Merge changes from topics "adbd_reboot", "adbd_verity" (18bbb2d8) · Commits · e / os / android_system_core

adb/Android.bp

+16 −9

Original line number	Diff line number	Diff line
		@@ -428,18 +428,10 @@ cc_library {
		"daemon/abb_service.cpp",
		"daemon/framebuffer_service.cpp",
		"daemon/mdns.cpp",
		"daemon/reboot_service.cpp",
		"daemon/restart_service.cpp",
		"daemon/set_verity_enable_state_service.cpp",
		],
		static_libs: [
		"libavb_user",
		],
		shared_libs: [
		"libbootloader_message",
		"libmdnssd",
		"libfec",
		"libfs_mgr",
		"libselinux",
		],
		},
		@@ -513,6 +505,22 @@ cc_binary {
		],
		}

		phony {
		name: "adbd_system_binaries",
		required: [
		"abb",
		"reboot",
		"set-verity-state",
		]
		}

		phony {
		name: "adbd_system_binaries_recovery",
		required: [
		"reboot.recovery",
		],
		}

		cc_binary {
		name: "static_adbd",
		defaults: ["adbd_defaults", "host_adbd_supported"],
		@@ -608,7 +616,6 @@ cc_test {
		static_libs: [
		"libadbd",
		"libbase",
		"libbootloader_message",
		"libcutils",
		"libcrypto_utils",
		"libcrypto_static",

adb/daemon/reboot_service.cpp

deleted100644 → 0

+0 −84

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2018 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#define TRACE_TAG SERVICES

		#include "sysdeps.h"

		#include <stdlib.h>
		#include <sys/socket.h>
		#include <sys/un.h>
		#include <unistd.h>

		#include <string>

		#include <android-base/logging.h>
		#include <android-base/properties.h>
		#include <android-base/stringprintf.h>
		#include <bootloader_message/bootloader_message.h>
		#include <cutils/android_reboot.h>

		#include "adb_io.h"
		#include "adb_unique_fd.h"

		void reboot_service(unique_fd fd, const std::string& arg) {
		std::string reboot_arg = arg;
		sync();

		if (reboot_arg.empty()) reboot_arg = "adb";
		std::string reboot_string = android::base::StringPrintf("reboot,%s", reboot_arg.c_str());

		if (reboot_arg == "fastboot" &&
		android::base::GetBoolProperty("ro.boot.dynamic_partitions", false) &&
		access("/dev/socket/recovery", F_OK) == 0) {
		LOG(INFO) << "Recovery specific reboot fastboot";
		/*
		* The socket is created to allow switching between recovery and
		* fastboot.
		*/
		android::base::unique_fd sock(socket(AF_UNIX, SOCK_STREAM, 0));
		if (sock < 0) {
		WriteFdFmt(fd, "reboot (%s) create\n", strerror(errno));
		PLOG(ERROR) << "Creating recovery socket failed";
		return;
		}

		sockaddr_un addr = {.sun_family = AF_UNIX};
		strncpy(addr.sun_path, "/dev/socket/recovery", sizeof(addr.sun_path) - 1);
		if (connect(sock.get(), reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) == -1) {
		WriteFdFmt(fd, "reboot (%s) connect\n", strerror(errno));
		PLOG(ERROR) << "Couldn't connect to recovery socket";
		return;
		}
		const char msg_switch_to_fastboot = 'f';
		auto ret = adb_write(sock, &msg_switch_to_fastboot, sizeof(msg_switch_to_fastboot));
		if (ret != sizeof(msg_switch_to_fastboot)) {
		WriteFdFmt(fd, "reboot (%s) write\n", strerror(errno));
		PLOG(ERROR) << "Couldn't write message to recovery socket to switch to fastboot";
		return;
		}
		} else {
		if (!android::base::SetProperty(ANDROID_RB_PROPERTY, reboot_string)) {
		WriteFdFmt(fd.get(), "reboot (%s) failed\n", reboot_string.c_str());
		return;
		}
		}
		// Don't return early. Give the reboot command time to take effect
		// to avoid messing up scripts which do "adb reboot && adb wait-for-device"
		while (true) {
		pause();
		}
		}

adb/daemon/reboot_service.h

deleted100644 → 0

+0 −25

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2018 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#pragma once

		#include <string>

		#include "adb_unique_fd.h"

