Android加密之全盘加密详解

# Android fstab file.
#             
...... 
/dev/block/platform/soc.0/f9824900.sdhci/by-name/userdata  /data   ext4 noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,errors=panic wait,check,fileencryption 
......
defaults

//设置ro.crypto.state标记，手机已被用户加密
static int do_mount_all(const std::vector& args) {
 ......
 if (ret == FS_MGR_MNTALL_DEV_NEEDS_ENCRYPTION) {
  ActionManager::GetInstance().QueueEventTrigger("encrypt");
 } else if (ret == FS_MGR_MNTALL_DEV_MIGHT_BE_ENCRYPTED) {
  // 全盘加密，ro.crypto.state = encrypted， ro.crypto.type = block
  property_set("ro.crypto.state", "encrypted");
  property_set("ro.crypto.type", "block");
  //发送vdc 命令 defaultcrypto
  ActionManager::GetInstance().QueueEventTrigger("defaultcrypto");
 ......
 } else if (ret == FS_MGR_MNTALL_DEV_FILE_ENCRYPTED) {
  if (e4crypt_install_keyring()) {
   return -1;
  }
  property_set("ro.crypto.state", "encrypted");
  property_set("ro.crypto.type", "file");
  ......

 return ret;
}

# One shot invocation to deal with encrypted volume.
# do_mount_all 中写入命令 defaultcrypto，执行 vdc 发送命令 mountdefaultencrypted
on defaultcrypto
 exec - root -- /system/bin/vdc --wait cryptfs mountdefaultencrypted
 # vold will set vold.decrypt to trigger_restart_framework (default
 # encryption) or trigger_restart_min_framework (other encryption)

# One shot invocation to encrypt unencrypted volumes
on encrypt
 start surfaceflinger
 exec - root -- /system/bin/vdc --wait cryptfs enablecrypto inplace default noui
 # vold will set vold.decrypt to trigger_restart_framework (default
 # encryption)

int CryptCommandListener::CryptfsCmd::runCommand(SocketClient *cli,
             int argc, char **argv) {
 ......
 } else if (subcommand == "mountdefaultencrypted") {
  ......
  //执行cryptfs_mount_default_encrypted
  std::thread(&cryptfs_mount_default_encrypted).detach();
 }
 ......
}

int cryptfs_mount_default_encrypted(void)
{
 int crypt_type = cryptfs_get_password_type();
 ......
 } else if (crypt_type != CRYPT_TYPE_DEFAULT) {
  SLOGD("Password is not default - "
    "starting min framework to prompt");
  //不是默认加密， 设置 vold.decrypt = trigger_restart_min_framework
  property_set("vold.decrypt", "trigger_restart_min_framework");
  return 0;
 } else if (cryptfs_check_passwd(DEFAULT_PASSWORD) == 0) {
 ......

#属性vold.decrypt==trigger_restart_min_framework 时执行
on property:vold.decrypt=trigger_restart_min_framework
 # A/B update verifier that marks a successful boot.
 exec - root -- /system/bin/update_verifier trigger_restart_min_framework
 class_start main

int CommandListener::StorageCmd::runCommand(SocketClient *cli,
              int argc, char **argv) {
 ......
 if (!strcmp(argv[1], "mountall")) {
  if (argc != 2) {
   cli->sendMsg(ResponseCode::CommandSyntaxError, "Usage: mountall", false);
   return 0;
  }
  // 挂载所有设备
  fs_mgr_mount_all(fstab);
  cli->sendMsg(ResponseCode::CommandOkay, "Mountall ran successfully", false);
  return 0;
 }

int fs_mgr_mount_all(struct fstab *fstab)
{
 ......
 /* mount(2) returned an error, handle the encryptable/formattable case */
 bool wiped = partition_wiped(fstab->recs[top_idx].blk_device);
 //挂载 tmpfs 临时分区
 if (fs_mgr_do_tmpfs_mount(fstab->recs[attempted_idx].mount_point) < 0) {
  ++error_count;
  continue;
 }
 //全盘加密
 encryptable = FS_MGR_MNTALL_DEV_MIGHT_BE_ENCRYPTED;
 ......
}

private void startBootstrapServices() {
 // Only run "core" apps if we're encrypting the device.
 //启动min-framework 显示密码输入界面，仅启动 coreApp， 在AndroidManifest.xml中声明。
 //此时启动的 APP 在 tmpfs 临时分区，所以，所有app都是原始安装状态，不包含任何用户使用产生的数据。
 String cryptState = SystemProperties.get("vold.decrypt");
 if (ENCRYPTING_STATE.equals(cryptState)) {
  Slog.w(TAG, "Detected encryption in progress - only parsing core apps");
  mOnlyCore = true;
 } else if (ENCRYPTED_STATE.equals(cryptState)) {
  Slog.w(TAG, "Device encrypted - only parsing core apps");
  mOnlyCore = true;
 }
 ......
 mPackageManagerService = PackageManagerService.main(mSystemContext, installer,
 mFactoryTestMode != FactoryTest.FACTORY_TEST_OFF, mOnlyCore);
 ......

