pkcs11_init.cc - chromiumos/platform/cryptohome - Git at Google

 // Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 // Contains the implementation of class Pkcs11Init.

 #include "pkcs11_init.h"

 #include <iostream>

 #include <base/logging.h>
 #include <base/string_util.h>
 #include <glib.h>
 #include <opencryptoki/pkcs11.h>

 #include "platform.h"


 namespace cryptohome {

 // static
 const CK_SLOT_ID Pkcs11Init::kDefaultTpmSlotId = 0;
 const CK_ULONG Pkcs11Init::kMaxPinLen = 9;
 const CK_ULONG Pkcs11Init::kMaxLabelLen = 32;
 // openCryptoki 2.2.4 PIN defaults as per the README at:
 // http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki
 //       /opencryptoki;a=summary
 const CK_CHAR Pkcs11Init::kDefaultOpencryptokiSoPin[] = "87654321";
 const CK_CHAR Pkcs11Init::kDefaultOpencryptokiUserPin[] = "12345678";
 const CK_CHAR Pkcs11Init::kDefaultSoPin[] = "000000";
 const CK_CHAR Pkcs11Init::kDefaultUserPin[] = "111111";
 const CK_CHAR Pkcs11Init::kDefaultLabel[] = "User-Specific TPM Token";
 const char Pkcs11Init::kOpencryptokiDir[] = "/var/lib/opencryptoki";
 const char Pkcs11Init::kUserTokenLink[] = "/var/lib/opencryptoki/tpm/chronos";
 const char Pkcs11Init::kRootTokenLink[] = "/var/lib/opencryptoki/tpm/root";
 const char Pkcs11Init::kUserTokenDir[] = "/home/chronos/user/.tpm";
 const char Pkcs11Init::kRootTokenDir[] = "./chronos";
 const char Pkcs11Init::kPkcs11Group[] = "pkcs11";
 const char Pkcs11Init::kOldTokenEntry[] =
     "/var/lib/opencryptoki/pk_config_data";
 const std::string Pkcs11Init::kPkcs11StartupPath = "/usr/sbin/pkcs11_startup";
 const std::string Pkcs11Init::kPkcsSlotdPath = "/usr/sbin/pkcsslotd";
 const std::string Pkcs11Init::kPkcsSlotPath = "/usr/sbin/pkcs_slot";
 const std::string Pkcs11Init::kPkcsSlotCmd[] = { Pkcs11Init::kPkcsSlotPath,
                                                  "0", "tpm" };
 // This file in the user's cryptohome signifies that Pkcs11 initialization
 // was completed for the user.
 const std::string Pkcs11Init::kPkcs11InitializedFile =
     "/home/chronos/user/.tpm/.isinitialized";

 extern const char* kTpmOwnedFile;
 extern const std::string kDefaultSharedUser;

 // Helper function to copy a CK_CHAR string |src| to another CK_CHAR string
 // |dest| with at most most |len-1| characters. |dest| is then null-terminated.
 void CKCharcpy(CK_CHAR* dest, const CK_CHAR* src, CK_ULONG len) {
   strncpy(reinterpret_cast<char*>(dest),
           reinterpret_cast<const char*>(src),
           len - 1);
   dest[len - 1] = '\0';
 }


 void Pkcs11Init::GetTpmTokenInfo(gchar **OUT_label,
                                  gchar **OUT_user_pin) {
   *OUT_label = g_strdup(reinterpret_cast<const gchar *>(kDefaultLabel));
   *OUT_user_pin = g_strdup(reinterpret_cast<const gchar *>(kDefaultUserPin));
 }

 bool Pkcs11Init::Initialize() {
   Platform platform;
   // Determine required uid and gids.
   if (!platform.GetGroupId(kPkcs11Group, &pkcs11_group_id_)) {
     LOG(ERROR) << "Couldn't get the group ID for group " << kPkcs11Group;
     return false;
   }
   if (!platform.GetUserId(kDefaultSharedUser, &chronos_user_id_,
                           &chronos_group_id_)) {
     LOG(ERROR) << "Couldn't get the user/group ID for user "
                << kDefaultSharedUser;
     return false;
   }

