Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f90fbd6d authored by Alyssa Haroldsen's avatar Alyssa Haroldsen
Browse files

Add a sysprop-as-API for Trusty Android properties 

This provides access to the Android system properties that Trusty
defines. It does not grant any access to these properties from within
Trusty itself.

Bug: 382335252
Test: Use libtrustyproperties_rust in a rust_binary, call
Test: `trustyproperties::trustproperties::vm_cid()`
Change-Id: I7426eeaf6bee5cdb1eb644044a50953063440906
parent 20f62340

trusty/sysprops/Android.bp

0 → 100644
+15 −0
Original line number Diff line number Diff line 
sysprop_library {

    name: "trusty-properties",

    srcs: ["android/sysprop/trusty/security_vm.sysprop"],

    property_owner: "Platform",

    api_packages: ["android.sysprop.trusty"],

    apex_available: [

        "//apex_available:platform",

    ],

}



rust_binary {

    name: "trusty-properties-example",

    srcs: ["example.rs"],

    rustlibs: ["libtrusty_properties_rust"],

}

trusty/sysprops/android/sysprop/trusty/security_vm.sysprop

0 → 100644
+67 −0
Original line number Diff line number Diff line 
# Copyright (C) 2025 The Android Open Source Project

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.



# This module accesses properties regarding the Trusty VM that runs apps

# used to provide security for the system, such as Keymint or Gatekeeper.



module: "android.sysprop.trusty.security_vm"

owner: Platform



# The default Context Identifier to connect to Trusty over vsock.

prop {

    api_name: "vm_cid"

    prop_name: "trusty.security_vm.vm_cid"

    type: Integer

    scope: Internal

    access: Readonly

}



# Signals when a nonsecure VM is ready.

#

# This is used to launch dependent HALs.

#

# Trusty security VMs come in two flavors: non-secure and secure.

#

# 1. Non-secure VMs run on emulated environments like Cuttlefish, which lack

#    pVM firmware and TEE support. Consequently, KeyMint's root-of-trust data

#    is passed into the VM from the host's HAL, and an RPMB proxy provides

#    secure storage.

# 2. Secure VMs run on physical devices. Here, pVM firmware handles the

#    transfer of root-of-trust data via DeviceTree, and a TEE provides secure

#    storage.

prop {

    api_name: "nonsecure_vm_ready"

    prop_name: "trusty.security_vm.nonsecure_vm_ready"

    type: Boolean

    scope: Internal

    access: Readonly

}



# The Trusty Security VM is enabled.

prop {

    api_name: "enabled"

    prop_name: "trusty.security_vm.enabled"

    type: Boolean

    scope: Public

    access: Readonly

}



# KeyMint is enabled in the Trusty Security VM.

prop {

    api_name: "keymint_enabled"

    prop_name: "trusty.security_vm.keymint.enabled"

    type: Boolean

    scope: Public

    access: Readonly

}

trusty/sysprops/api/trusty-properties-current.txt

0 → 100644
+11 −0
Original line number Diff line number Diff line 
props {

  module: "android.sysprop.trusty.security_vm"

  prop {

    api_name: "enabled"

    prop_name: "trusty.security_vm.enabled"

  }

  prop {

    api_name: "keymint_enabled"

    prop_name: "trusty.security_vm.keymint.enabled"

  }

}

trusty/sysprops/api/trusty-properties-latest.txt

0 → 100644
+11 −0
Original line number Diff line number Diff line 
props {

  module: "android.sysprop.trusty.security_vm"

  prop {

    api_name: "enabled"

    prop_name: "trusty.security_vm.enabled"

  }

  prop {

    api_name: "keymint_enabled"

    prop_name: "trusty.security_vm.keymint.enabled"

  }

}

trusty/sysprops/example.rs

0 → 100644
+11 −0
Original line number Diff line number Diff line 
//! Example showing how to access the `trusty.security_vm.vm_cid` system property with Rust.



use trusty_properties::security_vm;



fn main() {

    match security_vm::vm_cid() {

        Ok(Some(cid)) => println!("CID: {cid}"),

        Ok(None) => println!("CID property not set"),

        Err(e) => println!("Error: {e:?}"),

    }

}