am 09b542f2: (-s ours) am 20642ae7: Give secondary users read-only physical cards.
* commit '09b542f269bfd0726de53c2d230c5266f5227f1c':
diff --git a/Android.mk b/Android.mk
index 1a4f8dd..29d3dd3 100644
--- a/Android.mk
+++ b/Android.mk
@@ -88,6 +88,8 @@
main.cpp \
$(common_src_files)
+LOCAL_INIT_RC := vold.rc
+
LOCAL_C_INCLUDES := $(common_c_includes)
LOCAL_CFLAGS := $(vold_cflags)
LOCAL_CONLYFLAGS := $(vold_conlyflags)
@@ -112,5 +114,18 @@
LOCAL_SHARED_LIBRARIES := libcutils
LOCAL_CFLAGS := $(vold_cflags)
LOCAL_CONLYFLAGS := $(vold_conlyflags)
+LOCAL_INIT_RC := vdc.rc
+
+include $(BUILD_EXECUTABLE)
+
+include $(CLEAR_VARS)
+
+LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/Android.mk
+LOCAL_CLANG := true
+LOCAL_SRC_FILES:= secdiscard.cpp
+LOCAL_MODULE:= secdiscard
+LOCAL_SHARED_LIBRARIES := libcutils
+LOCAL_CFLAGS := $(vold_cflags)
+LOCAL_CONLYFLAGS := $(vold_conlyflags)
include $(BUILD_EXECUTABLE)
diff --git a/BenchmarkGen.h b/BenchmarkGen.h
index 3e46c21..6813b08 100644
--- a/BenchmarkGen.h
+++ b/BenchmarkGen.h
@@ -31,6 +31,8 @@
#include <algorithm>
#include <string>
+#include <Utils.h>
+
namespace android {
namespace vold {
@@ -4024,35 +4026,32 @@
return 0;
}
-static status_t CreateFile(const char* name, size_t len) {
- status_t res = -1;
- int in = -1;
+static status_t CreateFile(const char* name, int len) {
+ int chunk = std::min(len, 65536);
int out = -1;
+ std::string buf;
- if ((in = TEMP_FAILURE_RETRY(open("/dev/zero", O_RDONLY))) < 0) {
- PLOG(ERROR) << "Failed to open";
- goto done;
+ if (android::vold::ReadRandomBytes(chunk, buf) != OK) {
+ LOG(ERROR) << "Failed to read random data";
+ return -EIO;
}
if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC))) < 0) {
PLOG(ERROR) << "Failed to open " << name;
- goto done;
+ return -errno;
}
- char buf[65536];
while (len > 0) {
- int n = read(in, buf, std::min(len, sizeof(buf)));
- if (write(out, buf, n) != n) {
+ int n = write(out, buf.c_str(), std::min(len, chunk));
+ if (n < 0) {
PLOG(ERROR) << "Failed to write";
- goto done;
+ close(out);
+ return -errno;
}
len -= n;
}
- res = 0;
-done:
- close(in);
close(out);
- return res;
+ return OK;
}
static status_t BenchmarkCreate() {
diff --git a/CryptCommandListener.cpp b/CryptCommandListener.cpp
index 2e46919..173be63 100644
--- a/CryptCommandListener.cpp
+++ b/CryptCommandListener.cpp
@@ -42,6 +42,7 @@
#include "Process.h"
#include "ResponseCode.h"
#include "cryptfs.h"
+#include "Ext4Crypt.h"
#define DUMP_ARGS 0
@@ -288,6 +289,35 @@
dumpArgs(argc, argv, -1);
cryptfs_clear_password();
rc = 0;
+ } else if (!strcmp(argv[1], "setusercryptopolicies")) {
+ if (argc != 3) {
+ cli->sendMsg(ResponseCode::CommandSyntaxError,
+ "Usage: cryptfs setusercryptopolicies <path>", false);
+ return 0;
+ }
+ SLOGD("cryptfs setusercryptopolicies");
+ dumpArgs(argc, argv, -1);
+ rc = e4crypt_set_user_crypto_policies(argv[2]);
+ } else if (!strcmp(argv[1], "createnewuserdir")) {
+ if (argc != 4) {
+ cli->sendMsg(ResponseCode::CommandSyntaxError,
+ "Usage: cryptfs createnewuserdir <userHandle> <path>", false);
+ return 0;
+ }