   if (!SetUpPkcs11System())
     return false;

   if (IsTokenBroken()) {
     LOG(INFO) << "Broken or uninitialized token. Removing user token dir "
               << kUserTokenDir << " just to be safe.";
     RemoveUserTokenDir();
     if (!SetUpLinksAndPermissions())
       return false;
     return SetUpTPMToken();
   }
   LOG(INFO) << "PKCS#11 is already initialized.";
   return true;
 }

 bool Pkcs11Init::SetUpPkcs11System() {
   Platform platform;
   // Run the pkcs11_startup script that will detect available tokens and update
   // pk_config_data appropriately. This is used later by pkcsslotd.
   std::string startup_cmd = kPkcs11StartupPath;
   std::string startup_args[1] = { startup_cmd };
   std::vector<std::string> startup_arguments;
   startup_arguments.assign(startup_args,
                            startup_args + arraysize(startup_args));
   // TODO(gauravsh): Consider moving to using process functions from
   // src/common/chromeos/process.h instead.
   //
   // Note: This must be run as root so that it can create the necessary
   // directories with the correct permissions under /var/lib. Since it's a
   // and not a service daemon, we are OK with that.
   if (!platform.Exec(startup_cmd, startup_arguments,
                      static_cast<uid_t>(0),  // Run as root.
                      pkcs11_group_id_))
     return false;

   // Start the slot manager daemon (pkcsslotd).
   std::string slotd_cmd = kPkcsSlotdPath;
   std::string slotd_args[1] = { slotd_cmd };
   std::vector<std::string> slotd_arguments;
   slotd_arguments.assign(slotd_args, slotd_args + arraysize(slotd_args));
   // TODO(gauravsh): Figure out if pkcsslotd can be run as a different primary
   // uid.
   if (!platform.Exec(slotd_cmd, slotd_arguments, chronos_user_id_,
                      pkcs11_group_id_))
     return false;
   return true;
 }

 bool Pkcs11Init::SetUpTPMToken() {
   Platform platform;

   // Setup the TPM as a token.
   std::vector<std::string> arguments;
   arguments.assign(kPkcsSlotCmd, kPkcsSlotCmd + arraysize(kPkcsSlotCmd));
   if (!platform.Exec(kPkcsSlotPath, arguments, chronos_user_id_,
                      pkcs11_group_id_)) {
     LOG(ERROR) << "Couldn't configure the tpm as a token. "
                << kPkcsSlotPath << " " << kPkcsSlotCmd[1] << " "
                << kPkcsSlotCmd[2] << "failed.";
     return false;
   }

   CK_RV rv = C_Initialize(NULL);
   if (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED && rv != CKR_OK) {
     LOG(ERROR) << "C_Initialize returned error code 0x" << std::hex << rv;
     return false;
   }

   CK_SLOT_ID slot_id = kDefaultTpmSlotId;

   // Initialize the token by login using the default openCryptoki SO PIN.
   CK_CHAR old_pin[kMaxPinLen];
   CK_CHAR ck_label[kMaxLabelLen];
   CKCharcpy(old_pin, kDefaultOpencryptokiSoPin, sizeof(old_pin));
   CKCharcpy(ck_label, kDefaultLabel, sizeof(ck_label));

   LOG(INFO) << "Initializing token by using default openCryptoki SO PIN.";
   rv = C_InitToken(slot_id,
                    old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
                    ck_label);
   if (rv != CKR_OK) {
     LOG(ERROR) << "C_InitToken returned error code 0x" << std::hex << rv;
     return false;
   }

   // Reset the SO PIN to our default value.
   CK_CHAR new_pin[kMaxPinLen];
   CKCharcpy(new_pin, kDefaultSoPin, sizeof(new_pin));
   LOG(INFO) << "Resetting the SO PIN on the token to our default value.";
   if (!SetPin(slot_id, CKU_SO,
               old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
               new_pin, strlen(reinterpret_cast<const char*>(new_pin)))) {
     LOG(ERROR) << "Couldn't reset the SO PIN on the token.";
     return false;
   }

