blob: 49e0363a1b6e7bd224c663d153b9c43435d06787 [file] [log] [blame]
Paul Lawrence5f356482014-10-09 14:22:49 +00001/*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Yabin Cui19bec5b2015-09-22 15:52:57 -070017#define TRACE_TAG ADB
Dan Albertdb6fe642015-03-19 15:21:08 -070018
19#include "sysdeps.h"
20
Dan Albert59bcbe22015-01-26 17:49:17 -080021#include <fcntl.h>
22#include <inttypes.h>
David Zeuthen499ad6c2017-04-12 16:07:06 -040023#include <libavb_user/libavb_user.h>
Dan Albert59bcbe22015-01-26 17:49:17 -080024#include <stdarg.h>
Dan Albert59bcbe22015-01-26 17:49:17 -080025#include <stdio.h>
26#include <sys/stat.h>
Paul Lawrence5f356482014-10-09 14:22:49 +000027
Elliott Hughes8b249d22016-09-23 15:40:03 -070028#include "android-base/properties.h"
29#include "android-base/stringprintf.h"
Steven Morelandb087d302017-04-13 23:48:57 -070030#include <log/log_properties.h>
Dan Albertdb6fe642015-03-19 15:21:08 -070031
32#include "adb.h"
Elliott Hughesfb596842015-05-01 17:04:38 -070033#include "adb_io.h"
Elliott Hughes8b249d22016-09-23 15:40:03 -070034#include "adb_unique_fd.h"
Dan Albert59bcbe22015-01-26 17:49:17 -080035#include "fs_mgr.h"
Elliott Hughesdedf7672015-03-16 21:58:32 +000036#include "remount_service.h"
Paul Lawrence5f356482014-10-09 14:22:49 +000037
Sami Tolvanen778f5002015-10-20 13:24:24 +010038#include "fec/io.h"
39
Paul Lawrence5f356482014-10-09 14:22:49 +000040struct fstab *fstab;
41
Dan Albert59bcbe22015-01-26 17:49:17 -080042#ifdef ALLOW_ADBD_DISABLE_VERITY
43static const bool kAllowDisableVerity = true;
44#else
45static const bool kAllowDisableVerity = false;
46#endif
47
Paul Lawrence8ba2b022014-12-03 15:31:57 -080048/* Turn verity on/off */
David Zeuthen499ad6c2017-04-12 16:07:06 -040049static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
50 bool enable) {
Elliott Hughes689011f2015-05-11 11:55:25 -070051 if (!make_block_device_writable(block_device)) {
Elliott Hughesfb596842015-05-01 17:04:38 -070052 WriteFdFmt(fd, "Could not make block device %s writable (%s).\n",
53 block_device, strerror(errno));
David Zeuthen499ad6c2017-04-12 16:07:06 -040054 return false;
Sami Tolvanen5638a1a2015-01-02 13:30:50 +000055 }
56
Sami Tolvanen778f5002015-10-20 13:24:24 +010057 fec::io fh(block_device, O_RDWR);
58
59 if (!fh) {
Elliott Hughesfb596842015-05-01 17:04:38 -070060 WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
Sami Tolvanen778f5002015-10-20 13:24:24 +010061 WriteFdFmt(fd, "Maybe run adb root?\n");
David Zeuthen499ad6c2017-04-12 16:07:06 -040062 return false;
Paul Lawrence5f356482014-10-09 14:22:49 +000063 }
64
Sami Tolvanen778f5002015-10-20 13:24:24 +010065 fec_verity_metadata metadata;
66
67 if (!fh.get_verity_metadata(metadata)) {
68 WriteFdFmt(fd, "Couldn't find verity metadata!\n");
David Zeuthen499ad6c2017-04-12 16:07:06 -040069 return false;
Paul Lawrence5f356482014-10-09 14:22:49 +000070 }
71
Sami Tolvanen778f5002015-10-20 13:24:24 +010072 if (!enable && metadata.disabled) {
Elliott Hughesfb596842015-05-01 17:04:38 -070073 WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point);
David Zeuthen499ad6c2017-04-12 16:07:06 -040074 return false;
Paul Lawrence5f356482014-10-09 14:22:49 +000075 }
76
Sami Tolvanen778f5002015-10-20 13:24:24 +010077 if (enable && !metadata.disabled) {
Elliott Hughesfb596842015-05-01 17:04:38 -070078 WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point);
David Zeuthen499ad6c2017-04-12 16:07:06 -040079 return false;
Paul Lawrence8ba2b022014-12-03 15:31:57 -080080 }
81
Sami Tolvanen778f5002015-10-20 13:24:24 +010082 if (!fh.set_verity_status(enable)) {
Elliott Hughesfb596842015-05-01 17:04:38 -070083 WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n",
84 enable ? "enabled" : "disabled",
85 block_device, strerror(errno));
David Zeuthen499ad6c2017-04-12 16:07:06 -040086 return false;
Paul Lawrence5f356482014-10-09 14:22:49 +000087 }
88
Elliott Hughesfb596842015-05-01 17:04:38 -070089 WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
David Zeuthen499ad6c2017-04-12 16:07:06 -040090 return true;
91}
92
93/* Helper function to get A/B suffix, if any. If the device isn't
94 * using A/B the empty string is returned. Otherwise either "_a",
95 * "_b", ... is returned.
