2

How can I properly mount my SD card as "internal" (i.e. so that all apps are on it) using a custom filesystem (in my case Ext4, but I'd like to use full-disk encryption using a key that I can decrypt when putting the SD card in my laptop too, and eventually switch to a custom FUSE filesystem, so it's not an ext4-specific question)?

According to https://source.android.com/security/encryption/full-disk, I would need to run class_stop late_start; class_stop main to halt all applications, mount on top of /data (I guess, any other location that should be hidden?), and restart with class_start late_start; class_start main. However, these commands do not exist, and don't seem to be sub-commands of init.

How would I do this stop-all-apps, mount-on-/data/, start-all-apps dance from an adb shell?

I have root access via adb, but no root access for apps. The bootloader is locked (needs to be for my banking app it seems), so I can't edit /etc/vold.fstab or any other file in /system or /vendor. I'm using /e/ os Android 10 (a fork of LineageOS).

Suzanne Soy
  • 121
  • 2
  • 2
    You can't do that from adb shell. The init commands you mentioned aren't to be executed from commandline but need to be put in some .rc file: https://android.googlesource.com/platform/system/core/+/master/init/README.md#commands. They are already defined in .rc files by ROM developers and are executed automatically in proper sequence when you format your SD card as Adoptable (internal) Storage. – Irfan Latif Mar 10 '21 at 05:50
  • 1
    Not sure what you mean by "using a custom filesystem". I think you are looking for something like this: Decrypting microSD card on another Android device or desktop computer – Irfan Latif Mar 10 '21 at 05:53
  • 1
    even if you manage to edit something your device would brick. modifications prevented on locked bootloader. just use android native adoptable-storage and get a copy of */data/misc/vold/expand_*.key* – alecxs Mar 10 '21 at 07:13
  • @IrfanLatif "Adoptable" storage can be stopped and started while the phone is running, IIRC, so I assumed there was a way to trigger these stop / restart events. That link to your other answer is very interesting. If I understand well, you suggest to do the mounting in init.rc (dm-crypt + mount or mount + fscrypt or mount a FUSE filesystem). I can't edit this file: it's on boot.img, and something in the system refuses to lock the bootloader if it's modified (e.g. I flashing a magisk'ed boot.img and locking gives a "corrupted" message, and my bank's app won't run with unlocked boot) – Suzanne Soy Mar 10 '21 at 23:53
  • @IrfanLatif examples of using a custom filesystem: Ext4, dm-crypt + Ext4, a FUSE filesystem which I wrote myself. – Suzanne Soy Mar 10 '21 at 23:55
  • @alecxs I didn't know where the key was (saw somewhere that you had to dump it from RAM, that's much better!). This would work for Ext4 + dm-crypt, but wouldn't work if I wanted to use e.g. a FUSE filesystem which I wrote myself. – Suzanne Soy Mar 11 '21 at 00:01

0 Answers0