Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d8e9a38 authored by Victor Hsieh's avatar Victor Hsieh
Browse files

Enable fs-verity asynchronously on package install 

Bug: 259179666
Test: atest ChecksumsTest
Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.ApkVerityInstallTest
Change-Id: Ie87efba347bd2c9bf08928191b2c724a47abd18b
parent 4bdb6e5e

services/core/java/com/android/server/pm/InstallPackageHelper.java

+18 −3
Original line number Diff line number Diff line
@@ -1845,15 +1845,30 @@ final class InstallPackageHelper { 
                    continue;

                }



                VerityUtils.setUpFsverity(filePath, (byte[]) null);



                // Verify fs-verity signature if exists.

                final String signaturePath = entry.getValue();

                if (new File(signaturePath).exists()) {

                    // If signature is provided, enable fs-verity first so that the file can be

                    // measured for signature check below.

                    VerityUtils.setUpFsverity(filePath, (byte[]) null);



                    if (!fis.verifyPkcs7DetachedSignature(signaturePath, filePath)) {

                        throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,

                                "fs-verity signature does not verify against a known key");

                    }

                } else {

                    // Without signature, we don't need to access the digest right away and can

                    // enable fs-verity in background (since this is a blocking call).

                    new Thread("fsverity-setup") {

                        @Override public void run() {

                            try {

                                VerityUtils.setUpFsverity(filePath, (byte[]) null);

                            } catch (IOException e) {

                                // There's nothing we can do if the setup failed. Since fs-verity is

                                // optional, just ignore the error for now.

                                Slog.e(TAG, "Failed to enable fs-verity to " + filePath);

                            }

                        }

                    }.start();

                }

            } catch (IOException e) {

                throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,