   // Reset the User PIN to our default value.
   CKCharcpy(old_pin, kDefaultOpencryptokiUserPin, sizeof(old_pin));
   CKCharcpy(new_pin, kDefaultUserPin, sizeof(new_pin));
   LOG(INFO) << "Resetting the User PIN on the token to our default value.";
   if (!SetPin(slot_id, CKU_USER,
               old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
               new_pin, strlen(reinterpret_cast<const char*>(new_pin)))) {
     LOG(ERROR) << "Couldn't reset the User PIN on the token.";
     return false;
   }

   LOG(INFO) << "Token initialization complete.";
   return SetInitialized(true);
 }

 bool Pkcs11Init::SetUpLinksAndPermissions() {
   Platform platform;
   std::string opencryptoki_tpm = StringPrintf("%s/tpm", kOpencryptokiDir);
   if (!platform.CreateDirectory(opencryptoki_tpm)) {
     LOG(ERROR) << "Couldn't create openCryptoki token directory "
                << opencryptoki_tpm;
     return false;
   }

   // Ensure symbolic links for the token directories are correctly setup.
   // TODO(gauravsh): (crosbug.com/7284) Patch openCryptoki so that this is no
   // longer necessary.
   if (!platform.Symlink(std::string(kUserTokenDir),
                         std::string(kUserTokenLink)))
     return false;

   if (!platform.Symlink(std::string(kRootTokenDir),
                         std::string(kRootTokenLink)))
     return false;

   // Remove old token directory.
   if (platform.DirectoryExists(kOldTokenEntry) &&
       !platform.DeleteFile(kOldTokenEntry, true))
     return false;

   // Create token directory, since initialization neither creates or populates
   // it.
   std::string token_obj_dir = StringPrintf("%s/TOK_OBJ", kUserTokenDir);
   if (!platform.DirectoryExists(token_obj_dir) &&
       !platform.CreateDirectory(token_obj_dir))
     return false;

   // Set correct permissions on opencryptoki directory (root:$PKCS11_GROUP_ID).
   if (!platform.SetOwnershipRecursive(std::string(kOpencryptokiDir),
                                       static_cast<uid_t>(0),  // Root uid is 0.
                                       pkcs11_group_id_)) {
     LOG(ERROR) << "Couldn't set file ownership for " << kOpencryptokiDir;
     return false;
   }

   // Setup permissions on the user token directory to ensure that users can
   // access their own data.
   if (!platform.SetOwnershipRecursive(std::string(kUserTokenDir),
                                       chronos_user_id_,
                                       pkcs11_group_id_)) {
     LOG(ERROR) << "Couldn't set file ownership for " << kOpencryptokiDir;
     return false;
   }

   return true;
 }

 bool Pkcs11Init::IsTokenBroken() {
   Platform platform;
   // A non-existent token is also broken.
   if (!platform.FileExists(StringPrintf("%s/NVTOK.DAT", kUserTokenDir)))
     return true;

   if (!platform.FileExists(kTpmOwnedFile)) {
     LOG(WARNING) << "TPM is not owned, token can't valid.";
     return true;
   }

   if (!platform.FileExists(StringPrintf("%s/PRIVATE_ROOT_KEY.pem",
                                         kUserTokenDir)) ||
       !platform.FileExists(StringPrintf("%s/TOK_OBJ/70000000",
                                         kUserTokenDir))) {
     LOG(WARNING) << "PKCS#11 token is missing some files. Possibly not yet "
                  << "initialized? TOK_OBJ contents were: ";
     // Log the contents of what was observed in exists in the TOK_OBJ directory.
     std::vector<std::string> tok_file_list;
     platform.EnumerateFiles(StringPrintf("%s/TOK_OBJ/",  kUserTokenDir), true,
                             &tok_file_list);
     for (std::vector<std::string>::iterator it = tok_file_list.begin();
          it != tok_file_list.end(); ++it)
       LOG(WARNING) << *it;
     return true;
   }

   // At this point, we are done with basic sanity checking.
   // Now check if our "it is initialized" special file is still there.
   if (!platform.FileExists(kPkcs11InitializedFile))
     return true;

