blob: 181706577f23f374430824485c4450325c5bad68 [file] [log] [blame]
// Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "cryptohome/service.h"
#if USE_TPM2
#include "cryptohome/bootlockbox/boot_lockbox_client.h"
#endif // USE_TPM2
#include <functional>
#include <base/bind.h>
#include <base/callback.h>
#include <base/command_line.h>
#include <base/files/file_util.h>
#include <base/json/json_writer.h>
#include <base/logging.h>
#include <base/message_loop/message_loop_current.h>
#include <base/message_loop/message_pump_type.h>
#include <base/optional.h>
#include <base/stl_util.h>
#include <base/strings/string_number_conversions.h>
#include <base/strings/string_util.h>
#include <base/strings/stringprintf.h>
#include <base/strings/sys_string_conversions.h>
#include <base/system/sys_info.h>
#include <base/time/time.h>
#include <base/values.h>
#include <brillo/cryptohome.h>
#include <brillo/glib/dbus.h>
#include <brillo/secure_blob.h>
#include <chaps/isolate.h>
#include <chaps/token_manager_client.h>
#include <chromeos/constants/cryptohome.h>
#include <dbus/bus.h>
#include <dbus/dbus.h>
#include <glib-unix.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <algorithm>
#include <map>
#include <memory>
#include <set>
#include <string>
#include <unordered_set>
#include <utility>
#include <vector>
#include "cryptohome/bootlockbox/boot_attributes.h"
#include "cryptohome/bootlockbox/boot_lockbox.h"
#include "cryptohome/challenge_credentials/challenge_credentials_helper_impl.h"
#include "cryptohome/credentials.h"
#include "cryptohome/crypto.h"
#include "cryptohome/cryptohome_common.h"
#include "cryptohome/cryptohome_event_source.h"
#include "cryptohome/cryptohome_metrics.h"
#include "cryptohome/cryptolib.h"
#include "cryptohome/dbus_transition.h"
#include "cryptohome/disk_cleanup.h"
#include "cryptohome/filesystem_layout.h"
#include "cryptohome/firmware_management_parameters.h"
#include "cryptohome/glib_transition.h"
#include "cryptohome/install_attributes.h"
#include "cryptohome/interface.h"
#include "cryptohome/key.pb.h"
#include "cryptohome/key_challenge_service.h"
#include "cryptohome/key_challenge_service_factory.h"
#include "cryptohome/key_challenge_service_factory_impl.h"
#include "cryptohome/mount.h"
#include "cryptohome/platform.h"
#include "cryptohome/rpc.pb.h"
#include "cryptohome/service_distributed.h"
#include "cryptohome/stateful_recovery.h"
#include "cryptohome/tpm.h"
#include "cryptohome/user_oldest_activity_timestamp_cache.h"
#include "cryptohome/vault_keyset.pb.h"
using base::FilePath;
using brillo::Blob;
using brillo::BlobFromString;
using brillo::SecureBlob;
using brillo::cryptohome::home::SanitizeUserNameWithSalt;
namespace {
constexpr const char* kIgnoreParallelTaskNames[] = {"LowDiskCallback",
"UploadAlertsDataCallback"};
}
// Forcibly namespace the dbus-bindings generated server bindings instead of
// modifying the files afterward.
namespace cryptohome {
namespace gobject {
#include "bindings/cryptohome.dbusserver.h" // NOLINT(build/include_alpha)
} // namespace gobject
} // namespace cryptohome
namespace cryptohome {
namespace {
const std::string& GetAccountId(const AccountIdentifier& id) {
if (id.has_account_id()) {
return id.account_id();
}
return id.email();
}
bool KeyHasWrappedAuthorizationSecrets(const Key& k) {
for (const KeyAuthorizationData& auth_data : k.data().authorization_data()) {
for (const KeyAuthorizationSecret& secret : auth_data.secrets()) {
// If wrapping becomes richer in the future, this may change.
if (secret.wrapped())
return true;
}
}
return false;
}
void AddTaskObserverToThread(base::Thread* thread,
MountThreadObserver* task_observer) {
// Since MessageLoopCurrent::AddTaskObserver need to be executed in the same
// thread of that message loop. So we need to wrap it and post as a task.
scoped_refptr<base::SingleThreadTaskRunner> task_runner =
thread->task_runner();
if (task_runner == nullptr) {
LOG(ERROR) << __func__ << ": The thread doesn't have task runner.";
return;
}
task_observer->PostTask();
task_runner->PostTask(
FROM_HERE,
base::BindOnce(
[](MountThreadObserver* task_observer) {
base::MessageLoopCurrent::Get().AddTaskObserver(task_observer);
},
base::Unretained(task_observer)));
}
// Returns whether the Chrome OS image is a test one.
bool IsOsTestImage() {
std::string chromeos_release_track;
if (!base::SysInfo::GetLsbReleaseValue("CHROMEOS_RELEASE_TRACK",
&chromeos_release_track)) {
// Fall back to the safer assumption that we're not in a test image.
return false;
}
return base::StartsWith(chromeos_release_track, "test",
base::CompareCase::SENSITIVE);
}
// Whether the key can be used for lightweight challenge-response authentication
// check against the given user session.
bool KeyMatchesForLightweightChallengeResponseCheck(
const KeyData& key_data, const UserSession& session) {
DCHECK_EQ(key_data.type(), KeyData::KEY_TYPE_CHALLENGE_RESPONSE);
DCHECK_EQ(key_data.challenge_response_key_size(), 1);
if (session.key_data().type() != KeyData::KEY_TYPE_CHALLENGE_RESPONSE ||
session.key_data().label().empty() ||
session.key_data().label() != key_data.label())
return false;
if (session.key_data().challenge_response_key_size() != 1) {
// Using multiple challenge-response keys at once is currently unsupported.
return false;
}
if (session.key_data().challenge_response_key(0).public_key_spki_der() !=
key_data.challenge_response_key(0).public_key_spki_der()) {
LOG(WARNING) << "Public key mismatch for lightweight challenge-response "
"authentication check";
return false;
}
return true;
}
// Performs an attempt to mount a non-guest user.
MountError AttemptUserMount(const Credentials& credentials,
const Mount::MountArgs& mount_args,
scoped_refptr<UserSession> user_session) {
if (user_session->GetMount()->IsMounted()) {
return MOUNT_ERROR_MOUNT_POINT_BUSY;
}
if (mount_args.is_ephemeral) {
return user_session->MountEphemeral(credentials);
}
return user_session->MountVault(credentials, mount_args);
}
} // anonymous namespace
const char kMountThreadName[] = "MountThread";
const char kTpmInitStatusEventType[] = "TpmInitStatus";
const char kDircryptoMigrationProgressEventType[] =
"DircryptoMigrationProgress";
const char kAutoInitializeTpmSwitch[] = "auto_initialize_tpm";
class TpmInitStatus : public CryptohomeEventBase {
public:
TpmInitStatus(bool took_ownership, bool status)
: took_ownership_(took_ownership), status_(status) {}
~TpmInitStatus() override = default;
const char* GetEventName() const override { return kTpmInitStatusEventType; }
bool get_took_ownership() { return took_ownership_; }
bool get_status() { return status_; }
private:
bool took_ownership_;
bool status_;
};
class DircryptoMigrationProgress : public CryptohomeEventBase {
public:
DircryptoMigrationProgress(DircryptoMigrationStatus status,
uint64_t current_bytes,
uint64_t total_bytes)
: status_(status),
current_bytes_(current_bytes),
total_bytes_(total_bytes) {}
DircryptoMigrationProgress(const DircryptoMigrationProgress&) = delete;
DircryptoMigrationProgress& operator=(const DircryptoMigrationProgress&) =
delete;
~DircryptoMigrationProgress() override = default;
const char* GetEventName() const override {
return kDircryptoMigrationProgressEventType;
}
DircryptoMigrationStatus status() const { return status_; }
uint64_t current_bytes() const { return current_bytes_; }
uint64_t total_bytes() const { return total_bytes_; }
private:
DircryptoMigrationStatus status_;
uint64_t current_bytes_;
uint64_t total_bytes_;
};
void MountThreadObserver::PostTask() {
parallel_task_count_ += 1;
}
void MountThreadObserver::WillProcessTask(const base::PendingTask& pending_task,
bool was_blocked_or_low_priority) {
// Task name will be equal to the task handler name
std::string task_name = pending_task.posted_from.function_name();
ReportAsyncDbusRequestInqueueTime(
task_name, base::TimeTicks::Now() - pending_task.delayed_run_time);
}
void MountThreadObserver::DidProcessTask(
const base::PendingTask& pending_task) {
for (const char* name : kIgnoreParallelTaskNames) {
if (pending_task.posted_from.function_name() == name) {
return;
}
}
parallel_task_count_ -= 1;
}
int MountThreadObserver::GetParallelTaskCount() const {
return parallel_task_count_;
}
Service::Service()
: loop_(NULL),
cryptohome_(NULL),
shadow_root_(base::FilePath(kShadowRoot)),
system_salt_(),
default_platform_(new Platform()),
platform_(default_platform_.get()),
default_crypto_(new Crypto(platform_)),
crypto_(default_crypto_.get()),
tpm_(nullptr),
tpm_init_(nullptr),
fingerprint_manager_(nullptr),
default_pkcs11_init_(new Pkcs11Init()),
pkcs11_init_(default_pkcs11_init_.get()),
initialize_tpm_(true),
mount_thread_(kMountThreadName),
async_complete_signal_(-1),
async_data_complete_signal_(-1),
tpm_init_signal_(-1),
low_disk_space_signal_(-1),
dircrypto_migration_progress_signal_(-1),
low_disk_space_signal_was_emitted_(false),
event_source_(),
event_source_sink_(this),
default_install_attrs_(new cryptohome::InstallAttributes(NULL)),
install_attrs_(default_install_attrs_.get()),
reported_pkcs11_init_fail_(false),
enterprise_owned_(false),
user_timestamp_cache_(new UserOldestActivityTimestampCache()),
default_mount_factory_(new cryptohome::MountFactory()),
mount_factory_(default_mount_factory_.get()),
default_homedirs_(nullptr),
homedirs_(nullptr),
default_arc_disk_quota_(nullptr),
arc_disk_quota_(nullptr),
default_disk_cleanup_(nullptr),
disk_cleanup_(nullptr),
