Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include "grant_store.h" |
| 18 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 19 | #include "blob.h" |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 20 | #include <algorithm> |
| 21 | #include <sstream> |
| 22 | |
| 23 | namespace keystore { |
| 24 | |
| 25 | static constexpr uint64_t kInvalidGrantNo = std::numeric_limits<uint64_t>::max(); |
| 26 | static const char* kKeystoreGrantInfix = "_KEYSTOREGRANT_"; |
| 27 | static constexpr size_t kKeystoreGrantInfixLength = 15; |
| 28 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 29 | Grant::Grant(const KeyBlobEntry& entry, const uint64_t grant_no) |
| 30 | : entry_(entry), grant_no_(grant_no) {} |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 31 | |
| 32 | static std::pair<uint64_t, std::string> parseGrantAlias(const std::string& grantAlias) { |
| 33 | auto pos = grantAlias.rfind(kKeystoreGrantInfix); |
| 34 | if (pos == std::string::npos) return {kInvalidGrantNo, ""}; |
| 35 | std::stringstream s(grantAlias.substr(pos + kKeystoreGrantInfixLength)); |
| 36 | std::string wrapped_alias = grantAlias.substr(0, pos); |
| 37 | uint64_t grant_no = kInvalidGrantNo; |
| 38 | s >> grant_no; |
| 39 | if (s.fail() || grant_no == kInvalidGrantNo) return {kInvalidGrantNo, ""}; |
| 40 | return {grant_no, wrapped_alias}; |
| 41 | } |
| 42 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 43 | std::string GrantStore::put(const uid_t uid, const LockedKeyBlobEntry& lockedEntry) { |
| 44 | std::unique_lock<std::shared_mutex> lock(mutex_); |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 45 | std::stringstream s; |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 46 | KeyBlobEntry blobEntry = *lockedEntry; |
| 47 | s << blobEntry.alias() << kKeystoreGrantInfix; |
| 48 | |
| 49 | std::set<Grant, std::less<>>& uid_grant_list = grants_[uid]; |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 50 | |
| 51 | bool success = false; |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 52 | auto iterator = |
| 53 | std::find_if(uid_grant_list.begin(), uid_grant_list.end(), |
| 54 | [&](const Grant& entry) { return success = entry.entry_ == blobEntry; }); |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 55 | while (!success) { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 56 | std::tie(iterator, success) = uid_grant_list.emplace(blobEntry, std::rand()); |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 57 | } |
| 58 | s << iterator->grant_no_; |
| 59 | return s.str(); |
| 60 | } |
| 61 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 62 | ReadLockedGrant GrantStore::get(const uid_t uid, const std::string& alias) const { |
| 63 | std::shared_lock<std::shared_mutex> lock(mutex_); |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 64 | uint64_t grant_no; |
| 65 | std::string wrappedAlias; |
| 66 | std::tie(grant_no, wrappedAlias) = parseGrantAlias(alias); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 67 | if (grant_no == kInvalidGrantNo) return {}; |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 68 | auto uid_set_iter = grants_.find(uid); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 69 | if (uid_set_iter == grants_.end()) return {}; |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 70 | auto& uid_grant_list = uid_set_iter->second; |
| 71 | auto grant = uid_grant_list.find(grant_no); |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 72 | if (grant == uid_grant_list.end()) return {}; |
| 73 | if (grant->entry_.alias() != wrappedAlias) return {}; |
| 74 | return {&(*grant), std::move(lock)}; |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 75 | } |
| 76 | |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 77 | bool GrantStore::removeByFileAlias(const uid_t granteeUid, const LockedKeyBlobEntry& lockedEntry) { |
| 78 | std::unique_lock<std::shared_mutex> lock(mutex_); |
Janis Danisevskis | f9f5545 | 2017-09-21 11:29:47 -0700 | [diff] [blame] | 79 | auto& uid_grant_list = grants_[granteeUid]; |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 80 | for (auto i = uid_grant_list.begin(); i != uid_grant_list.end(); ++i) { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 81 | if (i->entry_ == *lockedEntry) { |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 82 | uid_grant_list.erase(i); |
| 83 | return true; |
| 84 | } |
| 85 | } |
| 86 | return false; |
| 87 | } |
| 88 | |
Janis Danisevskis | f9f5545 | 2017-09-21 11:29:47 -0700 | [diff] [blame] | 89 | void GrantStore::removeAllGrantsToKey(const uid_t granterUid, const std::string& alias) { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 90 | std::unique_lock<std::shared_mutex> lock(mutex_); |
Janis Danisevskis | f9f5545 | 2017-09-21 11:29:47 -0700 | [diff] [blame] | 91 | for (auto& uid_grant_list : grants_) { |
| 92 | for (auto i = uid_grant_list.second.begin(); i != uid_grant_list.second.end(); ++i) { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 93 | if (i->entry_.alias() == alias && i->entry_.uid() == granterUid) { |
Janis Danisevskis | f9f5545 | 2017-09-21 11:29:47 -0700 | [diff] [blame] | 94 | uid_grant_list.second.erase(i); |
| 95 | break; |
| 96 | } |
| 97 | } |
| 98 | } |
| 99 | } |
| 100 | |
| 101 | void GrantStore::removeAllGrantsToUid(const uid_t granteeUid) { |
Janis Danisevskis | ff3d7f4 | 2018-10-08 07:15:09 -0700 | [diff] [blame] | 102 | std::unique_lock<std::shared_mutex> lock(mutex_); |
Janis Danisevskis | f9f5545 | 2017-09-21 11:29:47 -0700 | [diff] [blame] | 103 | grants_.erase(granteeUid); |
| 104 | } |
| 105 | |
Janis Danisevskis | 6d449e8 | 2017-06-07 18:03:31 -0700 | [diff] [blame] | 106 | } // namespace keystore |