How to encrypt a "portable" sd card in Marshmallow? - Android Q&A, Help & Troubleshooting

Hi,
I run CM 13 and want to encrypt my sd card. The internal storage is already encrypted. I do NOT want to use the sd card as "internal" or "adopted" because the sd is for data only and I want all the apps in the faster internal storage. I do not care if the sd is usable on other phones or not, I just want to completely encrypt it.
The security menu doesn't show a "encrypt sd card" option anymore as in previous versions.
So what is the best way to encrypt the sd card?
Is there some command like "vdc cryptfs" which handles sd cards?
Thanks.

---

Nobody got a solution for this?
I've been reading various Android crypto documentations, the vold source code etc. and haven't found a solution yet. Seems like this is not a feature readily available...

---

Ok, after some work I figured out a way to do it.
You need a rooted phone and an adb connection to it. I tried this with CM13, other versions or roms will probably differ slightly in the parameters, so you should have basic linux shell skills.
The first step is to get a cryptsetup binary compiled for the architecture of your phone. You can compile it yourself from sources like https://android.googlesource.com/platform/external/cryptsetup/+/master or https://github.com/nelenkov/cryptsetup.
But I was lazy and installed LUKS Manager from the Play store. It contains a version of cryptsetup compiled for ARM. Extract it like this:
Code:
adb root
adb shell
setenforce 0
cd /data/app/com.nemesis2.luksmanager-1
unzip base.apk
cp assets/lm.cryptsetup /data
chmod 755 /data/lm.cryptsetup
Now we have the cryptsetup binary lying in /data/lm.cryptsetup. You can now uninstall LUKS Manager again as we don't need it anymore.
Now is a good time to back up the contents of your sd card. Then insert it into the phone and format it as portable if you don't have done that yet.
The next step is to figure out the device node of your sd card. You don't easily see this when looking at the mounts as vold hides it from us. So go to /dev/block and look at the device nodes. You are looking for a mmc device that has just one partition (just one extra node with ...p1). Then open it with fdisk and look if the size matches your sd card. On my phone it was mmcblk1.
Now we split the sd into two partitions: one very small (like 10MB) fat32 partition and the rest as an encrypted partition with LUKS header. This is to trick vold into helping us making the encrypted partition visible to regular Android apps.
Run fdisk for the mmc device (not the one with ...p1, the one without) and delete the existing partition. Create two partitions as outlined above. Set the type of the small partition to "c" (fat32) and the type for the large one to "8e".
It should look like this:
Code:
# fdisk /dev/block/mmcblk1
The number of cylinders for this disk is set to 3902128.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems.
Command ('m' for help): p
Disk mmcblk1: 127.8 GB, 127864930304 bytes
4 heads, 16 sectors/track, 3902128 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Device Boot Start End Blocks Id System
mmcblk1p1 33 352 10240 c Win95 FAT32 (LBA)
mmcblk1p2 353 3902128 124856832 8e Linux LVM
Now we format and set up the partitions. Replace "mmcblk1" with the device node on your device.
Code:
mkfs.vfat /dev/block/mmcblk1p1
/data/lm.cryptsetup -i 5000 -h sha256 luksFormat /dev/block/mmcblk1p2
/data/lm.cryptsetup luksOpen /dev/block/mmcblk1p2 sdcrypt
mkfs.ext2 /dev/mapper/sdcrypt
The mkfs.ext2 may take a while. I'm using ext4 here as it's usually faster for reads than f2fs. I use the sd mostly for long-term media storage, so reads are more important than writes.
When you are done reboot your phone.
When it is up again check your sd card storage. It should be a bit below the size you chose for the small fat32 partition, e.g. around 9 MB. If that worked, then vold has mounted the small partition and made it available to regular Android apps.
Connect with adb and check the volume id of the fat32 partition like this:
Code:
blkid /dev/block/mmcblk1p1
Mine is "5824-FB9F". You need to adapt the following commands and insert your volume id.
Now we open the crypto container and mount the partition over the mountpoint of the small fat32 partition. This way we reuse the work that vold has just done and switch out the partitions without it noticing.
These are the commands you need to issue on a root shell to do the mount:
Code:
echo "your_secret_password" | /data/lm.cryptsetup luksOpen /dev/block/mmcblk1p2 sdcrypt
mount /dev/mapper/sdcrypt /mnt/media_rw/5824-FB9F -t ext4 -o nosuid,nodev,noexec,noatime,nodiratime,context=u:object_r:vfat:s0
am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///storage/5824-FB9F
This needs to be done on after each reboot. I use tasker for this, but there are plenty of other methods. The script contains your password. So make sure that it is stored on the encrypted /data partition and not somewhere insecure.
On the first mount I had to fix the permissions like this:
Code:
chown -r media_rw:media_rw /mnt/media_rw/5824-FB9F
chmod 770 /mnt/media_rw/5824-FB9F
Have phun!