guest_user_(brillo::cryptohome::home::kGuestUserName),
force_ecryptfs_(true),
legacy_mount_(true),
public_mount_salt_(),
default_chaps_client_(new chaps::TokenManagerClient()),
chaps_client_(default_chaps_client_.get()),
boot_lockbox_(nullptr),
boot_attributes_(nullptr),
firmware_management_parameters_(nullptr),
low_disk_notification_period_ms_(kLowDiskNotificationPeriodMS),
upload_alerts_period_ms_(kUploadAlertsPeriodMS),
ownership_callback_has_run_(false) {}
Service::~Service() {
mount_thread_.Stop();
if (loop_) {
g_main_loop_unref(loop_);
}
if (cryptohome_) {
g_object_unref(cryptohome_);
}
}
void Service::StopTasks() {
LOG(INFO) << "Stopping cryptohome task processing.";
if (loop_) {
g_main_loop_quit(loop_);
}
// It is safe to call Stop() multiple times
mount_thread_.Stop();
}
Service* Service::CreateDefault() {
return new ServiceDistributed();
}
static bool PrefixPresent(const std::vector<FilePath>& prefixes,
const std::string path) {
for (const auto& prefix : prefixes)
if (base::StartsWith(path, prefix.value(),
base::CompareCase::INSENSITIVE_ASCII))
return true;
return false;
}
bool Service::UnloadPkcs11Tokens(const std::vector<FilePath>& exclude) {
SecureBlob isolate =
chaps::IsolateCredentialManager::GetDefaultIsolateCredential();
std::vector<std::string> tokens;
if (!chaps_client_->GetTokenList(isolate, &tokens))
return false;
for (size_t i = 0; i < tokens.size(); ++i) {
if (tokens[i] != chaps::kSystemTokenPath &&
!PrefixPresent(exclude, tokens[i])) {
LOG(INFO) << "Cleaning up PKCS #11 token: " << tokens[i];
chaps_client_->UnloadToken(isolate, FilePath(tokens[i]));
}
}
return true;
}
CryptohomeErrorCode Service::MountErrorToCryptohomeError(
const MountError code) const {
switch (code) {
case MOUNT_ERROR_NONE:
return CRYPTOHOME_ERROR_NOT_SET;
case MOUNT_ERROR_FATAL:
return CRYPTOHOME_ERROR_MOUNT_FATAL;
case MOUNT_ERROR_KEY_FAILURE:
return CRYPTOHOME_ERROR_AUTHORIZATION_KEY_FAILED;
case MOUNT_ERROR_MOUNT_POINT_BUSY:
return CRYPTOHOME_ERROR_MOUNT_MOUNT_POINT_BUSY;
case MOUNT_ERROR_TPM_COMM_ERROR:
return CRYPTOHOME_ERROR_TPM_COMM_ERROR;
case MOUNT_ERROR_UNPRIVILEGED_KEY:
return CRYPTOHOME_ERROR_AUTHORIZATION_KEY_DENIED;
case MOUNT_ERROR_TPM_DEFEND_LOCK:
return CRYPTOHOME_ERROR_TPM_DEFEND_LOCK;
case MOUNT_ERROR_TPM_UPDATE_REQUIRED:
return CRYPTOHOME_ERROR_TPM_UPDATE_REQUIRED;
case MOUNT_ERROR_USER_DOES_NOT_EXIST:
return CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND;
case MOUNT_ERROR_TPM_NEEDS_REBOOT:
return CRYPTOHOME_ERROR_TPM_NEEDS_REBOOT;
case MOUNT_ERROR_OLD_ENCRYPTION:
return CRYPTOHOME_ERROR_MOUNT_OLD_ENCRYPTION;
case MOUNT_ERROR_PREVIOUS_MIGRATION_INCOMPLETE:
return CRYPTOHOME_ERROR_MOUNT_PREVIOUS_MIGRATION_INCOMPLETE;
case MOUNT_ERROR_RECREATED:
return CRYPTOHOME_ERROR_NOT_SET;
default:
return CRYPTOHOME_ERROR_MOUNT_FATAL;
}
}
void Service::PostTask(const base::Location& from_here,
base::OnceClosure task) {
mount_thread_observer_.PostTask();
int task_count = mount_thread_observer_.GetParallelTaskCount();
if (task_count > 1) {
ReportParallelTasks(task_count);
}
mount_thread_.task_runner()->PostTask(from_here, std::move(task));
}
void Service::SendReply(DBusGMethodInvocation* context,
const BaseReply& reply) {
// DBusBlobReply will take ownership of the |reply_str|.
std::unique_ptr<std::string> reply_str(new std::string);
reply.SerializeToString(reply_str.get());
event_source_.AddEvent(
std::make_unique<DBusBlobReply>(context, reply_str.release()));
}
void Service::SendDBusErrorReply(DBusGMethodInvocation* context,
GQuark domain,
gint code,
const gchar* message) {
if (message) {
LOG(ERROR) << message;
}
GError* error = g_error_new_literal(domain, code, message);
event_source_.AddEvent(std::make_unique<DBusErrorReply>(context, error));
}
bool Service::FilterActiveMounts(
std::multimap<const FilePath, const FilePath>* mounts,
std::multimap<const FilePath, const FilePath>* active_mounts,
bool force) {
bool skipped = false;
std::set<const FilePath> children_to_preserve;
for (auto match = mounts->begin(); match != mounts->end();) {
auto curr = match;
bool keep = false;
// Walk each set of sources as one group since multimaps are key ordered.
for (; match != mounts->end() && match->first == curr->first; ++match) {
// Ignore known mounts.
{
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
if (session_pair.second->GetMount()->OwnsMountPoint(match->second)) {
keep = true;
// If !force, other mount points not owned scanned after should
// be preserved as well.
if (force)
break;
}
}
}
// Ignore mounts pointing to children of used mounts.
if (!force) {
if (children_to_preserve.find(match->second) !=
children_to_preserve.end()) {
keep = true;
skipped = true;
LOG(WARNING) << "Stale mount " << match->second.value() << " from "
<< match->first.value() << " is a just a child.";
}
}
// Optionally, ignore mounts with open files.
if (!keep && !force) {
std::vector<ProcessInformation> processes;
platform_->GetProcessesWithOpenFiles(match->second, &processes);
if (processes.size()) {
const std::vector<std::string> cmd_line = processes[0].get_cmd_line();
const std::string first_cmd =
(cmd_line.size() > 0 ? cmd_line[0] : "<empty>");
LOG(WARNING) << "Stale mount " << match->second.value() << " from "
<< match->first.value() << " has " << processes.size()
<< " active holders. First one " << first_cmd;
keep = true;
skipped = true;
}
}
}
if (keep) {
std::multimap<const FilePath, const FilePath> children;
LOG(WARNING) << "Looking for children of " << curr->first;
platform_->GetMountsBySourcePrefix(curr->first, &children);
for (const auto& child : children) {
children_to_preserve.insert(child.second);
}
active_mounts->insert(curr, match);
mounts->erase(curr, match);
}
}
return skipped;
}
void Service::GetEphemeralLoopDevicesMounts(
std::multimap<const FilePath, const FilePath>* mounts) {
std::multimap<const FilePath, const FilePath> loop_mounts;
platform_->GetLoopDeviceMounts(&loop_mounts);
const FilePath sparse_path =
FilePath(kEphemeralCryptohomeDir).Append(kSparseFileDir);
for (const auto& device : platform_->GetAttachedLoopDevices()) {
// Ephemeral mounts are mounts from a loop device with ephemeral sparse
// backing file.
if (sparse_path.IsParent(device.backing_file)) {
auto range = loop_mounts.equal_range(device.device);
mounts->insert(range.first, range.second);
}
}
}
bool Service::CleanUpStaleMounts(bool force) {
// This function is meant to aid in a clean recovery from a crashed or
// manually restarted cryptohomed. Cryptohomed may restart:
// 1. Before any mounts occur
// 2. While mounts are active
// 3. During an unmount
// In case #1, there should be no special work to be done.
// The best way to disambiguate #2 and #3 is to determine if there are
// any active open files on any stale mounts. If there are open files,
// then we've likely(*) resumed an active session. If there are not,
// the last cryptohome should have been unmounted.
// It's worth noting that a restart during active use doesn't impair
// other user session behavior, like CheckKey, because it doesn't rely
// exclusively on mount state.
//
// In the future, it may make sense to attempt to keep the MountMap
// persisted to disk which would make resumption much easier.
//
// (*) Relies on the expectation that all processes have been killed off.
std::multimap<const FilePath, const FilePath> shadow_mounts;
std::multimap<const FilePath, const FilePath> ephemeral_mounts;
platform_->GetMountsBySourcePrefix(shadow_root_, &shadow_mounts);
GetEphemeralLoopDevicesMounts(&ephemeral_mounts);
std::multimap<const FilePath, const FilePath> excluded;
bool skipped = FilterActiveMounts(&shadow_mounts, &excluded, force);
skipped |= FilterActiveMounts(&ephemeral_mounts, &excluded, force);
std::vector<FilePath> excluded_mount_points;
for (const auto& mount : excluded)
excluded_mount_points.push_back(mount.second);
UnloadPkcs11Tokens(excluded_mount_points);
// Unmount anything left.
for (const auto& match : shadow_mounts) {
LOG(WARNING) << "Lazily unmounting stale shadow mount: "
<< match.second.value() << " from " << match.first.value();
platform_->Unmount(match.second, true, nullptr);
}
// Attempt to clear the encryption key for the shadow directories once
// the mount has been unmounted. The encryption key needs to be cleared
// after all the unmounts are done to ensure that none of the existing
// submounts becomes inaccessible.
if (force && !shadow_mounts.empty()) {
// Attempt to clear fscrypt encryption keys for the shadow mounts.
for (const auto& match : shadow_mounts) {
if (!platform_->InvalidateDirCryptoKey(dircrypto::KeyReference(),
match.first)) {
LOG(WARNING) << "Failed to clear fscrypt keys for stale mount: "
<< match.first;
}
}
// Clear all keys in the user keyring for ecryptfs mounts.
if (!platform_->ClearUserKeyring()) {
LOG(WARNING) << "Failed to clear stale user keys.";
}
}
for (const auto& match : ephemeral_mounts) {
LOG(WARNING) << "Lazily unmounting stale ephemeral mount: "
<< match.second.value() << " from " << match.first.value();
platform_->Unmount(match.second, true, nullptr);
// Clean up destination directory for ephemeral mounts under ephemeral
// cryptohome dir.
if (base::StartsWith(match.first.value(), kLoopPrefix,
base::CompareCase::SENSITIVE) &&
FilePath(kEphemeralCryptohomeDir).IsParent(match.second)) {
platform_->DeleteFile(match.second, true /* recursive */);
}
}
// TODO(chromium:781821): Add autotests for this case.
