1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #ifndef KEYSTORE_KEYSTORE_H_ 18 #define KEYSTORE_KEYSTORE_H_ 19 20 #include <android/hardware/keymaster/3.0/IKeymasterDevice.h> 21 #include <keymasterV4_0/Keymaster.h> 22 #include <utils/Vector.h> 23 24 #include <keystore/keymaster_types.h> 25 26 #include "blob.h" 27 #include "grant_store.h" 28 #include "user_state.h" 29 30 namespace keystore { 31 32 using ::android::sp; 33 using keymaster::support::Keymaster; 34 35 class KeymasterDevices : public std::array<sp<Keymaster>, 3> { 36 public: 37 sp<Keymaster>& operator[](SecurityLevel secLevel); 38 sp<Keymaster> operator[](SecurityLevel secLevel) const; 39 }; 40 41 class KeyStore { 42 public: 43 KeyStore(Entropy* entropy, const KeymasterDevices& kmDevices, 44 SecurityLevel minimalAllowedSecurityLevelForNewKeys); 45 ~KeyStore(); 46 47 sp<Keymaster> getDevice(SecurityLevel securityLevel) const { return mKmDevices[securityLevel]; } 48 49 std::pair<sp<Keymaster>, SecurityLevel> getMostSecureDevice() const { 50 SecurityLevel level = SecurityLevel::STRONGBOX; 51 do { 52 if (mKmDevices[level].get()) { 53 return {mKmDevices[level], level}; 54 } 55 level = static_cast<SecurityLevel>(static_cast<uint32_t>(level) - 1); 56 } while (level != SecurityLevel::SOFTWARE); 57 return {nullptr, SecurityLevel::SOFTWARE}; 58 } 59 60 sp<Keymaster> getFallbackDevice() const { 61 // we only return the fallback device if the creation of new fallback key blobs is 62 // allowed. (also see getDevice below) 63 if (mAllowNewFallback) { 64 return mKmDevices[SecurityLevel::SOFTWARE]; 65 } else { 66 return nullptr; 67 } 68 } 69 70 sp<Keymaster> getDevice(const Blob& blob) { return mKmDevices[blob.getSecurityLevel()]; } 71 72 ResponseCode initialize(); 73 74 State getState(uid_t userId) { return getUserState(userId)->getState(); } 75 76 ResponseCode initializeUser(const android::String8& pw, uid_t userId); 77 78 ResponseCode copyMasterKey(uid_t srcUser, uid_t dstUser); 79 ResponseCode writeMasterKey(const android::String8& pw, uid_t userId); 80 ResponseCode readMasterKey(const android::String8& pw, uid_t userId); 81 82 android::String8 getKeyName(const android::String8& keyName, const BlobType type); 83 android::String8 getKeyNameForUid(const android::String8& keyName, uid_t uid, 84 const BlobType type); 85 android::String8 getKeyNameForUidWithDir(const android::String8& keyName, uid_t uid, 86 const BlobType type); 87 NullOr<android::String8> getBlobFileNameIfExists(const android::String8& alias, uid_t uid, 88 const BlobType type); 89 90 /* 91 * Delete entries owned by userId. If keepUnencryptedEntries is true 92 * then only encrypted entries will be removed, otherwise all entries will 93 * be removed. 94 */ 95 void resetUser(uid_t userId, bool keepUnenryptedEntries); 96 bool isEmpty(uid_t userId) const; 97 98 void lock(uid_t userId); 99 100 ResponseCode get(const char* filename, Blob* keyBlob, const BlobType type, uid_t userId); 101 ResponseCode put(const char* filename, Blob* keyBlob, uid_t userId); 102 ResponseCode del(const char* filename, const BlobType type, uid_t userId); 103 ResponseCode list(const android::String8& prefix, android::Vector<android::String16>* matches, 104 uid_t userId); 105 106 std::string addGrant(const char* alias, uid_t granterUid, uid_t granteeUid); 107 bool removeGrant(const char* alias, const uid_t granterUid, const uid_t granteeUid); 108 void removeAllGrantsToUid(const uid_t granteeUid); 109 110 ResponseCode importKey(const uint8_t* key, size_t keyLen, const char* filename, uid_t userId, 111 int32_t flags); 112 113 bool isHardwareBacked(const android::String16& keyType) const; 114 115 ResponseCode getKeyForName(Blob* keyBlob, const android::String8& keyName, const uid_t uid, 116 const BlobType type); 117 118 /** 119 * Returns any existing UserState or creates it if it doesn't exist. 120 */ 121 UserState* getUserState(uid_t userId); 122 123 /** 124 * Returns any existing UserState or creates it if it doesn't exist. 125 */ 126 UserState* getUserStateByUid(uid_t uid); 127 128 /** 129 * Returns NULL if the UserState doesn't already exist. 130 */ 131 const UserState* getUserState(uid_t userId) const; 132 133 /** 134 * Returns NULL if the UserState doesn't already exist. 135 */ 136 const UserState* getUserStateByUid(uid_t uid) const; 137 138 private: 139 static const char* kOldMasterKey; 140 static const char* kMetaDataFile; 141 static const android::String16 kRsaKeyType; 142 static const android::String16 kEcKeyType; 143 Entropy* mEntropy; 144 145 KeymasterDevices mKmDevices; 146 bool mAllowNewFallback; 147 148 android::Vector<UserState*> mMasterKeys; 149 150 ::keystore::GrantStore mGrants; 151 152 typedef struct { uint32_t version; } keystore_metadata_t; 153 154 keystore_metadata_t mMetaData; 155 156 /** 157 * Upgrade the key from the current version to whatever is newest. 158 */ 159 bool upgradeBlob(const char* filename, Blob* blob, const uint8_t oldVersion, 160 const BlobType type, uid_t uid); 161 162 /** 163 * Takes a blob that is an PEM-encoded RSA key as a byte array and converts it to a DER-encoded 164 * PKCS#8 for import into a keymaster. Then it overwrites the original blob with the new blob 165 * format that is returned from the keymaster. 166 */ 167 ResponseCode importBlobAsKey(Blob* blob, const char* filename, uid_t uid); 168 169 void readMetaData(); 170 void writeMetaData(); 171 172 bool upgradeKeystore(); 173 }; 174 175 } // namespace keystore 176 177 #endif // KEYSTORE_KEYSTORE_H_ 178