+ // ext4enc:TODO: send a CommandSyntaxError if argv[2] not an integer
+ SLOGD("cryptfs createnewuserdir");
+ dumpArgs(argc, argv, -1);
+ rc = e4crypt_create_new_user_dir(argv[2], argv[3]);
+ } else if (!strcmp(argv[1], "deleteuserkey")) {
+ if (argc != 3) {
+ cli->sendMsg(ResponseCode::CommandSyntaxError,
+ "Usage: cryptfs deleteuserkey <userHandle>", false);
+ return 0;
+ }
+ // ext4enc:TODO: send a CommandSyntaxError if argv[2] not an integer
+ SLOGD("cryptfs deleteuserkey");
+ dumpArgs(argc, argv, -1);
+ rc = e4crypt_delete_user_key(argv[2]);
} else {
dumpArgs(argc, argv, -1);
cli->sendMsg(ResponseCode::CommandSyntaxError, "Unknown cryptfs cmd", false);
diff --git a/EmulatedVolume.cpp b/EmulatedVolume.cpp
index f1ca97b..6e440cc 100644
--- a/EmulatedVolume.cpp
+++ b/EmulatedVolume.cpp
@@ -61,9 +61,9 @@
label = "emulated";
}
- mFuseDefault = StringPrintf("/mnt/runtime_default/%s", label.c_str());
- mFuseRead = StringPrintf("/mnt/runtime_read/%s", label.c_str());
- mFuseWrite = StringPrintf("/mnt/runtime_write/%s", label.c_str());
+ mFuseDefault = StringPrintf("/mnt/runtime/default/%s", label.c_str());
+ mFuseRead = StringPrintf("/mnt/runtime/read/%s", label.c_str());
+ mFuseWrite = StringPrintf("/mnt/runtime/write/%s", label.c_str());
setInternalPath(mRawPath);
setPath(StringPrintf("/storage/%s", label.c_str()));
diff --git a/Ext4Crypt.cpp b/Ext4Crypt.cpp
index 7470ff9..95cbfb7 100644
--- a/Ext4Crypt.cpp
+++ b/Ext4Crypt.cpp
@@ -285,6 +285,7 @@
return 0;
}
+// Get raw keyref - used to make keyname and to pass to ioctl
static std::string generate_key_ref(const char* key, int length)
{
SHA512_CTX c;
@@ -351,9 +352,7 @@
return 0;
}
-// Install password into global keyring
-// Return raw key reference for use in policy
-static std::string e4crypt_install_key(const std::string &key)
+static ext4_encryption_key fill_key(const std::string &key)
{
// ext4enc:TODO Currently raw key is required to be of length
// sizeof(ext4_key.raw) == EXT4_MAX_KEY_SIZE, so zero pad to
@@ -365,37 +364,52 @@
static_assert(key_length / 8 <= sizeof(ext4_key.raw),
"Key too long!");
memcpy(ext4_key.raw, &key[0], key.size());
+ return ext4_key;
+}
- // Get raw keyref - used to make keyname and to pass to ioctl
- auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
-
- // Generate keyname
+static std::string keyname(const std::string &raw_ref)
+{
std::ostringstream o;
+ o << "ext4:";
for (auto i = raw_ref.begin(); i != raw_ref.end(); ++i) {
o << std::hex << std::setw(2) << std::setfill('0') << (int)*i;
}
- auto ref = std::string("ext4:") + o.str();
+ return o.str();
+}
- // Find existing keyring
- key_serial_t device_keyring = keyctl_search(KEY_SPEC_SESSION_KEYRING,
- "keyring", "e4crypt", 0);
+// Get the keyring we store all keys in
+static key_serial_t e4crypt_keyring()
+{
+ return keyctl_search(KEY_SPEC_SESSION_KEYRING, "keyring", "e4crypt", 0);
+}
+static int e4crypt_install_key(const ext4_encryption_key &ext4_key, const std::string &ref)
+{
+ key_serial_t device_keyring = e4crypt_keyring();
SLOGI("Found device_keyring - id is %d", device_keyring);
-
- // Add key ...
