fs_mgr_verity.c revision 99184bab35c0b88dfc70c8be1d88cfb100dbf4cd 
1/*
2 * Copyright (C) 2013 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include <inttypes.h>
18#include <stdio.h>
19#include <stdlib.h>
20#include <string.h>
21#include <unistd.h>
22#include <fcntl.h>
23#include <ctype.h>
24#include <sys/mount.h>
25#include <sys/stat.h>
26#include <errno.h>
27#include <sys/types.h>
28#include <sys/wait.h>
29#include <libgen.h>
30#include <time.h>
31
32#include <private/android_filesystem_config.h>
33#include <cutils/properties.h>
34#include <logwrap/logwrap.h>
35
36#include "mincrypt/rsa.h"
37#include "mincrypt/sha.h"
38#include "mincrypt/sha256.h"
39
40#include "ext4_sb.h"
41
42#include "fs_mgr_priv.h"
43#include "fs_mgr_priv_verity.h"
44
45#define VERITY_METADATA_SIZE 32768
46#define VERITY_TABLE_RSA_KEY "/verity_key"
47
48extern struct fs_info info;
49
50static RSAPublicKey *load_key(char *path)
51{
52    FILE *f;
53    RSAPublicKey *key;
54
55    key = malloc(sizeof(RSAPublicKey));
56    if (!key) {
57        ERROR("Can't malloc key\n");
58        return NULL;
59    }
60
61    f = fopen(path, "r");
62    if (!f) {
63        ERROR("Can't open '%s'\n", path);
64        free(key);
65        return NULL;
66    }
67
68    if (!fread(key, sizeof(*key), 1, f)) {
69        ERROR("Could not read key!");
70        fclose(f);
71        free(key);
72        return NULL;
73    }
74
75    if (key->len != RSANUMWORDS) {
76        ERROR("Invalid key length %d\n", key->len);
77        fclose(f);
78        free(key);
79        return NULL;
80    }
81
82    fclose(f);
83    return key;
84}
85
86static int verify_table(char *signature, char *table, int table_length)
87{
88    RSAPublicKey *key;
89    uint8_t hash_buf[SHA256_DIGEST_SIZE];
90    int retval = -1;
91
92    // Hash the table
93    SHA256_hash((uint8_t*)table, table_length, hash_buf);
94
95    // Now get the public key from the keyfile
96    key = load_key(VERITY_TABLE_RSA_KEY);
97    if (!key) {
98        ERROR("Couldn't load verity keys");
99        goto out;
100    }
101
102    // verify the result
103    if (!RSA_verify(key,
104                    (uint8_t*) signature,
105                    RSANUMBYTES,
106                    (uint8_t*) hash_buf,
107                    SHA256_DIGEST_SIZE)) {
108        ERROR("Couldn't verify table.");
109        goto out;
110    }
111
112    retval = 0;
113
114out:
115    free(key);
116    return retval;
117}
118
119static int get_target_device_size(char *blk_device, uint64_t *device_size)
120{
121    int data_device;
122    struct ext4_super_block sb;
123    struct fs_info info;
124
125    info.len = 0;  /* Only len is set to 0 to ask the device for real size. */
126
127    data_device = TEMP_FAILURE_RETRY(open(blk_device, O_RDONLY | O_CLOEXEC));
128    if (data_device == -1) {
129        ERROR("Error opening block device (%s)", strerror(errno));
130        return -1;
131    }
132
133    if (TEMP_FAILURE_RETRY(lseek64(data_device, 1024, SEEK_SET)) < 0) {
134        ERROR("Error seeking to superblock");
135        TEMP_FAILURE_RETRY(close(data_device));
136        return -1;
137    }
138
139    if (TEMP_FAILURE_RETRY(read(data_device, &sb, sizeof(sb))) != sizeof(sb)) {
140        ERROR("Error reading superblock");
141        TEMP_FAILURE_RETRY(close(data_device));
142        return -1;
143    }
144
145    ext4_parse_sb(&sb, &info);
146    *device_size = info.len;
147
148    TEMP_FAILURE_RETRY(close(data_device));
149    return 0;
150}
151
152static int read_verity_metadata(char *block_device, char **signature, char **table)
153{
154    unsigned magic_number;
155    unsigned table_length;
156    uint64_t device_length;
157    int protocol_version;
158    int device;
159    int retval = FS_MGR_SETUP_VERITY_FAIL;
160    *signature = 0;
161    *table = 0;
162
163    device = TEMP_FAILURE_RETRY(open(block_device, O_RDONLY | O_CLOEXEC));
164    if (device == -1) {
165        ERROR("Could not open block device %s (%s).\n", block_device, strerror(errno));
166        goto out;
167    }
168
169    // find the start of the verity metadata
170    if (get_target_device_size(block_device, &device_length) < 0) {
171        ERROR("Could not get target device size.\n");
172        goto out;
173    }
174    if (TEMP_FAILURE_RETRY(lseek64(device, device_length, SEEK_SET)) < 0) {
175        ERROR("Could not seek to start of verity metadata block.\n");
176        goto out;
177    }
178
179    // check the magic number
180    if (TEMP_FAILURE_RETRY(read(device, &magic_number, sizeof(magic_number))) !=
