openharmony/filemanagement_storage_service
1
0
Fork 0
mirror of https://gitee.com/openharmony/filemanagement_storage_service synced 2024-11-23 06:59:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Issue: https://gitee.com/openharmony/filemanagement_storage_service/issues/IA895W

Browse Source 
Description: StorageService，依赖IAM添加宏隔离
Feature or Bugfix: Feature
Binary Source: No

Signed-off-by: hongshengquan <hongshengquan3@huawei.com>
This commit is contained in:
iFinder-Mini 2024-06-25 19:26:02 +08:00
parent 2e363d0e77
commit 9cff263560
17 changed files with 116 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
services/storage_daemon/BUILD.gn
View File

@ -123,7 +123,6 @@ ohos_executable("storage_daemon") {
"ipc:ipc_single",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (storage_service_user_crypto_manager) {
@ -138,6 +137,11 @@ ohos_executable("storage_daemon") {
external_deps += [ "huks:libhukssdk" ]
}
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
if (storage_service_dfs_service) {
defines += [ "DFS_SERVICE" ]
external_deps += [ "dfs_service:cloud_daemon_kit_inner" ]

6
services/storage_daemon/crypto/BUILD.gn
View File

@ -75,7 +75,6 @@ ohos_static_library("libsdcrypto") {
"init:libbegetutil",
"ipc:ipc_single",
"openssl:libcrypto_shared",
"user_auth_framework:userauth_client",
]
if (storage_service_el5_filekey_manager) {
@ -83,6 +82,11 @@ ohos_static_library("libsdcrypto") {
external_deps += [ "access_token:el5_filekey_manager_sdk" ]
}
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
subsystem_name = "filemanagement"
part_name = "storage_service"
}

6
services/storage_daemon/crypto/src/base_key.cpp
View File

@ -826,7 +826,8 @@ bool BaseKey::UpgradeKeys()
return true;
}
bool BaseKey::EncryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &encryptedKey)
bool BaseKey::EncryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey,
KeyBlob &encryptedKey)
{
LOGD("enter");
KeyContext keyCtx;
@ -857,7 +858,8 @@ bool BaseKey::EncryptKeyBlob(const UserAuth &auth, const std::string &keyPath, K
return true;
}
bool BaseKey::DecryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &decryptedKey)
bool BaseKey::DecryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey,
KeyBlob &decryptedKey)
{
LOGD("enter");
KeyContext keyCtx;

