Enable fs-verity to all APKs on install
Previously, we only enable fs-verity to an APK if it comes with a trusted signature (.fsv_sig). With this change, we'll enable fs-verity in integrity-only mode if there's no signature. The biggest benefit is O(1) measurement of the APK content, and can be useful to some use cases. Note that integrity-only does not imply security, since without a signature, an attacker can also enable fs-verity on arbitrary files. Bug: 249158715 Test: CtsAppSecurityHostTestCases:android.appsecurity.cts.ApkVerityInstallTest Change-Id: I119e5189603af888dfa1ece2bee9e7635120854b
Loading
Please register or sign in to comment