181            sizeof(magic_number)) {
182        ERROR("Couldn't read magic number!\n");
183        goto out;
184    }
185
186#ifdef ALLOW_ADBD_DISABLE_VERITY
187    if (magic_number == VERITY_METADATA_MAGIC_DISABLE) {
188        retval = FS_MGR_SETUP_VERITY_DISABLED;
189        INFO("Attempt to cleanly disable verity - only works in USERDEBUG");
190        goto out;
191    }
192#endif
193
194    if (magic_number != VERITY_METADATA_MAGIC_NUMBER) {
195        ERROR("Couldn't find verity metadata at offset %"PRIu64"!\n",
196              device_length);
197        goto out;
198    }
199
200    // check the protocol version
201    if (TEMP_FAILURE_RETRY(read(device, &protocol_version,
202            sizeof(protocol_version))) != sizeof(protocol_version)) {
203        ERROR("Couldn't read verity metadata protocol version!\n");
204        goto out;
205    }
206    if (protocol_version != 0) {
207        ERROR("Got unknown verity metadata protocol version %d!\n", protocol_version);
208        goto out;
209    }
210
211    // get the signature
212    *signature = (char*) malloc(RSANUMBYTES);
213    if (!*signature) {
214        ERROR("Couldn't allocate memory for signature!\n");
215        goto out;
216    }
217    if (TEMP_FAILURE_RETRY(read(device, *signature, RSANUMBYTES)) != RSANUMBYTES) {
218        ERROR("Couldn't read signature from verity metadata!\n");
219        goto out;
220    }
221
222    // get the size of the table
223    if (TEMP_FAILURE_RETRY(read(device, &table_length, sizeof(table_length))) !=
224            sizeof(table_length)) {
225        ERROR("Couldn't get the size of the verity table from metadata!\n");
226        goto out;
227    }
228
229    // get the table + null terminator
230    *table = malloc(table_length + 1);
231    if (!*table) {
232        ERROR("Couldn't allocate memory for verity table!\n");
233        goto out;
234    }
235    if (TEMP_FAILURE_RETRY(read(device, *table, table_length)) !=
236            (ssize_t)table_length) {
237        ERROR("Couldn't read the verity table from metadata!\n");
238        goto out;
239    }
240
241    (*table)[table_length] = 0;
242    retval = FS_MGR_SETUP_VERITY_SUCCESS;
243
244out:
245    if (device != -1)
246        TEMP_FAILURE_RETRY(close(device));
247
248    if (retval != FS_MGR_SETUP_VERITY_SUCCESS) {
249        free(*table);
250        free(*signature);
251        *table = 0;
252        *signature = 0;
253    }
254
255    return retval;
256}
257
258static void verity_ioctl_init(struct dm_ioctl *io, char *name, unsigned flags)
259{
260    memset(io, 0, DM_BUF_SIZE);
261    io->data_size = DM_BUF_SIZE;
262    io->data_start = sizeof(struct dm_ioctl);
263    io->version[0] = 4;
264    io->version[1] = 0;
265    io->version[2] = 0;
266    io->flags = flags | DM_READONLY_FLAG;
267    if (name) {
268        strlcpy(io->name, name, sizeof(io->name));
269    }
270}
271
272static int create_verity_device(struct dm_ioctl *io, char *name, int fd)
273{
274    verity_ioctl_init(io, name, 1);
275    if (ioctl(fd, DM_DEV_CREATE, io)) {
276        ERROR("Error creating device mapping (%s)", strerror(errno));
277        return -1;
278    }
279    return 0;
280}
281
282static int get_verity_device_name(struct dm_ioctl *io, char *name, int fd, char **dev_name)
283{
284    verity_ioctl_init(io, name, 0);
285    if (ioctl(fd, DM_DEV_STATUS, io)) {
286        ERROR("Error fetching verity device number (%s)", strerror(errno));
287        return -1;
288    }
289    int dev_num = (io->dev & 0xff) | ((io->dev >> 12) & 0xfff00);
290    if (asprintf(dev_name, "/dev/block/dm-%u", dev_num) < 0) {
291        ERROR("Error getting verity block device name (%s)", strerror(errno));
292        return -1;
293    }
294    return 0;
295}
296
297static int load_verity_table(struct dm_ioctl *io, char *name, char *blockdev, int fd, char *table)
298{
299    char *verity_params;
300    char *buffer = (char*) io;
301    uint64_t device_size = 0;
302
303    if (get_target_device_size(blockdev, &device_size) < 0) {
304        return -1;
305    }
306
307    verity_ioctl_init(io, name, DM_STATUS_TABLE_FLAG);
308
309    struct dm_target_spec *tgt = (struct dm_target_spec *) &buffer[sizeof(struct dm_ioctl)];
310
311    // set tgt arguments here
312    io->target_count = 1;
313    tgt->status=0;
314    tgt->sector_start=0;
315    tgt->length=device_size/512;
316    strcpy(tgt->target_type, "verity");
317
318    // build the verity params here
319    verity_params = buffer + sizeof(struct dm_ioctl) + sizeof(struct dm_target_spec);
