GitLab

Bug: http://b/20501816
Change-Id: Ieecce9304539c250ed1728252b8c2c09d29afd7f

Since otherwise we might have a stale path.

Bug: 19993667
Change-Id: I099e3dc0c5aa9ab6820cded4f2ae7fd6bf18ea40

Change-Id: Ia11c689c373f41b2a63bc84151eb16f7c7b9d155

Bug: 19993667
Change-Id: Ie226e06edcb426caca2dbc97d2d5d60ae948c85e

Bug: 19993667
Change-Id: If6a79391e34b652b2ba4e6df40a8e712f7a2e172

* commit '85c7c08e':
  Wait for completion of device mapping in mountObb

* commit 'd5aa67cc':
  Wait for completion of device mapping in mountObb

The VolumeManager::mountObb() creates a mapping between
a loopback device and a dm device. However the device-mapper
carries it out asynchronously, so there is a possibility that
Vold accesses to the dm device which is being built. Added
waiting for completion of the mapping in that function, like
mountAsec().

To verify install FrameworksCoreTests.apk and do:

  adb shell am instrument -r -w -e class android.os.storage.\
  StorageManagerIntegrationTest#testMountTwoEncryptedObb \
  com.android.frameworks.coretests/android.test.\
  InstrumentationTestRunner

Change-Id: If42f4b7494bb2f8a8b72d106ad84b3e3bf91fd9b

When requested, kick off a thread that will migrate storage contents
between two locations.  This is performed in several steps that
also interact with the framework:

1. Take old and new volumes offline during migration
2. Wipe new location clean (10% of progress)
3. Copy files from old to new (60% of progress)
4. Inform framework that move was successful so it can persist
5. Wipe old location clean (15% of progress)

Derives a hacky progress estimate by using a rough proxy of free
disk space changes while a cp/rm is taking place.

Add new internal path for direct access to volumes to bypass any
FUSE emulation overhead, and send it to framework.  Remove mutex
around various exec calls since setexeccon() is already per-thread.

Bug: 19993667
Change-Id: Ibcb4f6fe0126d05b2365f316f53e71dc3e79a2b8

We eventually should move back to per-disk locks, but use a giant
lock to keep development rolling forward.  Also move force adoptable
flag to framework since, since encrypted devices don't have persisted
properties loaded early during boot.

Bug: 19993667
Change-Id: Ifa3016ef41b038f8f71fc30bc81596cfd21dcd2a

Bug: 19993667
Change-Id: I47099c262686127f82dd376570d49cf0ad119842

Bug: 19993667
Change-Id: I20dc183a35c11b5b4ba6139e690929b9c279b830

Use system log for more durable log history.  Also accept persistable
version of flag to force adoptability.

Bug: 19993667
Change-Id: Icdf36799e26038e9a8e2bdaca276d97b22ba3941

This is cleaner and more direct than the reverse of having the disk
publish child volume membership.  Rename state constants to match
public API.  Add state representing bad removal.  Make it clear that
volume flags are related to mounting.

Send new unsupported disk event when we finish scanning an entire
disk and have no meaningful volumes.

Bug: 19993667
Change-Id: I08a91452ff561171a484d1da5745293ec893aec0

Otherwise we get really excited and trip over ourselves while
partitions are still being created.

Bug: 19993667
Change-Id: I034e56b3063a71d73f9311a945c05ea2ae255f7d

Bug: 19993667
Change-Id: Id125d9252bf7130516c0ec619d5f067fea24d560

Bug: 19993667
Change-Id: Ib15e79a94a185843dace35fea7daaea866120f87

Bug: 19993667
Change-Id: I17093f0f9abe8762e5ee4f38ce99f9024e419dfc

When a private volume is mounted, create an emulated volume above it
hosted at the /media path on that device.  That emulated volume is
automatically torn down when unmounting the private volume.

Add "removed" state for volume, which signals to framework that
media has left the building, send when the volume is destroyed.

Bug: 19993667
Change-Id: I1f82b51de578ac5cfcc5d7b9a6fb44f6f25c775c

Sadly setexeccon() is process global, so we need to carefully ensure
that all exec() are mutually exclusive to avoid transitioning into
unwanted domains.  Also, because we have several threads floating
around, we need to guard all our FDs with O_CLOEXEC.

Format all newly created volumes immediately after partitioning,
but silence all events emitted from those volumes to prevent the
framework from getting all excited.  Unify all notify events under a
single codepath to make them easy to silence.

Sent SIGINT before escalating to SIGTERM when unmounting.

