diff --git a/init/property_service.cpp b/init/property_service.cpp index 65e9cda1ccc698ca0beb12dd204f8c8aa29f5bcc..e47ba30a6770cf7669ba982f979d129b922acd13 100644 --- a/init/property_service.cpp +++ b/init/property_service.cpp @@ -98,6 +98,7 @@ static int init_socket = -1; static PropertyInfoAreaFile property_info_area; void CreateSerializedPropertyInfo(); +static void SetSafetyNetProps(); struct PropertyAuditData { const ucred* cr; @@ -130,6 +131,12 @@ void property_init() { if (!property_info_area.LoadDefaultPath()) { LOG(FATAL) << "Failed to load serialized property info file"; } + + // Report a valid verified boot chain to make Google SafetyNet integrity + // checks pass. This needs to be done before parsing the kernel cmdline as + // these properties are read-only and will be set to invalid values with + // androidboot cmdline arguments. + SetSafetyNetProps(); } bool CanReadProperty(const std::string& source_context, const std::string& name) { @@ -544,6 +551,13 @@ uint32_t InitPropertySet(const std::string& name, const std::string& value) { return result; } +static void SetSafetyNetProps() { + InitPropertySet("ro.boot.flash.locked", "1"); + InitPropertySet("ro.boot.verifiedbootstate", "green"); + InitPropertySet("ro.boot.veritymode", "enforcing"); + InitPropertySet("ro.boot.vbmeta.device_state", "locked"); +} + uint32_t (*property_set)(const std::string& name, const std::string& value) = InitPropertySet; static void handle_property_set_fd() {