (fd < 0) {
	ALOGE("could not open file: %s: %s", filename, strerror(errno));
	return;
	}
	write(fd, &sid, sizeof(sid));
	close(fd);
	}

	bool mark_cold_boot() {
	const char *filename = ".coldboot";
	if (access(filename, F_OK) == -1) {
	int fd = open(filename, O_WRONLY \| O_TRUNC \| O_CREAT, S_IRUSR \| S_IWUSR);
	if (fd < 0) {
	ALOGE("could not open file: %s : %s", filename, strerror(errno));
	return false;
	}
	close(fd);
	return true;
	}
	return false;
	}

	void maybe_store_sid(uint32_t uid, uint64_t sid) {
	char filename[21];
	snprintf(filename, sizeof(filename), "%u", uid);
	if (access(filename, F_OK) == -1) {
	store_sid(uid, sid);
	}
	}

	uint64_t read_sid(uint32_t uid) {
	char filename[21];
	uint64_t sid;
	snprintf(filename, sizeof(filename), "%u", uid);
	int fd = open(filename, O_RDONLY);
	if (fd < 0) return 0;
	read(fd, &sid, sizeof(sid));
	close(fd);
	return sid;
	}

	void clear_sid(uint32_t uid) {
	char filename[21];
	snprintf(filename, sizeof(filename), "%u", uid);
	if (remove(filename) < 0) {
	ALOGE("%s: could not remove file [%s], attempting 0 write", __func__, strerror(errno));
	store_sid(uid, 0);
	}
	}

	virtual int enroll(uint32_t uid,
	const uint8_t *current_password_handle, uint32_t current_password_handle_length,
	const uint8_t *current_password, uint32_t current_password_length,
	const uint8_t *desired_password, uint32_t desired_password_length,
	uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length) {
	IPCThreadState* ipc = IPCThreadState::self();
	const int calling_pid = ipc->getCallingPid();
	const int calling_uid = ipc->getCallingUid();
	if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
	return PERMISSION_DENIED;
	}

	// need a desired password to enroll
	if (desired_password_length == 0) return -EINVAL;

	int ret;
	if (device) {
	const gatekeeper::password_handle_t *handle =
	reinterpret_cast<const gatekeeper::password_handle_t *>(current_password_handle);

	if (handle != NULL && handle->version != 0 && !handle->hardware_backed) {
	// handle is being re-enrolled from a software version. HAL probably won't accept
	// the handle as valid, so we nullify it and enroll from scratch
	current_password_handle = NULL;
	current_password_handle_length = 0;
	current_password = NULL;
	current_password_length = 0;
	}

	ret = device->enroll(device, uid, current_password_handle, current_password_handle_length,
	current_password, current_password_length,
	desired_password, desired_password_length,
	enrolled_password_handle, enrolled_password_handle_length);
	} else {
	ret = soft_device->enroll(uid,
	current_password_handle, current_password_handle_length,
	current_password, current_password_length,
	desired_password, desired_password_length,
	enrolled_password_handle, enrolled_password_handle_length);
	}

	if (ret == 0) {
	gatekeeper::password_handle_t *handle =
	reinterpret_cast<gatekeeper::password_handle_t >(enrolled_password_handle);
	store_sid(uid, handle->user_id);
	bool rr;

	// immediately verify this password so we don't ask the user to enter it again
	// if they just created it.
	verify(uid, *enrolled_password_handle, sizeof(password_handle_t), desired_password,
	desired_password_length, &rr);
	}

	return ret;
	}

	virtual int verify(uint32_t uid,
	const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
	const uint8_t provided_password, uint32_t provided_password_length, bool request_reenroll) {
	uint8_t *auth_token;
	uint32_t auth_token_length;
	return verifyChallenge(uid, 0, enrolled_password_handle, enrolled_password_handle_length,
	provided_password, provided_password_length,
	&auth_token, &auth_token_length, request_reenroll);
	}

	virtual int verifyChallenge(uint32_t uid, uint64_t challenge,
	const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length,
	const uint8_t *provided_password, uint32_t provided_password_length,
	uint8_t *auth_token, uint32_t auth_token_length, bool *request_reenroll) {
	IPCThreadState* ipc = IPCThreadState::self();
	const int calling_pid = ipc->getCallingPid();
	const int calling_uid = ipc->getCallingUid();
	if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
	return PERMISSION_DENIED;
	}

