Encrypted File Systems Project. Installer modifications.

Started to modify isntaller for data redirection to a secure location.

3 files changed, 108 insertions, 37 deletions

diff --git a/cmds/installd/commands.c b/cmds/installd/commands.c
index 70a1206..dcae0c7 100644
--- a/cmds/installd/commands.c
+++ b/cmds/installd/commands.c
@@ -16,7 +16,7 @@
 
 #include "installd.h"
 
-int install(const char *pkgname, uid_t uid, gid_t gid)
+int install(const char *pkgname, int encrypted_fs_flag, uid_t uid, gid_t gid)
 {
     char pkgdir[PKG_PATH_MAX];
     char libdir[PKG_PATH_MAX];
@@ -26,10 +26,18 @@ int install(const char *pkgname, uid_t uid, gid_t gid)
         return -1;
         
     }
-    if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
-        return -1;
-    if (create_pkg_path(libdir, PKG_LIB_PREFIX, pkgname, PKG_LIB_POSTFIX))
-        return -1;
+
+    if (encrypted_fs_flag == USE_UNENCRYPTED_FS) {
+        if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+        if (create_pkg_path(libdir, PKG_LIB_PREFIX, pkgname, PKG_LIB_POSTFIX))
+            return -1;
+    } else {
+        if (create_pkg_path(pkgdir, PKG_SEC_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+        if (create_pkg_path(libdir, PKG_SEC_LIB_PREFIX, pkgname, PKG_LIB_POSTFIX))
+            return -1;
+    }
 
     if (mkdir(pkgdir, 0755) < 0) {
         LOGE("cannot create dir '%s': %s\n", pkgdir, strerror(errno));
@@ -54,41 +62,58 @@ int install(const char *pkgname, uid_t uid, gid_t gid)
     return 0;
 }
 
-int uninstall(const char *pkgname)
+int uninstall(const char *pkgname, int encrypted_fs_flag)
 {
     char pkgdir[PKG_PATH_MAX];
 
-    if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
-        return -1;
+    if (encrypted_fs_flag == USE_UNENCRYPTED_FS) {
+        if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+    } else {
+        if (create_pkg_path(pkgdir, PKG_SEC_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+    }
 
         /* delete contents AND directory, no exceptions */
     return delete_dir_contents(pkgdir, 1, 0);
 }
 
-int delete_user_data(const char *pkgname)
+int delete_user_data(const char *pkgname, int encrypted_fs_flag)
 {
     char pkgdir[PKG_PATH_MAX];
 
-    if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
-        return -1;
+    if (encrypted_fs_flag == USE_UNENCRYPTED_FS) {
+        if (create_pkg_path(pkgdir, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+    } else {
+        if (create_pkg_path(pkgdir, PKG_SEC_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX))
+            return -1;
+    }
 
         /* delete contents, excluding "lib", but not the directory itself */
     return delete_dir_contents(pkgdir, 0, "lib");
 }
 
-int delete_cache(const char *pkgname)
+int delete_cache(const char *pkgname, int encrypted_fs_flag)
 {
     char cachedir[PKG_PATH_MAX];
 
-    if (create_pkg_path(cachedir, CACHE_DIR_PREFIX, pkgname, CACHE_DIR_POSTFIX))
-        return -1;
+    if (encrypted_fs_flag == USE_UNENCRYPTED_FS) {
+        if (create_pkg_path(cachedir, CACHE_DIR_PREFIX, pkgname, CACHE_DIR_POSTFIX))
+            return -1;
+    } else {
+        if (create_pkg_path(cachedir, CACHE_SEC_DIR_PREFIX, pkgname, CACHE_DIR_POSTFIX))
+            return -1;
+    }
 
         /* delete contents, not the directory, no exceptions */
     return delete_dir_contents(cachedir, 0, 0);
 }
 
-
-static int disk_free(void)
+/* TODO(oam): depending on use case (ecryptfs or dmcrypt)
+ * change implementation
+ */
+static int disk_free()
 {
     struct statfs sfs;
     if (statfs(PKG_DIR_PREFIX, &sfs) == 0) {
@@ -98,7 +123,6 @@ static int disk_free(void)
     }
 }
 
