Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 42164ff9 authored by Eric Biggers's avatar Eric Biggers Committed by Gerrit Code Review
Browse files

Merge changes from topic "fsverity-init-cleanup" into main 

* changes:
  init.rc: stop using fsverity_init --lock
  init: remove unfinished fsverity signature support for APEX sepolicy
parents 83ebc437 79a67391

init/Android.bp

+0 −2
Original line number Diff line number Diff line
@@ -166,11 +166,9 @@ libinit_cc_defaults { 
        "libbootloader_message",

        "libc++fs",

        "libcgrouprc_format",

        "libfsverity_init",

        "liblmkd_utils",

        "liblz4",

        "libzstd",

        "libmini_keyctl_static",

        "libmodprobe",

        "libprocinfo",

        "libprotobuf-cpp-lite",

init/selinux.cpp

+2 −44
Original line number Diff line number Diff line
@@ -74,10 +74,8 @@ 
#include <android-base/unique_fd.h>

#include <fs_avb/fs_avb.h>

#include <fs_mgr.h>

#include <fsverity_init.h>

#include <libgsi/libgsi.h>

#include <libsnapshot/snapshot.h>

#include <mini_keyctl_utils.h>

#include <selinux/android.h>

#include <ziparchive/zip_archive.h>
@@ -510,7 +508,6 @@ bool OpenMonolithicPolicy(PolicyFile* policy_file) { 


constexpr const char* kSigningCertRelease =

        "/system/etc/selinux/com.android.sepolicy.cert-release.der";

constexpr const char* kFsVerityProcPath = "/proc/sys/fs/verity";

const std::string kSepolicyApexMetadataDir = "/metadata/sepolicy/";

const std::string kSepolicyApexSystemDir = "/system/etc/selinux/apex/";

const std::string kSepolicyZip = "SEPolicy.zip";
@@ -614,24 +611,6 @@ Result<void> GetPolicyFromApex(const std::string& dir) { 
    return {};

}



Result<void> LoadSepolicyApexCerts() {

    key_serial_t keyring_id = android::GetKeyringId(".fs-verity");

    if (keyring_id < 0) {

        return Error() << "Failed to find .fs-verity keyring id";

    }



    // TODO(b/199914227) the release key should always exist. Once it's checked in, start

    // throwing an error here if it doesn't exist.

    if (access(kSigningCertRelease, F_OK) == 0) {

        LoadKeyFromFile(keyring_id, "fsv_sepolicy_apex_release", kSigningCertRelease);

    }

    return {};

}



Result<void> SepolicyFsVerityCheck() {

    return Error() << "TODO implement support for fsverity SEPolicy.";

}



Result<void> SepolicyCheckSignature(const std::string& dir) {

    std::string signature;

    if (!android::base::ReadFileToString(dir + kSepolicySignature, &signature)) {
@@ -654,18 +633,7 @@ Result<void> SepolicyCheckSignature(const std::string& dir) { 
    return verifySignature(sepolicyStr, signature, *releaseKey);

}



Result<void> SepolicyVerify(const std::string& dir, bool supportsFsVerity) {

    if (supportsFsVerity) {

        auto fsVerityCheck = SepolicyFsVerityCheck();

        if (fsVerityCheck.ok()) {

            return fsVerityCheck;

        }

        // TODO(b/199914227) If the device supports fsverity, but we fail here, we should fail to

        // boot and not carry on. For now, fallback to a signature checkuntil the fsverity

        // logic is implemented.

        LOG(INFO) << "Falling back to standard signature check. " << fsVerityCheck.error();

    }



Result<void> SepolicyVerify(const std::string& dir) {

    auto sepolicySignature = SepolicyCheckSignature(dir);

    if (!sepolicySignature.ok()) {

        return Error() << "Apex SEPolicy failed signature check";
@@ -698,23 +666,13 @@ void CleanupApexSepolicy() { 
// 6. Sets selinux into enforcing mode and continues normal booting.

//

void PrepareApexSepolicy() {

    bool supportsFsVerity = access(kFsVerityProcPath, F_OK) == 0;

    if (supportsFsVerity) {

        auto loadSepolicyApexCerts = LoadSepolicyApexCerts();

        if (!loadSepolicyApexCerts.ok()) {

            // TODO(b/199914227) If the device supports fsverity, but we fail here, we should fail

            // to boot and not carry on. For now, fallback to a signature checkuntil the fsverity

            // logic is implemented.

            LOG(INFO) << loadSepolicyApexCerts.error();

        }

    }

    // If apex sepolicy zip exists in /metadata/sepolicy, use that, otherwise use version on

    // /system.

    auto dir = (access((kSepolicyApexMetadataDir + kSepolicyZip).c_str(), F_OK) == 0)

                       ? kSepolicyApexMetadataDir

                       : kSepolicyApexSystemDir;



    auto sepolicyVerify = SepolicyVerify(dir, supportsFsVerity);

    auto sepolicyVerify = SepolicyVerify(dir);

    if (!sepolicyVerify.ok()) {

        LOG(INFO) << "Error: " << sepolicyVerify.error();

        // If signature verification fails, fall back to version on /system.

rootdir/init.rc

+1 −5
Original line number Diff line number Diff line
@@ -1021,13 +1021,9 @@ on post-fs-data 
    # Must start after 'derive_classpath' to have *CLASSPATH variables set.

    start odsign



    # Before we can lock keys and proceed to the next boot stage, wait for

    # odsign to be done with the key

    # Wait for odsign to be done with the key.

    wait_for_prop odsign.key.done 1



    # Lock the fs-verity keyring, so no more keys can be added

    exec -- /system/bin/fsverity_init --lock



    # Bump the boot level to 1000000000; this prevents further on-device signing.

    # This is a special value that shuts down the thread which listens for

    # further updates.