Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #define LOG_TAG "gatekeeperd" |
| 18 | |
| 19 | #include "IGateKeeperService.h" |
| 20 | |
| 21 | #include <cutils/log.h> |
| 22 | #include <utils/Log.h> |
| 23 | |
| 24 | #include <binder/IPCThreadState.h> |
| 25 | #include <binder/IServiceManager.h> |
| 26 | #include <binder/PermissionCache.h> |
| 27 | #include <utils/String16.h> |
| 28 | |
| 29 | #include <keystore/IKeystoreService.h> |
| 30 | #include <hardware/gatekeeper.h> |
| 31 | |
| 32 | namespace android { |
| 33 | |
| 34 | static const String16 KEYGUARD_PERMISSION("android.permission.ACCESS_KEYGUARD_SECURE_STORAGE"); |
| 35 | static const String16 DUMP_PERMISSION("android.permission.DUMP"); |
| 36 | |
| 37 | class GateKeeperProxy : public BnGateKeeperService { |
| 38 | public: |
| 39 | GateKeeperProxy() { |
| 40 | int ret = hw_get_module_by_class(GATEKEEPER_HARDWARE_MODULE_ID, NULL, &module); |
| 41 | if (ret < 0) |
| 42 | LOG_ALWAYS_FATAL_IF(ret < 0, "Unable to find GateKeeper HAL"); |
| 43 | ret = gatekeeper_open(module, &device); |
| 44 | if (ret < 0) |
| 45 | LOG_ALWAYS_FATAL_IF(ret < 0, "Unable to open GateKeeper HAL"); |
| 46 | } |
| 47 | |
| 48 | virtual ~GateKeeperProxy() { |
| 49 | gatekeeper_close(device); |
| 50 | } |
| 51 | |
| 52 | virtual status_t enroll(uint32_t uid, |
| 53 | const uint8_t *current_password_handle, uint32_t current_password_handle_length, |
| 54 | const uint8_t *current_password, uint32_t current_password_length, |
| 55 | const uint8_t *desired_password, uint32_t desired_password_length, |
| 56 | uint8_t **enrolled_password_handle, uint32_t *enrolled_password_handle_length) { |
| 57 | IPCThreadState* ipc = IPCThreadState::self(); |
| 58 | const int calling_pid = ipc->getCallingPid(); |
| 59 | const int calling_uid = ipc->getCallingUid(); |
| 60 | if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) { |
| 61 | return PERMISSION_DENIED; |
| 62 | } |
| 63 | |
| 64 | // need a desired password to enroll |
| 65 | if (desired_password_length == 0) return -EINVAL; |
| 66 | int ret = device->enroll(device, uid, |
| 67 | current_password_handle, current_password_handle_length, |
| 68 | current_password, current_password_length, |
| 69 | desired_password, desired_password_length, |
| 70 | enrolled_password_handle, enrolled_password_handle_length); |
| 71 | return ret >= 0 ? NO_ERROR : UNKNOWN_ERROR; |
| 72 | } |
| 73 | |
Andres Morales | c828ae8 | 2015-04-10 21:03:07 -0700 | [diff] [blame^] | 74 | virtual status_t verify(uint32_t uid, |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 75 | const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length, |
| 76 | const uint8_t *provided_password, uint32_t provided_password_length) { |
Andres Morales | c828ae8 | 2015-04-10 21:03:07 -0700 | [diff] [blame^] | 77 | uint8_t *auth_token; |
| 78 | uint32_t auth_token_length; |
| 79 | return verifyChallenge(uid, 0, enrolled_password_handle, enrolled_password_handle_length, |
| 80 | provided_password, provided_password_length, |
| 81 | &auth_token, &auth_token_length); |
| 82 | } |
| 83 | |
| 84 | virtual status_t verifyChallenge(uint32_t uid, uint64_t challenge, |
| 85 | const uint8_t *enrolled_password_handle, uint32_t enrolled_password_handle_length, |
| 86 | const uint8_t *provided_password, uint32_t provided_password_length, |
| 87 | uint8_t **auth_token, uint32_t *auth_token_length) { |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 88 | IPCThreadState* ipc = IPCThreadState::self(); |
