Enable verity on userdebug, and add disable-verity to adb (d4cea0bc) · Commits · e / os / android_system_core

adb/Android.mk

+14 −1

Original line number	Diff line number	Diff line
		@@ -111,6 +111,7 @@ LOCAL_SRC_FILES := \
		jdwp_service.c \
		framebuffer_service.c \
		remount_service.c \
		disable_verity_service.c \
		usb_linux_client.c

		LOCAL_CFLAGS := -O2 -g -DADB_HOST=0 -Wall -Wno-unused-parameter -Werror
		@@ -120,13 +121,25 @@ ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
		LOCAL_CFLAGS += -DALLOW_ADBD_ROOT=1
		endif

		ifneq (,$(filter userdebug,$(TARGET_BUILD_VARIANT)))
		LOCAL_CFLAGS += -DALLOW_ADBD_DISABLE_VERITY=1
		endif

		LOCAL_MODULE := adbd

		LOCAL_FORCE_STATIC_EXECUTABLE := true
		LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT_SBIN)
		LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_SBIN_UNSTRIPPED)
		LOCAL_C_INCLUDES += system/extras/ext4_utils system/core/fs_mgr/include

		LOCAL_STATIC_LIBRARIES := liblog \
		libfs_mgr \
		libcutils \
		libc \
		libmincrypt \
		libselinux \
		libext4_utils_static

		LOCAL_STATIC_LIBRARIES := liblog libcutils libc libmincrypt libselinux
		include $(BUILD_EXECUTABLE)

adb/adb.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -329,6 +329,7 @@ int handle_forward_request(const char* service, transport_type ttype, char* seri
		#if !ADB_HOST
		void framebuffer_service(int fd, void *cookie);
		void remount_service(int fd, void *cookie);
		void disable_verity_service(int fd, void* cookie);
		#endif

		/* packet allocator */

adb/commandline.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -189,6 +189,7 @@ void help()
		"\n"
		" adb restore <file> - restore device contents from the <file> backup archive\n"
		"\n"
		" adb disable-verity - disable dm-verity checking on USERDEBUG builds\n"
		" adb help - show this help message\n"
		" adb version - show version num\n"
		"\n"
		@@ -205,8 +206,7 @@ void help()
		" adb reboot-bootloader - reboots the device into the bootloader\n"
		" adb root - restarts the adbd daemon with root permissions\n"
		" adb usb - restarts the adbd daemon listening on USB\n"
		" adb tcpip <port> - restarts the adbd daemon listening on TCP on the specified port"
		"\n"
		" adb tcpip <port> - restarts the adbd daemon listening on TCP on the specified port\n"
		"networking:\n"
		" adb ppp <tty> [parameters] - Run PPP over USB.\n"
		" Note: you should not automatically start a PPP connection.\n"
		@@ -1437,7 +1437,7 @@ top:
		if(!strcmp(argv[0], "remount") \|\| !strcmp(argv[0], "reboot")
		\|\| !strcmp(argv[0], "reboot-bootloader")
		\|\| !strcmp(argv[0], "tcpip") \|\| !strcmp(argv[0], "usb")
		\|\| !strcmp(argv[0], "root")) {
		\|\| !strcmp(argv[0], "root") \|\| !strcmp(argv[0], "disable-verity")) {
		char command[100];
		if (!strcmp(argv[0], "reboot-bootloader"))
		snprintf(command, sizeof(command), "reboot:bootloader");

adb/disable_verity_service.c

0 → 100644

+199 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (C) 2014 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include "sysdeps.h"

		#define TRACE_TAG TRACE_ADB
		#include "adb.h"

		#include <stdio.h>
		#include <stdarg.h>
		#include <sys/stat.h>
		#include <fcntl.h>
		#include <inttypes.h>

		#include "cutils/properties.h"
		#include "ext4_sb.h"
		#include <fs_mgr.h>

		#define FSTAB_PREFIX "/fstab."
		struct fstab *fstab;

		__attribute__((__format__(printf, 2, 3))) __nonnull((2))
		static void write_console(int fd, const char* format, ...)
		{
		char buffer[256];
		va_list args;
		va_start (args, format);
		vsnprintf (buffer, sizeof(buffer), format, args);
		va_end (args);

		adb_write(fd, buffer, strnlen(buffer, sizeof(buffer)));
		}

		static int get_target_device_size(int fd, const char *blk_device,
		uint64_t *device_size)
		{
		int data_device;
		struct ext4_super_block sb;
		struct fs_info info;

		info.len = 0; /* Only len is set to 0 to ask the device for real size. */

		data_device = adb_open(blk_device, O_RDONLY \| O_CLOEXEC);
		if (data_device < 0) {
		write_console(fd, "Error opening block device (%s)\n", strerror(errno));
		return -1;
		}

