Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c60153f7 authored by Mark Salyzyn's avatar Mark Salyzyn
Browse files

adb: add overlayfs handling for readonly system filesystems 

adb verity-on setup overlayfs directories, do not skip if verity
feature not configured for device.

adb verity-off teardown overlayfs directories, do not skip if verity
feature not configured for device.

adb remount setup overlayfs directories and mount if possible, and
do so without a reboot if possible.

Test: compile
Bug: 109821005
Bug: 110985612
Change-Id: I28c4c23fea44b886c5523f0286a523f0b0485df0
parent d9e6c202

adb/daemon/remount_service.cpp

+19 −9
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ 
#include <sys/vfs.h>

#include <unistd.h>



#include <memory>

#include <set>

#include <string>

#include <vector>
@@ -38,28 +39,30 @@ 
#include <bootloader_message/bootloader_message.h>

#include <cutils/android_reboot.h>

#include <ext4_utils/ext4_utils.h>

#include <fs_mgr.h>

#include <fs_mgr_overlayfs.h>



#include "adb.h"

#include "adb_io.h"

#include "adb_unique_fd.h"

#include "adb_utils.h"

#include "fs_mgr.h"

#include "set_verity_enable_state_service.h"



// Returns the device used to mount a directory in /proc/mounts.

// Returns the last device used to mount a directory in /proc/mounts.

// This will find overlayfs entry where upperdir=lowerdir, to make sure

// remount is associated with the correct directory.

static std::string find_proc_mount(const char* dir) {

    std::unique_ptr<FILE, int(*)(FILE*)> fp(setmntent("/proc/mounts", "r"), endmntent);

    if (!fp) {

        return "";

    }

    std::string mnt_fsname;

    if (!fp) return mnt_fsname;



    mntent* e;

    while ((e = getmntent(fp.get())) != nullptr) {

        if (strcmp(dir, e->mnt_dir) == 0) {

            return e->mnt_fsname;

            mnt_fsname = e->mnt_fsname;

        }

    }

    return "";

    return mnt_fsname;

}



// Returns the device used to mount a directory in the fstab.
@@ -81,6 +84,7 @@ static std::string find_mount(const char* dir, bool is_root) { 
}



bool make_block_device_writable(const std::string& dev) {

    if ((dev == "overlay") || (dev == "overlayfs")) return true;

    int fd = unix_open(dev.c_str(), O_RDONLY | O_CLOEXEC);

    if (fd == -1) {

        return false;
@@ -234,6 +238,14 @@ void remount_service(unique_fd fd, const std::string& cmd) { 
        partitions.push_back("/system");

    }



    bool verity_enabled = (system_verified || vendor_verified);



    // If we can use overlayfs, lets get it in place first

    // before we struggle with determining deduplication operations.

    if (!verity_enabled && fs_mgr_overlayfs_setup() && fs_mgr_overlayfs_mount_all()) {

        WriteFdExactly(fd.get(), "overlayfs mounted\n");

    }



    // Find partitions that are deduplicated, and can be un-deduplicated.

    std::set<std::string> dedup;

    for (const auto& partition : partitions) {
@@ -246,8 +258,6 @@ void remount_service(unique_fd fd, const std::string& cmd) { 
        }

    }



    bool verity_enabled = (system_verified || vendor_verified);



    // Reboot now if the user requested it (and an operation needs a reboot).

    if (user_requested_reboot) {

        if (!dedup.empty() || verity_enabled) {

adb/daemon/set_verity_enable_state_service.cpp

+43 −5
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include "set_verity_enable_state_service.h"

#include "sysdeps.h"



#include <errno.h>

#include <fcntl.h>

#include <inttypes.h>

#include <libavb_user/libavb_user.h>
@@ -28,12 +29,14 @@ 


#include <android-base/properties.h>

#include <android-base/stringprintf.h>

#include <fs_mgr.h>

#include <fs_mgr_overlayfs.h>

#include <fstab/fstab.h>

#include <log/log_properties.h>



#include "adb.h"

#include "adb_io.h"

#include "adb_unique_fd.h"

#include "fs_mgr.h"

#include "remount_service.h"



#include "fec/io.h"
@@ -46,6 +49,10 @@ static const bool kAllowDisableVerity = true; 
static const bool kAllowDisableVerity = false;

#endif



void suggest_run_adb_root(int fd) {

    if (getuid() != 0) WriteFdExactly(fd, "Maybe run adb root?\n");

}



/* Turn verity on/off */

static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,

                                     bool enable) {
@@ -59,7 +66,7 @@ static bool set_verity_enabled_state(int fd, const char* block_device, const cha 


    if (!fh) {

        WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));

        WriteFdFmt(fd, "Maybe run adb root?\n");

        suggest_run_adb_root(fd);

        return false;

    }
@@ -87,6 +94,17 @@ static bool set_verity_enabled_state(int fd, const char* block_device, const cha 
        return false;

    }



    auto change = false;

    errno = 0;

    if (enable ? fs_mgr_overlayfs_teardown(mount_point, &change)

               : fs_mgr_overlayfs_setup(nullptr, mount_point, &change)) {

        if (change) {

            WriteFdFmt(fd, "%s overlayfs for %s\n", enable ? "disabling" : "using", mount_point);

        }

    } else if (errno) {

        WriteFdFmt(fd, "Overlayfs %s for %s failed with error %s\n", enable ? "teardown" : "setup",

                   mount_point, strerror(errno));

    }

    WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);

    return true;

}
@@ -103,6 +121,22 @@ static bool is_avb_device_locked() { 
    return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";

}



static bool overlayfs_setup(int fd, bool enable) {

    auto change = false;

    errno = 0;

    if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)

               : fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {

        if (change) {

            WriteFdFmt(fd, "%s overlayfs\n", enable ? "disabling" : "using");

        }

    } else if (errno) {

        WriteFdFmt(fd, "Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup",

                   strerror(errno));

        suggest_run_adb_root(fd);

    }

    return change;

}



/* Use AVB to turn verity on/off */

static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {

    std::string ab_suffix = get_ab_suffix();
@@ -128,6 +162,7 @@ static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity 
        return false;

    }



    overlayfs_setup(fd, enable_verity);

    WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");

    return true;

}
@@ -150,6 +185,7 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) { 
        }



        if (!android::base::GetBoolProperty("ro.secure", false)) {

            overlayfs_setup(fd, enable);

            WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");

            return;

        }
@@ -177,13 +213,14 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) { 
        // Not using AVB - assume VB1.0.



        // read all fstab entries at once from all sources

        fstab = fs_mgr_read_fstab_default();

        if (!fstab) fstab = fs_mgr_read_fstab_default();

        if (!fstab) {

            WriteFdExactly(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");

            WriteFdExactly(fd.get(), "Failed to read fstab\n");

            suggest_run_adb_root(fd.get());

            return;

        }



        // Loop through entries looking for ones that vold manages.

        // Loop through entries looking for ones that verity manages.

        for (int i = 0; i < fstab->num_entries; i++) {

            if (fs_mgr_is_verified(&fstab->recs[i])) {

                if (set_verity_enabled_state(fd.get(), fstab->recs[i].blk_device,
@@ -193,6 +230,7 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) { 
            }

        }

    }

    if (!any_changed) any_changed = overlayfs_setup(fd, enable);



    if (any_changed) {

        WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");