key_serial_t key_id = add_key("logon", ref.c_str(),
(void*)&ext4_key, sizeof(ext4_key),
device_keyring);
-
if (key_id == -1) {
SLOGE("Failed to insert key into keyring with error %s",
strerror(errno));
- return "";
+ return -1;
}
-
SLOGI("Added key %d (%s) to keyring %d in process %d",
key_id, ref.c_str(), device_keyring, getpid());
+ return 0;
+}
+// Install password into global keyring
+// Return raw key reference for use in policy
+static std::string e4crypt_install_key(const std::string &key)
+{
+ auto ext4_key = fill_key(key);
+ auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
+ auto ref = keyname(raw_ref);
+ if (e4crypt_install_key(ext4_key, ref) == -1) {
+ return "";
+ }
return raw_ref;
}
@@ -493,12 +507,9 @@
.Set(fieldname, std::string(value)) ? 0 : -1;
}
-// ext4enc:TODO this can't be the only place keys are read from /dev/urandom
-// we should unite those places.
-static std::string e4crypt_get_user_key(
+static std::string get_key_path(
const char *mount_path,
- const char *user_handle,
- bool create_if_absent)
+ const char *user_handle)
{
// ext4enc:TODO get the path properly
auto key_dir = android::base::StringPrintf("%s/misc/vold/user_keys",
@@ -507,7 +518,15 @@
SLOGE("Unable to create %s (%s)", key_dir.c_str(), strerror(errno));
return "";
}
- auto key_path = key_dir + "/" + user_handle;
+ return key_dir + "/" + user_handle;
+}
+
+// ext4enc:TODO this can't be the only place keys are read from /dev/urandom
+// we should unite those places.
+static std::string e4crypt_get_key(
+ const std::string &key_path,
+ bool create_if_absent)
+{
std::string content;
if (android::base::ReadFileToString(key_path, &content)) {
if (content.size() != key_length/8) {
@@ -532,20 +551,21 @@
SLOGE("Unable to read key from /dev/urandom (%s)", strerror(errno));
return "";
}
- std::string user_key(key_bytes, sizeof(key_bytes));
- if (!android::base::WriteStringToFile(user_key, key_path)) {
+ std::string key(key_bytes, sizeof(key_bytes));
+ if (!android::base::WriteStringToFile(key, key_path)) {
SLOGE("Unable to write key to %s (%s)",
key_path.c_str(), strerror(errno));
return "";
}
- return user_key;
+ return key;
}
static int e4crypt_set_user_policy(const char *mount_path, const char *user_handle,
const char *path, bool create_if_absent)
{
SLOGD("e4crypt_set_user_policy for %s", user_handle);
- auto user_key = e4crypt_get_user_key(mount_path, user_handle,
+ auto user_key = e4crypt_get_key(
+ get_key_path(mount_path, user_handle),
create_if_absent);
if (user_key.empty()) {
return -1;
@@ -612,3 +632,35 @@
}
return 0;
}
+
+int e4crypt_delete_user_key(const char *user_handle) {
+ SLOGD("e4crypt_delete_user_key(\"%s\")", user_handle);
+ auto key_path = get_key_path(DATA_MNT_POINT, user_handle);
+ auto key = e4crypt_get_key(key_path, false);
+ auto ext4_key = fill_key(key);
+ auto ref = keyname(generate_key_ref(ext4_key.raw, ext4_key.size));
+ auto key_serial = keyctl_search(e4crypt_keyring(), "logon", ref.c_str(), 0);
+ if (keyctl_revoke(key_serial) == 0) {
+ SLOGD("Revoked key with serial %ld ref %s\n", key_serial, ref.c_str());
+ } else {
+ SLOGE("Failed to revoke key with serial %ld ref %s: %s\n",
+ key_serial, ref.c_str(), strerror(errno));
+ }
+ int pid = fork();
+ if (pid < 0) {
+ SLOGE("Unable to fork: %s", strerror(errno));
+ return -1;
+ }
+ if (pid == 0) {
+ SLOGD("Forked for secdiscard");