		if (lseek64(data_device, 1024, SEEK_SET) < 0) {
		write_console(fd, "Error seeking to superblock\n");
		adb_close(data_device);
		return -1;
		}

		if (adb_read(data_device, &sb, sizeof(sb)) != sizeof(sb)) {
		write_console(fd, "Error reading superblock\n");
		adb_close(data_device);
		return -1;
		}

		ext4_parse_sb(&sb, &info);
		*device_size = info.len;

		adb_close(data_device);
		return 0;
		}

		static int disable_verity(int fd, const char *block_device,
		const char* mount_point)
		{
		uint32_t magic_number;
		const uint32_t voff = VERITY_METADATA_MAGIC_DISABLE;
		uint64_t device_length;
		int device;
		int retval = -1;

		device = adb_open(block_device, O_RDWR \| O_CLOEXEC);
		if (device == -1) {
		write_console(fd, "Could not open block device %s (%s).\n",
		block_device, strerror(errno));
		write_console(fd, "Maybe run adb remount?\n");
		goto errout;
		}

		// find the start of the verity metadata
		if (get_target_device_size(fd, (char*)block_device, &device_length) < 0) {
		write_console(fd, "Could not get target device size.\n");
		goto errout;
		}

		if (lseek64(device, device_length, SEEK_SET) < 0) {
		write_console(fd,
		"Could not seek to start of verity metadata block.\n");
		goto errout;
		}

		// check the magic number
		if (adb_read(device, &magic_number, sizeof(magic_number))
		!= sizeof(magic_number)) {
		write_console(fd, "Couldn't read magic number!\n");
		goto errout;
		}

		if (magic_number == VERITY_METADATA_MAGIC_DISABLE) {
		write_console(fd, "Verity already disabled on %s\n", mount_point);
		goto errout;
		}

		if (magic_number != VERITY_METADATA_MAGIC_NUMBER) {
		write_console(fd,
		"Couldn't find verity metadata at offset %"PRIu64"!\n",
		device_length);
		goto errout;
		}

		if (lseek64(device, device_length, SEEK_SET) < 0) {
		write_console(fd,
		"Could not seek to start of verity metadata block.\n");
		goto errout;
		}

		if (adb_write(device, &voff, sizeof(voff)) != sizeof(voff)) {
		write_console(fd, "Could not set verity disabled flag on device %s\n",
		block_device);
		goto errout;
		}

		write_console(fd, "Verity disabled on %s\n", mount_point);
		retval = 0;
		errout:
		if (device != -1)
		adb_close(device);
		return retval;
		}

		void disable_verity_service(int fd, void* cookie)
		{
		#ifdef ALLOW_ADBD_DISABLE_VERITY
		char fstab_filename[PROPERTY_VALUE_MAX + sizeof(FSTAB_PREFIX)];
		char propbuf[PROPERTY_VALUE_MAX];
		int i;
		bool any_disabled = false;

		property_get("ro.secure", propbuf, "0");
		if (strcmp(propbuf, "1")) {
		write_console(fd, "verity not enabled - ENG build\n");
		goto errout;
		}

		property_get("ro.debuggable", propbuf, "0");
		if (strcmp(propbuf, "1")) {
		write_console(fd, "verity cannot be disabled - USER build\n");
		goto errout;
		}

		property_get("ro.hardware", propbuf, "");
		snprintf(fstab_filename, sizeof(fstab_filename), FSTAB_PREFIX"%s", propbuf);

		fstab = fs_mgr_read_fstab(fstab_filename);
		if (!fstab) {
		write_console(fd, "Failed to open %s\nMaybe run adb root?\n",
		fstab_filename);
		goto errout;
		}

		/* Loop through entries looking for ones that vold manages */
		for (i = 0; i < fstab->num_entries; i++) {
		if(fs_mgr_is_verified(&fstab->recs[i])) {
		if (!disable_verity(fd, fstab->recs[i].blk_device,
		fstab->recs[i].mount_point)) {
		any_disabled = true;
		}
		}
		}

		if (any_disabled) {
		write_console(fd,
		"Now reboot your device for settings to take effect\n");
		}
		#else
		write_console(fd, "disable-verity only works for userdebug builds\n");
		#endif

		errout:
		adb_close(fd);
		}

adb/services.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -469,6 +469,8 @@ int service_to_fd(const char *name)
		free(cookie);
		}
		}
		} else if(!strncmp(name, "disable-verity:", 15)) {
		ret = create_service_thread(disable_verity_service, NULL);
		#endif
		}
		if (ret >= 0) {