   LOG(INFO) << "PKCS#11 token looks ok.";
   return false;
 }

 bool Pkcs11Init::RemoveUserTokenDir() {
   Platform platform;
   if (platform.DirectoryExists(kUserTokenDir)) {
     return platform.DeleteFile(kUserTokenDir, true);
   }
   return true;
 }

 bool Pkcs11Init::SetInitialized(bool status) {
   Platform platform;
   if (!status) {
     // Remove initialization state.
     platform.DeleteFile(kPkcs11InitializedFile, false);
     is_initialized_ = false;
     return true;
   }

   chromeos::Blob empty_blob;
   if (!platform.WriteFile(kPkcs11InitializedFile, empty_blob))
     return false;
   is_initialized_ = true;
   return true;
 }

 bool Pkcs11Init::SetPin(CK_SLOT_ID slot_id, CK_USER_TYPE user,
                         CK_CHAR_PTR old_pin, CK_ULONG old_pin_len,
                         CK_CHAR_PTR new_pin, CK_ULONG new_pin_len) {
   CK_RV rv;
   CK_SESSION_HANDLE session_handle = 0;
   rv = C_OpenSession(slot_id, CKF_RW_SESSION | CKF_SERIAL_SESSION,
                      NULL, NULL,
                      &session_handle);
   if (rv != CKR_OK) {
     LOG(ERROR) << "C_OpenSession returned error code 0x" << std::hex << rv;
     return false;
   }

   rv = C_Login(session_handle, user, old_pin, old_pin_len);
   if (rv != CKR_OK) {
     LOG(ERROR) << "Couldn't login using the old pin.";
     LOG(ERROR) << "C_Login returned error code 0x" << std::hex << rv;
     return false;
   }

   rv = C_SetPIN(session_handle, old_pin, old_pin_len, new_pin, new_pin_len);
   if (rv != CKR_OK) {
     C_CloseAllSessions(slot_id);
     LOG(ERROR) << "C_SetPIN returned error code 0x" << std::hex << rv;
     return false;
   }

   rv = C_CloseAllSessions(slot_id);
   if (rv != CKR_OK) {
     LOG(ERROR) << "C_CloseAllSessions returned error code 0x" << std::hex << rv;
     return false;
   }

   return true;
 }


 }  // namespace cryptohome
	// Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	// Contains the implementation of class Pkcs11Init.

	#include "pkcs11_init.h"

	#include <iostream>

	#include <base/logging.h>
	#include <base/string_util.h>
	#include <glib.h>
	#include <opencryptoki/pkcs11.h>

	#include "platform.h"


	namespace cryptohome {

	// static
	const CK_SLOT_ID Pkcs11Init::kDefaultTpmSlotId = 0;
	const CK_ULONG Pkcs11Init::kMaxPinLen = 9;
	const CK_ULONG Pkcs11Init::kMaxLabelLen = 32;
	// openCryptoki 2.2.4 PIN defaults as per the README at:
	// http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki
	// /opencryptoki;a=summary
	const CK_CHAR Pkcs11Init::kDefaultOpencryptokiSoPin[] = "87654321";
	const CK_CHAR Pkcs11Init::kDefaultOpencryptokiUserPin[] = "12345678";
	const CK_CHAR Pkcs11Init::kDefaultSoPin[] = "000000";
	const CK_CHAR Pkcs11Init::kDefaultUserPin[] = "111111";
	const CK_CHAR Pkcs11Init::kDefaultLabel[] = "User-Specific TPM Token";
	const char Pkcs11Init::kOpencryptokiDir[] = "/var/lib/opencryptoki";
	const char Pkcs11Init::kUserTokenLink[] = "/var/lib/opencryptoki/tpm/chronos";
	const char Pkcs11Init::kRootTokenLink[] = "/var/lib/opencryptoki/tpm/root";
	const char Pkcs11Init::kUserTokenDir[] = "/home/chronos/user/.tpm";
	const char Pkcs11Init::kRootTokenDir[] = "./chronos";
	const char Pkcs11Init::kPkcs11Group[] = "pkcs11";
	const char Pkcs11Init::kOldTokenEntry[] =
	"/var/lib/opencryptoki/pk_config_data";
	const std::string Pkcs11Init::kPkcs11StartupPath = "/usr/sbin/pkcs11_startup";
	const std::string Pkcs11Init::kPkcsSlotdPath = "/usr/sbin/pkcsslotd";
	const std::string Pkcs11Init::kPkcsSlotPath = "/usr/sbin/pkcs_slot";
	const std::string Pkcs11Init::kPkcsSlotCmd[] = { Pkcs11Init::kPkcsSlotPath,
	"0", "tpm" };
	// This file in the user's cryptohome signifies that Pkcs11 initialization
	// was completed for the user.
	const std::string Pkcs11Init::kPkcs11InitializedFile =
	"/home/chronos/user/.tpm/.isinitialized";

