fs_mgr: set ext4 fsverity feature bit (0b721d3d) · Commits · e / os / android_system_core

fs_mgr/fs_mgr.cpp

+43 −1

Original line number	Original line	Diff line number	Diff line
	@@ -81,6 +81,8 @@
	#define ZRAM_CONF_MCS "/sys/block/zram0/max_comp_streams"		#define ZRAM_CONF_MCS "/sys/block/zram0/max_comp_streams"
	#define ZRAM_BACK_DEV "/sys/block/zram0/backing_dev"		#define ZRAM_BACK_DEV "/sys/block/zram0/backing_dev"

			#define SYSFS_EXT4_VERITY "/sys/fs/ext4/features/verity"

	#define ARRAY_SIZE(a) (sizeof(a) / sizeof(*(a)))		#define ARRAY_SIZE(a) (sizeof(a) / sizeof(*(a)))

	using android::base::Realpath;		using android::base::Realpath;
	@@ -110,6 +112,7 @@ enum FsStatFlags {
	FS_STAT_TOGGLE_QUOTAS_FAILED = 0x10000,		FS_STAT_TOGGLE_QUOTAS_FAILED = 0x10000,
	FS_STAT_SET_RESERVED_BLOCKS_FAILED = 0x20000,		FS_STAT_SET_RESERVED_BLOCKS_FAILED = 0x20000,
	FS_STAT_ENABLE_ENCRYPTION_FAILED = 0x40000,		FS_STAT_ENABLE_ENCRYPTION_FAILED = 0x40000,
			FS_STAT_ENABLE_VERITY_FAILED = 0x80000,
	};		};

	// TODO: switch to inotify()		// TODO: switch to inotify()
	@@ -440,6 +443,43 @@ static void tune_encrypt(const std::string& blk_device, const FstabEntry& entry,
	}		}
	}		}

			// Enable fs-verity if needed.
			static void tune_verity(const std::string& blk_device, const FstabEntry& entry,
			const struct ext4_super_block* sb, int* fs_stat) {
			bool has_verity = (sb->s_feature_ro_compat & cpu_to_le32(EXT4_FEATURE_RO_COMPAT_VERITY)) != 0;
			bool want_verity = entry.fs_mgr_flags.fs_verity;

			if (has_verity \|\| !want_verity) {
			return;
			}

			std::string verity_support;
			if (!android::base::ReadFileToString(SYSFS_EXT4_VERITY, &verity_support)) {
			LERROR << "Failed to open " << SYSFS_EXT4_VERITY;
			return;
			}

			if (!(android::base::Trim(verity_support) == "supported")) {
			LERROR << "Current ext4 verity not supported by kernel";
			return;
			}

			if (!tune2fs_available()) {
			LERROR << "Unable to enable ext4 verity on " << blk_device
			<< " because " TUNE2FS_BIN " is missing";
			return;
			}

			LINFO << "Enabling ext4 verity on " << blk_device;

			const char* argv[] = {TUNE2FS_BIN, "-O", "verity", blk_device.c_str()};
			if (!run_tune2fs(argv, ARRAY_SIZE(argv))) {
			LERROR << "Failed to run " TUNE2FS_BIN " to enable "
			<< "ext4 verity on " << blk_device;
			*fs_stat \|= FS_STAT_ENABLE_VERITY_FAILED;
			}
			}

	// Read the primary superblock from an f2fs filesystem. On failure return		// Read the primary superblock from an f2fs filesystem. On failure return
	// false. If it's not an f2fs filesystem, also set FS_STAT_INVALID_MAGIC.		// false. If it's not an f2fs filesystem, also set FS_STAT_INVALID_MAGIC.
	#define F2FS_BLKSIZE 4096		#define F2FS_BLKSIZE 4096
	@@ -511,12 +551,14 @@ static int prepare_fs_for_mount(const std::string& blk_device, const FstabEntry&
	}		}

	if (is_extfs(entry.fs_type) &&		if (is_extfs(entry.fs_type) &&
	(entry.fs_mgr_flags.reserved_size \|\| entry.fs_mgr_flags.file_encryption)) {		(entry.fs_mgr_flags.reserved_size \|\| entry.fs_mgr_flags.file_encryption \|\|
			entry.fs_mgr_flags.fs_verity)) {
	struct ext4_super_block sb;		struct ext4_super_block sb;

