27bb6c6608
Previously, the boot process of microdroid was mostly implemented in the init.rc file. microdroid_manager was started first in the background, then apexd, apkdmverity, and zipfuse were executed in sequence. However, in order to correctly implement the app payload verification scheme, most of the early boot process has to be controlled by microdroid_manager. Specifically, apkdmverity should be started "after" the apk roothash is read from the instance disk by microdroid_manager. As an alternative, we could let apkdmverity the read instance disk by itself. However, this is undesirable because doing so requires multiple processes - microdroid_manager and apkdmverity - have access to the instance disk and more seriously the secret key to decrypt it. Another alternative is to let microdroid_manager do the dm-verity configuration which apkdmverity does. This also is considered undesirable because then we would give the permissions for configuring dm-verity devices to microdroid_manager which is a long-running daemon process. Note that apkdmverity is not a daemon process. This CL introduces a few number of changes which are required to let microdroid_manager directly control the early boot process: 1) microdroid_manager is allowed to start the services apkdmverity and zipfuse by using the `ctl.start` sysprop. 2) apkdmverity is allowed to use bootstrap bionic libraries as it is now executed before APEXd activates the APEXes. 3) A new sysprop `microdroid_manager.apk_roothash` is added. It is written by microdroid_manager and read by apkdmverity. It contains the roothash read from the instance disk. This value is not a secret. 4) Another new sysprop `apex_config.done` is added. It is set by init just after `perform_apex_config` and read by microdroid_manager. Microdroid_manager uses this to wait until linker configuration is ready so that it can execute app payloads with the config. Bug: 193504400 Test: atest MicrodroidHostTestCases Change-Id: If29ce17d7a6cb4859e8ceeffb321724e7f11bf82
36 lines
1.4 KiB
Text
36 lines
1.4 KiB
Text
# apkdmverity is a program that protects a signed APK file using dm-verity.
|
|
|
|
type apkdmverity, domain, coredomain;
|
|
type apkdmverity_exec, exec_type, file_type, system_file_type;
|
|
|
|
# allow domain transition from init
|
|
init_daemon_domain(apkdmverity)
|
|
|
|
# apkdmverity is using bootstrap bionic
|
|
allow apkdmverity system_bootstrap_lib_file:dir r_dir_perms;
|
|
allow apkdmverity system_bootstrap_lib_file:file { execute read open getattr map };
|
|
|
|
# apkdmverity accesses "payload metadata disk" which points to
|
|
# a /dev/vd* block device file.
|
|
allow apkdmverity block_device:dir r_dir_perms;
|
|
allow apkdmverity block_device:lnk_file r_file_perms;
|
|
allow apkdmverity vd_device:blk_file r_file_perms;
|
|
|
|
# allow apkdmverity to create dm-verity devices
|
|
allow apkdmverity dm_device:{chr_file blk_file} rw_file_perms;
|
|
# sys_admin is required to access the device-mapper and mount
|
|
allow apkdmverity self:global_capability_class_set sys_admin;
|
|
|
|
# allow apkdmverity to create loop devices with /dev/loop-control
|
|
allow apkdmverity loop_control_device:chr_file rw_file_perms;
|
|
|
|
# allow apkdmverity to read the roothash passed from microdroid_manager
|
|
get_prop(apkdmverity, microdroid_manager_roothash_prop)
|
|
|
|
# allow apkdmverity to access loop devices
|
|
allow apkdmverity loop_device:blk_file rw_file_perms;
|
|
allowxperm apkdmverity loop_device:blk_file ioctl {
|
|
LOOP_SET_STATUS64
|
|
LOOP_SET_FD
|
|
LOOP_SET_DIRECT_IO
|
|
};
|