std::vector<Platform::LoopDevice> loop_devices =
platform_->GetAttachedLoopDevices();
const FilePath sparse_dir =
FilePath(kEphemeralCryptohomeDir).Append(kSparseFileDir);
std::vector<FilePath> stale_sparse_files;
platform_->EnumerateDirectoryEntries(sparse_dir, false /* is_recursive */,
&stale_sparse_files);
for (const auto& device : loop_devices) {
// Check whether it's created from an ephemeral sparse file.
if (!sparse_dir.IsParent(device.backing_file))
continue;
if (excluded.count(device.device) == 0) {
LOG(WARNING) << "Detaching stale loop device: " << device.device.value();
if (!platform_->DetachLoop(device.device)) {
ReportCryptohomeError(kEphemeralCleanUpFailed);
PLOG(ERROR) << "Can't detach stale loop: " << device.device.value();
}
} else {
// Remove if it's a non-stale loop device.
stale_sparse_files.erase(
std::remove(stale_sparse_files.begin(), stale_sparse_files.end(),
device.backing_file),
stale_sparse_files.end());
}
}
for (const auto& file : stale_sparse_files) {
LOG(WARNING) << "Deleting stale ephemeral backing sparse file: "
<< file.value();
if (!platform_->DeleteFile(file, false /* recursive */)) {
ReportCryptohomeError(kEphemeralCleanUpFailed);
PLOG(ERROR) << "Failed to clean up ephemeral sparse file: "
<< file.value();
}
}
return skipped;
}
bool Service::CleanUpHiddenMounts() {
bool ok = true;
base::AutoLock _lock(sessions_lock_);
for (auto it = sessions_.begin(); it != sessions_.end();) {
scoped_refptr<UserSession> session = it->second;
if (session->GetMount()->IsMounted() &&
session->GetMount()->IsShadowOnly()) {
ok = ok && session->Unmount();
it = sessions_.erase(it);
} else {
++it;
}
}
return ok;
}
bool Service::Initialize() {
bool result = true;
if (!tpm_) {
tpm_ = Tpm::GetSingleton();
}
if (!tpm_init_ && initialize_tpm_) {
default_tpm_init_.reset(new TpmInit(tpm_, platform_));
tpm_init_ = default_tpm_init_.get();
}
if (!boot_lockbox_) {
default_boot_lockbox_.reset(new BootLockbox(tpm_, platform_, crypto_));
boot_lockbox_ = default_boot_lockbox_.get();
}
if (!boot_attributes_) {
default_boot_attributes_.reset(
new BootAttributes(boot_lockbox_, platform_));
boot_attributes_ = default_boot_attributes_.get();
}
if (!firmware_management_parameters_) {
default_firmware_management_params_.reset(
new FirmwareManagementParameters(tpm_));
firmware_management_parameters_ = default_firmware_management_params_.get();
}
if (!crypto_->Init(tpm_init_))
return false;
if (!InitializeFilesystemLayout(platform_, crypto_, shadow_root_,
&system_salt_)) {
LOG(ERROR) << "Failed to initialize filesystem layout.";
return false;
}
if (!homedirs_) {
default_homedirs_ = std::make_unique<HomeDirs>(
platform_, crypto_, shadow_root_, system_salt_,
user_timestamp_cache_.get(), std::make_unique<policy::PolicyProvider>(),
std::make_unique<VaultKeysetFactory>());
homedirs_ = default_homedirs_.get();
}
if (!arc_disk_quota_) {
default_arc_disk_quota_ = std::make_unique<ArcDiskQuota>(
homedirs_, platform_, base::FilePath(kArcDiskHome));
arc_disk_quota_ = default_arc_disk_quota_.get();
}
// Initialize ARC Disk Quota Service.
arc_disk_quota_->Initialize();
if (!disk_cleanup_) {
default_disk_cleanup_ = std::make_unique<DiskCleanup>(
platform_, homedirs_, user_timestamp_cache_.get());
disk_cleanup_ = default_disk_cleanup_.get();
}
// Install the type-info for the service with dbus.
dbus_g_object_type_install_info(gobject::cryptohome_get_type(),
&gobject::dbus_glib_cryptohome_object_info);
if (!Reset()) {
result = false;
}
// Registers the signal callbacks so the loop can exit gracefully.
for (int sig : {SIGTERM, SIGINT, SIGHUP}) {
g_unix_signal_add(sig, ShutdownService, this);
}
base::Thread::Options options;
options.message_pump_type = base::MessagePumpType::IO;
mount_thread_.StartWithOptions(options);
// Add task observer, message_loop is only available after the thread start.
// We can only add observer inside the thread.
AddTaskObserverToThread(&mount_thread_, &mount_thread_observer_);
// Clean up any unreferenced mountpoints at startup.
CleanUpStaleMounts(false);
// This ownership taken signal registration should be done before any
// Tpm::IsOwned() call so that Tpm can cache and update the ownership state
// correctly without keeping requesting for the TPM status.
ConnectOwnershipTakenSignal();
// If the TPM is unowned or doesn't exist, it's safe for
// this function to be called again. However, it shouldn't
// be called across multiple threads in parallel.
InitializeInstallAttributes();
AttestationInitialize();
async_complete_signal_ =
g_signal_lookup("async_call_status", gobject::cryptohome_get_type());
if (!async_complete_signal_) {
async_complete_signal_ =
g_signal_new("async_call_status", gobject::cryptohome_get_type(),
G_SIGNAL_RUN_LAST, 0, NULL, NULL, nullptr, G_TYPE_NONE, 3,
G_TYPE_INT, G_TYPE_BOOLEAN, G_TYPE_INT);
}
async_data_complete_signal_ = g_signal_lookup("async_call_status_with_data",
gobject::cryptohome_get_type());
if (!async_data_complete_signal_) {
async_data_complete_signal_ = g_signal_new(
"async_call_status_with_data", gobject::cryptohome_get_type(),
G_SIGNAL_RUN_LAST, 0, NULL, NULL, nullptr, G_TYPE_NONE, 3, G_TYPE_INT,
G_TYPE_BOOLEAN, DBUS_TYPE_G_UCHAR_ARRAY);
}
tpm_init_signal_ =
g_signal_lookup("tpm_init_status", gobject::cryptohome_get_type());
if (!tpm_init_signal_) {
tpm_init_signal_ =
g_signal_new("tpm_init_status", gobject::cryptohome_get_type(),
G_SIGNAL_RUN_LAST, 0, NULL, NULL, nullptr, G_TYPE_NONE, 3,
G_TYPE_BOOLEAN, G_TYPE_BOOLEAN, G_TYPE_BOOLEAN);
}
low_disk_space_signal_ =
g_signal_lookup("low_disk_space", gobject::cryptohome_get_type());
if (!low_disk_space_signal_) {
low_disk_space_signal_ = g_signal_new(
"low_disk_space", gobject::cryptohome_get_type(), G_SIGNAL_RUN_LAST, 0,
NULL, NULL, nullptr, G_TYPE_NONE, 1, G_TYPE_UINT64);
}
dircrypto_migration_progress_signal_ = g_signal_lookup(
"dircrypto_migration_progress", gobject::cryptohome_get_type());
if (!dircrypto_migration_progress_signal_) {
dircrypto_migration_progress_signal_ = g_signal_new(
"dircrypto_migration_progress", gobject::cryptohome_get_type(),
G_SIGNAL_RUN_LAST, 0, NULL, NULL, nullptr, G_TYPE_NONE, 3, G_TYPE_INT,
G_TYPE_UINT64, G_TYPE_UINT64);
}
// TODO(wad) Determine if this should only be called if
// tpm->IsEnabled() is true.
if (tpm_ && initialize_tpm_) {
tpm_init_->Init(
base::Bind(&Service::OwnershipCallback, base::Unretained(this)));
if (!SeedUrandom()) {
LOG(ERROR) << "FAILED TO SEED /dev/urandom AT START";
}
AttestationInitializeTpm();
if (tpm_init_->ShallInitialize() ||
base::CommandLine::ForCurrentProcess()->HasSwitch(
kAutoInitializeTpmSwitch)) {
tpm_init_->AsyncTakeOwnership();
}
}
last_user_activity_timestamp_time_ = platform_->GetCurrentTime();
// Clean up space on start (once).
PostTask(FROM_HERE,
base::Bind(&Service::DoAutoCleanup, base::Unretained(this)));
// Start scheduling periodic check for low-disk space and cleanup events.
// Subsequent events are scheduled by the callback itself.
PostTask(FROM_HERE,
base::Bind(&Service::LowDiskCallback, base::Unretained(this)));
// Start scheduling periodic TPM alerts upload to UMA. Subsequent events are
// scheduled by the callback itself.
PostTask(FROM_HERE, base::Bind(&Service::UploadAlertsDataCallback,
base::Unretained(this)));
// Create a FingerprintManager for talking to biod over dbus..
PostTask(FROM_HERE, base::Bind(&Service::CreateFingerprintManager,
base::Unretained(this)));
// TODO(keescook,ellyjones) Make this mock-able.
auto mountfn =
base::Bind(&Service::StatefulRecoveryMount, base::Unretained(this));
auto unmountfn =
base::Bind(&Service::StatefulRecoveryUnmount, base::Unretained(this));
auto isownerfn = base::Bind(&Service::IsOwner, base::Unretained(this));
StatefulRecovery recovery(platform_, mountfn, unmountfn, isownerfn);
if (recovery.Requested()) {
if (recovery.Recover())
LOG(INFO) << "A stateful recovery was performed successfully.";
recovery.PerformReboot();
}
boot_attributes_->Load();
return result;
}
bool Service::StatefulRecoveryMount(const std::string& username,
const std::string& passkey,
FilePath* out_home_path) {
gint error_code;
gboolean result;
GError* error = NULL;
if (!Mount(username.c_str(), passkey.c_str(), false, false, &error_code,
&result, &error) ||
!result) {
LOG(ERROR) << "Could not authenticate user '" << username
<< "' for stateful recovery: "
<< (error ? error->message : "[null]") << " (code:" << error_code
<< ")";
return false;
}
if (!GetMountPointForUser(username.c_str(), out_home_path)) {
LOG(ERROR) << "Mount point missing after successful mount call!?";
return false;
}
return true;
}
bool Service::StatefulRecoveryUnmount() {
gboolean result;
GError* error = NULL;
if (!Unmount(&result, &error) || !result) {
LOG(ERROR) << "Failed to unmount after stateful recovery: "
<< (error ? error->message : "[null]");
return false;
}
return true;
}
bool Service::IsOwner(const std::string& userid) {
std::string owner;
if (homedirs_->GetPlainOwner(&owner) && userid.length() && userid == owner)
return true;
return false;
}
void Service::InitializeInstallAttributes() {
// Don't reinitialize when install attributes are valid.
if (install_attrs_->status() == InstallAttributes::Status::kValid) {
return;
}
// The TPM owning instance may have changed since initialization.