22
services/storage_daemon/crypto/src/fbex.cpp
View File

@ -74,12 +74,12 @@ using FbeOptsE = FbeOptStrE;
#define FBEX_IOC_UNLOCK_SCREEN _IOWR(FBEX_IOC_MAGIC, FBEX_UNLOCK_SCREEN, FbeOpts)
#define FBEX_IOC_USER_LOGOUT _IOW(FBEX_IOC_MAGIC, FBEX_USER_LOGOUT, FbeOpts)
#define FBEX_IOC_STATUS_REPORT _IOW(FBEX_IOC_MAGIC, FBEX_STATUS_REPORT, FbeOpts)
#define HISI_FBEX_READ_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_READ_EL5, FbeOptsE)
#define HISI_FBEX_WRITE_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_WRITE_EL5, FbeOptsE)
#define HISI_FBEX_ADD_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_ADD_EL5, FbeOptsE)
#define HISI_FBEX_DEL_USER_PINCODE _IOWR(FBEX_IOC_MAGIC, FBEX_DEL_EL5, FbeOptsE)
#define HISI_FBEX_ADD_APPKEY2 _IOWR(FBEX_IOC_MAGIC, FBEX_GENERATE_APP_KEY, FbeOptsE)
#define HISI_FBEX_CHANGE_PINCODE _IOWR(FBEX_IOC_MAGIC, FBEX_CHANGE_PINCODE, FbeOptsE)
#define FBEX_READ_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_READ_EL5, FbeOptsE)
#define FBEX_WRITE_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_WRITE_EL5, FbeOptsE)
#define FBEX_ADD_CLASS_E _IOWR(FBEX_IOC_MAGIC, FBEX_ADD_EL5, FbeOptsE)
#define FBEX_DEL_USER_PINCODE _IOWR(FBEX_IOC_MAGIC, FBEX_DEL_EL5, FbeOptsE)
#define FBEX_ADD_APPKEY2 _IOWR(FBEX_IOC_MAGIC, FBEX_GENERATE_APP_KEY, FbeOptsE)
#define FBEX_CHANGE_PINCODE _IOWR(FBEX_IOC_MAGIC, FBEX_CHANGE_PINCODE, FbeOptsE)
} // namespace
@ -149,7 +149,7 @@ int FBEX::InstallEL5KeyToKernel(uint32_t userId, uint8_t flag)
}
FbeOptsE ops{.user = userId};
auto fbeRet = ioctl(fd, HISI_FBEX_ADD_CLASS_E, &ops);
auto fbeRet = ioctl(fd, FBEX_ADD_CLASS_E, &ops);
int ret = 0;
LOGE("InstallEL5KeyToKernel, ret: 0x%{public}x, errno: %{public}d", fbeRet, errno);
if (fbeRet != 0) {
@ -228,7 +228,7 @@ int FBEX::UninstallOrLockUserKeyForEL5ToKernel(uint32_t userId, bool destroy)
return -errno;
}
FbeOptsE ops{.user = userId};
auto fbeRet = ioctl(fd, destroy ? HISI_FBEX_DEL_USER_PINCODE : FBEX_IOC_USER_LOGOUT, &ops);
auto fbeRet = ioctl(fd, destroy ? FBEX_DEL_USER_PINCODE : FBEX_IOC_USER_LOGOUT, &ops);
int ret = 0;
if (fbeRet != 0) {
LOGE("ioctl fbex_cmd failed, fbeRet: 0x%{public}x, errno: %{public}d", fbeRet, errno);
@ -298,7 +298,7 @@ int FBEX::GenerateAppkey(uint32_t userId, uint32_t appUid, std::unique_ptr<uint8
return -errno;
}
FbeOptsE ops{.user = userId, .status = appUid, .length = size};
auto fbeRet = ioctl(fd, HISI_FBEX_ADD_APPKEY2, &ops);
auto fbeRet = ioctl(fd, FBEX_ADD_APPKEY2, &ops);
if (fbeRet != 0) {
LOGE("ioctl fbex_cmd failed, fbeRet: 0x%{public}x, errno: %{public}d", fbeRet, errno);
close(fd);
@ -360,7 +360,7 @@ int FBEX::ReadESecretToKernel(uint32_t userId, uint32_t status, uint8_t *eBuffer
uint32_t bufferSize = AES_256_HASH_RANDOM_SIZE + GCM_MAC_BYTES + GCM_NONCE_BYTES;
FbeOptsE ops{.user = userId, .status = status, .length = bufferSize};
(void)memcpy_s(ops.eBuffer, sizeof(ops.eBuffer), eBuffer, length);
auto ret = ioctl(fd, HISI_FBEX_READ_CLASS_E, &ops);
auto ret = ioctl(fd, FBEX_READ_CLASS_E, &ops);
if (ret != 0) {
LOGE("ioctl fbex_cmd failed, ret: 0x%{public}x, errno: %{public}d", ret, errno);
close(fd);
@ -397,7 +397,7 @@ int FBEX::WriteESecretToKernel(uint32_t userId, uint32_t status, uint8_t *eBuffe
uint32_t bufferSize = AES_256_HASH_RANDOM_SIZE + GCM_MAC_BYTES + GCM_NONCE_BYTES;
FbeOptsE ops{.user = userId, .status = status, .length = bufferSize};
(void)memcpy_s(ops.eBuffer, sizeof(ops.eBuffer), eBuffer, length);
auto ret = ioctl(fd, HISI_FBEX_WRITE_CLASS_E, &ops);
auto ret = ioctl(fd, FBEX_WRITE_CLASS_E, &ops);
if (ret != 0) {
LOGE("ioctl fbex_cmd failed, ret: 0x%{public}x, errno: %{public}d", ret, errno);
close(fd);

