ART: Boot integrity checks for dalvik cache
Add a boot rc file that checks for boot classpath components
in the dalvik-cache and ensures they are fsverity-protected.
Bug: 125474642
Test: m
Test: manual
Change-Id: I3e7c2926e549c88934d86eb2d1d5264c5930b674
diff --git a/build/apex/Android.bp b/build/apex/Android.bp
index 128a079..dcabfc6 100644
--- a/build/apex/Android.bp
+++ b/build/apex/Android.bp
@@ -188,6 +188,7 @@
prebuilts: art_runtime_data_file_prebuilts
+ ["com.android.runtime.ld.config.txt"],
key: "com.android.runtime.key",
+ required: ["art_apex_boot_integrity"],
}
// Release version of the Runtime APEX module (not containing debug
@@ -358,3 +359,9 @@
name: "art_postinstall_hook",
src: "art_postinstall_hook.sh",
}
+
+sh_binary {
+ name: "art_apex_boot_integrity",
+ src: "art_apex_boot_integrity.sh",
+ init_rc: ["art_apex_boot_integrity.rc"],
+}