Bug: 19993667
Change-Id: Idc6c806afc7919a004a93e2240b42884f6b52d6b

* commit '959de99a':
  Add dependency on libsquashfs_utils due to fs_mgr dependency

* commit 'f8c905e0':
  Add dependency on libsquashfs_utils due to fs_mgr dependency

Change-Id: I894d18c2086a6532194f478853a9837eb4b6fc09
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>

Mount private volumes at /mnt/expand, which is where we have new
SELinux policy waiting for us.  Also ensure that foundational
directories are ready when mounting.

Create local fs_prepare_dir() wrapper that sets SELinux context
based on path, avoiding the need for a later restorecon.

Use UUID as directory name for public volumes.  Wait a few seconds
before issuing first signal when force unmounting.

Bug: 19993667
Change-Id: If22595380faaae321705b06c87d877419620da48

Also automatically unmount when format is requested.

Bug: 19993667
Change-Id: I2c81b7ccc9d69df61d7ae4df1e8224c02f260044

Bug: 19993667
Change-Id: I1f6519655c5a366eca25e2329e1bf95d81b3bf8c

Bug: 19993667
Change-Id: If8c0b346820f30c6a7dac495f935be17d677ffcc

vold works with two broad classes of block devices: untrusted devices
that come in from the wild, and trusted devices like PrivateVolume
which are encrypted.

When running blkid and fsck, we pick which SELinux execution domain
to use based on which class the device belongs to.

Bug: 19993667
Change-Id: I2695f028710a4863f0c3b2ed6da437f466401272

This adds support for private volumes which is just a filesystem
wrapped in a dm-crypt layer.  For now we're using the exact same
configuration as internal encryption (aes-cbc-essiv:sha256), but we
don't store any key material on the removable media.  Instead, we
store the key on internal storage, and use the GPT partition GUID
to identify which key should be used.

This means that private external storage is effectively as secure as
the internal storage of the device.  That is, if the internal storage
is encrypted, then our external storage key is also encrypted.

When partitioning disks, we now support a "private" mode which has
a PrivateVolume partition, and a currently unused 16MB metadata
partition reserved for future use.  It also supports a "mixed" mode
which creates both a PublicVolume and PrivateVolume on the same
disk.  Mixed mode is currently experimental.

For now, just add ext4 support to PrivateVolume; we'll look at f2fs
in a future change.  Add VolumeBase lifecycle for setting up crypto
mappings, and extract blkid logic into shared method.  Sprinkle some
more "static" around the cryptfs code to improve invariants.

Bug: 19993667
Change-Id: Ibd1df6250735b706959a1eb9d9f7219ea85912a0

Change-Id: I4e30ecff3c29d0f8351c6f43de1c979c8c792fab

Wire up new Disk and VolumeBase objects and events to start replacing
older DirectVolume code.  Use filesystem UUID as visible PublicVolume
name to be more deterministic.

When starting, create DiskSource instances based on fstab, and watch
for kernel devices to appear.  Turn matching devices into Disk
objects, scan for partitions, and create any relevant VolumeBase
objects.  Broadcast all of these events towards userspace so the
framework can decide what to mount.

Keep track of the primary VolumeBase, and update the new per-user
/storage/self/primary symlink for all started users.

Provide a reset command that framework uses to start from a known
state when runtime is restarted.  When vold is unexpectedly killed,
try recovering by unmounting everything under /mnt and /storage
before moving forward.

Remove UMS sharing support for now, since no current devices support
it; MTP is the recommended solution going forward because it offers
better multi-user support.

Switch killProcessesWithOpenFiles() to directly take signal.  Fix
one SOCK_CLOEXEC bug, but SELinux says there are more lurking.

Bug: 19993667
Change-Id: I2dad1303aa4667ec14c52f774e2a28b3c1c1ff6d

* commit '8a0fde27':
  Fixed type mismatch for ioctl(BLKGETSIZE)

* commit 'e9623fed':
  Fixed type mismatch for ioctl(BLKGETSIZE)

ioctl(BLKGETSIZE) expects unsigned long
(8 bytes on 64 bit environment).

This is fixing fails in android.os.storage.StorageManagerIntegrationTest
(in FrameworkCoreTests).

To verify, install FrameworksCoreTests.apk and do:

adb shell am instrument -r -w -e class android.os.storage.\
StorageManagerIntegrationTest#testMountSingleEncryptedObb \
com.android.frameworks.coretests/android.test.InstrumentationTestRunner

Change-Id: Ib6d5c7490c02521c93f107c35ad0aac49f6a3f1a

* commit '836e7860':
  Adding e4crypt support

* commit '8120c3d1':
  Adding e4crypt support