// InstallAttributes can handle a NULL or !IsEnabled Tpm object.
install_attrs_->SetTpm(tpm_);
install_attrs_->Init(tpm_init_);
// Check if the machine is enterprise owned and report to mount_ then.
DetectEnterpriseOwnership();
}
void Service::DoInitializePkcs11(UserSession* session) {
bool still_mounted = false;
{
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
if (session_pair.second.get() == session) {
still_mounted = true;
}
}
}
if (!still_mounted) {
LOG(INFO) << "PKCS#11 initialization cancelled";
return;
}
if (session->GetMount()->IsMounted() &&
session->GetMount()->pkcs11_state() ==
cryptohome::Mount::kIsBeingInitialized) {
session->GetMount()->InsertPkcs11Token();
}
LOG(INFO) << "PKCS#11 initialization succeeded.";
session->GetMount()->set_pkcs11_state(cryptohome::Mount::kIsInitialized);
}
void Service::InitializePkcs11(UserSession* session) {
if (!session) {
LOG(ERROR) << "InitializePkcs11 called with NULL mount!";
return;
}
// Wait for ownership if there is a working TPM.
if (tpm_ && tpm_->IsEnabled() && !tpm_->IsOwned()) {
LOG(WARNING) << "TPM was not owned. TPM initialization call back will"
<< " handle PKCS#11 initialization.";
session->GetMount()->set_pkcs11_state(cryptohome::Mount::kIsWaitingOnTPM);
return;
}
// Ok, so the TPM is owned. Time to request asynchronous initialization of
// PKCS#11.
// Make sure cryptohome is mounted, otherwise all of this is for naught.
if (!session->GetMount()->IsMounted()) {
LOG(WARNING) << "PKCS#11 initialization requested but cryptohome is"
<< " not mounted.";
return;
}
// Reset PKCS#11 initialization status. A successful completion of
// MountTaskPkcs11_Init would set it in the service thread via NotifyEvent().
ReportTimerStart(kPkcs11InitTimer);
session->GetMount()->set_pkcs11_state(cryptohome::Mount::kIsBeingInitialized);
mount_thread_observer_.PostTask();
mount_thread_.task_runner()->PostTask(
FROM_HERE,
base::BindOnce(&Service::DoInitializePkcs11, base::Unretained(this),
base::Unretained(session)));
}
bool Service::SeedUrandom() {
brillo::Blob random;
if (!tpm_->GetRandomDataBlob(kDefaultRandomSeedLength, &random)) {
LOG(ERROR) << "Could not get random data from the TPM";
return false;
}
if (!platform_->WriteFile(FilePath(kDefaultEntropySourcePath), random)) {
LOG(ERROR) << "Error writing data to " << kDefaultEntropySourcePath;
return false;
}
return true;
}
void Service::UploadAlertsDataCallback() {
Tpm::AlertsData alerts;
if (tpm_) {
bool supported = tpm_->GetAlertsData(&alerts);
if (!supported) {
// success return code and unknown chip family means that chip does not
// support GetAlerts information. Return here as no need to reschedule
// the delayed task.
LOG(INFO) << "The TPM chip does not support GetAlertsData. "
<< "Stop UploadAlertsData task.";
return;
}
ReportAlertsData(alerts);
}
// We don't care about the parallel delay tasks number. Don't increase the
// parallel tasks count here.
mount_thread_.task_runner()->PostDelayedTask(
FROM_HERE,
base::Bind(&Service::UploadAlertsDataCallback, base::Unretained(this)),
base::TimeDelta::FromMilliseconds(upload_alerts_period_ms_));
}
bool Service::Reset() {
if (cryptohome_)
g_object_unref(cryptohome_);
cryptohome_ = reinterpret_cast<gobject::Cryptohome*>(
g_object_new(gobject::cryptohome_get_type(), NULL));
// Allow references to this instance.
cryptohome_->service = this;
if (loop_) {
::g_main_loop_unref(loop_);
}
loop_ = g_main_loop_new(NULL, false);
if (!loop_) {
LOG(ERROR) << "Failed to create main loop";
return false;
}
// Install the local event source for handling async results
event_source_.Reset(event_source_sink_, g_main_loop_get_context(loop_));
return true;
}
void Service::NotifyEvent(CryptohomeEventBase* event) {
if (!strcmp(event->GetEventName(), kMountTaskResultEventType)) {
MountTaskResult* result = static_cast<MountTaskResult*>(event);
scoped_refptr<UserSession> session =
GetUserSessionForMount(result->mount().get());
if (!result->return_data()) {
g_signal_emit(cryptohome_, async_complete_signal_, 0,
result->sequence_id(), result->return_status(),
result->return_code());
// TODO(wad) are there any non-mount uses of this type?
if (!result->return_status()) {
RemoveUserSession(session.get());
}
SendAsyncIdInfoToUma(result->sequence_id(), base::Time::Now());
} else {
brillo::glib::ScopedArray tmp_array(g_array_new(FALSE, FALSE, 1));
g_array_append_vals(tmp_array.get(), result->return_data()->data(),
result->return_data()->size());
g_signal_emit(cryptohome_, async_data_complete_signal_, 0,
result->sequence_id(), result->return_status(),
tmp_array.get());
brillo::SecureClear(tmp_array.get()->data, tmp_array.get()->len);
SendAsyncIdInfoToUma(result->sequence_id(), base::Time::Now());
}
if (result->pkcs11_init()) {
LOG(INFO) << "An asynchronous mount request with sequence id: "
<< result->sequence_id() << " finished; doing PKCS11 init...";
// We only report and init PKCS#11 for successful mounts.
if (result->return_status() && session.get()) {
InitializePkcs11(session.get());
}
} else if (result->guest()) {
if (!result->return_status()) {
DLOG(INFO) << "Dropping MountMap entry for failed Guest mount.";
RemoveUserSession(guest_user_);
}
}
} else if (!strcmp(event->GetEventName(), kTpmInitStatusEventType)) {
TpmInitStatus* result = static_cast<TpmInitStatus*>(event);
g_signal_emit(cryptohome_, tpm_init_signal_, 0, tpm_init_->IsTpmReady(),
tpm_init_->IsTpmEnabled(), result->get_took_ownership());
// TODO(wad) should we package up a InstallAttributes status here too?
} else if (!strcmp(event->GetEventName(), kDBusErrorReplyEventType)) {
DBusErrorReply* result = static_cast<DBusErrorReply*>(event);
result->Run();
} else if (!strcmp(event->GetEventName(), kDBusBlobReplyEventType)) {
DBusBlobReply* result = static_cast<DBusBlobReply*>(event);
result->Run();
} else if (!strcmp(event->GetEventName(), kDBusReplyEventType)) {
DBusReply* result = static_cast<DBusReply*>(event);
result->Run();
} else if (!strcmp(event->GetEventName(),
kDircryptoMigrationProgressEventType)) {
auto* progress = static_cast<DircryptoMigrationProgress*>(event);
g_signal_emit(cryptohome_, dircrypto_migration_progress_signal_,
0 /* signal detail (not used) */,
static_cast<int32_t>(progress->status()),
progress->current_bytes(), progress->total_bytes());
} else if (!strcmp(event->GetEventName(), kClosureEventType)) {
ClosureEvent* closure_event = static_cast<ClosureEvent*>(event);
closure_event->Run();
}
}
void Service::DoResetTPMContext(UserSession* session) {
if (session) {
crypto_->EnsureTpm(true);
}
}
void Service::OwnershipCallback(bool status, bool took_ownership) {
// Note that this function should only be called once during the lifetime of
// this process, extra calls will be dropped.
if (ownership_callback_has_run_) {
LOG(WARNING) << "Duplicated call to OwnershipCallback.";
return;
}
ownership_callback_has_run_ = true;
if (took_ownership) {
ReportTimerStop(kTpmTakeOwnershipTimer);
// Since ownership is already taken, we are not currently taking ownership.
tpm_init_->SetTpmBeingOwned(false);
// Let the |tpm_| object know about the ownership status
if (tpm_) {
tpm_->HandleOwnershipTakenEvent();
}
// When TPM initialization finishes, we need to tell every Mount to
// reinitialize its TPM context, since the TPM is now useable, and we might
// need to kick off their PKCS11 initialization if they were blocked before.
{
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
mount_thread_observer_.PostTask();
mount_thread_.task_runner()->PostTask(
FROM_HERE,
base::Bind(&Service::DoResetTPMContext, base::Unretained(this),
base::RetainedRef(session_pair.second)));
}
}
}
PostTask(FROM_HERE,
base::Bind(&Service::ConfigureOwnedTpm, base::Unretained(this),
status, took_ownership));
}
void Service::ConfigureOwnedTpm(bool status, bool took_ownership) {
LOG(INFO) << "Configuring TPM, ownership taken: " << took_ownership << ".";
if (took_ownership) {
// Check if we have pending pkcs11 init tasks due to tpm ownership
// not being done earlier. Trigger initialization if so.
{
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
UserSession* session = session_pair.second.get();
if (session->GetMount()->pkcs11_state() ==
cryptohome::Mount::kIsWaitingOnTPM) {
InitializePkcs11(session);
}
}
}
// Initialize the install-time locked attributes since we
// can't do it prior to ownership.
InitializeInstallAttributes();
}
event_source_.AddEvent(
std::make_unique<TpmInitStatus>(took_ownership, status));
// Do attestation work after AddEvent because it may take long.