	// can't verify if we're missing either param
	if ((enrolled_password_handle_length \| provided_password_length) == 0)
	return -EINVAL;

	int ret;
	if (device) {
	const gatekeeper::password_handle_t *handle =
	reinterpret_cast<const gatekeeper::password_handle_t *>(enrolled_password_handle);
	// handle version 0 does not have hardware backed flag, and thus cannot be upgraded to
	// a HAL if there was none before
	if (handle->version == 0 \|\| handle->hardware_backed) {
	ret = device->verify(device, uid, challenge,
	enrolled_password_handle, enrolled_password_handle_length,
	provided_password, provided_password_length, auth_token, auth_token_length,
	request_reenroll);
	} else {
	// upgrade scenario, a HAL has been added to this device where there was none before
	SoftGateKeeperDevice soft_dev;
	ret = soft_dev.verify(uid, challenge,
	enrolled_password_handle, enrolled_password_handle_length,
	provided_password, provided_password_length, auth_token, auth_token_length,
	request_reenroll);

	if (ret == 0) {
	// success! re-enroll with HAL
	*request_reenroll = true;
	}
	}
	} else {
	ret = soft_device->verify(uid, challenge,
	enrolled_password_handle, enrolled_password_handle_length,
	provided_password, provided_password_length, auth_token, auth_token_length,
	request_reenroll);
	}

	if (ret == 0 && auth_token != NULL && auth_token_length > 0) {
	// TODO: cache service?
	sp<IServiceManager> sm = defaultServiceManager();
	sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
	sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
	if (service != NULL) {
	status_t ret = service->addAuthToken(auth_token, auth_token_length);
	if (ret != ResponseCode::NO_ERROR) {
	ALOGE("Falure sending auth token to KeyStore: %d", ret);
	}
	} else {
	ALOGE("Unable to communicate with KeyStore");
	}
	}

	if (ret == 0) {
	maybe_store_sid(uid, reinterpret_cast<const gatekeeper::password_handle_t *>(
	enrolled_password_handle)->user_id);
	}

	return ret;
	}

	virtual uint64_t getSecureUserId(uint32_t uid) {
	uint64_t sid = read_sid(uid);
	if (sid == 0) {
	// might be a work profile, look up the parent
	sp<IServiceManager> sm = defaultServiceManager();
	sp<IBinder> binder = sm->getService(String16("user"));
	sp<IUserManager> um = interface_cast<IUserManager>(binder);
	int32_t parent = um->getCredentialOwnerProfile(uid);
	if (parent < 0) {
	return 0;
	} else if (parent != (int32_t) uid) {
	return read_sid(parent);
	}
	}
	return sid;

	}

	virtual void clearSecureUserId(uint32_t uid) {
	IPCThreadState* ipc = IPCThreadState::self();
	const int calling_pid = ipc->getCallingPid();
	const int calling_uid = ipc->getCallingUid();
	if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) {
	ALOGE("%s: permission denied for [%d:%d]", __func__, calling_pid, calling_uid);
	return;
	}
	clear_sid(uid);

	if (device != NULL && device->delete_user != NULL) {
	device->delete_user(device, uid);
	}
	}

	virtual status_t dump(int fd, const Vector<String16> &) {
	IPCThreadState* ipc = IPCThreadState::self();
	const int pid = ipc->getCallingPid();
	const int uid = ipc->getCallingUid();
	if (!PermissionCache::checkPermission(DUMP_PERMISSION, pid, uid)) {
	return PERMISSION_DENIED;
	}

	if (device == NULL) {
	const char *result = "Device not available";
	write(fd, result, strlen(result) + 1);
	} else {
	const char *result = "OK";
	write(fd, result, strlen(result) + 1);
	}

	return NO_ERROR;
	}

	private:
	gatekeeper_device_t *device;
	UniquePtr<SoftGateKeeperDevice> soft_device;
	const hw_module_t *module;
	};
	}// namespace android

	int main(int argc, char* argv[]) {
	ALOGI("Starting gatekeeperd...");
	if (argc < 2) {
	ALOGE("A directory must be specified!");
	return 1;
	}
	if (chdir(argv[1]) == -1) {
	ALOGE("chdir: %s: %s", argv[1], strerror(errno));
	return 1;
	}

	android::sp<android::IServiceManager> sm = android::defaultServiceManager();
	android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy();
	android::status_t ret = sm->addService(
	android::String16("android.service.gatekeeper.IGateKeeperService"), proxy);
	if (ret != android::OK) {
	ALOGE("Couldn't register binder service!");
	return -1;
	}

	/*
	* We're the only thread in existence, so we're just going to process
	* Binder transaction as a single-threaded program.
	*/
	android::IPCThreadState::self()->joinThreadPool();
	return 0;
	}