GitLab

Don't rely on cryptographic binding of secdiscard to key; securely
delete the other information needed to reconstruct the key too.

Bug: 26021231
Change-Id: If03d2c051b0ec2fdcb5c6f70bde7e3287424f216

On a device where we can't BLKSECDISCARD sectors, we "overwrite" them
with zeroes. This changes the FTL to remap those sectors to new
locations.  With this done, the old contents are accessible only given
a compromise of flash firmware or a die level attack.

Bug: 26021231
Change-Id: Ia065921389886fac1ba456c19c138187237c2561

Only merge once

https://partner-android-review.googlesource.com/#/c/619829/1

has been merged into kernel.

Bug: 28779973
Change-Id: Icef78d1e4381e89e07797c36f6f650033d313557

Bug: 28905864
Change-Id: Ie2a5c3e029075d53a86ef3afb7fe364c16d8d52b

This reverts commit 01f1bc72.

Bug: 28905864
Change-Id: I489f5d073530438829038630af7af6b2a5cbdbbe

am: a363036b

* commit 'a363036b':
  Two phases to set the password for disk encryption

Change-Id: Ia28823079d8c0bda220238339f28095b234a0ae5

Revert "Revert "Two phases to set the password for disk encryption""

This reverts commit d4023892.

In addition, fix the bug in the original commit.

Bug: 28154455
Bug: 28694324
Change-Id: I885f1d73e739416347c135d79979941c2bbdbe62

Bug: 28616054
Change-Id: If3fddd62f069c7e3e8369a1db68e69c390059d63

am: cfa03d4a

* commit 'cfa03d4a':
  e4crypt_is_native has been moved into system/extras.

Change-Id: I345475c44fb2d8812a25c9f2195c748cddc55bfe

am: d4023892

* commit 'd4023892':
  Revert "Two phases to set the password for disk encryption"

Change-Id: I53a3804fc7bff9c99840aeee36fc4b7ff8e46ac1

This reverts commit 92c5eeb4.

Bug: 28694324
Change-Id: Ibbbaff287f4dd28f4a13e122a3617987a8875a44

Bug: 28318405
Change-Id: Id962764cf7fb5f58b769bf99aeb6d3d69cb66991

am: 92c5eeb4

* commit '92c5eeb4':
  Two phases to set the password for disk encryption

Change-Id: I82c1cfa2874ac4709e42f5c2047c832cbcaccb91

In one phase, we make the new password work, and in the second we make
it the only one which works ("fixation"). This means that we can set
the password in Gatekeeper between these two phases, and a crash
doesn't break things. Unlocking a user automatically fixates the
presented credential.

Bug: 28154455
Change-Id: I54623c8652f0c9f72dd60388a7dc0ab2d48e81c7

Note that this is an ugly workaround for a kernel bug.

Bug: 28373400
Change-Id: Iec1ae53f4e18f06e41e8cf1fcc3ab03fc9848632

am: b3de337a

* commit 'b3de337a':
  Use a longer timeout on the disk encryption keys

Change-Id: Ieadec9da13383361ac76bf6b79ecea948965a1d9

Avoid a timeout error by extending the time allowed between getting
the auth token and decrypting the key from five to thirty seconds.

Bug: 28398766
Change-Id: I1dbb9e0e33707e7de4c1720ad1b8e153c77094b2

am: a4330beb

* commit 'a4330beb':
  Unmount public sdcard filesystems before killing the fuse process.

Change-Id: I294d46bb27fb6d8ac83f1041e849fd366134b6ee

am: 47ff14ad

* commit '47ff14ad':
  Move vold (and sdcard childs) to foreground cpuset.

Change-Id: I2d539472902f0f2ce33bbfe767f93b9bf91856ce

Avoids ENOTCONN during eject for sdcard users.

Change-Id: I7b89ccaad4bb7af3639dc0b702168030a2f88366
Bug: 28268676

am: 0264d8ff

* commit '0264d8ff':
  Don't start defaultcrypto twice

Change-Id: I39951628d41f656901658cd82a56298ef9f663ec

The old way (using triggers) starts defaultcrypto twice because
queue_property_triggers_action retriggers the action.

Bug: 27452459

Change-Id: I715d5441f8ae0b820b680f6a75f51694c4420992

am: be70c9ae

* commit 'be70c9ae':
  Consistent creation/destruction of user data.

Change-Id: I55f4fe88a8c02d019fa92028e6ad358fc0f75aeb

Preparing and destroying users currently needs to be split across
installd, system_server, and vold, since no single party has all the
required SELinux permissions.

Bug: 27896918, 25861755
Change-Id: Ieec14ccacfc7a3a5ab00df47ace7318feb900c38

Bug: 24949295
Change-Id: I7118a374db90ede517a92f72763d624b9a234ea7

Change-Id: I60ca596e32f8668ae5895e671d92c4978ede6314
Fixed: 28055420

Bug: 27176738
Change-Id: I09bfe777e383325809d7ecc2dcb9129fe234053f

Bug: 24863778
Change-Id: I86a482c6de78afe2e09ca91165000e1b10a42058

Users don't have to be unlocked to be deleted, so don't worry if we
don't have their key to evict.

Bug: 26847403
Bug: 27441228
Change-Id: Ifd93f620926630aa102a3bb4a5d2d45d34f9b75d

Bug: 27718275
Change-Id: I0b2aa74f45fd07a121ce0c342b27426a3fe593ce

Bug: 27099772
Change-Id: Ic96777edf4ea282be2b8f53525226396c01e023c

Bug: 27599622
Change-Id: I2f38c03941ac8cdba40baf7421132f572866e296