blob: 276b6b939d50c55138462c31e02c9d502bf397a4 [file] [log] [blame]
Paul Crowley1ef25582016-01-21 20:26:12 +00001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#ifndef ANDROID_VOLD_KEYSTORAGE_H
18#define ANDROID_VOLD_KEYSTORAGE_H
19
Pavel Grafove2e2d302017-08-01 17:15:53 +010020#include "KeyBuffer.h"
21
Paul Crowley1ef25582016-01-21 20:26:12 +000022#include <string>
23
24namespace android {
25namespace vold {
26
Paul Crowley05720802016-02-08 15:55:41 +000027// Represents the information needed to decrypt a disk encryption key.
28// If "token" is nonempty, it is passed in as a required Gatekeeper auth token.
Paul Crowley6ab2cab2017-01-04 22:32:40 -080029// If "token" and "secret" are nonempty, "secret" is appended to the application-specific
Paul Crowley05720802016-02-08 15:55:41 +000030// binary needed to unlock.
Paul Crowley6ab2cab2017-01-04 22:32:40 -080031// If only "secret" is nonempty, it is used to decrypt in a non-Keymaster process.
Paul Crowley05720802016-02-08 15:55:41 +000032class KeyAuthentication {
Paul Crowleydf528a72016-03-09 09:31:37 -080033 public:
Greg Kaiser8ae16db2018-12-18 11:10:31 -080034 KeyAuthentication(const std::string& t, const std::string& s) : token{t}, secret{s} {};
Paul Crowley6ab2cab2017-01-04 22:32:40 -080035
36 bool usesKeymaster() const { return !token.empty() || secret.empty(); };
37
Paul Crowley05720802016-02-08 15:55:41 +000038 const std::string token;
39 const std::string secret;
40};
41
42extern const KeyAuthentication kEmptyAuthentication;
43
Paul Crowleyf71ace32016-06-02 11:01:19 -070044// Checks if path "path" exists.
45bool pathExists(const std::string& path);
46
Paul Crowley26a53882017-10-26 11:16:39 -070047bool createSecdiscardable(const std::string& path, std::string* hash);
48bool readSecdiscardable(const std::string& path, std::string* hash);
49
Paul Crowley1ef25582016-01-21 20:26:12 +000050// Create a directory at the named path, and store "key" in it,
51// in such a way that it can only be retrieved via Keymaster and
52// can be securely deleted.
53// It's safe to move/rename the directory after creation.
Pavel Grafove2e2d302017-08-01 17:15:53 +010054bool storeKey(const std::string& dir, const KeyAuthentication& auth, const KeyBuffer& key);
Paul Crowley1ef25582016-01-21 20:26:12 +000055
Paul Crowleyf71ace32016-06-02 11:01:19 -070056// Create a directory at the named path, and store "key" in it as storeKey
57// This version creates the key in "tmp_path" then atomically renames "tmp_path"
58// to "key_path" thereby ensuring that the key is either stored entirely or
59// not at all.
60bool storeKeyAtomically(const std::string& key_path, const std::string& tmp_path,
Pavel Grafove2e2d302017-08-01 17:15:53 +010061 const KeyAuthentication& auth, const KeyBuffer& key);
Paul Crowleyf71ace32016-06-02 11:01:19 -070062
Paul Crowley1ef25582016-01-21 20:26:12 +000063// Retrieve the key from the named directory.
Daniel Rosenberg690d6de2018-12-14 01:08:10 -080064bool retrieveKey(const std::string& dir, const KeyAuthentication& auth, KeyBuffer* key,
65 bool keepOld = false);
Paul Crowley1ef25582016-01-21 20:26:12 +000066
67// Securely destroy the key stored in the named directory and delete the directory.
Paul Crowleydf528a72016-03-09 09:31:37 -080068bool destroyKey(const std::string& dir);
Paul Crowley1ef25582016-01-21 20:26:12 +000069
Rubin Xu2436e272017-04-27 20:43:10 +010070bool runSecdiscardSingle(const std::string& file);
Paul Crowley1ef25582016-01-21 20:26:12 +000071} // namespace vold
72} // namespace android
73
74#endif