1 /* 2 * Copyright (C) 2014 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #define TRACE_TAG ADB 18 19 #include "sysdeps.h" 20 21 #include <fcntl.h> 22 #include <inttypes.h> 23 #include <libavb_user/libavb_user.h> 24 #include <stdarg.h> 25 #include <stdio.h> 26 #include <sys/stat.h> 27 28 #include "android-base/properties.h" 29 #include "android-base/stringprintf.h" 30 #include <log/log_properties.h> 31 32 #include "adb.h" 33 #include "adb_io.h" 34 #include "adb_unique_fd.h" 35 #include "fs_mgr.h" 36 #include "remount_service.h" 37 38 #include "fec/io.h" 39 40 struct fstab *fstab; 41 42 #ifdef ALLOW_ADBD_DISABLE_VERITY 43 static const bool kAllowDisableVerity = true; 44 #else 45 static const bool kAllowDisableVerity = false; 46 #endif 47 48 /* Turn verity on/off */ 49 static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point, 50 bool enable) { 51 if (!make_block_device_writable(block_device)) { 52 WriteFdFmt(fd, "Could not make block device %s writable (%s).\n", 53 block_device, strerror(errno)); 54 return false; 55 } 56 57 fec::io fh(block_device, O_RDWR); 58 59 if (!fh) { 60 WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno)); 61 WriteFdFmt(fd, "Maybe run adb root?\n"); 62 return false; 63 } 64 65 fec_verity_metadata metadata; 66 67 if (!fh.get_verity_metadata(metadata)) { 68 WriteFdFmt(fd, "Couldn't find verity metadata!\n"); 69 return false; 70 } 71 72 if (!enable && metadata.disabled) { 73 WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point); 74 return false; 75 } 76 77 if (enable && !metadata.disabled) { 78 WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point); 79 return false; 80 } 81 82 if (!fh.set_verity_status(enable)) { 83 WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n", 84 enable ? "enabled" : "disabled", 85 block_device, strerror(errno)); 86 return false; 87 } 88 89 WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point); 90 return true; 91 } 92 93 /* Helper function to get A/B suffix, if any. If the device isn't 94 * using A/B the empty string is returned. Otherwise either "_a", 95 * "_b", ... is returned. 96 */ 97 static std::string get_ab_suffix() { 98 return android::base::GetProperty("ro.boot.slot_suffix", ""); 99 } 100 101 static bool is_avb_device_locked() { 102 return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked"; 103 } 104 105 /* Use AVB to turn verity on/off */ 106 static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) { 107 std::string ab_suffix = get_ab_suffix(); 108 bool verity_enabled; 109 110 if (is_avb_device_locked()) { 111 WriteFdFmt(fd, "Device is locked. Please unlock the device first\n"); 112 return false; 113 } 114 115 if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) { 116 WriteFdFmt(fd, "Error getting verity state. Try adb root first?\n"); 117 return false; 118 } 119 120 if ((verity_enabled && enable_verity) || (!verity_enabled && !enable_verity)) { 121 WriteFdFmt(fd, "verity is already %s\n", verity_enabled ? "enabled" : "disabled"); 122 return false; 123 } 124 125 if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) { 126 WriteFdFmt(fd, "Error setting verity\n"); 127 return false; 128 } 129 130 WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled"); 131 return true; 132 } 133 134 void set_verity_enabled_state_service(int fd, void* cookie) { 135 unique_fd closer(fd); 136 bool any_changed = false; 137 138 bool enable = (cookie != NULL); 139 140 // Figure out if we're using VB1.0 or VB2.0 (aka AVB) - by 141 // contract, androidboot.vbmeta.digest is set by the bootloader 142 // when using AVB). 143 bool using_avb = !android::base::GetProperty("ro.boot.vbmeta.digest", "").empty(); 144 145 // If using AVB, dm-verity is used on any build so we want it to 146 // be possible to disable/enable on any build (except USER). For 147 // VB1.0 dm-verity is only enabled on certain builds. 148 if (!using_avb) { 149 if (!kAllowDisableVerity) { 150 WriteFdFmt(fd, "%s-verity only works for userdebug builds\n", 151 enable ? "enable" : "disable"); 152 } 153 154 if (!android::base::GetBoolProperty("ro.secure", false)) { 155 WriteFdFmt(fd, "verity not enabled - ENG build\n"); 156 return; 157 } 158 } 159 160 // Should never be possible to disable dm-verity on a USER build 161 // regardless of using AVB or VB1.0. 162 if (!__android_log_is_debuggable()) { 163 WriteFdFmt(fd, "verity cannot be disabled/enabled - USER build\n"); 164 return; 165 } 166 167 if (using_avb) { 168 // Yep, the system is using AVB. 169 AvbOps* ops = avb_ops_user_new(); 170 if (ops == nullptr) { 171 WriteFdFmt(fd, "Error getting AVB ops\n"); 172 return; 173 } 174 if (set_avb_verity_enabled_state(fd, ops, enable)) { 175 any_changed = true; 176 } 177 avb_ops_user_free(ops); 178 } else { 179 // Not using AVB - assume VB1.0. 180 181 // read all fstab entries at once from all sources 182 fstab = fs_mgr_read_fstab_default(); 183 if (!fstab) { 184 WriteFdFmt(fd, "Failed to read fstab\nMaybe run adb root?\n"); 185 return; 186 } 187 188 // Loop through entries looking for ones that vold manages. 189 for (int i = 0; i < fstab->num_entries; i++) { 190 if (fs_mgr_is_verified(&fstab->recs[i])) { 191 if (set_verity_enabled_state(fd, fstab->recs[i].blk_device, 192 fstab->recs[i].mount_point, enable)) { 193 any_changed = true; 194 } 195 } 196 } 197 } 198 199 if (any_changed) { 200 WriteFdFmt(fd, "Now reboot your device for settings to take effect\n"); 201 } 202 } 203
