Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99de5161 authored by Victor Hsieh's avatar Victor Hsieh
Browse files

Installd: new interface to enable apk verity 

Note that file-based verity can be enabled only with CAP_SYS_ADMIN.

The implementation is dummy at the moment and waiting for kernel
implementation to be ready.  Having the interface ready first allows our
iteration on the caller side in Package Manager.

Test: Saw logs on install if ro.apk_verity.mode is 1
Bug: 30972906
Change-Id: I5fb03d745111028bafbff1029f480b0386906e8a
parent 4f9ecc63

cmds/installd/InstalldNativeService.cpp

+14 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ 
#include <unistd.h>



#include <android-base/logging.h>

#include <android-base/properties.h>

#include <android-base/stringprintf.h>

#include <android-base/strings.h>

#include <android-base/unique_fd.h>
@@ -82,6 +83,8 @@ static constexpr const char *kIdMapPath = "/system/bin/idmap"; 
static constexpr const char* IDMAP_PREFIX = "/data/resource-cache/";

static constexpr const char* IDMAP_SUFFIX = "@idmap";



static constexpr const char* kPropApkVerityMode = "ro.apk_verity.mode";



// NOTE: keep in sync with Installer

static constexpr int FLAG_CLEAR_CACHE_ONLY = 1 << 8;

static constexpr int FLAG_CLEAR_CODE_CACHE_ONLY = 1 << 9;
@@ -2351,6 +2354,17 @@ binder::Status InstalldNativeService::deleteOdex(const std::string& apkPath, 
    return res ? ok() : error();

}



binder::Status InstalldNativeService::installApkVerity(const std::string& /*filePath*/,

        const ::android::base::unique_fd& /*verityInput*/) {

    ENFORCE_UID(AID_SYSTEM);

    if (!android::base::GetBoolProperty(kPropApkVerityMode, false)) {

        return ok();

    }

    // TODO: Append verity to filePath then issue ioctl to enable

    // it and hide the tree.  See b/30972906.

    return error("not implemented yet");

}



binder::Status InstalldNativeService::reconcileSecondaryDexFile(

        const std::string& dexPath, const std::string& packageName, int32_t uid,

        const std::vector<std::string>& isas, const std::unique_ptr<std::string>& volumeUuid,

cmds/installd/InstalldNativeService.h

+2 −0
Original line number Diff line number Diff line
@@ -117,6 +117,8 @@ public: 
            const std::string& outputPath);

    binder::Status deleteOdex(const std::string& apkPath, const std::string& instructionSet,

            const std::unique_ptr<std::string>& outputPath);

    binder::Status installApkVerity(const std::string& filePath,

            const ::android::base::unique_fd& verityInput);

    binder::Status reconcileSecondaryDexFile(const std::string& dexPath,

        const std::string& packageName, int32_t uid, const std::vector<std::string>& isa,

        const std::unique_ptr<std::string>& volumeUuid, int32_t storage_flag, bool* _aidl_return);

cmds/installd/binder/android/os/IInstalld.aidl

+1 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ interface IInstalld { 
            @utf8InCpp String outputPath);

    void deleteOdex(@utf8InCpp String apkPath, @utf8InCpp String instructionSet,

            @nullable @utf8InCpp String outputPath);

    void installApkVerity(@utf8InCpp String filePath, in FileDescriptor verityInput);



    boolean reconcileSecondaryDexFile(@utf8InCpp String dexPath, @utf8InCpp String pkgName,

        int uid, in @utf8InCpp String[] isas, @nullable @utf8InCpp String volume_uuid,