+ execl("/system/bin/secdiscard",
+ "/system/bin/secdiscard",
+ key_path.c_str(),
+ NULL);
+ SLOGE("Unable to launch secdiscard on %s: %s\n", key_path.c_str(),
+ strerror(errno));
+ exit(-1);
+ }
+ // ext4enc:TODO reap the zombie
+ return 0;
+}
diff --git a/Ext4Crypt.h b/Ext4Crypt.h
index c502b62..f5c2871 100644
--- a/Ext4Crypt.h
+++ b/Ext4Crypt.h
@@ -20,5 +20,6 @@
const char* value);
int e4crypt_set_user_crypto_policies(const char *path);
int e4crypt_create_new_user_dir(const char *user_handle, const char *path);
+int e4crypt_delete_user_key(const char *user_handle);
__END_DECLS
diff --git a/Loop.cpp b/Loop.cpp
index 8872d7a..059b963 100644
--- a/Loop.cpp
+++ b/Loop.cpp
@@ -103,10 +103,11 @@
}
rc = ioctl(fd, LOOP_GET_STATUS64, &li);
- close(fd);
if (rc < 0 && errno == ENXIO) {
+ close(fd);
continue;
}
+ close(fd);
if (rc < 0) {
SLOGE("Unable to get loop status for %s (%s)", filename,
diff --git a/PublicVolume.cpp b/PublicVolume.cpp
index 762eb04..eb550c3 100644
--- a/PublicVolume.cpp
+++ b/PublicVolume.cpp
@@ -112,12 +112,16 @@
mRawPath = StringPrintf("/mnt/media_rw/%s", stableName.c_str());
- mFuseDefault = StringPrintf("/mnt/runtime_default/%s", stableName.c_str());
- mFuseRead = StringPrintf("/mnt/runtime_read/%s", stableName.c_str());
- mFuseWrite = StringPrintf("/mnt/runtime_write/%s", stableName.c_str());
+ mFuseDefault = StringPrintf("/mnt/runtime/default/%s", stableName.c_str());
+ mFuseRead = StringPrintf("/mnt/runtime/read/%s", stableName.c_str());
+ mFuseWrite = StringPrintf("/mnt/runtime/write/%s", stableName.c_str());
setInternalPath(mRawPath);
- setPath(StringPrintf("/storage/%s", stableName.c_str()));
+ if (getMountFlags() & MountFlags::kVisible) {
+ setPath(StringPrintf("/storage/%s", stableName.c_str()));
+ } else {
+ setPath(mRawPath);
+ }
if (fs_prepare_dir(mRawPath.c_str(), 0700, AID_ROOT, AID_ROOT) ||
fs_prepare_dir(mFuseDefault.c_str(), 0700, AID_ROOT, AID_ROOT) ||
diff --git a/Utils.cpp b/Utils.cpp
index 06222c3..e19c9df 100644
--- a/Utils.cpp
+++ b/Utils.cpp
@@ -170,6 +170,12 @@
cmd.push_back(kBlkidPath);
cmd.push_back("-c");
cmd.push_back("/dev/null");
+ cmd.push_back("-s");
+ cmd.push_back("TYPE");
+ cmd.push_back("-s");
+ cmd.push_back("UUID");
+ cmd.push_back("-s");
+ cmd.push_back("LABEL");
cmd.push_back(path);
std::vector<std::string> output;
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index ddb7517..ce355df 100755
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -580,11 +580,11 @@
std::string storageSource;
if (mode == "default") {
- storageSource = "/mnt/runtime_default";
+ storageSource = "/mnt/runtime/default";
} else if (mode == "read") {
- storageSource = "/mnt/runtime_read";
+ storageSource = "/mnt/runtime/read";
} else if (mode == "write") {
- storageSource = "/mnt/runtime_write";
+ storageSource = "/mnt/runtime/write";
} else {
// Sane default of no storage visible
_exit(0);
diff --git a/bench/benchgen.py b/bench/benchgen.py
index 077336c..77262c4 100644
--- a/bench/benchgen.py
+++ b/bench/benchgen.py
@@ -159,6 +159,8 @@
#include <algorithm>
#include <string>
+#include <Utils.h>
+
namespace android {
namespace vold {
@@ -262,35 +264,32 @@
return 0;
}
-static status_t CreateFile(const char* name, size_t len) {
- status_t res = -1;
- int in = -1;
+static status_t CreateFile(const char* name, int len) {
+ int chunk = std::min(len, 65536);
int out = -1;
+ std::string buf;
