tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Also load fs-verity cert from /system/etc/security/fsverity/

Browse source 
Bug: 153112812
Test: able to use the new cert after reboot
Change-Id: I01085913f81898592a3a1edcaa97aff6dc8ac89c
This commit is contained in:
Victor Hsieh 2020-04-03 15:17:37 -07:00
parent 21b6c38fa0
commit 753ac2a34b
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
fsverity_init/fsverity_init.cpp
View file

@ -37,10 +37,8 @@ bool LoadKeyToKeyring(key_serial_t keyring_id, const char* desc, const char* dat
return true; return true;
} }
void LoadKeyFromVerifiedPartitions(key_serial_t keyring_id) { void LoadKeyFromDirectory(key_serial_t keyring_id, const char* keyname, const char* dir) {
const char* dir = "/product/etc/security/fsverity";
if (!std::filesystem::exists(dir)) { if (!std::filesystem::exists(dir)) {
LOG(ERROR) << "no such dir: " << dir;
return; return;
} }
for (const auto& entry : std::filesystem::directory_iterator(dir)) { for (const auto& entry : std::filesystem::directory_iterator(dir)) {
@ -49,12 +47,19 @@ void LoadKeyFromVerifiedPartitions(key_serial_t keyring_id) {
if (!android::base::ReadFileToString(entry.path(), &content)) { if (!android::base::ReadFileToString(entry.path(), &content)) {
continue; continue;
} }
if (!LoadKeyToKeyring(keyring_id, "fsv_system", content.c_str(), content.size())) { if (!LoadKeyToKeyring(keyring_id, keyname, content.c_str(), content.size())) {
LOG(ERROR) << "Failed to load key from " << entry.path(); LOG(ERROR) << "Failed to load key from " << entry.path();
} }
} }
} }
void LoadKeyFromVerifiedPartitions(key_serial_t keyring_id) {
// NB: Directories need to be synced with FileIntegrityService.java in
// frameworks/base.
LoadKeyFromDirectory(keyring_id, "fsv_system", "/system/etc/security/fsverity");
LoadKeyFromDirectory(keyring_id, "fsv_product", "/product/etc/security/fsverity");
}
int main(int /*argc*/, const char** /*argv*/) { int main(int /*argc*/, const char** /*argv*/) {
key_serial_t keyring_id = android::GetKeyringId(".fs-verity"); key_serial_t keyring_id = android::GetKeyringId(".fs-verity");
if (keyring_id < 0) { if (keyring_id < 0) {