-
 /* Try to ensure free_size bytes of storage are available.
  * Returns 0 on success.
  * This is rather simple-minded because doing a full LRU would
@@ -120,6 +144,39 @@ int free_cache(int free_size)
     LOGI("free_cache(%d) avail %d\n", free_size, avail);
     if (avail >= free_size) return 0;
 
+    /* First try encrypted dir */
+    d = opendir(PKG_SEC_DIR_PREFIX);
+    if (d == NULL) {
+        LOGE("cannot open %s\n", PKG_SEC_DIR_PREFIX);
+    } else {
+        dfd = dirfd(d);
+
+        while ((de = readdir(d))) {
+           if (de->d_type != DT_DIR) continue;
+           name = de->d_name;
+
+            /* always skip "." and ".." */
+            if (name[0] == '.') {
+                if (name[1] == 0) continue;
+                if ((name[1] == '.') && (name[2] == 0)) continue;
+            }
+
+            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY);
+            if (subfd < 0) continue;
+
+            delete_dir_contents_fd(subfd, "cache");
+            close(subfd);
+
+            avail = disk_free();
+            if (avail >= free_size) {
+                closedir(d);
+                return 0;
+            }
+        }
+        closedir(d);
+    }
+
+    /* Next try unencrypted dir... */
     d = opendir(PKG_DIR_PREFIX);
     if (d == NULL) {
         LOGE("cannot open %s\n", PKG_DIR_PREFIX);
@@ -131,7 +188,7 @@ int free_cache(int free_size)
         if (de->d_type != DT_DIR) continue;
         name = de->d_name;
 
-            /* always skip "." and ".." */
+        /* always skip "." and ".." */
         if (name[0] == '.') {
             if (name[1] == 0) continue;
             if ((name[1] == '.') && (name[2] == 0)) continue;
@@ -150,10 +207,11 @@ int free_cache(int free_size)
         }
     }
     closedir(d);
+
+    /* Fail case - not possible to free space */
     return -1;
 }
 
-
 /* used by move_dex, rm_dex, etc to ensure that the provided paths
  * don't point anywhere other than at the APK_DIR_PREFIX
  */
@@ -288,7 +346,7 @@ static int calculate_dir_size(int dfd)
 
 int get_size(const char *pkgname, const char *apkpath,
              const char *fwdlock_apkpath,
-             int *_codesize, int *_datasize, int *_cachesize)
+             int *_codesize, int *_datasize, int *_cachesize, int encrypted_fs_flag)
 {
     DIR *d;
     int dfd;
@@ -324,8 +382,14 @@ int get_size(const char *pkgname, const char *apkpath,
         }
     }
 
-    if (create_pkg_path(path, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX)) {
-        goto done;
+    if (encrypted_fs_flag == 0) {
+        if (create_pkg_path(path, PKG_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX)) {
+            goto done;
+        }
+    } else {
+        if (create_pkg_path(path, PKG_SEC_DIR_PREFIX, pkgname, PKG_DIR_POSTFIX)) {
+            goto done;
+        }
     }
 
     d = opendir(path);
diff --git a/cmds/installd/installd.c b/cmds/installd/installd.c
index 7c7441f..5bc6c86 100644
--- a/cmds/installd/installd.c
+++ b/cmds/installd/installd.c
@@ -29,7 +29,7 @@ static int do_ping(char **arg, char reply[REPLY_MAX])
 
 static int do_install(char **arg, char reply[REPLY_MAX])
 {
-    return install(arg[0], atoi(arg[1]), atoi(arg[2])); /* pkgname, uid, gid */
+    return install(arg[0], atoi(arg[1]), atoi(arg[2]), atoi(arg[3])); /* pkgname, uid, gid */
 }
 
 static int do_dexopt(char **arg, char reply[REPLY_MAX])
@@ -50,7 +50,7 @@ static int do_rm_dex(char **arg, char reply[REPLY_MAX])
 
 static int do_remove(char **arg, char reply[REPLY_MAX])
 {
-    return uninstall(arg[0]); /* pkgname */
+    return uninstall(arg[0], atoi(arg[1])); /* pkgname */
 }
 
 static int do_free_cache(char **arg, char reply[REPLY_MAX]) /* TODO int:free_size */
@@ -60,7 +60,7 @@ static int do_free_cache(char **arg, char reply[REPLY_MAX]) /* TODO int:free_siz
 
 static int do_rm_cache(char **arg, char reply[REPLY_MAX])
 {
-    return delete_cache(arg[0]); /* pkgname */
+    return delete_cache(arg[0], atoi(arg[1])); /* pkgname */
 }
 
 static int do_protect(char **arg, char reply[REPLY_MAX])
@@ -76,7 +76,7 @@ static int do_get_size(char **arg, char reply[REPLY_MAX])
     int res = 0;
 