AttestationInitializeTpmComplete();
// If we mounted before the TPM finished initialization, we must
// finalize the install attributes now too, otherwise it takes a
// full re-login cycle to finalize.
gboolean mounted = FALSE;
bool is_mounted = (IsMounted(&mounted, NULL) && mounted);
if (is_mounted && took_ownership &&
install_attrs_->status() == InstallAttributes::Status::kFirstInstall) {
scoped_refptr<UserSession> guest_session = GetUserSession(guest_user_);
bool guest_mounted =
guest_session.get() && guest_session->GetMount()->IsMounted();
if (!guest_mounted)
install_attrs_->Finalize();
}
}
void Service::CreateFingerprintManager() {
if (fingerprint_manager_.get() != nullptr) {
return;
}
dbus::Bus::Options options;
options.bus_type = dbus::Bus::SYSTEM;
scoped_refptr<dbus::Bus> bus(new dbus::Bus(options));
if (!bus->Connect()) {
LOG(ERROR) << "CreateFingerprintManager: Cannot connect to D-Bus.";
return;
}
fingerprint_manager_ = FingerprintManager::Create(
bus, dbus::ObjectPath(std::string(biod::kBiodServicePath)
.append(kCrosFpBiometricsManagerRelativePath)));
}
void Service::CompleteFingerprintCheckKeyEx(DBusGMethodInvocation* context,
FingerprintScanStatus status) {
BaseReply reply;
if (status == FingerprintScanStatus::FAILED_RETRY_ALLOWED)
reply.set_error(CRYPTOHOME_ERROR_FINGERPRINT_RETRY_REQUIRED);
if (status == FingerprintScanStatus::FAILED_RETRY_NOT_ALLOWED)
reply.set_error(CRYPTOHOME_ERROR_FINGERPRINT_DENIED);
SendReply(context, reply);
}
void Service::DoCheckKeyEx(std::unique_ptr<AccountIdentifier> identifier,
std::unique_ptr<AuthorizationRequest> authorization,
std::unique_ptr<CheckKeyRequest> check_key_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !check_key_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
// Process challenge-response credentials asynchronously.
if (authorization->key().data().type() ==
KeyData::KEY_TYPE_CHALLENGE_RESPONSE) {
DoChallengeResponseCheckKeyEx(std::move(identifier),
std::move(authorization), context);
return;
}
if (authorization->key().data().type() == KeyData::KEY_TYPE_FINGERPRINT) {
const std::string obfuscated_username =
SanitizeUserNameWithSalt(GetAccountId(*identifier), system_salt_);
BaseReply reply;
if (!fingerprint_manager_) {
// Fingerprint manager failed to initialize, or the device may not
// support fingerprint auth at all.
reply.set_error(CRYPTOHOME_ERROR_FINGERPRINT_ERROR_INTERNAL);
SendReply(context, reply);
return;
}
if (!fingerprint_manager_->HasAuthSessionForUser(obfuscated_username)) {
reply.set_error(CRYPTOHOME_ERROR_FINGERPRINT_DENIED);
SendReply(context, reply);
return;
}
fingerprint_manager_->SetAuthScanDoneCallback(
base::Bind(&Service::CompleteFingerprintCheckKeyEx,
base::Unretained(this), context));
return;
}
// An AuthorizationRequest key without a label will test against
// all VaultKeysets of a compatible key().data().type().
if (authorization->key().secret().empty()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
Credentials credentials(GetAccountId(*identifier),
SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
credentials.set_key_data(authorization->key().data());
const std::string obfuscated_username =
credentials.GetObfuscatedUsername(system_salt_);
BaseReply reply;
bool found_valid_credentials = false;
{
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
if (session_pair.second->VerifyCredentials(credentials)) {
found_valid_credentials = true;
break;
}
}
}
if (found_valid_credentials) {
// Entered the right creds, so reset LE credentials.
homedirs_->ResetLECredentials(credentials);
SendReply(context, reply);
return;
}
// Fallthrough to HomeDirs to cover different keys for the same user.
if (homedirs_->Exists(obfuscated_username)) {
if (homedirs_->AreCredentialsValid(credentials)) {
homedirs_->ResetLECredentials(credentials);
} else {
// TODO(wad) Should this pass along KEY_NOT_FOUND too?
reply.set_error(CRYPTOHOME_ERROR_AUTHORIZATION_KEY_FAILED);
ResetDictionaryAttackMitigation();
}
} else {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
}
SendReply(context, reply);
}
gboolean Service::CheckKeyEx(GArray* account_id,
GArray* authorization_request,
GArray* check_key_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<CheckKeyRequest> request(new CheckKeyRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
if (!request->ParseFromArray(check_key_request->data, check_key_request->len))
request.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE, base::Bind(&Service::DoCheckKeyEx, base::Unretained(this),
base::Passed(std::move(identifier)),
base::Passed(std::move(authorization)),
base::Passed(std::move(request)),
base::Unretained(context)));
return TRUE;
}
void Service::DoRemoveKeyEx(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
RemoveKeyRequest* remove_key_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !remove_key_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
// An AuthorizationRequest key without a label will test against
// all VaultKeysets of a compatible key().data().type().
if (authorization->key().secret().empty()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
if (remove_key_request->key().data().label().empty()) {
SendInvalidArgsReply(context, "No label provided for target key");
return;
}
BaseReply reply;
Credentials credentials(GetAccountId(*identifier),
SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
credentials.set_key_data(authorization->key().data());
if (!homedirs_->Exists(credentials.GetObfuscatedUsername(system_salt_))) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
reply.set_error(
homedirs_->RemoveKeyset(credentials, remove_key_request->key().data()));
if (reply.error() == CRYPTOHOME_ERROR_NOT_SET) {
// Don't set the error if there wasn't one.
reply.clear_error();
}
SendReply(context, reply);
}
gboolean Service::RemoveKeyEx(GArray* account_id,
GArray* authorization_request,
GArray* remove_key_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<RemoveKeyRequest> request(new RemoveKeyRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
if (!request->ParseFromArray(remove_key_request->data,
remove_key_request->len))
request.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(
FROM_HERE,
base::Bind(&Service::DoRemoveKeyEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()), base::Unretained(context)));
return TRUE;
}
void Service::DoMassRemoveKeys(AccountIdentifier* account_id,
AuthorizationRequest* authorization_request,
MassRemoveKeysRequest* mass_remove_keys_request,
DBusGMethodInvocation* context) {
if (!account_id || !authorization_request || !mass_remove_keys_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
const std::string username = GetAccountId(*account_id);
if (username.empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
if (authorization_request->key().secret().empty()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
BaseReply reply;
Credentials credentials(
username, SecureBlob(authorization_request->key().secret().begin(),
authorization_request->key().secret().end()));
credentials.set_key_data(authorization_request->key().data());
const std::string obfuscated_username =
SanitizeUserNameWithSalt(username, system_salt_);
if (!homedirs_->Exists(obfuscated_username)) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
if (!homedirs_->AreCredentialsValid(credentials)) {
reply.set_error(CRYPTOHOME_ERROR_AUTHORIZATION_KEY_FAILED);
SendReply(context, reply);
return;
}
// get all labels under the username
std::vector<std::string> labels;
if (!homedirs_->GetVaultKeysetLabels(obfuscated_username, &labels)) {
reply.set_error(CRYPTOHOME_ERROR_KEY_NOT_FOUND);
SendReply(context, reply);
return;
}
// get all exempt labels from mass_remove_keys_request
std::unordered_set<std::string> exempt_labels;
for (int i = 0; i < mass_remove_keys_request->exempt_key_data_size(); i++) {
exempt_labels.insert(mass_remove_keys_request->exempt_key_data(i).label());
}
for (std::string label : labels) {
if (exempt_labels.find(label) == exempt_labels.end()) {
// non-exempt label, should be removed
std::unique_ptr<VaultKeyset> remove_vk(
homedirs_->GetVaultKeyset(obfuscated_username, label));
if (!homedirs_->ForceRemoveKeyset(obfuscated_username,
remove_vk->legacy_index())) {
LOG(ERROR) << "MassRemoveKeys: failed to remove keyset " << label;
reply.set_error(CRYPTOHOME_ERROR_BACKING_STORE_FAILURE);
SendReply(context, reply);
return;
}
}
}
SendReply(context, reply);
}
gboolean Service::MassRemoveKeys(GArray* account_id,
GArray* authorization_request,
GArray* mass_remove_keys_request,
DBusGMethodInvocation* context) {
auto identifier = std::make_unique<AccountIdentifier>();
auto authorization = std::make_unique<AuthorizationRequest>();
auto request = std::make_unique<MassRemoveKeysRequest>();
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(nullptr);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(nullptr);
if (!request->ParseFromArray(mass_remove_keys_request->data,
mass_remove_keys_request->len))
request.reset(nullptr);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(
FROM_HERE,
base::Bind(&Service::DoMassRemoveKeys, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()), base::Unretained(context)));
return TRUE;
}
void Service::DoListKeysEx(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
ListKeysRequest* list_keys_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !list_keys_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
const std::string username = GetAccountId(*identifier);
if (username.empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
BaseReply reply;
const std::string obfuscated_username =
SanitizeUserNameWithSalt(username, system_salt_);
if (!homedirs_->Exists(obfuscated_username)) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
std::vector<std::string> labels;
if (!homedirs_->GetVaultKeysetLabels(obfuscated_username, &labels)) {
reply.set_error(CRYPTOHOME_ERROR_KEY_NOT_FOUND);
}
ListKeysReply* list_keys_reply = reply.MutableExtension(ListKeysReply::reply);
for (const auto& label : labels)
list_keys_reply->add_labels(label);
SendReply(context, reply);
}
gboolean Service::ListKeysEx(GArray* account_id,
GArray* authorization_request,
GArray* list_keys_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<ListKeysRequest> request(new ListKeysRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
if (!request->ParseFromArray(list_keys_request->data, list_keys_request->len))
request.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE, base::Bind(&Service::DoListKeysEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()),
base::Unretained(context)));
return TRUE;
}
void Service::DoGetKeyDataEx(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
GetKeyDataRequest* get_key_data_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !get_key_data_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
if (!get_key_data_request->has_key()) {
SendInvalidArgsReply(context, "No key attributes provided");
return;
}
BaseReply reply;
const std::string obfuscated_username =
SanitizeUserNameWithSalt(GetAccountId(*identifier), system_salt_);
if (!homedirs_->Exists(obfuscated_username)) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
GetKeyDataReply* sub_reply = reply.MutableExtension(GetKeyDataReply::reply);
// Requests only support using the key label at present.
std::unique_ptr<VaultKeyset> vk(homedirs_->GetVaultKeyset(
obfuscated_username, get_key_data_request->key().data().label()));
if (vk) {
KeyData* new_kd = sub_reply->add_key_data();
*new_kd = vk->serialized().key_data();
// Clear any symmetric KeyAuthorizationSecrets even if they are wrapped.
for (int a = 0; a < new_kd->authorization_data_size(); ++a) {
KeyAuthorizationData* auth_data = new_kd->mutable_authorization_data(a);
for (int s = 0; s < auth_data->secrets_size(); ++s) {
auth_data->mutable_secrets(s)->clear_symmetric_key();
auth_data->mutable_secrets(s)->set_wrapped(false);
}
}
}
// No error is thrown if there is no match.
reply.clear_error();
SendReply(context, reply);
}
gboolean Service::GetKeyDataEx(GArray* account_id,
GArray* authorization_request,
GArray* get_key_data_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<GetKeyDataRequest> request(new GetKeyDataRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len)) {
identifier.reset(NULL);
}
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len)) {
authorization.reset(NULL);
}
if (!request->ParseFromArray(get_key_data_request->data,
get_key_data_request->len)) {
request.reset(NULL);
}
// If PBs don't parse, the validation in the handler will catch it.
