Commit Graph

23 Commits

Author SHA1 Message Date
bigbiff
d58ba18272 AOSP10 TWRP Merge: fix conflicts and update libraries needed
This allows flame to boot TWRP. Still will need to work on
super partition for vendor and system access.

The plan will be to cherry-pick any updates to android-9.0
through gerrit.twrp.me to this branch as a WIP.
2020-03-23 11:18:29 -04:00
Captain Throwback
a5283b3570 crypto: add more missing newlines
Change-Id: I158b2a8fee89c2543a0b809af8e278702466b106
2020-03-08 02:13:03 +00:00
Captain Throwback
49cfb7e537 crypto: add some missing newlines
Change-Id: I6bc6b512fe6e841703229d45333421532ecebb83
2020-01-28 17:46:23 -05:00
bigbiff bigbiff
0be03b3217 Encryption: try wrapped key if the first time decryption fails
Change-Id: I108b7aeea41c6b85c851f40c1c4a7e25012e2463
2019-09-01 13:38:44 -04:00
Peter Cai
05cd3f8616 ext4crypt: change to upgrade key if export fails
Add support to upgrade key when export fails with KEY_REQUIRES_UPGRADE.

Ported from
https://source.codeaurora.org/quic/la/platform/system/vold/commit/?h=LA.UM.7.9.r1-06100-sm6150.0&id=85c46eaacc60290db5e71380d89eb4d99ed67995

Change-Id: Ic64be8ade00c0b0d014370ecc9341b1ecc9b0d7a
2019-09-01 19:34:09 +02:00
Peter Cai
90edd2e867 ext4crypt: support wrappedkey for FBE
Qualcomm devices use a special `wrappedkey` mode for FBE. This is ported
from CAF
https://source.codeaurora.org/quic/la/platform/system/vold/commit/?h=LA.UM.7.8.r4-01000-SDM710.0&id=9229262d893a8592f7bc1b4e8a8dab7aad8df68c,
originally by folks at Mokee for vold
https://mokeedev.review/c/MoKee/android_system_vold/+/34102.

This patch ports the above changes to `ext4crypt`, which we can use in
recovery. Note that since we do not have `fs_mgr` in the recovery, we
cannot read the `wrappedkey` flag from fstab. Instead, similar to
`fbe.contents`, we use a special property `fbe.data.wrappedkey` to
indicate support for wrappedkey mode. Devices that need to use this
should set this property to `true` to activate corresponding code.

Change-Id: I79c2855d577156670b45c10c7c7b1fcd9fece8d9
2019-09-01 19:33:30 +02:00
big biff
0bd7c59026 Merge "ext4crypt: support synthetic keys v3 on May update" into android-9.0 2019-06-25 02:01:42 +02:00
Ethan Yonker
abf1fb0086 Switch between dependencies and modules
Use LOCAL_REQUIRED_MODULES for Pie and up and
LOCAL_ADDITIONAL_DEPENDENCIES for Oreo and down.

Change-Id: I5365e782f98f3bbf4bf246be22c8f573824b65ee
2019-05-24 22:39:12 +02:00
Peter Cai
ea1764c9fa ext4crypt: support synthetic keys v3 on May update
Re-implemented SP800Derive in C++, which is added as the new key
derivation function in Android 9.0 May update. From file
services/core/java/com/android/server/locksettings/SP800Derive.java in
frameworks/base.

This is required to get TWRP working on any Android device that has a
screen lock set up after the May update.

Change-Id: I5c1a51b110033f2b0b75d5e36fd8098c05e95179
2019-05-24 20:41:12 +08:00
codeworkx
22e3aa9ed6 ext4crypt: add missing cflag
Avoid calling e4crypt_prepare_user_storage with wrong input parameters.

Change-Id: I5c8945370cb642e46f08c65090c0290c15fe0b57
libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 632 (recovery), pid 564 (recovery)
2019-04-23 12:07:43 +02:00
Ethan Yonker
98661c1a29 Update FDE decrypt to pie from CAF
cryptfs.cpp based on CAF tag LA.UM.7.3.r1-05900-sdm845.0
Used CAF because AOSP no longer contains code for qcom's hardware
crypto.

