1/* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#define TRACE_TAG ADB 18 19#include "sysdeps.h" 20 21#include <fcntl.h> 22#include <inttypes.h> 23#include <libavb_user/libavb_user.h> 24#include <stdarg.h> 25#include <stdio.h> 26#include <sys/stat.h> 27 28#include "android-base/properties.h" 29#include "android-base/stringprintf.h" 30#include <log/log_properties.h> 31 32#include "adb.h" 33#include "adb_io.h" 34#include "adb_unique_fd.h" 35#include "fs_mgr.h" 36#include "remount_service.h" 37 38#include "fec/io.h" 39 40struct fstab *fstab; 41 42#ifdef ALLOW_ADBD_DISABLE_VERITY 43static const bool kAllowDisableVerity = true; 44#else 45static const bool kAllowDisableVerity = false; 46#endif 47 48/* Turn verity on/off */ 49static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point, 50 bool enable) { 51 if (!make_block_device_writable(block_device)) { 52 WriteFdFmt(fd, "Could not make block device %s writable (%s).\n", 53 block_device, strerror(errno)); 54 return false; 55 } 56 57 fec::io fh(block_device, O_RDWR); 58 59 if (!fh) { 60 WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno)); 61 WriteFdFmt(fd, "Maybe run adb root?\n"); 62 return false; 63 } 64 65 fec_verity_metadata metadata; 66 67 if (!fh.get_verity_metadata(metadata)) { 68 WriteFdFmt(fd, "Couldn't find verity metadata!\n"); 69 return false; 70 } 71 72 if (!enable && metadata.disabled) { 73 WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point); 74 return false; 75 } 76 77 if (enable && !metadata.disabled) { 78 WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point); 79 return false; 80 } 81 82 if (!fh.set_verity_status(enable)) { 83 WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n", 84 enable ? "enabled" : "disabled", 85 block_device, strerror(errno)); 86 return false; 87 } 88 89 WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point); 90 return true; 91} 92 93/* Helper function to get A/B suffix, if any. If the device isn't 94 * using A/B the empty string is returned. Otherwise either "_a", 95 * "_b", ... is returned. 96 * 97 * Note that since sometime in O androidboot.slot_suffix is deprecated 98 * and androidboot.slot should be used instead. Since bootloaders may 99 * be out of sync with the OS, we check both and for extra safety 100 * prepend a leading underscore if there isn't one already. 101 */ 102static std::string get_ab_suffix() { 103 std::string ab_suffix = android::base::GetProperty("ro.boot.slot_suffix", ""); 104 if (ab_suffix == "") { 105 ab_suffix = android::base::GetProperty("ro.boot.slot", ""); 106 } 107 if (ab_suffix.size() > 0 && ab_suffix[0] != '_') { 108 ab_suffix = std::string("_") + ab_suffix; 109 } 110 return ab_suffix; 111} 112 113/* Use AVB to turn verity on/off */ 114static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) { 115 std::string ab_suffix = get_ab_suffix(); 116 117 bool verity_enabled; 118 if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) { 119 WriteFdFmt(fd, "Error getting verity state\n"); 120 return false; 121 } 122 123 if ((verity_enabled && enable_verity) || (!verity_enabled && !enable_verity)) { 124 WriteFdFmt(fd, "verity is already %s\n", verity_enabled ? "enabled" : "disabled"); 125 return false; 126 } 127 128 if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) { 129 WriteFdFmt(fd, "Error setting verity\n"); 130 return false; 131 } 132 133 WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled"); 134 return true; 135} 136 137void set_verity_enabled_state_service(int fd, void* cookie) { 138 unique_fd closer(fd); 139 bool any_changed = false; 140 141 bool enable = (cookie != NULL); 142 143 // Figure out if we're using VB1.0 or VB2.0 (aka AVB) - by 144 // contract, androidboot.vbmeta.digest is set by the bootloader 145 // when using AVB). 146 bool using_avb = !android::base::GetProperty("ro.boot.vbmeta.digest", "").empty(); 147 148 // If using AVB, dm-verity is used on any build so we want it to 149 // be possible to disable/enable on any build (except USER). For 150 // VB1.0 dm-verity is only enabled on certain builds. 151 if (!using_avb) { 152 if (!kAllowDisableVerity) { 153 WriteFdFmt(fd, "%s-verity only works for userdebug builds\n", 154 enable ? "enable" : "disable"); 155 } 156 157 if (!android::base::GetBoolProperty("ro.secure", false)) { 158 WriteFdFmt(fd, "verity not enabled - ENG build\n"); 159 return; 160 } 161 } 162 163 // Should never be possible to disable dm-verity on a USER build 164 // regardless of using AVB or VB1.0. 165 if (!__android_log_is_debuggable()) { 166 WriteFdFmt(fd, "verity cannot be disabled/enabled - USER build\n"); 167 return; 168 } 169 170 if (using_avb) { 171 // Yep, the system is using AVB. 172 AvbOps* ops = avb_ops_user_new(); 173 if (ops == nullptr) { 174 WriteFdFmt(fd, "Error getting AVB ops\n"); 175 return; 176 } 177 if (set_avb_verity_enabled_state(fd, ops, enable)) { 178 any_changed = true; 179 } 180 avb_ops_user_free(ops); 181 } else { 182 // Not using AVB - assume VB1.0. 183 184 // read all fstab entries at once from all sources 185 fstab = fs_mgr_read_fstab_default(); 186 if (!fstab) { 187 WriteFdFmt(fd, "Failed to read fstab\nMaybe run adb root?\n"); 188 return; 189 } 190 191 // Loop through entries looking for ones that vold manages. 192 for (int i = 0; i < fstab->num_entries; i++) { 193 if (fs_mgr_is_verified(&fstab->recs[i])) { 194 if (set_verity_enabled_state(fd, fstab->recs[i].blk_device, 195 fstab->recs[i].mount_point, enable)) { 196 any_changed = true; 197 } 198 } 199 } 200 } 201 202 if (any_changed) { 203 WriteFdFmt(fd, "Now reboot your device for settings to take effect\n"); 204 } 205} 206