---

Just for your convenience, here is the tasker profile I use to automatically mount it on startup:
Code:
<TaskerData sr="" dvi="1" tv="4.8u5">
<Profile sr="prof6" ve="2">
<cdate>1478460038918</cdate>
<edate>1478460038919</edate>
<id>6</id>
<mid0>5</mid0>
<nme>Booted</nme>
<Event sr="con0" ve="2">
<code>411</code>
<pri>0</pri>
</Event>
</Profile>
<Task sr="task5">
<cdate>1478457711553</cdate>
<edate>1478460213089</edate>
<id>5</id>
<nme>Mount Sdcrypt</nme>
<Action sr="act0" ve="7">
<code>123</code>
<Str sr="arg0" ve="3">echo "your_secret_password" | /data/lm.cryptsetup luksOpen /dev/block/mmcblk1p2 sdcrypt</Str>
<Int sr="arg1" val="20"/>
<Int sr="arg2" val="1"/>
<Str sr="arg3" ve="3"/>
<Str sr="arg4" ve="3"/>
<Str sr="arg5" ve="3"/>
</Action>
<Action sr="act1" ve="7">
<code>123</code>
<Str sr="arg0" ve="3">mount /dev/mapper/sdcrypt /mnt/media_rw/5824-FB9F -t ext4 -o nosuid,nodev,noexec,noatime,nodiratime,context=u:object_r:vfat:s0</Str>
<Int sr="arg1" val="20"/>
<Int sr="arg2" val="1"/>
<Str sr="arg3" ve="3"/>
<Str sr="arg4" ve="3"/>
<Str sr="arg5" ve="3"/>
</Action>
<Action sr="act2" ve="7">
<code>123</code>
<Str sr="arg0" ve="3">am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///storage/5824-FB9F</Str>
<Int sr="arg1" val="0"/>
<Int sr="arg2" val="1"/>
<Str sr="arg3" ve="3"/>
<Str sr="arg4" ve="3"/>
<Str sr="arg5" ve="3"/>
</Action>
</Task>
</TaskerData>
You just need to replace the password, the block device node name and the volume id of the fat32 filesystem.

---

After having used it for a few days, I encountered a few problems regarding the access rights to the sd card: new folders are created with the unix-ownership of the app doing the create. All other apps don't have access and I couldn't find anything like a global umask for all Android apps. Usually portable sd cards are formatted vfat, so there are no unix permissions at all.
I first thought about solutions like bindfs, which is an extra FUSE layer which can replace the permissions on access. But I was to lazy to set up a build environment. So I replaced the ext4 on the encrypted drive with exfat, which also does not have permissions.
Why exfat and not fat? Because I don't want the limit of 4GB per file.
To switch to exfat, format the encrypted drive like this:
Code:
mkfs.exfat /dev/mapper/sdcrypt
Mounting is done like this:
Code:
mount /dev/mapper/sdcrypt /mnt/media_rw/5824-FB9F -t exfat -o nosuid,nodev,noexec,noatime,uid=1023,gid=1023,fmask=0007,dmask=0007
Just replace the commands in the steps above with these.