2
services/storage_daemon/crypto/src/fscrypt_key_v1.cpp
View File

@ -37,7 +37,7 @@ bool FscryptKeyV1::ActiveKey(uint32_t flag, const std::string &mnt)
LOGE("GenerateKeyDesc failed");
return false;
}
LOGE("ActiveKey-- keyInfo: %{public}u", keyInfo_.key.size);
LOGE("ActiveKey key is empty: %{public}u", keyInfo_.key.IsEmpty());
if (!fscryptV1Ext.ActiveKeyExt(flag, keyInfo_.key.data.get(), keyInfo_.key.size, elType)) {
keyInfo_.key.Clear();
LOGE("fscryptV1Ext ActiveKeyExtfailed");

4
services/storage_daemon/crypto/src/fscrypt_key_v2.cpp
View File

@ -167,7 +167,7 @@ bool FscryptKeyV2::DecryptClassE(const UserAuth &auth, bool &isSupport, uint32_t
(void)auth;
(void)user;
(void)status;
(void)isSupport;
isSupport = false;
LOGI("Unsupported fscrypt v2");
return true;
}
@ -177,7 +177,7 @@ bool FscryptKeyV2::EncryptClassE(const UserAuth &auth, bool &isSupport, uint32_t
(void)auth;
(void)user;
(void)status;
(void)isSupport;
isSupport = false;
LOGI("Unsupported fscrypt v2");
return true;
}

8
services/storage_daemon/crypto/src/iam_client.cpp
View File

@ -29,6 +29,7 @@ IamClient::~IamClient()
LOGD("enter");
}
#ifdef USER_AUTH_FRAMEWORK
void UserSecCallback::OnSecUserInfo(const UserIam::UserAuth::SecUserInfo &info)
{
LOGI("enter");
@ -41,10 +42,13 @@ uint64_t UserSecCallback::GetSecureUid()
LOGI("enter");
return secureUid_;
}
#endif
bool IamClient::GetSecureUid(uint32_t userId, uint64_t &secureUid)
{
LOGI("enter");
#ifdef USER_AUTH_FRAMEWORK
LOGI("get secure uid real !");
secureUidStatus_ = FAILED;
std::shared_ptr<UserSecCallback> secCallback = std::make_shared<UserSecCallback>();
if (UserIam::UserAuth::UserIdmClient::GetInstance().GetSecUserInfo(userId, secCallback) !=
@ -60,6 +64,10 @@ bool IamClient::GetSecureUid(uint32_t userId, uint64_t &secureUid)
LOGE("Get secure uid failed, use default !");
}
secureUid = secCallback->GetSecureUid();
#else
LOGI("iam not support, use default !");
secureUid = { 0 };
#endif
LOGI("finish");
return true;
}

