[Android Q&A, Help & Troubleshooting] mm11751:
How can I ensure that the file /data/misc/vold/user_keys/ce/0/current/keymaster_key_blob cannot be deleted?

I am an Android system engineer and currently need to modify the system on the Android 11 of the rk3568 platform. I have received feedback from customers that several devices cannot enter the system and are stuck in the boot animation interface. The analysis results show that this is because the file /data/misc/vold/user_keys/ce/0/current/keymaster_key_blob has been deleted. I want to ensure that this file is not deleted by modifying the permissions. I tried to modify the following code and then compile and flash the device, but it didn't work. What should I do? Thank you

this is the erro log:

06-12 18:25:04.283 440 460 I ActivityManager: User 0 state changed from BOOTING to RUNNING_LOCKED
06-12 18:25:04.283 440 460 W ActivityManager: UserLifecycleEvent 4 received without an active userJourneySession.
06-12 18:25:04.283 567 732 D bt_bte_conf: bte_load_did_conf no section named DID2.
06-12 18:25:04.284 567 716 I bt_stack_manager: event_start_up_stack finished
06-12 18:25:04.284 567 732 I bt_btif_core: btif_enable_bluetooth_evt finished
06-12 18:25:04.287 440 460 D StorageManagerService: unlockUserKey: 0 isFileEncryptedNativeOrEmulated: true hasToken: false hasSecret: false
06-12 18:25:04.287 0 0 I init : processing action (sys.boot_completed=1) from (/system/etc/init/hw/init.rc:981)
06-12 18:25:04.288 159 159 D vold : fscrypt_unlock_user_key 0 serial=0 token_present=0
06-12 18:25:04.288 0 0 I init : starting service 'exec 14 (/bin/rm -rf /data/per_boot)'...
06-12 18:25:04.289 159 159 D vold : Skipping non-key .
06-12 18:25:04.289 159 159 D vold : Skipping non-key ..
06-12 18:25:04.289 159 159 D vold : Trying user CE key /data/misc/vold/user_keys/ce/0/current
06-12 18:25:04.291 0 0 I init : SVC_EXEC service 'exec 14 (/bin/rm -rf /data/per_boot)' pid 1017 (uid 1000 gid 1000+0 context default) started; waiting...
06-12 18:25:04.311 149 149 I hwservicemanager: getTransport: Cannot find entry android.hardware.keymaster@3.0::IKeymasterDevice/default in either framework or device manifest.
06-12 18:25:04.311 159 159 I vold : List of Keymaster HALs found:
06-12 18:25:04.311 159 159 I vold : Keymaster HAL #1: OpteeKeymasterDevice from Rockchip SecurityLevel: TRUSTED_ENVIRONMENT HAL: android.hardware.keymaster@4.1::IKeymasterDevice/default
06-12 18:25:04.311 159 159 I vold : Using OpteeKeymasterDevice from Rockchip for encryption. Security level: TRUSTED_ENVIRONMENT, HAL: android.hardware.keymaster@4.1::IKeymasterDevice/default
06-12 18:25:04.311 159 159 E vold : Failed to read from /data/misc/vold/user_keys/ce/0/current/keymaster_key_blob: No such file or directory
06-12 18:25:04.312 159 159 E vold : Failed to find working ce key for user 0
06-12 18:25:04.312 159 159 E vold : Couldn't read key for 0
06-12 18:25:04.313 440 460 E StorageManagerService: android.os.ServiceSpecificException: (code 0)
06-12 18:25:04.313 440 460 E StorageManagerService: at android.os.Parcel.createExceptionOrNull(Parcel.java:2387)
06-12 18:25:04.313 440 460 E StorageManagerService: at android.os.Parcel.createException(Parcel.java:2357)
06-12 18:25:04.313 440 460 E StorageManagerService: at android.os.Parcel.readException(Parcel.java:2340)
06-12 18:25:04.313 440 460 E StorageManagerService: at android.os.Parcel.readException(Parcel.java:2282)
06-12 18:25:04.313 440 460 E StorageManagerService: at android.os.IVold$Stub$Proxy.unlockUserKey(IVold.java:2572)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.StorageManagerService.unlockUserKey(StorageManagerService.java:3315)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.UserController.unlockUserCleared(UserController.java:1532)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.UserController.maybeUnlockUser(UserController.java:1513)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.UserController.finishUserBoot(UserController.java:540)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.UserController.sendBootCompleted(UserController.java:2053)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.ActivityManagerService.finishBooting(ActivityManagerService.java:5555)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.am.ActivityManagerService.bootAnimationComplete(ActivityManagerService.java:5614)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.wm.WindowManagerService.performEnableScreen(WindowManagerService.java:3492)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.wm.WindowManagerService.access$1100(WindowManagerService.java:317)
06-12 18:25:04.313 440 460 E StorageManagerService: at com.android.server.wm.WindowManagerService$H.handleMessage(WindowManagerService.java:4984)