- if ((in = TEMP_FAILURE_RETRY(open("/dev/zero", O_RDONLY))) < 0) {
- PLOG(ERROR) << "Failed to open";
- goto done;
+ if (android::vold::ReadRandomBytes(chunk, buf) != OK) {
+ LOG(ERROR) << "Failed to read random data";
+ return -EIO;
}
if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC))) < 0) {
PLOG(ERROR) << "Failed to open " << name;
- goto done;
+ return -errno;
}
- char buf[65536];
while (len > 0) {
- int n = read(in, buf, std::min(len, sizeof(buf)));
- if (write(out, buf, n) != n) {
+ int n = write(out, buf.c_str(), std::min(len, chunk));
+ if (n < 0) {
PLOG(ERROR) << "Failed to write";
- goto done;
+ close(out);
+ return -errno;
}
len -= n;
}
- res = 0;
-done:
- close(in);
close(out);
- return res;
+ return OK;
}
static status_t BenchmarkCreate() {
diff --git a/cryptfs.c b/cryptfs.c
index a905ff6..1a63a5b 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -3237,7 +3237,9 @@
int cryptfs_changepw(int crypt_type, const char *newpw)
{
if (e4crypt_crypto_complete(DATA_MNT_POINT) == 0) {
- return e4crypt_change_password(DATA_MNT_POINT, crypt_type, newpw);
+ return e4crypt_change_password(DATA_MNT_POINT, crypt_type,
+ crypt_type == CRYPT_TYPE_DEFAULT ? DEFAULT_PASSWORD
+ : newpw);
}
struct crypt_mnt_ftr crypt_ftr;
diff --git a/fs/Vfat.cpp b/fs/Vfat.cpp
index faff763..7bd05ec 100644
--- a/fs/Vfat.cpp
+++ b/fs/Vfat.cpp
@@ -134,20 +134,6 @@
flags |= (ro ? MS_RDONLY : 0);
flags |= (remount ? MS_REMOUNT : 0);
- /*
- * Note: This is a temporary hack. If the sampling profiler is enabled,
- * we make the SD card world-writable so any process can write snapshots.
- *
- * TODO: Remove this code once we have a drop box in system_server.
- */
- char value[PROPERTY_VALUE_MAX];
- property_get("persist.sampling_profiler", value, "");
- if (value[0] == '1') {
- SLOGW("The SD card is world-writable because the"
- " 'persist.sampling_profiler' system property is set to '1'.");
- permMask = 0;
- }
-
sprintf(mountData,
"utf8,uid=%d,gid=%d,fmask=%o,dmask=%o,shortname=mixed",
ownerUid, ownerGid, permMask, permMask);
diff --git a/secdiscard.cpp b/secdiscard.cpp
new file mode 100644
index 0000000..3f4ab2e
--- /dev/null
+++ b/secdiscard.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <linux/fiemap.h>
+
+#define LOG_TAG "secdiscard"
+#include "cutils/log.h"
+
+// Deliberately limit ourselves to wiping small files.
+#define MAX_WIPE_LENGTH 4096
+#define INIT_BUFFER_SIZE 2048
+
+static void usage(char *progname);
+static void destroy_key(const std::string &path);
+static int file_device_range(const std::string &path, uint64_t range[2]);
+static int open_block_device_for_path(const std::string &path);
+static int read_file_as_string_atomically(const std::string &path, std::string &contents);
+static int find_block_device_for_path(
+ const std::string &mounts,
+ const std::string &path,
+ std::string &block_device);
+
+int main(int argc, char **argv) {
+ if (argc != 2 || argv[1][0] != '/') {
+ usage(argv[0]);
+ return -1;
+ }
+ SLOGD("Running: %s %s", argv[0], argv[1]);
+ std::string target(argv[1]);
+ destroy_key(target);
+ if (unlink(argv[1]) != 0 && errno != ENOENT) {
+ SLOGE("Unable to delete %s: %s",
+ argv[1], strerror(errno));
+ return -1;
+ }
+ return 0;
+}
+
+static void usage(char *progname) {
+ fprintf(stderr, "Usage: %s <absolute path>\n", progname);
+}
+
+// BLKSECDISCARD all content in "path", if it's small enough.