55
services/storage_daemon/crypto/src/key_manager.cpp
View File

@ -785,6 +785,10 @@ int KeyManager::ActiveUserKey(unsigned int user, const std::vector<uint8_t> &tok
LOGI("Active user %{public}u el4 fail", user);
return -EFAULT;
}
if (UnlockUserAppKeys(user, true) != E_OK) {
LOGE("failed to delete appkey2");
return -EFAULT;
}
saveESecretStatus[user] = !secret.empty();
return 0;
}
@ -910,8 +914,8 @@ int KeyManager::ActiveCeSceSeceUserKey(unsigned int user,
return -ENOENT;
}
std::string keyUeceDir = UECE_DIR + "/" + std::to_string(user);
if ((type == TYPE_EL5) && !IsDir(keyUeceDir)) {
LOGE("Have not found user %{public}u el", user);
if ((type == EL5_KEY) && !IsDir(keyUeceDir)) {
LOGE("Have not found uece dir %{public}u el", user);
return -ENOENT;
}
@ -921,13 +925,13 @@ int KeyManager::ActiveCeSceSeceUserKey(unsigned int user,
return -EOPNOTSUPP;
}
if (type == EL5_KEY) {
if (ActiveUeceUserKey(user, token, secret, elKey)) {
if (ActiveUeceUserKey(user, token, secret, elKey) != 0) {
LOGE("ActiveUeceUserKey failed");
return -EFAULT;
}
return 0;
}
if (ActiveElXUserKey(user, token, keyDir, secret, elKey)) {
if (ActiveElXUserKey(user, token, keyDir, secret, elKey) != 0) {
LOGE("ActiveElXUserKey failed");
return -EFAULT;
}
@ -1012,18 +1016,20 @@ int KeyManager::UnlockUserScreen(uint32_t user, const std::vector<uint8_t> &toke
LOGE("UnlockUserScreen user %{public}u el4 key failed", user);
return -EFAULT;
}
LOGI("DecryptClassE user %{public}u saveESecretStatus %{public}d", user, saveESecretStatus[user]);
UserAuth auth = { .token = token, .secret = secret };
auto el5Key = userEl5Key_[user];
if (!el5Key->DecryptClassE(auth, saveESecretStatus[user], user, USER_UNLOCK)) {
LOGE("Unlock user %{public}u uece failed", user);
return -EFAULT;
}
if (UnlockUserAppKeys(user, false) != E_OK) {
LOGE("failed to delete appkey2");
return -EFAULT;
}
saveLockScreenStatus[user] = true;
LOGI("UnlockUserScreen user %{public}u el3 and el4 success and saveLockScreenStatus is %{public}d", user,
saveLockScreenStatus[user]);
LOGI("DecryptClassE user %{public}u saveESecretStatus %{public}d", user, saveESecretStatus[user]);
if (saveESecretStatus[user]) {
UserAuth auth = { .token = token, .secret = secret };
auto el5Key = userEl5Key_[user];
if (!el5Key->DecryptClassE(auth, saveESecretStatus[user], user, USER_UNLOCK)) {
LOGE("Unlock user %{public}u uece failed", user);
return -EFAULT;
}
}
return 0;
}
@ -1067,25 +1073,34 @@ int KeyManager::DeleteAppkey(uint32_t userId, const std::string keyId)
return 0;
}
int KeyManager::UnlockUserAppKeys(uint32_t userId)
int KeyManager::UnlockUserAppKeys(uint32_t userId, bool needGetAllAppKey)
{
LOGI("UnlockUserAppKeys enter!");
#ifdef EL5_FILEKEY_MANAGER
std::vector<std::pair<int, std::string>> keyInfo;
std::vector<std::pair<std::string, bool>> loadInfos;
if (El5FilekeyManagerKit::GetUserAppKey(userId, keyInfo) != 0) {
LOGE("get User Appkeys fail.");
return -EFAULT;
if (needGetAllAppKey) {
if (El5FilekeyManagerKit::GetUserAllAppKey(userId, keyInfo) != 0) {
LOGE("get user all app keys fail.");
return -EFAULT;
}
LOGI("get user all app keys success.");
} else {
if (El5FilekeyManagerKit::GetUserAppKey(userId, keyInfo) != 0) {
LOGE("get User Appkeys fail.");
return -EFAULT;
}
LOGI("get User Appkeys success.");
}
if (keyInfo.size() == 0) {
LOGE("The keyInfo is empty!");
return 0;
}
if (userEl2Key_.find(userId) == userEl2Key_.end()) {
LOGD("userEl2Key_ has not existed");
if (userEl5Key_.find(userId) == userEl5Key_.end()) {
LOGE("userEl5Key_ has not existed");
return -ENOENT;
}
auto elKey = userEl2Key_[userId];
auto elKey = userEl5Key_[userId];
std::string keyId;
for (auto keyInfoAppUid :keyInfo) {
if (elKey->GenerateAppkey(userId, keyInfoAppUid.first, keyId) == false) {

5
services/storage_daemon/crypto/test/key_manager_mock.cpp
View File

@ -80,6 +80,11 @@ int32_t KeyManager::DeleteAppkey(uint32_t userId, const std::string keyId)
return E_OK;
}
int32_t KeyManager::UnlockUserAppKeys(uint32_t userId, bool needGetAllAppKey)
{
return E_OK;
}
int32_t KeyManager::SetDirectoryElPolicy(unsigned int user, KeyType type,
const std::vector<FileList> &vec)
{