Change-Id: I921cbe9bed70989f91449e23b5ac3ec1037b7b97
2019-03-20 15:33:48 -05:00
Ethan Yonker
933828251d Add metadata decrypt support for FBE
Change-Id: Ie0292f4ffea5993a4ae74fa04fc5c8252ca2cfcf
2019-01-17 14:14:59 -06:00
Ethan Yonker
e9afc3de0f Decrypt FBE on 9.0 (backwards compatible)
Building in 9.0 may require you to add a flag to your twrp fstab
with the fileencryption details like:
fileencryption=ice:aes-256-heh

Verify this against your device's stock fstab of course.

Change-Id: If9286f5d5787280814daca9fbc8f5191ff26a839
2018-08-31 10:37:08 -05:00
Ethan Yonker
58f2132bc3 Merge AOSP android-9.0.0_r3
Fix conflicts and make it build in 5.1, 6.0, 7.1, 8.1, and 9.0

Change-Id: Ida0a64c29ff27d339b7f42a18d820930964ac6e4
2018-08-24 11:17:39 -05:00
big biff
a185c6ced7 Merge "ext4crypt: keymaster: fix missing include" into android-8.1 2018-03-24 14:14:47 +01:00
Ethan Yonker
c5dd579168 FBE: Decrypt spblob v2 (February security patch)
Change-Id: Iad82fa5d90ce7f3e4b1cf5cd5c6d6fef644f6762
2018-03-09 04:30:57 +01:00
Ethan Yonker
e131bec179 Add spblob decrypt for secdis method (Pixel 1 non-weaver)
Support decrypting Pixel 1 devices using secdis method with the
gatekeeper instead of weaver.

Add a bit of a dirty workaround to a permissions issue that the
keystore presents because the keystore checks the uid of the
calling process and refuses to let the root user add authorization
tokens. We write the auth token to a file and start a separate
service that runs under the system user. The service reads the
token from the file and adds it to the keystore. You must define
this service in your init.recovery.{hardware}.rc file:

service keystore_auth /sbin/keystore_auth
    disabled
    oneshot
    user system
    group root
    seclabel u:r:recovery:s0

TWRP will run this service when needed.

Change-Id: I0ff48d3355f03dc0be8e75cddb8b484bdef98772
2018-01-04 07:40:22 -06:00
codeworkx
071526bd13 ext4crypt: keymaster: fix missing include
Change-Id: I9a6c5a1384bed7f0169d9af94ff8cb22913ff8e4
2017-12-26 20:41:55 +01:00
Ethan Yonker
31344a3b2f Better compatibility across 8.0.0 trees
Change-Id: Ic8200da4e99826736e002a1ab5f9e5f967e84193
2017-11-29 13:23:50 -06:00
Ethan Yonker
fefe5915b0 FBE for Pixel 2
Includes various minor fixes for building in Android 8 trees with r23+ tag

Update FBE extended header in libtar to version 2 and include the entire
ext4_encryption_policy structure now after translating the policy.

See this post for more details:
https://plus.google.com/u/1/+DeesTroy/posts/i33ygUi7tiu

Change-Id: I2af981e51f459b17fcd895fb8c2d3f6c8200e24b
2017-11-28 16:03:41 -06:00
Ethan Yonker
95e8007578 DO NOT MERGE Android 8.0 stuff
Change-Id: I8c8a9734adbf36c33463123844fa6e078934ae34
2017-08-24 21:45:50 -05:00
Ethan Yonker
79f88bdf8d Support backup/restore of FBE policies
Change-Id: Iba8ef20f57b0fb57bb9406c53148a806441d0b59
2016-12-13 14:25:04 -06:00
Ethan Yonker
bd7492de28 Support File Based Encryption
Change-Id: Ib688ddd0c32d3999590cacd86b6d9b18eac336e9
2016-12-13 21:16:42 +01:00