+static void destroy_key(const std::string &path) {
+ uint64_t range[2];
+ if (file_device_range(path, range) < 0) {
+ return;
+ }
+ int fs_fd = open_block_device_for_path(path);
+ if (fs_fd < 0) {
+ return;
+ }
+ if (ioctl(fs_fd, BLKSECDISCARD, range) != 0) {
+ SLOGE("Unable to BLKSECDISCARD %s: %s", path.c_str(), strerror(errno));
+ close(fs_fd);
+ return;
+ }
+ close(fs_fd);
+ SLOGD("Discarded %s", path.c_str());
+}
+
+// Find a short range that completely covers the file.
+// If there isn't one, return -1, otherwise 0.
+static int file_device_range(const std::string &path, uint64_t range[2])
+{
+ int fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
+ if (fd < 0) {
+ if (errno == ENOENT) {
+ SLOGD("Unable to open %s: %s", path.c_str(), strerror(errno));
+ } else {
+ SLOGE("Unable to open %s: %s", path.c_str(), strerror(errno));
+ }
+ return -1;
+ }
+ alignas(struct fiemap) char fiemap_buffer[offsetof(struct fiemap, fm_extents[1])];
+ memset(fiemap_buffer, 0, sizeof(fiemap_buffer));
+ struct fiemap *fiemap = (struct fiemap *)fiemap_buffer;
+ fiemap->fm_start = 0;
+ fiemap->fm_length = UINT64_MAX;
+ fiemap->fm_flags = 0;
+ fiemap->fm_extent_count = 1;
+ fiemap->fm_mapped_extents = 0;
+ if (ioctl(fd, FS_IOC_FIEMAP, fiemap) != 0) {
+ SLOGE("Unable to FIEMAP %s: %s", path.c_str(), strerror(errno));
+ close(fd);
+ return -1;
+ }
+ close(fd);
+ if (fiemap->fm_mapped_extents != 1) {
+ SLOGE("Expecting one extent, got %d in %s", fiemap->fm_mapped_extents, path.c_str());
+ return -1;
+ }
+ struct fiemap_extent *extent = &fiemap->fm_extents[0];
+ if (!(extent->fe_flags & FIEMAP_EXTENT_LAST)) {
+ SLOGE("First extent was not the last in %s", path.c_str());
+ return -1;
+ }
+ if (extent->fe_flags &
+ (FIEMAP_EXTENT_UNKNOWN | FIEMAP_EXTENT_DELALLOC | FIEMAP_EXTENT_NOT_ALIGNED)) {
+ SLOGE("Extent has unexpected flags %ulx: %s", extent->fe_flags, path.c_str());
+ return -1;
+ }
+ if (extent->fe_length > MAX_WIPE_LENGTH) {
+ SLOGE("Extent too big, %llu bytes in %s", extent->fe_length, path.c_str());
+ return -1;
+ }
+ range[0] = extent->fe_physical;
+ range[1] = extent->fe_length;
+ return 0;
+}
+
+// Given a file path, look for the corresponding
+// block device in /proc/mounts and open it.
+static int open_block_device_for_path(const std::string &path)
+{
+ std::string mountsfile("/proc/mounts");
+ std::string mounts;
+ if (read_file_as_string_atomically(mountsfile, mounts) < 0) {
+ return -1;
+ }
+ std::string block_device;
+ if (find_block_device_for_path(mounts, path, block_device) < 0) {
+ return -1;
+ }
+ SLOGD("For path %s block device is %s", path.c_str(), block_device.c_str());
+ int res = open(block_device.c_str(), O_RDWR | O_LARGEFILE | O_CLOEXEC);
+ if (res < 0) {
+ SLOGE("Failed to open device %s: %s", block_device.c_str(), strerror(errno));
+ return -1;
+ }
+ return res;
+}
+
+// Read a file into a buffer in a single gulp, for atomicity.
+// Null-terminate the buffer.