5
services/storage_daemon/include/crypto/iam_client.h
View File

@ -19,10 +19,12 @@
#include <condition_variable>
#include <mutex>
#ifdef USER_AUTH_FRAMEWORK
#include "iam_common_defines.h"
#include "user_idm_client.h"
#include "user_idm_client_callback.h"
#include "user_idm_client_defines.h"
#endif
namespace OHOS {
namespace StorageDaemon {
@ -34,7 +36,7 @@ enum UserSecStatus {
FAILED
};
#ifdef USER_AUTH_FRAMEWORK
class UserSecCallback : public UserIam::UserAuth::GetSecUserInfoCallback {
public:
UserSecCallback()
@ -51,6 +53,7 @@ public:
private:
uint64_t secureUid_;
};
#endif
class IamClient {
public:

2
services/storage_daemon/include/crypto/key_manager.h
View File

@ -77,7 +77,7 @@ public:
int GetLockScreenStatus(uint32_t user, bool &lockScreenStatus);
int GenerateAppkey(uint32_t user, uint32_t appUid, std::string &keyId);
int DeleteAppkey(uint32_t user, const std::string keyId);
int UnlockUserAppKeys(uint32_t userId);
int UnlockUserAppKeys(uint32_t userId, bool needGetAllAppKey);
#ifdef USER_CRYPTO_MIGRATE_KEY
int RestoreUserKey(uint32_t userId, KeyType type);
#endif

4
services/storage_daemon/ipc/src/storage_daemon.cpp
View File

@ -549,6 +549,10 @@ int32_t StorageDaemon::ActiveUserKey(uint32_t userId,
LOGE("ActiveUserKey fail, userId %{public}u, type %{public}u", userId, EL4_KEY);
return ret;
}
if (KeyManager::GetInstance()->UnlockUserAppKeys(userId, true) != E_OK) {
LOGE("failed to delete appkey2");
return -EFAULT;
}
RestoreconElX(userId);
if (updateFlag) {
UserManager::GetInstance()->CreateBundleDataDir(userId);

12
services/storage_daemon/ipc/test/BUILD.gn
View File

@ -93,9 +93,13 @@ ohos_unittest("storage_daemon_test") {
"ipc:libdbinder",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
use_exceptions = true
}
@ -192,8 +196,12 @@ ohos_unittest("storage_daemon_stub_test") {
"ipc:libdbinder",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
}
group("storage_daemon_ipc_test") {

6
storage_service_aafwk.gni
View File

@ -31,6 +31,12 @@ declare_args() {
} else {
storage_service_el5_filekey_manager = false
}
if (defined(global_parts_info) &&
defined(global_parts_info.useriam_user_auth_framework)) {
enable_user_auth_framework = true
} else {
enable_user_auth_framework = false
}
}
storage_manager_path =
"//foundation/filemanagement/storage_service/services/storage_manager"

6
test/fuzztest/storagedaemon_fuzzer/BUILD.gn
View File

@ -74,7 +74,6 @@ ohos_fuzztest("StorageDaemonFuzzTest") {
"ipc:ipc_single",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (storage_service_dfs_service) {
@ -82,6 +81,11 @@ ohos_fuzztest("StorageDaemonFuzzTest") {
external_deps += [ "dfs_service:cloud_daemon_kit_inner" ]
}
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
use_exceptions = true
}

6
test/fuzztest/storagedaemoncreatesharefile_fuzzer/BUILD.gn
View File

@ -70,7 +70,6 @@ ohos_fuzztest("StorageDaemonCreateShareFileFuzzTest") {
"ipc:ipc_single",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (storage_service_dfs_service) {
@ -78,6 +77,11 @@ ohos_fuzztest("StorageDaemonCreateShareFileFuzzTest") {
external_deps += [ "dfs_service:cloud_daemon_kit_inner" ]
}
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
use_exceptions = true
}

6
test/fuzztest/storagedaemondeletesharefile_fuzzer/BUILD.gn
View File

@ -70,7 +70,6 @@ ohos_fuzztest("StorageDaemonDeleteShareFileFuzzTest") {
"ipc:ipc_single",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"user_auth_framework:userauth_client",
]
if (storage_service_dfs_service) {
@ -78,6 +77,11 @@ ohos_fuzztest("StorageDaemonDeleteShareFileFuzzTest") {
external_deps += [ "dfs_service:cloud_daemon_kit_inner" ]
}
if (enable_user_auth_framework) {
defines += [ "USER_AUTH_FRAMEWORK" ]
external_deps += [ "user_auth_framework:userauth_client" ]
}
use_exceptions = true
}