PostTask(
FROM_HERE,
base::Bind(&Service::DoGetKeyDataEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()), base::Unretained(context)));
return TRUE;
}
void Service::DoMigrateKeyEx(AccountIdentifier* account,
AuthorizationRequest* auth_request,
MigrateKeyRequest* migrate_request,
DBusGMethodInvocation* context) {
if (!account || !auth_request || !migrate_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
// Setup a reply to use during error handling.
BaseReply reply;
if (account->account_id().empty()) {
SendInvalidArgsReply(context, "Must supply account_id.");
return;
}
Credentials credentials(account->account_id(),
SecureBlob(migrate_request->secret()));
int key_index = -1;
if (!homedirs_->Migrate(credentials, SecureBlob(auth_request->key().secret()),
&key_index)) {
reply.set_error(CRYPTOHOME_ERROR_MIGRATE_KEY_FAILED);
} else {
scoped_refptr<UserSession> session = GetUserSession(GetAccountId(*account));
if (session.get()) {
if (!session->SetCredentials(credentials, key_index)) {
LOG(WARNING) << "Failed to set new creds";
}
}
reply.clear_error();
}
SendReply(context, reply);
}
gboolean Service::MigrateKeyEx(GArray* account_ary,
GArray* auth_request_ary,
GArray* migrate_request_ary,
DBusGMethodInvocation* context) {
auto account = std::make_unique<AccountIdentifier>();
auto auth_request = std::make_unique<AuthorizationRequest>();
auto migrate_request = std::make_unique<MigrateKeyRequest>();
// On parsing failure, pass along a nullptr.
if (!account->ParseFromArray(account_ary->data, account_ary->len))
account.reset(nullptr);
if (!auth_request->ParseFromArray(auth_request_ary->data,
auth_request_ary->len)) {
auth_request.reset(nullptr);
}
if (!migrate_request->ParseFromArray(migrate_request_ary->data,
migrate_request_ary->len)) {
migrate_request.reset(nullptr);
}
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE,
base::Bind(&Service::DoMigrateKeyEx, base::Unretained(this),
base::Owned(account.release()),
base::Owned(auth_request.release()),
base::Owned(migrate_request.release()),
base::Unretained(context)));
return TRUE;
}
void Service::DoAddKeyEx(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
AddKeyRequest* add_key_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !add_key_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
// Setup a reply for use during error handling.
BaseReply reply;
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
// An AuthorizationRequest key without a label will test against
// all VaultKeysets of a compatible key().data().type().
if (authorization->key().secret().empty()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
if (!add_key_request->has_key() || add_key_request->key().secret().empty()) {
SendInvalidArgsReply(context, "No new key supplied");
return;
}
if (add_key_request->key().data().label().empty()) {
SendInvalidArgsReply(context, "No new key label supplied");
return;
}
// Ensure any new keys do not contain a wrapped authorization key.
if (KeyHasWrappedAuthorizationSecrets(add_key_request->key())) {
SendInvalidArgsReply(context, "KeyAuthorizationSecrets may not be wrapped");
return;
}
Credentials credentials(GetAccountId(*identifier),
SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
credentials.set_key_data(authorization->key().data());
if (!homedirs_->Exists(credentials.GetObfuscatedUsername(system_salt_))) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
int index = -1;
SecureBlob new_secret(add_key_request->key().secret().begin(),
add_key_request->key().secret().end());
reply.set_error(homedirs_->AddKeyset(
credentials, new_secret, &add_key_request->key().data(),
add_key_request->clobber_if_exists(), &index));
if (reply.error() == CRYPTOHOME_ERROR_NOT_SET) {
// Don't set the error if there wasn't one.
reply.clear_error();
}
SendReply(context, reply);
}
gboolean Service::AddKeyEx(GArray* account_id,
GArray* authorization_request,
GArray* add_key_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<AddKeyRequest> request(new AddKeyRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
if (!request->ParseFromArray(add_key_request->data, add_key_request->len))
request.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE, base::Bind(&Service::DoAddKeyEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()),
base::Unretained(context)));
return TRUE;
}
void Service::DoAddDataRestoreKey(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
DBusGMethodInvocation* context) {
if (!identifier || !authorization) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
if (!authorization->has_key() || !authorization->key().has_secret()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
KeyData new_key_data;
BaseReply reply;
const auto data_restore_key =
CryptoLib::CreateSecureRandomBlob(kDefaultDataRestoreKeyLength);
new_key_data.set_label(kDataRestoreKeyLabel);
Credentials credentials(GetAccountId(*identifier),
SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
credentials.set_key_data(authorization->key().data());
if (!homedirs_->Exists(credentials.GetObfuscatedUsername(system_salt_))) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
int index = -1;
reply.set_error(homedirs_->AddKeyset(credentials, data_restore_key,
&new_key_data, true, &index));
if (reply.error() == CRYPTOHOME_ERROR_NOT_SET) {
// Don't set the error if there wasn't one.
reply.clear_error();
} else {
SendReply(context, reply);
return;
}
// send the raw bytes of data restore key as a part of reply back to caller
AddDataRestoreKeyReply* extension =
reply.MutableExtension(AddDataRestoreKeyReply::reply);
extension->set_data_restore_key(data_restore_key.to_string());
SendReply(context, reply);
}
gboolean Service::AddDataRestoreKey(GArray* account_id,
GArray* authorization_request,
DBusGMethodInvocation* context) {
auto identifier = std::make_unique<AccountIdentifier>();
auto authorization = std::make_unique<AuthorizationRequest>();
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
PostTask(FROM_HERE,
base::Bind(&Service::DoAddDataRestoreKey, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Unretained(context)));
return TRUE;
}
void Service::DoUpdateKeyEx(AccountIdentifier* identifier,
AuthorizationRequest* authorization,
UpdateKeyRequest* update_key_request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !update_key_request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
// Setup a reply for use during error handling.
BaseReply reply;
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
// An AuthorizationRequest key without a label will test against
// all VaultKeysets of a compatible key().data().type().
if (authorization->key().secret().empty()) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
// Any undefined field in changes() will be left as it is.
if (!update_key_request->has_changes()) {
SendInvalidArgsReply(context, "No updates requested");
return;
}
if (KeyHasWrappedAuthorizationSecrets(update_key_request->changes())) {
SendInvalidArgsReply(context, "KeyAuthorizationSecrets may not be wrapped");
return;
}
Credentials credentials(GetAccountId(*identifier),
SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
credentials.set_key_data(authorization->key().data());
if (!homedirs_->Exists(credentials.GetObfuscatedUsername(system_salt_))) {
reply.set_error(CRYPTOHOME_ERROR_ACCOUNT_NOT_FOUND);
SendReply(context, reply);
return;
}
reply.set_error(
homedirs_->UpdateKeyset(credentials, &update_key_request->changes(),
update_key_request->authorization_signature()));
if (reply.error() == CRYPTOHOME_ERROR_NOT_SET) {
// Don't set the error if there wasn't one.
reply.clear_error();
}
SendReply(context, reply);
}
gboolean Service::UpdateKeyEx(GArray* account_id,
GArray* authorization_request,
GArray* update_key_request,
DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
std::unique_ptr<AuthorizationRequest> authorization(new AuthorizationRequest);
std::unique_ptr<UpdateKeyRequest> request(new UpdateKeyRequest);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
if (!authorization->ParseFromArray(authorization_request->data,
authorization_request->len))
authorization.reset(NULL);
if (!request->ParseFromArray(update_key_request->data,
update_key_request->len))
request.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(
FROM_HERE,
base::Bind(&Service::DoUpdateKeyEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Owned(authorization.release()),
base::Owned(request.release()), base::Unretained(context)));
return TRUE;
}
void Service::DoRemoveEx(AccountIdentifier* identifier,
DBusGMethodInvocation* context) {
if (!identifier) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
if (GetAccountId(*identifier).empty()) {
SendInvalidArgsReply(context, "Empty account_id.");
return;
}
BaseReply reply;
if (!homedirs_->Remove(identifier->account_id()))
reply.set_error(CRYPTOHOME_ERROR_REMOVE_FAILED);
else
reply.clear_error();
SendReply(context, reply);
}
gboolean Service::RemoveEx(GArray* account_id, DBusGMethodInvocation* context) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
// On parsing failure, pass along a NULL.
if (!identifier->ParseFromArray(account_id->data, account_id->len))
identifier.reset(NULL);
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE, base::Bind(&Service::DoRemoveEx, base::Unretained(this),
base::Owned(identifier.release()),
base::Unretained(context)));
return TRUE;
}
gboolean Service::RenameCryptohome(const GArray* account_id_from,
const GArray* account_id_to,
DBusGMethodInvocation* response) {
std::unique_ptr<AccountIdentifier> id_from(new AccountIdentifier);
std::unique_ptr<AccountIdentifier> id_to(new AccountIdentifier);
if (!id_from->ParseFromArray(account_id_from->data, account_id_from->len)) {
id_from.reset(NULL);
}
if (!id_to->ParseFromArray(account_id_to->data, account_id_to->len)) {
id_to.reset(NULL);
}
// If PBs don't parse, the validation in the handler will catch it.
PostTask(
FROM_HERE,
base::Bind(&Service::DoRenameCryptohome, base::Unretained(this),
base::Owned(id_from.release()), base::Owned(id_to.release()),
base::Unretained(response)));
return TRUE;
}
void Service::DoRenameCryptohome(AccountIdentifier* id_from,
AccountIdentifier* id_to,
DBusGMethodInvocation* context) {
if (!id_from || !id_to) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
scoped_refptr<UserSession> session = GetUserSession(GetAccountId(*id_from));
const bool is_mounted = session.get() && session->GetMount()->IsMounted();
BaseReply reply;
if (is_mounted) {
LOG(ERROR) << "RenameCryptohome('" << GetAccountId(*id_from) << "','"
<< GetAccountId(*id_to)
<< "'): Unable to rename mounted cryptohome.";
reply.set_error(CRYPTOHOME_ERROR_MOUNT_MOUNT_POINT_BUSY);
} else if (!homedirs_) {
LOG(ERROR) << "RenameCryptohome('" << GetAccountId(*id_from) << "','"
<< GetAccountId(*id_to) << "'): Homedirs not initialized.";
reply.set_error(CRYPTOHOME_ERROR_MOUNT_MOUNT_POINT_BUSY);
} else if (!homedirs_->Rename(GetAccountId(*id_from), GetAccountId(*id_to))) {
reply.set_error(CRYPTOHOME_ERROR_MOUNT_FATAL);
}
SendReply(context, reply);
}
gboolean Service::GetAccountDiskUsage(const GArray* account_id,
DBusGMethodInvocation* response) {
std::unique_ptr<AccountIdentifier> identifier(new AccountIdentifier);
if (!identifier->ParseFromArray(account_id->data, account_id->len)) {
identifier.reset(NULL);
}
// If PBs don't parse, the validation in the handler will catch it.