David Zeuthen499ad6c2017-04-12 16:07:06 -040096 */
97static std::string get_ab_suffix() {
Xin Life0ee3d2017-12-06 11:52:22 -080098 return android::base::GetProperty("ro.boot.slot_suffix", "");
David Zeuthen499ad6c2017-04-12 16:07:06 -040099}
100
101/* Use AVB to turn verity on/off */
102static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
103 std::string ab_suffix = get_ab_suffix();
104
105 bool verity_enabled;
106 if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) {
107 WriteFdFmt(fd, "Error getting verity state\n");
108 return false;
109 }
110
111 if ((verity_enabled && enable_verity) || (!verity_enabled && !enable_verity)) {
112 WriteFdFmt(fd, "verity is already %s\n", verity_enabled ? "enabled" : "disabled");
113 return false;
114 }
115
116 if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) {
117 WriteFdFmt(fd, "Error setting verity\n");
118 return false;
119 }
120
121 WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
122 return true;
Paul Lawrence5f356482014-10-09 14:22:49 +0000123}
124
Elliott Hughes8b249d22016-09-23 15:40:03 -0700125void set_verity_enabled_state_service(int fd, void* cookie) {
126 unique_fd closer(fd);
David Zeuthen499ad6c2017-04-12 16:07:06 -0400127 bool any_changed = false;
Elliott Hughes8b249d22016-09-23 15:40:03 -0700128
Paul Lawrence8ba2b022014-12-03 15:31:57 -0800129 bool enable = (cookie != NULL);
David Zeuthen71dfb9c2017-05-17 10:36:35 -0400130
131 // Figure out if we're using VB1.0 or VB2.0 (aka AVB) - by
132 // contract, androidboot.vbmeta.digest is set by the bootloader
133 // when using AVB).
134 bool using_avb = !android::base::GetProperty("ro.boot.vbmeta.digest", "").empty();
135
136 // If using AVB, dm-verity is used on any build so we want it to
137 // be possible to disable/enable on any build (except USER). For
138 // VB1.0 dm-verity is only enabled on certain builds.
139 if (!using_avb) {
140 if (!kAllowDisableVerity) {
141 WriteFdFmt(fd, "%s-verity only works for userdebug builds\n",
142 enable ? "enable" : "disable");
143 }
144
145 if (!android::base::GetBoolProperty("ro.secure", false)) {
146 WriteFdFmt(fd, "verity not enabled - ENG build\n");
147 return;
148 }
Paul Lawrence5f356482014-10-09 14:22:49 +0000149 }
150
David Zeuthen71dfb9c2017-05-17 10:36:35 -0400151 // Should never be possible to disable dm-verity on a USER build
152 // regardless of using AVB or VB1.0.
Mark Salyzync75f65f2016-03-28 15:52:13 -0700153 if (!__android_log_is_debuggable()) {
Elliott Hughes8b249d22016-09-23 15:40:03 -0700154 WriteFdFmt(fd, "verity cannot be disabled/enabled - USER build\n");
155 return;
156 }
157
David Zeuthen71dfb9c2017-05-17 10:36:35 -0400158 if (using_avb) {
159 // Yep, the system is using AVB.
David Zeuthen499ad6c2017-04-12 16:07:06 -0400160 AvbOps* ops = avb_ops_user_new();
161 if (ops == nullptr) {
162 WriteFdFmt(fd, "Error getting AVB ops\n");
163 return;
164 }
165 if (set_avb_verity_enabled_state(fd, ops, enable)) {
166 any_changed = true;
167 }
168 avb_ops_user_free(ops);
169 } else {
170 // Not using AVB - assume VB1.0.
Elliott Hughes8b249d22016-09-23 15:40:03 -0700171
David Zeuthen499ad6c2017-04-12 16:07:06 -0400172 // read all fstab entries at once from all sources
173 fstab = fs_mgr_read_fstab_default();
174 if (!fstab) {
175 WriteFdFmt(fd, "Failed to read fstab\nMaybe run adb root?\n");
176 return;
177 }
178
179 // Loop through entries looking for ones that vold manages.
180 for (int i = 0; i < fstab->num_entries; i++) {
181 if (fs_mgr_is_verified(&fstab->recs[i])) {
182 if (set_verity_enabled_state(fd, fstab->recs[i].blk_device,
183 fstab->recs[i].mount_point, enable)) {
184 any_changed = true;
185 }
Elliott Hughes8b249d22016-09-23 15:40:03 -0700186 }
187 }
188 }
189
190 if (any_changed) {
191 WriteFdFmt(fd, "Now reboot your device for settings to take effect\n");
192 }
Paul Lawrence5f356482014-10-09 14:22:49 +0000193}