	extern const char* kTpmOwnedFile;
	extern const std::string kDefaultSharedUser;

	// Helper function to copy a CK_CHAR string \|src\| to another CK_CHAR string
	// \|dest\| with at most most \|len-1\| characters. \|dest\| is then null-terminated.
	void CKCharcpy(CK_CHAR* dest, const CK_CHAR* src, CK_ULONG len) {
	strncpy(reinterpret_cast<char*>(dest),
	reinterpret_cast<const char*>(src),
	len - 1);
	dest[len - 1] = '\0';
	}


	void Pkcs11Init::GetTpmTokenInfo(gchar **OUT_label,
	gchar **OUT_user_pin) {
	OUT_label = g_strdup(reinterpret_cast<const gchar >(kDefaultLabel));
	OUT_user_pin = g_strdup(reinterpret_cast<const gchar >(kDefaultUserPin));
	}

	bool Pkcs11Init::Initialize() {
	Platform platform;
	// Determine required uid and gids.
	if (!platform.GetGroupId(kPkcs11Group, &pkcs11_group_id_)) {
	LOG(ERROR) << "Couldn't get the group ID for group " << kPkcs11Group;
	return false;
	}
	if (!platform.GetUserId(kDefaultSharedUser, &chronos_user_id_,
	&chronos_group_id_)) {
	LOG(ERROR) << "Couldn't get the user/group ID for user "
	<< kDefaultSharedUser;
	return false;
	}

	if (!SetUpPkcs11System())
	return false;

	if (IsTokenBroken()) {
	LOG(INFO) << "Broken or uninitialized token. Removing user token dir "
	<< kUserTokenDir << " just to be safe.";
	RemoveUserTokenDir();
	if (!SetUpLinksAndPermissions())
	return false;
	return SetUpTPMToken();
	}
	LOG(INFO) << "PKCS#11 is already initialized.";
	return true;
	}

	bool Pkcs11Init::SetUpPkcs11System() {
	Platform platform;
	// Run the pkcs11_startup script that will detect available tokens and update
	// pk_config_data appropriately. This is used later by pkcsslotd.
	std::string startup_cmd = kPkcs11StartupPath;
	std::string startup_args[1] = { startup_cmd };
	std::vector<std::string> startup_arguments;
	startup_arguments.assign(startup_args,
	startup_args + arraysize(startup_args));
	// TODO(gauravsh): Consider moving to using process functions from
	// src/common/chromeos/process.h instead.
	//
	// Note: This must be run as root so that it can create the necessary
	// directories with the correct permissions under /var/lib. Since it's a
	// and not a service daemon, we are OK with that.
	if (!platform.Exec(startup_cmd, startup_arguments,
	static_cast<uid_t>(0), // Run as root.
	pkcs11_group_id_))
	return false;

	// Start the slot manager daemon (pkcsslotd).
	std::string slotd_cmd = kPkcsSlotdPath;
	std::string slotd_args[1] = { slotd_cmd };
	std::vector<std::string> slotd_arguments;
	slotd_arguments.assign(slotd_args, slotd_args + arraysize(slotd_args));
	// TODO(gauravsh): Figure out if pkcsslotd can be run as a different primary
	// uid.
	if (!platform.Exec(slotd_cmd, slotd_arguments, chronos_user_id_,
	pkcs11_group_id_))
	return false;
	return true;
	}

	bool Pkcs11Init::SetUpTPMToken() {
	Platform platform;