PostTask(FROM_HERE,
base::Bind(&Service::DoGetAccountDiskUsage, base::Unretained(this),
base::Owned(identifier.release()),
base::Unretained(response)));
return TRUE;
}
void Service::DoGetAccountDiskUsage(AccountIdentifier* identifier,
DBusGMethodInvocation* context) {
if (!identifier) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
BaseReply reply;
reply.MutableExtension(GetAccountDiskUsageReply::reply)
->set_size(homedirs_->ComputeDiskUsage(GetAccountId(*identifier)));
SendReply(context, reply);
}
gboolean Service::GetSystemSalt(GArray** OUT_salt, GError** error) {
*OUT_salt = g_array_new(false, false, 1);
g_array_append_vals(*OUT_salt, system_salt_.data(), system_salt_.size());
return TRUE;
}
gboolean Service::GetSanitizedUsername(gchar* username,
gchar** OUT_sanitized,
GError** error) {
// Credentials::GetObfuscatedUsername() returns an uppercase hex encoding,
// while SanitizeUserName() returns a lowercase hex encoding. They should
// return the same value, but login_manager is already relying on
// SanitizeUserName() and that's the value that chrome should see.
std::string sanitized = brillo::cryptohome::home::SanitizeUserName(username);
if (sanitized.empty())
return FALSE;
*OUT_sanitized = g_strndup(sanitized.data(), sanitized.size());
return TRUE;
}
gboolean Service::IsMounted(gboolean* OUT_is_mounted, GError** error) {
// We consider "the cryptohome" to be mounted if any existing cryptohome is
// mounted.
*OUT_is_mounted = FALSE;
base::AutoLock _lock(sessions_lock_);
for (const auto& session_pair : sessions_) {
if (session_pair.second->GetMount()->IsMounted()) {
*OUT_is_mounted = TRUE;
break;
}
}
return TRUE;
}
gboolean Service::IsMountedForUser(gchar* userid,
gboolean* OUT_is_mounted,
gboolean* OUT_is_ephemeral_mount,
GError** error) {
scoped_refptr<UserSession> session = GetUserSession(userid);
*OUT_is_mounted = false;
*OUT_is_ephemeral_mount = false;
if (!session.get())
return TRUE;
if (session->GetMount()->IsNonEphemeralMounted()) {
*OUT_is_mounted = true;
*OUT_is_ephemeral_mount = false;
} else if (session->GetMount()->IsMounted()) {
*OUT_is_mounted = true;
*OUT_is_ephemeral_mount = true;
}
return TRUE;
}
void Service::DoUpdateTimestamp(scoped_refptr<UserSession> session) {
session->UpdateActivityTimestamp(0);
}
void Service::DoMount(scoped_refptr<UserSession> session,
const Credentials& credentials,
const Mount::MountArgs& mount_args,
base::WaitableEvent* event,
MountError* return_code,
bool* return_status) {
DCHECK(return_code);
// Remove all existing cryptohomes, except for the owner's one, if the
// ephemeral users policy is on.
// Note that a fresh policy value is read here, which in theory can conflict
// with the one used for calculation of |mount_args.is_ephemeral|. However,
// this inconsistency (whose probability is anyway pretty low in practice)
// should only lead to insignificant transient glitches, like an attempt to
// mount a non existing anymore cryptohome.
if (homedirs_->AreEphemeralUsersEnabled())
homedirs_->RemoveNonOwnerCryptohomes();
MountError code = AttemptUserMount(credentials, mount_args, session);
if (code == MOUNT_ERROR_TPM_COMM_ERROR) {
LOG(WARNING) << "TPM communication error. Retrying.";
code = AttemptUserMount(credentials, mount_args, session);
}
// TODO(chromium:1140868, dlunev): extract the recreation behaviour to the
// higher layer and then return VAULT_UNRECOVERABLE directly.
if (code == MOUNT_ERROR_VAULT_UNRECOVERABLE) {
LOG(ERROR) << "Unrecoverable vault, removing.";
if (!homedirs_->Remove(credentials.username())) {
LOG(ERROR) << "Failed to remove unrecoverable vault.";
code = MOUNT_ERROR_REMOVE_INVALID_USER_FAILED;
} else {
code = AttemptUserMount(credentials, mount_args, session);
if (code == MOUNT_ERROR_NONE) {
code = MOUNT_ERROR_RECREATED;
}
// Return VAULT_UNRECOVERABLE as FATAL for the higher level code doesn't
// know such an error.
if (code == MOUNT_ERROR_VAULT_UNRECOVERABLE) {
code = MOUNT_ERROR_FATAL;
}
}
}
*return_code = code;
*return_status = (code == MOUNT_ERROR_NONE || code == MOUNT_ERROR_RECREATED);
event->Signal();
}
gboolean Service::Mount(const gchar* userid,
const gchar* key,
gboolean create_if_missing,
gboolean ensure_ephemeral,
gint* OUT_error_code,
gboolean* OUT_result,
GError** error) {
CleanUpHiddenMounts();
// This is safe even if cryptohomed restarts during a multi-mount
// session and a new mount is added because cleanup is not forced.
// An existing process will keep the mount alive. On the next
// Unmount() it'll be forcibly cleaned up. In the case that
// cryptohomed crashes and misses the Unmount call, the stale
// mountpoints should still be cleaned up on the next daemon
// interaction.
//
// As we introduce multiple mounts, we can consider API changes to
// make it clearer what the UI expectations are (AddMount, etc).
if (sessions_.size() == 0)
// This could run on every interaction to catch any unused mounts.
CleanUpStaleMounts(false);
Credentials credentials(userid, SecureBlob(key, key + strlen(key)));
scoped_refptr<UserSession> guest_session = GetUserSession(guest_user_);
bool guest_mounted =
guest_session.get() && guest_session->GetMount()->IsMounted();
if (guest_mounted && !guest_session->Unmount()) {
LOG(ERROR) << "Could not unmount cryptohome from Guest session";
*OUT_error_code = MOUNT_ERROR_MOUNT_POINT_BUSY;
*OUT_result = FALSE;
return TRUE;
}
// Determine whether the mount should be ephemeral.
bool is_ephemeral = false;
MountError mount_error = MOUNT_ERROR_NONE;
if (!GetShouldMountAsEphemeral(userid, ensure_ephemeral, create_if_missing,
&is_ephemeral, &mount_error)) {
*OUT_error_code = mount_error;
*OUT_result = FALSE;
return TRUE;
}
// If a cryptohome is mounted for the user already, reuse that mount unless
// the |is_ephemeral| flag prevents it: When |is_ephemeral| is
// |true|, a cryptohome backed by tmpfs is required. If the currently
// mounted cryptohome is backed by a vault, it must be unmounted and
// remounted with a tmpfs backend.
scoped_refptr<UserSession> user_session = GetOrCreateUserSession(userid);
if (!user_session) {
LOG(ERROR) << "Could not initialize user session.";
*OUT_error_code = CRYPTOHOME_ERROR_MOUNT_FATAL;
*OUT_result = FALSE;
return TRUE;
}
if (is_ephemeral && user_session->GetMount()->IsNonEphemeralMounted()) {
// TODO(wad,ellyjones) Change this behavior to return failure even
// on a succesful unmount to tell chrome MOUNT_ERROR_NEEDS_RESTART.
if (!user_session->Unmount()) {
// The MountMap entry is kept since the Unmount failed.
LOG(ERROR) << "Could not unmount vault before an ephemeral mount.";
*OUT_error_code = MOUNT_ERROR_MOUNT_POINT_BUSY;
*OUT_result = FALSE;
return TRUE;
}
}
if (is_ephemeral && !create_if_missing) {
NOTREACHED() << "An ephemeral cryptohome can only be mounted when its "
"creation on-the-fly is allowed.";
*OUT_error_code = MOUNT_ERROR_INVALID_ARGS;
*OUT_result = FALSE;
return TRUE;
}
// TODO(wad) A case we haven't handled is mount-over of a non-ephemeral user.
// This is the case where there were 2 mount requests for a given user
// without any intervening unmount requests. This should only be able to
// happen if Chrome acts pathologically and re-requests a Mount. If,
// for instance, cryptohomed crashed, the MountMap would not contain the
// entry.
// TODO(wad) Can we get rid of this code path?
if (user_session->GetMount()->IsMounted()) {
// Count this event to confirm the code path can be removed.
ReportCrosEvent(kCryptohomeDoubleMount);
// TODO(wad) This tests against the stored credentials, not the TPM.
// If mounts are "repopulated", then a trip through the TPM would be needed.
LOG(INFO) << "Mount exists. Rechecking credentials.";
if (!user_session->VerifyCredentials(credentials)) {
// Need to take a trip through the TPM.
if (!homedirs_->AreCredentialsValid(credentials)) {
LOG(ERROR) << "Failed to reauthenticate against the existing mount!";
// TODO(wad) Should we teardown all the mounts if this happens?
// RemoveAllMounts();
*OUT_error_code = MOUNT_ERROR_KEY_FAILURE;
*OUT_result = FALSE;
return TRUE;
}
}
// As far as PKCS#11 initialization goes, we treat this as a brand new
// mount request. InitializePkcs11() will detect and re-initialize if
// necessary except if the mount point is ephemeral as there is no PKCS#11
// data.
InitializePkcs11(user_session.get());
*OUT_error_code = MOUNT_ERROR_NONE;
*OUT_result = TRUE;
return TRUE;
}
// Any non-guest mount attempt triggers InstallAttributes finalization.
// The return value is ignored as it is possible we're pre-ownership.