---

Kudos to robberknight for finding out how this works on Marshmellow!
After upgrading to lineage 14.1 (Android 7.1.2), the given approach did no longer work.
The sd card storage is now divided into multiple "views" by making use of mount namespaces.
This allows an user to grant or deny sd card permission at app runtime.
The corresponding git commit in "vold" is:
Code:
commit 66270a21df1058434e4d63691221f11ff5387a0f
Commit: Jeff Sharkey <[email protected]>
CommitDate: Thu Jun 25 22:40:08 2015 -0700
Let's reinvent storage, yet again!
..
After countless hours of tracing through vold, I developed a solution for lineage 14.1.
Main changes:
mount source exfat filesystem with correct selinux context
automatically unmount all user views and then call the "sdcard" binary to set up the user views again. "sdcard" is normally called by vold internally.
The updated mount script can either store the password or ask for the password upon mount.
Not storing the password might come in handy if you are forced to reveal any unlock codes:
If the encrypted volume is not mounted, the "original" SD card content from the first partition is mounted by Android.
Here's the updated script, please adjust path to cryptsetup binary / uuid of the sd card:
Code:
password=""
cardid="780AD-7FC9"
cardmnt="/mnt/media_rw/$cardid"
cryptsetup_bin="/data/cryptsetup.arm"
function die()
{
echo "$*"
exit 1
}
# ask user for password if not given
if [ "$password" = "" ]; then
echo -n "Enter password: "
read password
fi
echo "$password" | $cryptsetup_bin luksOpen /dev/block/mmcblk1p2 sdcrypt
password=""
test -b /dev/mapper/sdcrypt || die "luksOpen failed"
# unmount old sdcard (up to four mount points on lineage 14.1)
count=0
while grep -q -F "$cardid" /proc/mounts; do
# force unmount like the UI would
umount -f "/mnt/media_rw/$cardid"
count=$((count+1))
[ $count -eq 10 ] && die "sdcard $cardid still mounted? Please check."
done
echo "Unmounted $count old mount points"
# Mount base filesystem with correct selinux context
mount /dev/mapper/sdcrypt "$cardmnt" -t exfat -o context=u:object_r:fuseblk:s0,nosuid,nodev,noexec,noatime,uid=1023,gid=1023,fmask=0007,dmask=0007
# set up read/write views using "sdcard"
sdcard -u 1023 -g 1023 -U 0 "/mnt/media_rw/$cardid" "$cardid"
# tell MediaServer to search for new content
am broadcast -a android.intent.action.MEDIA_MOUNTED -d "file:///storage/$cardid"
Hopefully this is useful for someone else.
Big thanks to haggertk for bringing lineage 14.x to the Samsung Galaxy S5 (klte).

---

I tried the solution by robberknight and thomasjfox on a Motorola G (2015) "osprey" running the latest nightly LineageOs 14, but when I want to mount the exfat, I get an error:
mount: '/storage/emulated/0/'->'/dev/storage/xxxx-xxxx': No such file or directory
Is the exfat-support missing on my device?
Edit: I formated the LUKS partition with my ubuntu machine to fat32 (vfat). Then I was able to mount it with the solution by thomasjfox. Just changed -t exfat to -t vfat

---

Glad it's working for you. As the linux kernel is different for each LineageOS phone, it could be that the Motorola G (2015) does not have exfat support. Though I always thought that exfat support is provided by userspace (FUSE), so it should work IMHO.

---

does this still work with current Android 10?
I'm considering trying this on my Xiaomi Note 9S (curtana).
But before I start I'd love it if somebody could tell me if they have tried it on an Android 10 device and if it worked.
I'd feel more confident that I don't do the work of backing up and restoring my sdcard in vain (since this post is from 2016/17 and about Android 6..)

---

hagekic548 said:
does this still work with current Android 10?
Click to expand...
Click to collapse
Works for me except last part (about mounting and setting permissions). I prefer use fbind magisk module to handle encrypted partitions on my SD card, slightly modded it to meet Android 10, works fine so far.