	// Setup the TPM as a token.
	std::vector<std::string> arguments;
	arguments.assign(kPkcsSlotCmd, kPkcsSlotCmd + arraysize(kPkcsSlotCmd));
	if (!platform.Exec(kPkcsSlotPath, arguments, chronos_user_id_,
	pkcs11_group_id_)) {
	LOG(ERROR) << "Couldn't configure the tpm as a token. "
	<< kPkcsSlotPath << " " << kPkcsSlotCmd[1] << " "
	<< kPkcsSlotCmd[2] << "failed.";
	return false;
	}

	CK_RV rv = C_Initialize(NULL);
	if (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED && rv != CKR_OK) {
	LOG(ERROR) << "C_Initialize returned error code 0x" << std::hex << rv;
	return false;
	}

	CK_SLOT_ID slot_id = kDefaultTpmSlotId;

	// Initialize the token by login using the default openCryptoki SO PIN.
	CK_CHAR old_pin[kMaxPinLen];
	CK_CHAR ck_label[kMaxLabelLen];
	CKCharcpy(old_pin, kDefaultOpencryptokiSoPin, sizeof(old_pin));
	CKCharcpy(ck_label, kDefaultLabel, sizeof(ck_label));

	LOG(INFO) << "Initializing token by using default openCryptoki SO PIN.";
	rv = C_InitToken(slot_id,
	old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
	ck_label);
	if (rv != CKR_OK) {
	LOG(ERROR) << "C_InitToken returned error code 0x" << std::hex << rv;
	return false;
	}

	// Reset the SO PIN to our default value.
	CK_CHAR new_pin[kMaxPinLen];
	CKCharcpy(new_pin, kDefaultSoPin, sizeof(new_pin));
	LOG(INFO) << "Resetting the SO PIN on the token to our default value.";
	if (!SetPin(slot_id, CKU_SO,
	old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
	new_pin, strlen(reinterpret_cast<const char*>(new_pin)))) {
	LOG(ERROR) << "Couldn't reset the SO PIN on the token.";
	return false;
	}

	// Reset the User PIN to our default value.
	CKCharcpy(old_pin, kDefaultOpencryptokiUserPin, sizeof(old_pin));
	CKCharcpy(new_pin, kDefaultUserPin, sizeof(new_pin));
	LOG(INFO) << "Resetting the User PIN on the token to our default value.";
	if (!SetPin(slot_id, CKU_USER,
	old_pin, strlen(reinterpret_cast<const char*>(old_pin)),
	new_pin, strlen(reinterpret_cast<const char*>(new_pin)))) {
	LOG(ERROR) << "Couldn't reset the User PIN on the token.";
	return false;
	}

	LOG(INFO) << "Token initialization complete.";
	return SetInitialized(true);
	}

	bool Pkcs11Init::SetUpLinksAndPermissions() {
	Platform platform;
	std::string opencryptoki_tpm = StringPrintf("%s/tpm", kOpencryptokiDir);
	if (!platform.CreateDirectory(opencryptoki_tpm)) {
	LOG(ERROR) << "Couldn't create openCryptoki token directory "
	<< opencryptoki_tpm;
	return false;
	}

	// Ensure symbolic links for the token directories are correctly setup.
	// TODO(gauravsh): (crosbug.com/7284) Patch openCryptoki so that this is no
	// longer necessary.
	if (!platform.Symlink(std::string(kUserTokenDir),
	std::string(kUserTokenLink)))
	return false;

	if (!platform.Symlink(std::string(kRootTokenDir),
	std::string(kRootTokenLink)))
	return false;

	// Remove old token directory.
	if (platform.DirectoryExists(kOldTokenEntry) &&
	!platform.DeleteFile(kOldTokenEntry, true))
	return false;

	// Create token directory, since initialization neither creates or populates
	// it.
	std::string token_obj_dir = StringPrintf("%s/TOK_OBJ", kUserTokenDir);
	if (!platform.DirectoryExists(token_obj_dir) &&
	!platform.CreateDirectory(token_obj_dir))
	return false;

	// Set correct permissions on opencryptoki directory (root:$PKCS11_GROUP_ID).
	if (!platform.SetOwnershipRecursive(std::string(kOpencryptokiDir),
	static_cast<uid_t>(0), // Root uid is 0.
	pkcs11_group_id_)) {
	LOG(ERROR) << "Couldn't set file ownership for " << kOpencryptokiDir;
	return false;
	}