The code below is my mdify code but no working, please help me thanks:

evan@BLD-Evan:~/sky-8200/system/vold$ git df
diff --git a/KeyStorage.cpp b/KeyStorage.cpp
index 951536b..7c73578 100644
--- a/KeyStorage.cpp
+++ b/KeyStorage.cpp
@@ -599,30 +599,42 @@ static bool recursiveDeleteKey(const std::string& dir) {
}
return true;
}
-
+//evan add
bool destroyKey(const std::string& dir) {
+ ALOGE("xwg 0614----start");
+ // Check if the filePath is the protected keymaster_key_blob
+ std::string filePath = dir + "/" + kFn_keymaster_key_blob;
+ if (filePath == "/data/misc/vold/user_keys/ce/0/current/keymaster_key_blob") {
+ ALOGE("xwg 0614----Attempt to delete protected keymaster_key_blob file: %s", filePath.c_str());
+ return -EPERM; // 返回权限错误，阻止删除
+ }
+
bool success = true;
- // Try each thing, even if previous things failed.
- bool uses_km = pathExists(dir + "/" + kFn_keymaster_key_blob);
+ // Try each operation, even if previous ones fail
+ bool uses_km = pathExists(filePath);
if (uses_km) {
success &= deleteKey(dir);
}
- auto secdiscard_cmd = std::vector<std::string>{
+ std::vector<std::string> secdiscard_cmd{
kSecdiscardPath,
"--",
dir + "/" + kFn_encrypted_key,
+ dir + "/" + kFn_salt,
dir + "/" + kFn_secdiscardable,
+ dir + "/" + kFn_stretching,
+ dir + "/" + kFn_version,
};
- if (uses_km) {
- secdiscard_cmd.emplace_back(dir + "/" + kFn_keymaster_key_blob);
- }
if (ForkExecvp(secdiscard_cmd) != 0) {
LOG(ERROR) << "secdiscard failed";
success = false;
}
- success &= recursiveDeleteKey(dir);
+ if (!recursiveDeleteKey(dir)) {
+ LOG(ERROR) << "xwg 0614----recursive delete failed";
+ success = false;
+ }
return success;
}
+//evan end

} // namespace vold
} // namespace android
evan@BLD-Evan:~/sky-8200/system/vold$

evan@BLD-Evan:~/sky-8200/system/core/rootdir$ git df
diff --git a/rootdir/init.rc b/rootdir/init.rc
index a9af0b0..31d9406 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -755,6 +755,10 @@ on post-fs-data
mkdir /data/media 0770 media_rw media_rw encryption=None
exec - media_rw media_rw -- /system/bin/chattr +F /data/media
mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt
+
+ ##evan add
+ # Run script to set keymaster_key_blob permissions
+ start set_keymaster_key_blob_permissions

exec_start derive_sdk

@@ -791,6 +795,13 @@ on post-fs-data
# Enable FUSE by default
setprop persist.sys.fuse true

+## evan add
+service set_keymaster_key_blob_permissions /system/bin/sh /system/etc/set_keymaster_key_blob_permissions.sh
+ class main
+ user root
+ group root
+ oneshot
+
# Switch between sdcardfs and FUSE depending on persist property
# TODO: Move this to ro property before launch because FDE devices
# interact with persistent properties differently during boot
evan@BLD-Evan:~/sky-8200/system/core/rootdir$