| 89 | const int calling_pid = ipc->getCallingPid(); |
| 90 | const int calling_uid = ipc->getCallingUid(); |
| 91 | if (!PermissionCache::checkPermission(KEYGUARD_PERMISSION, calling_pid, calling_uid)) { |
| 92 | return PERMISSION_DENIED; |
| 93 | } |
| 94 | |
| 95 | // can't verify if we're missing either param |
| 96 | if ((enrolled_password_handle_length | provided_password_length) == 0) |
| 97 | return -EINVAL; |
| 98 | |
Andres Morales | 851b57c | 2015-04-09 19:23:48 -0700 | [diff] [blame] | 99 | int ret = device->verify(device, uid, challenge, |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 100 | enrolled_password_handle, enrolled_password_handle_length, |
Andres Morales | c828ae8 | 2015-04-10 21:03:07 -0700 | [diff] [blame^] | 101 | provided_password, provided_password_length, auth_token, auth_token_length); |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 102 | |
Andres Morales | c828ae8 | 2015-04-10 21:03:07 -0700 | [diff] [blame^] | 103 | if (ret >= 0 && *auth_token != NULL && *auth_token_length > 0) { |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 104 | // TODO: cache service? |
| 105 | sp<IServiceManager> sm = defaultServiceManager(); |
| 106 | sp<IBinder> binder = sm->getService(String16("android.security.keystore")); |
| 107 | sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder); |
| 108 | if (service != NULL) { |
Andres Morales | c828ae8 | 2015-04-10 21:03:07 -0700 | [diff] [blame^] | 109 | if (service->addAuthToken(*auth_token, *auth_token_length) != NO_ERROR) { |
Andres Morales | 2d08dce | 2015-04-03 16:40:15 -0700 | [diff] [blame] | 110 | ALOGE("Falure sending auth token to KeyStore"); |
| 111 | } |
| 112 | } else { |
| 113 | ALOGE("Unable to communicate with KeyStore"); |
| 114 | } |
| 115 | } |
| 116 | |
| 117 | return ret >= 0 ? NO_ERROR : UNKNOWN_ERROR; |
| 118 | } |
| 119 | |
| 120 | virtual status_t dump(int fd, const Vector<String16> &) { |
| 121 | IPCThreadState* ipc = IPCThreadState::self(); |
| 122 | const int pid = ipc->getCallingPid(); |
| 123 | const int uid = ipc->getCallingUid(); |
| 124 | if (!PermissionCache::checkPermission(DUMP_PERMISSION, pid, uid)) { |
| 125 | return PERMISSION_DENIED; |
| 126 | } |
| 127 | |
| 128 | if (device == NULL) { |
| 129 | const char *result = "Device not available"; |
| 130 | write(fd, result, strlen(result) + 1); |
| 131 | } else { |
| 132 | const char *result = "OK"; |
| 133 | write(fd, result, strlen(result) + 1); |
| 134 | } |
| 135 | |
| 136 | return NO_ERROR; |
| 137 | } |
| 138 | |
| 139 | private: |
| 140 | gatekeeper_device_t *device; |
| 141 | const hw_module_t *module; |
| 142 | }; |
| 143 | }// namespace android |
| 144 | |
| 145 | int main() { |
| 146 | ALOGI("Starting gatekeeperd..."); |
| 147 | android::sp<android::IServiceManager> sm = android::defaultServiceManager(); |
| 148 | android::sp<android::GateKeeperProxy> proxy = new android::GateKeeperProxy(); |
| 149 | android::status_t ret = sm->addService( |
| 150 | android::String16("android.service.gatekeeper.IGateKeeperService"), proxy); |
| 151 | if (ret != android::OK) { |
| 152 | ALOGE("Couldn't register binder service!"); |
| 153 | return -1; |
| 154 | } |
| 155 | |
| 156 | /* |
| 157 | * We're the only thread in existence, so we're just going to process |
| 158 | * Binder transaction as a single-threaded program. |
| 159 | */ |
| 160 | android::IPCThreadState::self()->joinThreadPool(); |
| 161 | return 0; |
| 162 | } |