Encrypted overlay filesystems implementation for Android.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

122 lines
6.1 KiB

10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
10 months ago
  1. # DroidFS
  2. DroidFS is an alternative way to use encrypted overlay filesystems on Android that uses its own internal file explorer instead of mounting virtual volumes.
  3. It currently only works with [gocryptfs](https://github.com/rfjakob/gocryptfs) but support for [CryFS](https://github.com/cryfs/cryfs) could be added in the future.
  4. <p align="center">
  5. <img src="https://forge.chapril.org/hardcoresushi/DroidFS/raw/branch/master/fastlane/metadata/android/en-US/images/phoneScreenshots/1.png" height="500">
  6. <img src="https://forge.chapril.org/hardcoresushi/DroidFS/raw/branch/master/fastlane/metadata/android/en-US/images/phoneScreenshots/2.png" height="500">
  7. <img src="https://forge.chapril.org/hardcoresushi/DroidFS/raw/branch/master/fastlane/metadata/android/en-US/images/phoneScreenshots/3.png" height="500">
  8. </p>
  9. # Disclamer
  10. DroidFS is provided "as is", without any warranty of any kind.
  11. It shouldn't be considered as an absolute safe way to store files.
  12. DroidFS cannot protect you from screen recording apps, keyloggers, apk backdooring, compromised root accesses, memory dumps etc.
  13. Do not use this app with volumes containing sensitive data unless you know exactly what you are doing.
  14. # Unsafe features
  15. DroidFS allows you to enable/disable unsafe features to fit your needs between security and comfort.
  16. It is strongly recommended to read the documentation of a feature before enabling it.
  17. <ul>
  18. <li><h4>Allow screenshots:</h4>
  19. Disable the secure flag of DroidFS activities. This will allow you to take screenshots from the app, but will also allow other apps to record the screen while using DroidFS.
  20. Note: apps with root access don't care about this flag: they can take screenshots or record the screen of any app without any permissions.
  21. </li>
  22. <li><h4>Allow opening files with other applications *:</h4>
  23. Decrypt and open file using external apps. These apps could save and send the files thus opened.
  24. </li>
  25. <li><h4>Allow exporting files:</h4>
  26. Decrypt and write file to disk (external storage). Any app with storage permissions could access exported files.
  27. </li>
  28. <li><h4>Allow sharing files via the android share menu *:</h4>
  29. Decrypt and share file with other apps. These apps could save and send the files thus shared.
  30. </li>
  31. <li><h4>Keep volume open when the app goes in background:</h4>
  32. Don't close the volume when you leave the app but keep running it in the background. Anyone going back to the activity could have access to the volume.
  33. </li>
  34. <li><h4>Allow saving password hash using fingerprint:</h4>
  35. Generate an AES-256 GCM key in the Android Keystore (protected by fingerprint authentication), then use it to encrypt the volume password hash and store it to the DroidFS internal storage. This require Android v6.0+. If your device is not encrypted, extracting the encryption key with physical access may be possible.
  36. </li>
  37. </ul>
  38. * Features requiring temporary writing of the plain file to disk (DroidFS internal storage). This file could be read by apps with root access or by physical access if your device is not encrypted.
  39. # Download
  40. You can download the latest version in the Releases section. All APKs from v1.3.0 are signed with my PGP key available on keyservers:
  41. `gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 007F84120107191E` \
  42. Fingerprint: `BD5621479E7B74D36A405BE8007F84120107191E` \
  43. Email: `Hardcore Sushi <hardcore.sushi@disroot.org>`
  44. To verify APKs: `gpg --verify <ASC file> <APK file>`
  45. # Permissions
  46. DroidFS need some permissions to work properly. Here is why:
  47. <ul>
  48. <li><h4>Read & write access to shared storage:</h4>
  49. Required for creating, opening and modifying volumes and for importing/exporting files to/from volumes.
  50. </li>
  51. <li><h4>Biometric/Fingerprint hardware:</h4>
  52. Required to encrypt/decrypt password hashes using a fingerprint protected key.
  53. </li>
  54. <li><h4>Camera:</h4>
  55. Needed to take photos directly from DroidFS to import them securely. You can deny this permission if you don't want to use it.
  56. </li>
  57. </ul>
  58. # Build
  59. Most of the original gocryptfs code was used as is (written in Go) and compiled to native code. That's why you need [Go](https://golang.org) and the [Android Native Development Kit (NDK)](https://developer.android.com/ndk/) to build DroidFS from source.
  60. #### Install Requirements
  61. - [Android Studio](https://developer.android.com/studio/)
  62. - [Android NDK and CMake](https://developer.android.com/studio/projects/install-ndk)
  63. - [Go](https://golang.org/doc/install) (on debian: `$ sudo apt-get install golang-go`)
  64. #### Download Sources
  65. ```
  66. $ git clone https://github.com/hardcore-sushi/DroidFS.git
  67. ```
  68. Gocryptfs need OpenSSL to work:
  69. ```
  70. $ cd DroidFS/app/libgocryptfs
  71. $ wget https://www.openssl.org/source/openssl-1.1.1j.tar.gz
  72. ```
  73. Verify OpenSSL signature:
  74. ```
  75. $ wget https://www.openssl.org/source/openssl-1.1.1j.tar.gz.asc
  76. $ gpg --verify openssl-1.1.1j.tar.gz.asc openssl-1.1.1j.tar.gz
  77. ```
  78. Continue **ONLY** if the signature is **VALID**.
  79. ```
  80. $ tar -xvzf openssl-1.1.1j.tar.gz
  81. ```
  82. #### Build
  83. First, we need to build libgocryptfs.<br>
  84. For this, we will need to install some dependencies:
  85. ```
  86. $ sudo apt-get install libcrypto++-dev libssl-dev pkg-config
  87. ```
  88. And also Go dependencies:
  89. ```
  90. $ go get golang.org/x/sys/unix golang.org/x/sys/cpu golang.org/x/crypto/hkdf
  91. ```
  92. Then, retrieve your Android NDK installation path, usually someting like "/home/\<user\>/AndroidSDK/ndk/\<NDK version\>". We can now start the build process:
  93. ```
  94. $ cd DroidFS/app/libgocryptfs
  95. $ env ANDROID_NDK_HOME="<your ndk path>" OPENSSL_PATH="./openssl-1.1.1j" ./build.sh
  96. ```
  97. Then, open the DroidFS project with Android Studio.<br>
  98. If a device (virtual or physical) is connected, just click on "Run".<br>
  99. If you want to generate a signed APK, you can follow this [post](https://stackoverflow.com/a/28938286).
  100. # Third party code
  101. Thanks to these open source projects that DroidFS uses:
  102. ### Modified code:
  103. - [gocryptfs](https://github.com/rfjakob/gocryptfs) to encrypt your data
  104. ### Libraries:
  105. - [Cyanea](https://github.com/jaredrummler/Cyanea) to customize UI
  106. - [Glide](https://github.com/bumptech/glide/) to display pictures
  107. - [ExoPlayer](https://github.com/google/ExoPlayer) to play media files