         /* pkgdir, apkpath */
-    res = get_size(arg[0], arg[1], arg[2], &codesize, &datasize, &cachesize);
+    res = get_size(arg[0], arg[1], arg[2], &codesize, &datasize, &cachesize, atoi(arg[3]));
 
     sprintf(reply,"%d %d %d", codesize, datasize, cachesize);
     return res;
@@ -84,7 +84,7 @@ static int do_get_size(char **arg, char reply[REPLY_MAX])
 
 static int do_rm_user_data(char **arg, char reply[REPLY_MAX])
 {
-    return delete_user_data(arg[0]); /* pkgname */
+    return delete_user_data(arg[0], atoi(arg[1])); /* pkgname */
 }
 
 struct cmdinfo {
@@ -95,16 +95,16 @@ struct cmdinfo {
 
 struct cmdinfo cmds[] = {
     { "ping",                 0, do_ping },
-    { "install",              3, do_install },
+    { "install",              4, do_install },
     { "dexopt",               3, do_dexopt },
     { "movedex",              2, do_move_dex },
     { "rmdex",                1, do_rm_dex },
-    { "remove",               1, do_remove },
+    { "remove",               2, do_remove },
     { "freecache",            1, do_free_cache },
-    { "rmcache",              1, do_rm_cache },
+    { "rmcache",              2, do_rm_cache },
     { "protect",              2, do_protect },
-    { "getsize",              3, do_get_size },
-    { "rmuserdata",           1, do_rm_user_data },
+    { "getsize",              4, do_get_size },
+    { "rmuserdata",           2, do_rm_user_data },
 };
 
 static int readx(int s, void *_buf, int count)
diff --git a/cmds/installd/installd.h b/cmds/installd/installd.h
index db3badd..1679d14 100644
--- a/cmds/installd/installd.h
+++ b/cmds/installd/installd.h
@@ -48,16 +48,23 @@
 /* elements combined with a valid package name to form paths */
 
 #define PKG_DIR_PREFIX         "/data/data/"
+#define PKG_SEC_DIR_PREFIX     "/data/secure/data/"
 #define PKG_DIR_POSTFIX        ""
 
 #define PKG_LIB_PREFIX         "/data/data/"
+#define PKG_SEC_LIB_PREFIX     "/data/secure/data/"
 #define PKG_LIB_POSTFIX        "/lib"
 
 #define CACHE_DIR_PREFIX       "/data/data/"
+#define CACHE_SEC_DIR_PREFIX   "/data/secure/data/"
 #define CACHE_DIR_POSTFIX      "/cache"
 
 #define APK_DIR_PREFIX         "/data/app/"
 
+/* Encrypted File SYstems constants */
+#define USE_ENCRYPTED_FS       1
+#define USE_UNENCRYPTED_FS     0
+
 /* other handy constants */
 
 #define PROTECTED_DIR_PREFIX  "/data/app-private/"
@@ -87,14 +94,14 @@ int delete_dir_contents_fd(int dfd, const char *name);
 
 /* commands.c */
 
-int install(const char *pkgname, uid_t uid, gid_t gid);
-int uninstall(const char *pkgname);
-int delete_user_data(const char *pkgname);
-int delete_cache(const char *pkgname);
+int install(const char *pkgname, int encrypted_fs_flag, uid_t uid, gid_t gid);
+int uninstall(const char *pkgname, int encrypted_fs_flag);
+int delete_user_data(const char *pkgname, int encrypted_fs_flag);
+int delete_cache(const char *pkgname, int encrypted_fs_flag);
 int move_dex(const char *src, const char *dst);
 int rm_dex(const char *path);
 int protect(char *pkgname, gid_t gid);
 int get_size(const char *pkgname, const char *apkpath, const char *fwdlock_apkpath,
-             int *codesize, int *datasize, int *cachesize);
+             int *codesize, int *datasize, int *cachesize, int encrypted_fs_flag);
 int free_cache(int free_size);
 int dexopt(const char *apk_path, uid_t uid, int is_public);