+// Retry until the buffer is big enough.
+static int read_file_as_string_atomically(const std::string &path, std::string &contents)
+{
+ ssize_t buffer_size = INIT_BUFFER_SIZE;
+ while (true) {
+ int fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
+ if (fd < 0) {
+ SLOGE("Failed to open %s: %s", path.c_str(), strerror(errno));
+ return -1;
+ }
+ contents.resize(buffer_size);
+ ssize_t read_size = read(fd, &contents[0], buffer_size);
+ if (read_size < 0) {
+ SLOGE("Failed to read from %s: %s", path.c_str(), strerror(errno));
+ close(fd);
+ return -1;
+ }
+ close(fd);
+ if (read_size < buffer_size) {
+ contents.resize(read_size);
+ return 0;
+ }
+ SLOGD("%s too big for buffer of size %zu", path.c_str(), buffer_size);
+ buffer_size <<= 1;
+ }
+}
+
+// Search a string representing the contents of /proc/mounts
+// for the mount point of a particular file by prefix matching
+// and return the corresponding block device.
+static int find_block_device_for_path(
+ const std::string &mounts,
+ const std::string &path,
+ std::string &block_device)
+{
+ auto line_begin = mounts.begin();
+ size_t best_prefix = 0;
+ std::string::const_iterator line_end;
+ while (line_begin != mounts.end()) {
+ line_end = std::find(line_begin, mounts.end(), '\n');
+ if (line_end == mounts.end()) {
+ break;
+ }
+ auto device_end = std::find(line_begin, line_end, ' ');
+ if (device_end == line_end) {
+ break;
+ }
+ auto mountpoint_begin = device_end + 1;
+ auto mountpoint_end = std::find(mountpoint_begin, line_end, ' ');
+ if (mountpoint_end == line_end) {
+ break;
+ }
+ if (std::find(line_begin, mountpoint_end, '\\') != mountpoint_end) {
+ // We don't correctly handle escape sequences, and we don't expect
+ // to encounter any, so fail if we do.
+ break;
+ }
+ size_t mountpoint_len = mountpoint_end - mountpoint_begin;
+ if (mountpoint_len > best_prefix &&
+ mountpoint_len < path.length() &&
+ path[mountpoint_len] == '/' &&
+ std::equal(mountpoint_begin, mountpoint_end, path.begin())) {
+ block_device = std::string(line_begin, device_end);
+ best_prefix = mountpoint_len;
+ }
+ line_begin = line_end + 1;
+ }
+ // All of the "break"s above are fatal parse errors.
+ if (line_begin != mounts.end()) {
+ auto bad_line = std::string(line_begin, line_end);
+ SLOGE("Unable to parse line in %s: %s", path.c_str(), bad_line.c_str());
+ return -1;
+ }
+ if (best_prefix == 0) {
+ SLOGE("No prefix found for path: %s", path.c_str());
+ return -1;
+ }
+ return 0;
+}
diff --git a/vdc.rc b/vdc.rc
new file mode 100644
index 0000000..e842869
--- /dev/null
+++ b/vdc.rc
@@ -0,0 +1,13 @@
+# One shot invocation to deal with encrypted volume.
+service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted
+ disabled
+ oneshot
+ # vold will set vold.decrypt to trigger_restart_framework (default
+ # encryption) or trigger_restart_min_framework (other encryption)
+
+# One shot invocation to encrypt unencrypted volumes
+service encrypt /system/bin/vdc --wait cryptfs enablecrypto inplace default
+ disabled
+ oneshot
+ # vold will set vold.decrypt to trigger_restart_framework (default
+ # encryption)
diff --git a/vold.rc b/vold.rc
new file mode 100644
index 0000000..7719e0b
--- /dev/null
+++ b/vold.rc
@@ -0,0 +1,7 @@
+service vold /system/bin/vold \
+ --blkid_context=u:r:blkid:s0 --blkid_untrusted_context=u:r:blkid_untrusted:s0 \
+ --fsck_context=u:r:fsck:s0 --fsck_untrusted_context=u:r:fsck_untrusted:s0
+ class core
+ socket vold stream 0660 root mount
+ socket cryptd stream 0660 root mount
+ ioprio be 2