	// Setup permissions on the user token directory to ensure that users can
	// access their own data.
	if (!platform.SetOwnershipRecursive(std::string(kUserTokenDir),
	chronos_user_id_,
	pkcs11_group_id_)) {
	LOG(ERROR) << "Couldn't set file ownership for " << kOpencryptokiDir;
	return false;
	}

	return true;
	}

	bool Pkcs11Init::IsTokenBroken() {
	Platform platform;
	// A non-existent token is also broken.
	if (!platform.FileExists(StringPrintf("%s/NVTOK.DAT", kUserTokenDir)))
	return true;

	if (!platform.FileExists(kTpmOwnedFile)) {
	LOG(WARNING) << "TPM is not owned, token can't valid.";
	return true;
	}

	if (!platform.FileExists(StringPrintf("%s/PRIVATE_ROOT_KEY.pem",
	kUserTokenDir)) \|\|
	!platform.FileExists(StringPrintf("%s/TOK_OBJ/70000000",
	kUserTokenDir))) {
	LOG(WARNING) << "PKCS#11 token is missing some files. Possibly not yet "
	<< "initialized? TOK_OBJ contents were: ";
	// Log the contents of what was observed in exists in the TOK_OBJ directory.
	std::vector<std::string> tok_file_list;
	platform.EnumerateFiles(StringPrintf("%s/TOK_OBJ/", kUserTokenDir), true,
	&tok_file_list);
	for (std::vector<std::string>::iterator it = tok_file_list.begin();
	it != tok_file_list.end(); ++it)
	LOG(WARNING) << *it;
	return true;
	}

	// At this point, we are done with basic sanity checking.
	// Now check if our "it is initialized" special file is still there.
	if (!platform.FileExists(kPkcs11InitializedFile))
	return true;

	LOG(INFO) << "PKCS#11 token looks ok.";
	return false;
	}

	bool Pkcs11Init::RemoveUserTokenDir() {
	Platform platform;
	if (platform.DirectoryExists(kUserTokenDir)) {
	return platform.DeleteFile(kUserTokenDir, true);
	}
	return true;
	}

	bool Pkcs11Init::SetInitialized(bool status) {
	Platform platform;
	if (!status) {
	// Remove initialization state.
	platform.DeleteFile(kPkcs11InitializedFile, false);
	is_initialized_ = false;
	return true;
	}

	chromeos::Blob empty_blob;
	if (!platform.WriteFile(kPkcs11InitializedFile, empty_blob))
	return false;
	is_initialized_ = true;
	return true;
	}

	bool Pkcs11Init::SetPin(CK_SLOT_ID slot_id, CK_USER_TYPE user,
	CK_CHAR_PTR old_pin, CK_ULONG old_pin_len,
	CK_CHAR_PTR new_pin, CK_ULONG new_pin_len) {
	CK_RV rv;
	CK_SESSION_HANDLE session_handle = 0;
	rv = C_OpenSession(slot_id, CKF_RW_SESSION \| CKF_SERIAL_SESSION,
	NULL, NULL,
	&session_handle);
	if (rv != CKR_OK) {
	LOG(ERROR) << "C_OpenSession returned error code 0x" << std::hex << rv;
	return false;
	}

	rv = C_Login(session_handle, user, old_pin, old_pin_len);
	if (rv != CKR_OK) {
	LOG(ERROR) << "Couldn't login using the old pin.";
	LOG(ERROR) << "C_Login returned error code 0x" << std::hex << rv;
	return false;
	}

	rv = C_SetPIN(session_handle, old_pin, old_pin_len, new_pin, new_pin_len);
	if (rv != CKR_OK) {
	C_CloseAllSessions(slot_id);
	LOG(ERROR) << "C_SetPIN returned error code 0x" << std::hex << rv;
	return false;
	}

	rv = C_CloseAllSessions(slot_id);
	if (rv != CKR_OK) {
	LOG(ERROR) << "C_CloseAllSessions returned error code 0x" << std::hex << rv;
	return false;
	}

	return true;
	}


	} // namespace cryptohome