}

private PackageParser.Package scanPackageLI(File scanFile, int parseFlags, int scanFlags,
   long currentTime, UserHandle user) throws PackageManagerException {
  if (DEBUG_INSTALL) Slog.d(TAG, "Parsing: " + scanFile);
  PackageParser pp = new PackageParser();
  pp.setSeparateProcesses(mSeparateProcesses);
  // 设置仅解析 core app only,
  pp.setOnlyCoreApps(mOnlyCore);
  .....
}

private Package parseClusterPackage(File packageDir, int flags) throws PackageParserException {
  final PackageLite lite = parseClusterPackageLite(packageDir, 0);

  // 如果不是 !lite.coreApp， 跳过该 app，即启动时，不会安装该app
  if (mOnlyCoreApps && !lite.coreApp) {
   throw new PackageParserException(INSTALL_PARSE_FAILED_MANIFEST_MALFORMED,
     "Not a coreApp: " + packageDir);
  }

#重启 main 类别服务
on property:vold.decrypt=trigger_reset_main
 class_reset main

static int do_mount_all(const std::vector& args) {
 pid_t pid;
 .....
 //
 if (ret == FS_MGR_MNTALL_DEV_NEEDS_ENCRYPTION) {
  // 发送 encrypt 事件到 vdc
  ActionManager::GetInstance().QueueEventTrigger("encrypt");
 } else if
 .....
}

on encrypt
 start surfaceflinger
 exec - root -- /system/bin/vdc --wait cryptfs enablecrypto inplace default noui
 # vold will set vold.decrypt to trigger_restart_framework (default
 # encryption)

on encrypt
 start surfaceflinger
 #发送命令 enablecrypto 到 vold
 exec - root -- /system/bin/vdc --wait cryptfs enablecrypto inplace default noui
 # vold will set vold.decrypt to trigger_restart_framework (default
 # encryption)

int CryptCommandListener::CryptfsCmd::runCommand(SocketClient *cli,
             int argc, char **argv) {
 } else if (subcommand == "cryptocomplete") {
  if (!check_argc(cli, subcommand, argc, 2, "")) return 0;
  dumpArgs(argc, argv, -1);
  rc = cryptfs_crypto_complete();
 // 命令是 enablecrypto
 } else if (subcommand == "enablecrypto") {
  .....

  // Spawn as thread so init can issue commands back to vold without
  // causing deadlock, usually as a result of prep_data_fs.
  char* arg2 = argc > 2 ? strdup(argv[2]) : NULL;
  char* arg4 = argc > 4 ? strdup(argv[4]) : NULL;
  // 执行 do_enablecrypto 方法
  std::thread(&do_enablecrypto, arg2, arg4, type, no_ui).detach();
}

static int do_enablecrypto(char* arg2, char* arg4, int type, bool no_ui) {
 int rc;
 int tries;
 for (tries = 0; tries < 2; ++tries) {
  // 不是默认加密，运行方法 cryptfs_enable()
  if (type == CRYPT_TYPE_DEFAULT) {
   rc = cryptfs_enable_default(arg2, no_ui);
  } else {
   rc = cryptfs_enable(arg2, type, arg4, no_ui);
  }
  .....
 return -1;
}

int cryptfs_enable(char *howarg, int type, char *passwd, int no_ui)
{
 return cryptfs_enable_internal(howarg, type, passwd, no_ui);
}

int cryptfs_enable_internal(char *howarg, int crypt_type, char *passwd,
       int no_ui)
{
 /* restart the framework. */
 /* Create necessary paths on /data */
 if (prep_data_fs()) {
  goto error_shutting_down;
 }
}

static int prep_data_fs(void)
{
 property_set("vold.post_fs_data_done", "0");
 // 设置 vold.decrypt = trigger_post_fs_data，触发 init.rc
 property_set("vold.decrypt", "trigger_post_fs_data");
 SLOGD("Just triggered post_fs_data\n");

 /* Wait a max of 50 seconds, hopefully it takes much less */
 for (i=0; i

#创建/data 子目录和链接，启动服务
on post-fs-data
 # We chown/chmod /data again so because mount is run as root + defaults
 chown system system /data
 chmod 0771 /data
 # We restorecon /data in case the userdata partition has been reset.
 restorecon /data

 # start debuggerd to make debugging early-boot crashes easier.
 start debuggerd
 start debuggerd64

 #task4597305 added by xiwu.peng to output logcat to uart
 start logcat2uart

 # Make sure we have the device encryption key.
 start vold
 installkey /data

 # Start bootcharting as soon as possible after the data partition is
 # mounted to collect more data.
 mkdir /data/bootchart 0755 shell shell
 bootchart_init

 .....

 mkdir /data/system_de 0770 system system
 mkdir /data/system_ce 0770 system system

 mkdir /data/misc_de 01771 system misc
 mkdir /data/misc_ce 01771 system misc

 mkdir /data/user 0711 system system
 mkdir /data/user_de 0711 system system
 symlink /data/data /data/user/0

 mkdir /data/media 0770 media_rw media_rw
 mkdir /data/media/obb 0770 media_rw media_rw

 init_user0
 # If there is no fs-post-data action in the init..rc file, you
 # must uncomment this line, otherwise encrypted filesystems
 # won't work.
 # Set indication (checked by vold) that we have finished this action
 #setprop vold.post_fs_data_done 1

static int cryptfs_restart_internal(int restart_main)
{
 // init 做完 post-fs-data，继续往下执行代码
 if (prep_data_fs()) {
   return -1;
 }
 //init 做完 post-fs-data， vold 将 vold.decrypt 设为 trigger_restart_framework， 触发init
 /* startup service classes main and late_start */
 property_set("vold.decrypt", "trigger_restart_framework");
}

#重启所有服务
on property:vold.decrypt=trigger_restart_framework
 # A/B update verifier that marks a successful boot.
 exec - root -- /system/bin/update_verifier trigger_restart_framework
 class_start main
 class_start late_start