Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Yabin Cui | aed3c61 | 2015-09-22 15:52:57 -0700 | [diff] [blame] | 17 | #define TRACE_TAG ADB |
Dan Albert | 3313426 | 2015-03-19 15:21:08 -0700 | [diff] [blame] | 18 | |
| 19 | #include "sysdeps.h" |
| 20 | |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 21 | #include <fcntl.h> |
| 22 | #include <inttypes.h> |
| 23 | #include <stdarg.h> |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 24 | #include <stdio.h> |
| 25 | #include <sys/stat.h> |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 26 | |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 27 | #include "cutils/properties.h" |
Dan Albert | 3313426 | 2015-03-19 15:21:08 -0700 | [diff] [blame] | 28 | |
| 29 | #include "adb.h" |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 30 | #include "adb_io.h" |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 31 | #include "fs_mgr.h" |
Elliott Hughes | ec7a667 | 2015-03-16 21:58:32 +0000 | [diff] [blame] | 32 | #include "remount_service.h" |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 33 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 34 | #include "fec/io.h" |
| 35 | |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 36 | #define FSTAB_PREFIX "/fstab." |
| 37 | struct fstab *fstab; |
| 38 | |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 39 | #ifdef ALLOW_ADBD_DISABLE_VERITY |
| 40 | static const bool kAllowDisableVerity = true; |
| 41 | #else |
| 42 | static const bool kAllowDisableVerity = false; |
| 43 | #endif |
| 44 | |
Paul Lawrence | 982089d | 2014-12-03 15:31:57 -0800 | [diff] [blame] | 45 | /* Turn verity on/off */ |
| 46 | static int set_verity_enabled_state(int fd, const char *block_device, |
| 47 | const char* mount_point, bool enable) |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 48 | { |
Elliott Hughes | 9aa4fda | 2015-05-11 11:55:25 -0700 | [diff] [blame] | 49 | if (!make_block_device_writable(block_device)) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 50 | WriteFdFmt(fd, "Could not make block device %s writable (%s).\n", |
| 51 | block_device, strerror(errno)); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 52 | return -1; |
Sami Tolvanen | 13449cd | 2015-01-02 13:30:50 +0000 | [diff] [blame] | 53 | } |
| 54 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 55 | fec::io fh(block_device, O_RDWR); |
| 56 | |
| 57 | if (!fh) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 58 | WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno)); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 59 | WriteFdFmt(fd, "Maybe run adb root?\n"); |
| 60 | return -1; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 61 | } |
| 62 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 63 | fec_verity_metadata metadata; |
| 64 | |
| 65 | if (!fh.get_verity_metadata(metadata)) { |
| 66 | WriteFdFmt(fd, "Couldn't find verity metadata!\n"); |
| 67 | return -1; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 68 | } |
| 69 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 70 | if (!enable && metadata.disabled) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 71 | WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 72 | return -1; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 73 | } |
| 74 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 75 | if (enable && !metadata.disabled) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 76 | WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 77 | return -1; |
Paul Lawrence | 982089d | 2014-12-03 15:31:57 -0800 | [diff] [blame] | 78 | } |
| 79 | |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 80 | if (!fh.set_verity_status(enable)) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 81 | WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n", |
| 82 | enable ? "enabled" : "disabled", |
| 83 | block_device, strerror(errno)); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 84 | return -1; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 85 | } |
| 86 | |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 87 | WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point); |
Sami Tolvanen | 8ad8076 | 2015-10-20 13:24:24 +0100 | [diff] [blame] | 88 | return 0; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 89 | } |
| 90 | |
Paul Lawrence | 982089d | 2014-12-03 15:31:57 -0800 | [diff] [blame] | 91 | void set_verity_enabled_state_service(int fd, void* cookie) |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 92 | { |
Paul Lawrence | 982089d | 2014-12-03 15:31:57 -0800 | [diff] [blame] | 93 | bool enable = (cookie != NULL); |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 94 | if (kAllowDisableVerity) { |
| 95 | char fstab_filename[PROPERTY_VALUE_MAX + sizeof(FSTAB_PREFIX)]; |
| 96 | char propbuf[PROPERTY_VALUE_MAX]; |
| 97 | int i; |
| 98 | bool any_changed = false; |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 99 | |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 100 | property_get("ro.secure", propbuf, "0"); |
| 101 | if (strcmp(propbuf, "1")) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 102 | WriteFdFmt(fd, "verity not enabled - ENG build\n"); |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 103 | goto errout; |
| 104 | } |
| 105 | |
| 106 | property_get("ro.debuggable", propbuf, "0"); |
| 107 | if (strcmp(propbuf, "1")) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 108 | WriteFdFmt(fd, "verity cannot be disabled/enabled - USER build\n"); |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 109 | goto errout; |
| 110 | } |
| 111 | |
| 112 | property_get("ro.hardware", propbuf, ""); |
| 113 | snprintf(fstab_filename, sizeof(fstab_filename), FSTAB_PREFIX"%s", |
| 114 | propbuf); |
| 115 | |
| 116 | fstab = fs_mgr_read_fstab(fstab_filename); |
| 117 | if (!fstab) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 118 | WriteFdFmt(fd, "Failed to open %s\nMaybe run adb root?\n", fstab_filename); |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 119 | goto errout; |
| 120 | } |
| 121 | |
| 122 | /* Loop through entries looking for ones that vold manages */ |
| 123 | for (i = 0; i < fstab->num_entries; i++) { |
| 124 | if(fs_mgr_is_verified(&fstab->recs[i])) { |
| 125 | if (!set_verity_enabled_state(fd, fstab->recs[i].blk_device, |
| 126 | fstab->recs[i].mount_point, |
| 127 | enable)) { |
| 128 | any_changed = true; |
| 129 | } |
| 130 | } |
| 131 | } |
| 132 | |
| 133 | if (any_changed) { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 134 | WriteFdFmt(fd, "Now reboot your device for settings to take effect\n"); |
Dan Albert | 1f09bda | 2015-01-26 17:49:17 -0800 | [diff] [blame] | 135 | } |
| 136 | } else { |
Elliott Hughes | ab52c18 | 2015-05-01 17:04:38 -0700 | [diff] [blame] | 137 | WriteFdFmt(fd, "%s-verity only works for userdebug builds\n", |
| 138 | enable ? "enable" : "disable"); |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 139 | } |
| 140 | |
Bernhard Rosenkränzer | 2bd4124 | 2014-12-12 22:22:37 +0100 | [diff] [blame] | 141 | errout: |
Paul Lawrence | ec900bb | 2014-10-09 14:22:49 +0000 | [diff] [blame] | 142 | adb_close(fd); |
| 143 | } |