// The next login will assure finalization if possible.
if (install_attrs_->status() == InstallAttributes::Status::kFirstInstall)
install_attrs_->Finalize();
Mount::MountArgs mount_args;
mount_args.create_if_missing = create_if_missing;
mount_args.is_ephemeral = is_ephemeral;
mount_args.create_as_ecryptfs = force_ecryptfs_;
// TODO(kinaba): Currently Mount is not used for type of accounts that
// we need to force dircrypto. Add an option when it becomes necessary.
mount_args.force_dircrypto = false;
MountError return_code = MOUNT_ERROR_NONE;
bool return_status = false;
base::WaitableEvent event(base::WaitableEvent::ResetPolicy::MANUAL,
base::WaitableEvent::InitialState::NOT_SIGNALED);
PostTask(FROM_HERE,
base::Bind(&Service::DoMount, base::Unretained(this),
base::RetainedRef(user_session), std::cref(credentials),
std::cref(mount_args), base::Unretained(&event),
base::Unretained(&return_code),
base::Unretained(&return_status)));
event.Wait();
// Update the timestamp for old user detection in the background.
PostTask(FROM_HERE,
base::Bind(&Service::DoUpdateTimestamp, base::Unretained(this),
base::RetainedRef(user_session)));
user_session->GetMount()->set_pkcs11_state(cryptohome::Mount::kUninitialized);
if (return_status) {
InitializePkcs11(user_session.get());
} else {
RemoveUserSession(user_session.get());
}
*OUT_error_code = return_code;
*OUT_result = return_status;
return TRUE;
}
void Service::DoMountEx(std::unique_ptr<AccountIdentifier> identifier,
std::unique_ptr<AuthorizationRequest> authorization,
std::unique_ptr<MountRequest> request,
DBusGMethodInvocation* context) {
if (!identifier || !authorization || !request) {
SendInvalidArgsReply(context, "Failed to parse parameters.");
return;
}
// Setup a reply for use during error handling.
BaseReply reply;
// Needed to pass along |recreated|
MountReply* mount_reply = reply.MutableExtension(MountReply::reply);
mount_reply->set_recreated(false);
// At present, we only enforce non-empty email addresses.
// In the future, we may wish to canonicalize if we don't move
// to requiring a IdP-unique identifier.
const std::string& account_id = GetAccountId(*identifier);
if (account_id.empty()) {
SendInvalidArgsReply(context, "No email supplied");
return;
}
if (request->public_mount()) {
std::string public_mount_passkey;
if (!GetPublicMountPassKey(account_id, &public_mount_passkey)) {
LOG(ERROR) << "Could not get public mount passkey.";
reply.set_error(CRYPTOHOME_ERROR_AUTHORIZATION_KEY_FAILED);
SendReply(context, reply);
return;
}
// Set the secret as the key for cryptohome authorization/creation.
authorization->mutable_key()->set_secret(public_mount_passkey);
if (request->has_create()) {
request->mutable_create()->mutable_keys(0)->set_secret(
public_mount_passkey);
}
}
// An AuthorizationRequest key without a label will test against
// all VaultKeysets of a compatible key().data().type().
if (authorization->key().secret().empty() &&
authorization->key().data().type() !=
KeyData::KEY_TYPE_CHALLENGE_RESPONSE) {
SendInvalidArgsReply(context, "No key secret supplied");
return;
}
if (request->has_create()) {
if (request->create().copy_authorization_key()) {
Key* auth_key = request->mutable_create()->add_keys();
*auth_key = authorization->key();
}
int keys_size = request->create().keys_size();
if (keys_size == 0) {
SendInvalidArgsReply(context, "CreateRequest supplied with no keys");
return;
} else if (keys_size > 1) {
LOG(ERROR) << "MountEx: unimplemented CreateRequest with multiple keys";
reply.set_error(CRYPTOHOME_ERROR_NOT_IMPLEMENTED);
SendReply(context, reply);
return;
} else {
const Key key = request->create().keys(0);
// TODO(wad) Ensure the labels are all unique.
if (!key.has_data() || key.data().label().empty() ||
(key.secret().empty() &&
key.data().type() != KeyData::KEY_TYPE_CHALLENGE_RESPONSE)) {
SendInvalidArgsReply(context,
"CreateRequest Keys are not fully specified");
return;
}
if (KeyHasWrappedAuthorizationSecrets(key)) {
SendInvalidArgsReply(context,
"KeyAuthorizationSecrets may not be wrapped");
return;
}
}
}
// Determine whether the mount should be ephemeral.
bool is_ephemeral = false;
MountError mount_error = MOUNT_ERROR_NONE;
if (!GetShouldMountAsEphemeral(account_id, request->require_ephemeral(),
request->has_create(), &is_ephemeral,
&mount_error)) {
reply.set_error(MountErrorToCryptohomeError(mount_error));
SendReply(context, reply);
return;
}
Mount::MountArgs mount_args;
mount_args.create_if_missing = request->has_create();
mount_args.is_ephemeral = is_ephemeral;
mount_args.create_as_ecryptfs =
force_ecryptfs_ ||
(request->has_create() && request->create().force_ecryptfs());
mount_args.to_migrate_from_ecryptfs = request->to_migrate_from_ecryptfs();
// Force_ecryptfs_ wins.
mount_args.force_dircrypto =
!force_ecryptfs_ && request->force_dircrypto_if_available();
mount_args.shadow_only = request->hidden_mount();
// Process challenge-response credentials asynchronously.
if (authorization->key().data().type() ==
KeyData::KEY_TYPE_CHALLENGE_RESPONSE) {
DoChallengeResponseMountEx(std::move(identifier), std::move(authorization),
std::move(request), mount_args, context);
return;
}
auto credentials = std::make_unique<Credentials>(
account_id, SecureBlob(authorization->key().secret().begin(),
authorization->key().secret().end()));
// Everything else can be the default.
credentials->set_key_data(authorization->key().data());
ContinueMountExWithCredentials(std::move(identifier),
std::move(authorization), std::move(request),
std::move(credentials), mount_args, context);
LOG(INFO) << "Finished mount request process";
}
bool Service::InitForChallengeResponseAuth(CryptohomeErrorCode* error_code) {
if (challenge_credentials_helper_) {
// Already successfully initialized.
return true;
}
if (!tpm_) {
LOG(ERROR) << "Cannot do challenge-response authentication without TPM";
*error_code = CRYPTOHOME_ERROR_MOUNT_FATAL;
return false;
}
if (!tpm_init_->IsTpmReady()) {
LOG(ERROR) << "TPM must be initialized in order to do challenge-response "
"authentication";
*error_code = CRYPTOHOME_ERROR_MOUNT_FATAL;
return false;
}
// Fail if the TPM is known to be vulnerable and we're not in a test image.
const base::Optional<bool> is_srk_roca_vulnerable =
tpm_->IsSrkRocaVulnerable();
if (!is_srk_roca_vulnerable.has_value()) {
LOG(ERROR) << "Cannot do challenge-response mount: Failed to check for "
"ROCA vulnerability";
*error_code = CRYPTOHOME_ERROR_MOUNT_FATAL;
return false;
}
if (is_srk_roca_vulnerable.value()) {
if (!IsOsTestImage()) {
LOG(ERROR)
<< "Cannot do challenge-response mount: TPM is ROCA vulnerable";
*error_code = CRYPTOHOME_ERROR_TPM_UPDATE_REQUIRED;
return false;
}
LOG(WARNING) << "TPM is ROCA vulnerable; ignoring this for "
"challenge-response mount due to running in test image";
}
// Lazily create the helper object that manages generation/decryption of
// credentials for challenge-protected vaults.
Blob delegate_blob, delegate_secret;
bool has_reset_lock_permissions = false;
if (!AttestationGetDelegateCredentials(&delegate_blob, &delegate_secret,
&has_reset_lock_permissions)) {
LOG(ERROR)
<< "Cannot do challenge-response authentication without TPM delegate";
*error_code = CRYPTOHOME_ERROR_MOUNT_FATAL;
return false;
}
default_challenge_credentials_helper_ =
std::make_unique<ChallengeCredentialsHelperImpl>(tpm_, delegate_blob,
delegate_secret);
challenge_credentials_helper_ = default_challenge_credentials_helper_.get();
return true;
}
void Service::DoChallengeResponseCheckKeyEx(
std::unique_ptr<AccountIdentifier> identifier,
std::unique_ptr<AuthorizationRequest> authorization,
DBusGMethodInvocation* context) {
DCHECK_EQ(authorization->key().data().type(),
KeyData::KEY_TYPE_CHALLENGE_RESPONSE);
BaseReply reply;
CryptohomeErrorCode error_code = CRYPTOHOME_ERROR_NOT_SET;
if (!InitForChallengeResponseAuth(&error_code)) {
reply.set_error(error_code);
SendReply(context, reply);
return;
}
if (!authorization->has_key_delegate() ||
!authorization->key_delegate().has_dbus_service_name()) {
LOG(ERROR) << "Cannot do challenge-response authentication without key "
"delegate information";
reply.set_error(CRYPTOHOME_ERROR_MOUNT_FATAL);
SendReply(context, reply);
return;
}
if (!authorization->key().data().challenge_response_key_size()) {
LOG(ERROR) << "Missing challenge-response key information";
reply.set_error(CRYPTOHOME_ERROR_MOUNT_FATAL);
SendReply(context, reply);
return;
}
if (authorization->key().data().challenge_response_key_size() > 1) {
LOG(ERROR)
<< "Using multiple challenge-response keys at once is unsupported";
reply.set_error(CRYPTOHOME_ERROR_MOUNT_FATAL);
SendReply(context, reply);
return;
}
// Begin from attempting a lightweight check that doesn't use the vault keyset
// or heavy TPM operations, and therefore is faster than the full check and
// also works in case the mount is ephemeral.
TryLightweightChallengeResponseCheckKeyEx(std::move(identifier),
std::move(authorization), context);
}
void Service::TryLightweightChallengeResponseCheckKeyEx(
std::unique_ptr<AccountIdentifier> identifier,
std::unique_ptr<AuthorizationRequest> authorization,
DBusGMethodInvocation* context) {
DCHECK_EQ(authorization->key().data().type(),
KeyData::KEY_TYPE_CHALLENGE_RESPONSE);
DCHECK(challenge_credentials_helper_);
const std::string& account_id = GetAccountId(*identifier);
const std::string obfuscated_username =
SanitizeUserNameWithSalt(account_id, system_salt_);
std::unique_ptr<KeyChallengeService> key_challenge_service =
key_challenge_service_factory_->New(
system_dbus_connection_.Connect(),
authorization->key_delegate().dbus_service_name());
if (!key_challenge_service) {
LOG(ERROR) << "Failed to create key challenge service";
BaseReply reply;
reply.set_error(CRYPTOHOME_ERROR_MOUNT_FATAL);
SendReply(context, reply);
return;
}
base::Optional<KeyData> found_session_key_data;
{
base::AutoLock loc