		#if defined(__ANDROID__)
		void reboot_service(unique_fd fd, const std::string& arg);
		#endif

adb/daemon/services.cpp

+7 −9

Original line number	Diff line number	Diff line
		@@ -53,9 +53,7 @@

		#include "daemon/file_sync_service.h"
		#include "daemon/framebuffer_service.h"
		#include "daemon/reboot_service.h"
		#include "daemon/restart_service.h"
		#include "daemon/set_verity_enable_state_service.h"
		#include "daemon/shell_service.h"


		@@ -254,9 +252,9 @@ unique_fd daemon_service_to_fd(std::string_view name, atransport* transport) {
		cmd += name;
		return StartSubprocess(cmd, nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
		} else if (android::base::ConsumePrefix(&name, "reboot:")) {
		std::string arg(name);
		return create_service_thread("reboot",
		std::bind(reboot_service, std::placeholders::_1, arg));
		std::string cmd = "/system/bin/reboot ";
		cmd += name;
		return StartSubprocess(cmd, nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
		} else if (name.starts_with("root:")) {
		return create_service_thread("root", restart_root_service);
		} else if (name.starts_with("unroot:")) {
		@@ -269,11 +267,11 @@ unique_fd daemon_service_to_fd(std::string_view name, atransport* transport) {
		return StartSubprocess("/system/bin/bu restore", nullptr, SubprocessType::kRaw,
		SubprocessProtocol::kNone);
		} else if (name.starts_with("disable-verity:")) {
		return create_service_thread("verity-on", std::bind(set_verity_enabled_state_service,
		std::placeholders::_1, false));
		return StartSubprocess("/system/bin/disable-verity", nullptr, SubprocessType::kRaw,
		SubprocessProtocol::kNone);
		} else if (name.starts_with("enable-verity:")) {
		return create_service_thread("verity-off", std::bind(set_verity_enabled_state_service,
		std::placeholders::_1, true));
		return StartSubprocess("/system/bin/enable-verity", nullptr, SubprocessType::kRaw,
		SubprocessProtocol::kNone);
		} else if (android::base::ConsumePrefix(&name, "tcpip:")) {
		std::string str(name);

adb/daemon/set_verity_enable_state_service.cpp

deleted100644 → 0

+0 −250

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2014 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#define TRACE_TAG ADB

		#include "set_verity_enable_state_service.h"
		#include "sysdeps.h"

		#include <errno.h>
		#include <fcntl.h>
		#include <inttypes.h>
		#include <libavb_user/libavb_user.h>
		#include <stdarg.h>
		#include <stdio.h>
		#include <sys/mount.h>
		#include <sys/stat.h>

		#include <android-base/properties.h>
		#include <android-base/stringprintf.h>
		#include <fs_mgr.h>
		#include <fs_mgr_overlayfs.h>
		#include <fstab/fstab.h>
		#include <log/log_properties.h>

		#include "adb.h"
		#include "adb_io.h"
		#include "adb_unique_fd.h"

		#include "fec/io.h"

		#ifdef ALLOW_ADBD_DISABLE_VERITY
		static const bool kAllowDisableVerity = true;
		#else
		static const bool kAllowDisableVerity = false;
		#endif

		void suggest_run_adb_root(int fd) {
		if (getuid() != 0) WriteFdExactly(fd, "Maybe run adb root?\n");
		}

		static bool make_block_device_writable(const std::string& dev) {
		unique_fd fd(unix_open(dev, O_RDONLY \| O_CLOEXEC));
		if (fd == -1) {
		return false;
		}

		int OFF = 0;
		bool result = (ioctl(fd.get(), BLKROSET, &OFF) != -1);
		return result;
		}

		/* Turn verity on/off */
		static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
		bool enable) {
		if (!make_block_device_writable(block_device)) {
		WriteFdFmt(fd, "Could not make block device %s writable (%s).\n",
		block_device, strerror(errno));
		return false;
		}

		fec::io fh(block_device, O_RDWR);

		if (!fh) {
		WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
		suggest_run_adb_root(fd);
		return false;
		}

		fec_verity_metadata metadata;

		if (!fh.get_verity_metadata(metadata)) {
		WriteFdExactly(fd, "Couldn't find verity metadata!\n");
		return false;
		}

		if (!enable && metadata.disabled) {
		WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point);
		return false;
		}

		if (enable && !metadata.disabled) {
		WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point);
		return false;
		}

		if (!fh.set_verity_status(enable)) {
		WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n",
		enable ? "enabled" : "disabled",
		block_device, strerror(errno));
		return false;
		}

		auto change = false;
		errno = 0;
		if (enable ? fs_mgr_overlayfs_teardown(mount_point, &change)
		: fs_mgr_overlayfs_setup(nullptr, mount_point, &change)) {
		if (change) {
		WriteFdFmt(fd, "%s overlayfs for %s\n", enable ? "disabling" : "using", mount_point);
		}
		} else if (errno) {
		int expected_errno = enable ? EBUSY : ENOENT;
		if (errno != expected_errno) {
		WriteFdFmt(fd, "Overlayfs %s for %s failed with error %s\n",
		enable ? "teardown" : "setup", mount_point, strerror(errno));
		}
		}
		WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
		return true;
		}