320    if (sprintf(verity_params, "%s", table) < 0) {
321        return -1;
322    }
323
324    // set next target boundary
325    verity_params += strlen(verity_params) + 1;
326    verity_params = (char*) (((unsigned long)verity_params + 7) & ~8);
327    tgt->next = verity_params - buffer;
328
329    // send the ioctl to load the verity table
330    if (ioctl(fd, DM_TABLE_LOAD, io)) {
331        ERROR("Error loading verity table (%s)", strerror(errno));
332        return -1;
333    }
334
335    return 0;
336}
337
338static int resume_verity_table(struct dm_ioctl *io, char *name, int fd)
339{
340    verity_ioctl_init(io, name, 0);
341    if (ioctl(fd, DM_DEV_SUSPEND, io)) {
342        ERROR("Error activating verity device (%s)", strerror(errno));
343        return -1;
344    }
345    return 0;
346}
347
348static int test_access(char *device) {
349    int tries = 25;
350    while (tries--) {
351        if (!access(device, F_OK) || errno != ENOENT) {
352            return 0;
353        }
354        usleep(40 * 1000);
355    }
356    return -1;
357}
358
359static int set_verified_property(char *name) {
360    int ret;
361    char *key;
362    ret = asprintf(&key, "partition.%s.verified", name);
363    if (ret < 0) {
364        ERROR("Error formatting verified property");
365        return ret;
366    }
367    ret = PROP_NAME_MAX - strlen(key);
368    if (ret < 0) {
369        ERROR("Verified property name is too long");
370        return -1;
371    }
372    ret = property_set(key, "1");
373    if (ret < 0)
374        ERROR("Error setting verified property %s: %d", key, ret);
375    free(key);
376    return ret;
377}
378
379int fs_mgr_setup_verity(struct fstab_rec *fstab) {
380
381    int retval = FS_MGR_SETUP_VERITY_FAIL;
382    int fd = -1;
383
384    char *verity_blk_name = 0;
385    char *verity_table = 0;
386    char *verity_table_signature = 0;
387
388    char buffer[DM_BUF_SIZE];
389    struct dm_ioctl *io = (struct dm_ioctl *) buffer;
390    char *mount_point = basename(fstab->mount_point);
391
392    // set the dm_ioctl flags
393    io->flags |= 1;
394    io->target_count = 1;
395
396    // check to ensure that the verity device is ext4
397    // TODO: support non-ext4 filesystems
398    if (strcmp(fstab->fs_type, "ext4")) {
399        ERROR("Cannot verify non-ext4 device (%s)", fstab->fs_type);
400        return retval;
401    }
402
403    // read the verity block at the end of the block device
404    // send error code up the chain so we can detect attempts to disable verity
405    retval = read_verity_metadata(fstab->blk_device,
406                                  &verity_table_signature,
407                                  &verity_table);
408    if (retval < 0) {
409        goto out;
410    }
411
412    retval = FS_MGR_SETUP_VERITY_FAIL;
413
414    // get the device mapper fd
415    if ((fd = open("/dev/device-mapper", O_RDWR)) < 0) {
416        ERROR("Error opening device mapper (%s)", strerror(errno));
417        goto out;
418    }
419
420    // create the device
421    if (create_verity_device(io, mount_point, fd) < 0) {
422        ERROR("Couldn't create verity device!");
423        goto out;
424    }
425
426    // get the name of the device file
427    if (get_verity_device_name(io, mount_point, fd, &verity_blk_name) < 0) {
428        ERROR("Couldn't get verity device number!");
429        goto out;
430    }
431
432    // verify the signature on the table
433    if (verify_table(verity_table_signature,
434                            verity_table,
435                            strlen(verity_table)) < 0) {
436        goto out;
437    }
438
439    // load the verity mapping table
440    if (load_verity_table(io, mount_point, fstab->blk_device, fd, verity_table) < 0) {
441        goto out;
442    }
443
444    // activate the device
445    if (resume_verity_table(io, mount_point, fd) < 0) {
446        goto out;
447    }
448
449    // assign the new verity block device as the block device
450    free(fstab->blk_device);
451    fstab->blk_device = verity_blk_name;
452    verity_blk_name = 0;
453
454    // make sure we've set everything up properly
455    if (test_access(fstab->blk_device) < 0) {
456        goto out;
457    }
458
459    // set the property indicating that the partition is verified
460    retval = set_verified_property(mount_point);
461
462out:
463    if (fd != -1) {
464        close(fd);
465    }
466
467    free(verity_table);
468    free(verity_table_signature);
469    free(verity_blk_name);
470
471    return retval;
472}
473