commit 0663df489dbd320655beca60a84512aa40a783b3
author Victor Hsieh <victorhsieh@google.com> Mon Jan 07 15:28:27 2019 -0800
committer Victor Hsieh <victorhsieh@google.com> Mon Jan 07 15:31:01 2019 -0800
tree ddd9eaed8251a8b11201642f992fd300aedacc8a
parent 018edf2cb51801cb8de2818c8e40e6de1f9e10fa

Don't check fs-verity in installer session if not enabled

Test: build
Bug: 122442527
Bug: 112037636
Change-Id: I83e5b9f8d5425f8b9cb3ea96b7056dec8fae6978

services/core/java/com/android/server/pm/PackageInstallerSession.java

diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java
index 982daa5..3cb7714 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerSession.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java
@@ -1374,7 +1374,8 @@
                     "Missing existing base package");
         }
         // Default to require only if existing base has fs-verity.
-        mVerityFound = params.mode == SessionParams.MODE_INHERIT_EXISTING
+        mVerityFound = PackageManagerServiceUtils.isApkVerityEnabled()
+                && params.mode == SessionParams.MODE_INHERIT_EXISTING
                 && VerityUtils.hasFsverity(pkgInfo.applicationInfo.getBaseCodePath());
 
         try {

services/core/java/com/android/server/pm/PackageManagerService.java

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index fe89be6..522ab0b 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8572,7 +8572,7 @@
      * match one in a trusted source, and should be done separately.
      */
     private boolean canSkipForcedApkVerification(String apkPath) {
-        if (!PackageManagerServiceUtils.isLegacyApkVerityMode()) {
+        if (!PackageManagerServiceUtils.isLegacyApkVerityEnabled()) {
             return VerityUtils.hasFsverity(apkPath);
         }
 
@@ -16866,10 +16866,11 @@
      */
     private void setUpFsVerityIfPossible(PackageParser.Package pkg) throws InstallerException,
             PrepareFailure, IOException, DigestException, NoSuchAlgorithmException {
-        if (!PackageManagerServiceUtils.isApkVerityEnabled()) {
+        final boolean standardMode = PackageManagerServiceUtils.isApkVerityEnabled();
+        final boolean legacyMode = PackageManagerServiceUtils.isLegacyApkVerityEnabled();
+        if (!standardMode && !legacyMode) {
             return;
         }
-        final boolean legacyMode = PackageManagerServiceUtils.isLegacyApkVerityMode();
 
         // Collect files we care for fs-verity setup.
         ArrayMap<String, String> fsverityCandidates = new ArrayMap<>();

services/core/java/com/android/server/pm/PackageManagerServiceUtils.java

diff --git a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
index 25169a2..6134d30 100644
--- a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
+++ b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
@@ -555,19 +555,19 @@
     /** Standard fs-verity. */
     private static final int FSVERITY_ENABLED = 2;
 
-    /** Returns true if APK Verity is enabled. */
+    /** Returns true if standard APK Verity is enabled. */
     static boolean isApkVerityEnabled() {
-        int mode = SystemProperties.getInt("ro.apk_verity.mode", FSVERITY_DISABLED);
-        return mode == FSVERITY_LEGACY || mode == FSVERITY_ENABLED;
+        return SystemProperties.getInt("ro.apk_verity.mode", FSVERITY_DISABLED) == FSVERITY_ENABLED;
     }
 
-    static boolean isLegacyApkVerityMode() {
+    static boolean isLegacyApkVerityEnabled() {
         return SystemProperties.getInt("ro.apk_verity.mode", FSVERITY_DISABLED) == FSVERITY_LEGACY;
     }
 
     /** Returns true to force apk verification if the updated package (in /data) is a priv app. */
     static boolean isApkVerificationForced(@Nullable PackageSetting disabledPs) {
-        return disabledPs != null && disabledPs.isPrivileged() && isApkVerityEnabled();
+        return disabledPs != null && disabledPs.isPrivileged() && (
+                isApkVerityEnabled() || isLegacyApkVerityEnabled());
     }
 
     /**