		/* Helper function to get A/B suffix, if any. If the device isn't
		* using A/B the empty string is returned. Otherwise either "_a",
		* "_b", ... is returned.
		*/
		static std::string get_ab_suffix() {
		return android::base::GetProperty("ro.boot.slot_suffix", "");
		}

		static bool is_avb_device_locked() {
		return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";
		}

		static bool overlayfs_setup(int fd, bool enable) {
		auto change = false;
		errno = 0;
		if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)
		: fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {
		if (change) {
		WriteFdFmt(fd, "%s overlayfs\n", enable ? "disabling" : "using");
		}
		} else if (errno) {
		WriteFdFmt(fd, "Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup",
		strerror(errno));
		suggest_run_adb_root(fd);
		}
		return change;
		}

		/* Use AVB to turn verity on/off */
		static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
		std::string ab_suffix = get_ab_suffix();
		bool verity_enabled;

		if (is_avb_device_locked()) {
		WriteFdExactly(fd, "Device is locked. Please unlock the device first\n");
		return false;
		}

		if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) {
		WriteFdExactly(fd, "Error getting verity state. Try adb root first?\n");
		return false;
		}

		if ((verity_enabled && enable_verity) \|\| (!verity_enabled && !enable_verity)) {
		WriteFdFmt(fd, "verity is already %s\n", verity_enabled ? "enabled" : "disabled");
		return false;
		}

		if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) {
		WriteFdExactly(fd, "Error setting verity\n");
		return false;
		}

		overlayfs_setup(fd, enable_verity);
		WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
		return true;
		}

		void set_verity_enabled_state_service(unique_fd fd, bool enable) {
		bool any_changed = false;

		// Figure out if we're using VB1.0 or VB2.0 (aka AVB) - by
		// contract, androidboot.vbmeta.digest is set by the bootloader
		// when using AVB).
		bool using_avb = !android::base::GetProperty("ro.boot.vbmeta.digest", "").empty();

		// If using AVB, dm-verity is used on any build so we want it to
		// be possible to disable/enable on any build (except USER). For
		// VB1.0 dm-verity is only enabled on certain builds.
		if (!using_avb) {
		if (!kAllowDisableVerity) {
		WriteFdFmt(fd.get(), "%s-verity only works for userdebug builds\n",
		enable ? "enable" : "disable");
		}

		if (!android::base::GetBoolProperty("ro.secure", false)) {
		overlayfs_setup(fd.get(), enable);
		WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");
		return;
		}
		}

		// Should never be possible to disable dm-verity on a USER build
		// regardless of using AVB or VB1.0.
		if (!__android_log_is_debuggable()) {
		WriteFdExactly(fd.get(), "verity cannot be disabled/enabled - USER build\n");
		return;
		}

		if (using_avb) {
		// Yep, the system is using AVB.
		AvbOps* ops = avb_ops_user_new();
		if (ops == nullptr) {
		WriteFdExactly(fd.get(), "Error getting AVB ops\n");
		return;
		}
		if (set_avb_verity_enabled_state(fd.get(), ops, enable)) {
		any_changed = true;
		}
		avb_ops_user_free(ops);
		} else {
		// Not using AVB - assume VB1.0.

		// read all fstab entries at once from all sources
		android::fs_mgr::Fstab fstab;
		if (!android::fs_mgr::ReadDefaultFstab(&fstab)) {
		WriteFdExactly(fd.get(), "Failed to read fstab\n");
		suggest_run_adb_root(fd.get());
		return;
		}

		// Loop through entries looking for ones that verity manages.
		for (const auto& entry : fstab) {
		if (entry.fs_mgr_flags.verify) {
		if (set_verity_enabled_state(fd.get(), entry.blk_device.c_str(),
		entry.mount_point.c_str(), enable)) {
		any_changed = true;
		}
		}
		}
		}
		if (!any_changed) any_changed = overlayfs_setup(fd.get(), enable);

		if (any_changed) {
		WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");
		}
		}