	if (read_ext4_superblock(blk_device, &sb, &fs_stat)) {		if (read_ext4_superblock(blk_device, &sb, &fs_stat)) {
	tune_reserved_size(blk_device, entry, &sb, &fs_stat);		tune_reserved_size(blk_device, entry, &sb, &fs_stat);
	tune_encrypt(blk_device, entry, &sb, &fs_stat);		tune_encrypt(blk_device, entry, &sb, &fs_stat);
			tune_verity(blk_device, entry, &sb, &fs_stat);
	}		}
	}		}

fs_mgr/fs_mgr_fstab.cpp

+5 −0

Original line number	Original line	Diff line number	Diff line
	@@ -125,6 +125,7 @@ static struct flag_list fs_mgr_flags[] = {
	{"zram_loopback_path=", MF_ZRAM_LOOPBACK_PATH},		{"zram_loopback_path=", MF_ZRAM_LOOPBACK_PATH},
	{"zram_loopback_size=", MF_ZRAM_LOOPBACK_SIZE},		{"zram_loopback_size=", MF_ZRAM_LOOPBACK_SIZE},
	{"zram_backing_dev_path=", MF_ZRAM_BACKING_DEV_PATH},		{"zram_backing_dev_path=", MF_ZRAM_BACKING_DEV_PATH},
			{"fsverity", MF_FS_VERITY},
	{0, 0},		{0, 0},
	};		};

	@@ -1087,6 +1088,10 @@ int fs_mgr_is_checkpoint_blk(const struct fstab_rec* fstab) {
	return fstab->fs_mgr_flags & MF_CHECKPOINT_BLK;		return fstab->fs_mgr_flags & MF_CHECKPOINT_BLK;
	}		}

			int fs_mgr_is_fs_verity(const struct fstab_rec* fstab) {
			return fstab->fs_mgr_flags & MF_FS_VERITY;
			}

	FstabEntry BuildGsiSystemFstabEntry() {		FstabEntry BuildGsiSystemFstabEntry() {
	FstabEntry system = {		FstabEntry system = {
	.blk_device = "system_gsi",		.blk_device = "system_gsi",

fs_mgr/fs_mgr_priv.h

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -128,6 +128,8 @@
	0x400000000		0x400000000
	#define MF_ZRAM_BACKING_DEV_PATH \		#define MF_ZRAM_BACKING_DEV_PATH \
	0x800000000		0x800000000
			#define MF_FS_VERITY \
			0x1000000000
	// clang-format on		// clang-format on

	#define DM_BUF_SIZE 4096		#define DM_BUF_SIZE 4096

fs_mgr/include_fstab/fstab/fstab.h

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -95,6 +95,7 @@ int fs_mgr_is_checkpoint(const struct fstab_rec* fstab);
	int fs_mgr_is_checkpoint_fs(const struct fstab_rec* fstab);		int fs_mgr_is_checkpoint_fs(const struct fstab_rec* fstab);
	int fs_mgr_is_checkpoint_blk(const struct fstab_rec* fstab);		int fs_mgr_is_checkpoint_blk(const struct fstab_rec* fstab);
	int fs_mgr_has_sysfs_path(const struct fstab_rec* fstab);		int fs_mgr_has_sysfs_path(const struct fstab_rec* fstab);
			int fs_mgr_is_fs_verity(const struct fstab_rec* fstab);

	std::string fs_mgr_get_slot_suffix();		std::string fs_mgr_get_slot_suffix();
	std::set<std::string> fs_mgr_get_boot_devices();		std::set<std::string> fs_mgr_get_boot_devices();
	@@ -177,6 +178,7 @@ struct FstabEntry {
	bool zram_loopback_path : 1;		bool zram_loopback_path : 1;
	bool zram_loopback_size : 1;		bool zram_loopback_size : 1;
	bool zram_backing_dev_path : 1;		bool zram_backing_dev_path : 1;
			bool fs_verity : 1;
	};		};
	} fs_mgr_flags;		} fs_mgr_flags;