guardianproject / luks Goto Github PK

I’m having trouble compiling Sigkill’s luksunlock pre-boot authentication mechanism. I apologize if this post is inappropriate in this forum, please contact me so we can discuss the issue over email or another channel.

I can launch the prebuilt luksunlock binary from my init.rc on an HTC Desire with CyanogenMod 7.1 using GuardianProject’s cryptsetup and luksunlock binaries. luksunlock fails to unlock the volumes after providing a passphrase. LUKS is working properly on loopback devices and SD card partitions from a shell (after the Android framework is loaded). My volumes are set up according to the xda-forum (http://forum.xda-developers.com/showpost.php?p=11616180&postcount=12) and the luksunlock code / init.rc.

My problem is compiling the luksunlock source. I’m using android-ndk-r6b cross-compiler toolchain. I can successfully compile static and dynamically linked applications that run on my phone. I experience eabi-gcc build errors on minui functions when compiling luksunlock.c.

Any advice for compiling luksunlock with the NDK would be greatly appreciated (or any information on incorporating the Android recovery minui into a similar application). I can provide any further details on request (init.rc file, build environment, etc.).

Sincerest Thanks.

Hi,
I just tried to cross compile the LUKS, few issues occur as mentioned below

1. The url to which LVM is pointing is not available, need to change to a mirror site for downloading that specific version of LVM. Then while configuring, warning is thrown specifying that "unrecognized option --with-dmdir". Somehow I added patch to include --with-dmdir and later it got compiled.
2. The second error was while configuring util-linux, it was throwing "unrecognized option --enable-pkgconfig", not sure how to include the support for including enable-pkgconfig. Ignored the warning while configuring then it compiled.
3. Finally while configuring cryptsetup, it throws "unrecognized options --enable-libgcrypt, --enable-libdevmapper" but still the executable is getting generated. When copied and tried executing the generated executable on my device, it throws "segmentation fault". Probably I cannot skip or ignore the "unrecognized options --enable-libgcrypt, --enable-libdevmapper" error, as this is a key part.

Can you please help me out on how can I go ahead on this.

First I had to edit external/Makefile as follows:
NDK_TOOLCHAIN=$(NDK_BASE)/toolchains/arm-linux-androideabi-4.8/prebuilt/$(NDK_UNAME)-x86_64

Then, compilation failed at libgcrypt-1.4.6:

/bin/bash ../libtool --tag=CC   --mode=link /opt/android-ndk//toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin/arm-linux-androideabi-gcc --sysroot=/opt/android-ndk//platforms/android-9/arch-arm -I/usr/local/include -I/tmp/LUKS/external/include -fvisibility=hidden -Wall -Wcast-align -Wshadow -Wstrict-prototypes -Wformat -Wno-format-y2k -Wformat-security -W -Wextra -Wbad-function-cast -Wwrite-strings -Wdeclaration-after-statement -Wno-missing-field-initializers -Wno-sign-compare -Wpointer-arith  -L/tmp/LUKS/external/lib -Wl,--rpath,/tmp/LUKS/external/lib -o register register.o ../src/libgcrypt.la  
/opt/android-ndk//toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin/arm-linux-androideabi-gcc --sysroot=/opt/android-ndk//platforms/android-9/arch-arm -I/usr/local/include -I/tmp/LUKS/external/include -fvisibility=hidden -Wall -Wcast-align -Wshadow -Wstrict-prototypes -Wformat -Wno-format-y2k -Wformat-security -W -Wextra -Wbad-function-cast -Wwrite-strings -Wdeclaration-after-statement -Wno-missing-field-initializers -Wno-sign-compare -Wpointer-arith -Wl,--rpath -Wl,/tmp/LUKS/external/lib -o .libs/register register.o  -L/tmp/LUKS/external/lib ../src/.libs/libgcrypt.so
register.o:register.c:function check_run: error: undefined reference to 'gpg_strerror'
register.o:register.c:function check_run: error: undefined reference to 'gpg_strerror'
register.o:register.c:function check_run: error: undefined reference to 'gpg_strerror'
collect2: error: ld returned 1 exit status
Makefile:432: recipe for target 'register' failed
make[3]: *** [register] Error 1
make[3]: Leaving directory '/tmp/LUKS/external/libgcrypt-1.4.6/tests'
Makefile:317: recipe for target 'all-recursive' failed
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory '/tmp/LUKS/external/libgcrypt-1.4.6'
Makefile:247: recipe for target 'all' failed
make[1]: *** [all] Error 2
make[1]: Leaving directory '/tmp/LUKS/external/libgcrypt-1.4.6'
Makefile:110: recipe for target 'libgcrypt-build' failed
make: *** [libgcrypt-build] Error 2

Not really sure if this is where I should post this but...

I have been trying for a while to get Android LUKS to work. Here is my setup:

• rooted HTC Desire w/ CyanogenMod 7.1 (also tried with 6.1)
• BusyBox 1.19.1 in /system/xbin (also tried older versions)
• cryptsetup binary (also tried "Nemesis2 LUKS Manager" statically linked "lm.cryptsetup" binary)

I tried to configure a file container with info from the guardianproject README. I fail on the "luksOpen /dev/loop0" step with a message: "Device /dev/loop0 is too small". I have tried connecting the loopback device with files ranging from 5MB to 25MB and always the same error.

Any help would be greatly appreciated.

Also, if anyone has any advice on compiling the stock Android 2.3.x kernel with the necessary crypto, loopback, and device mapper modules I would be very thankful. I tried simply taking the generic linux 2.6.3x modules and placing them in the Android kernel module directory, but I can't get them to compile.

Thanks.

I realize this is a big complex undertaking, and if there's a better place to put this, please say so, especially if somebody is already doing it.

Guardian Project LUKS should use hardware acceleration where possible, to save on power consumption and CPU use (vs. other processes running). Many of the target platforms include ways to accelerate AES with built in hardware. e.g.:

Older TI parts can use the C64x DSP for AES acceleration
http://ti.com/tool/c64xpluscrypto

TI's e-book platform (OMAP 36xx) has the M-Shield part with hardware AES.
http://focus.ti.com/pdfs/wtbu/SWPT045.pdf

Newer ARMv9 chips have AES instructions natively.

It may mean we need patches for Linux (I know Intel AES and Via Padlock are currently supported) which isn't trivial and could take a while to trickle down, but one must start somewhere.

when using a luks partition as a seperate user linked into the home directory. when deleting other users files on the non encrypted drive the recycle bin eats them and the undo trash from a filebrowser does not work. (tested with caja possibly a caja issue - will investigate more)

Just curious, such an important project