1 /*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "sysdeps.h"
18
19 #define TRACE_TAG TRACE_ADB
20 #include "adb.h"
21
22 #include <stdio.h>
23 #include <stdarg.h>
24 #include <sys/stat.h>
25 #include <fcntl.h>
26 #include <inttypes.h>
27
28 #include "cutils/properties.h"
29 #include "ext4_sb.h"
30 #include <fs_mgr.h>
31
32 #define FSTAB_PREFIX "/fstab."
33 struct fstab *fstab;
34
35 __attribute__((__format__(printf, 2, 3))) __nonnull((2))
write_console(int fd,const char * format,...)36 static void write_console(int fd, const char* format, ...)
37 {
38 char buffer[256];
39 va_list args;
40 va_start (args, format);
41 vsnprintf (buffer, sizeof(buffer), format, args);
42 va_end (args);
43
44 adb_write(fd, buffer, strnlen(buffer, sizeof(buffer)));
45 }
46
get_target_device_size(int fd,const char * blk_device,uint64_t * device_size)47 static int get_target_device_size(int fd, const char *blk_device,
48 uint64_t *device_size)
49 {
50 int data_device;
51 struct ext4_super_block sb;
52 struct fs_info info;
53
54 info.len = 0; /* Only len is set to 0 to ask the device for real size. */
55
56 data_device = adb_open(blk_device, O_RDONLY | O_CLOEXEC);
57 if (data_device < 0) {
58 write_console(fd, "Error opening block device (%s)\n", strerror(errno));
59 return -1;
60 }
61
62 if (lseek64(data_device, 1024, SEEK_SET) < 0) {
63 write_console(fd, "Error seeking to superblock\n");
64 adb_close(data_device);
65 return -1;
66 }
67
68 if (adb_read(data_device, &sb, sizeof(sb)) != sizeof(sb)) {
69 write_console(fd, "Error reading superblock\n");
70 adb_close(data_device);
71 return -1;
72 }
73
74 ext4_parse_sb(&sb, &info);
75 *device_size = info.len;
76
77 adb_close(data_device);
78 return 0;
79 }
80
disable_verity(int fd,const char * block_device,const char * mount_point)81 static int disable_verity(int fd, const char *block_device,
82 const char* mount_point)
83 {
84 uint32_t magic_number;
85 const uint32_t voff = VERITY_METADATA_MAGIC_DISABLE;
86 uint64_t device_length;
87 int device;
88 int retval = -1;
89
90 device = adb_open(block_device, O_RDWR | O_CLOEXEC);
91 if (device == -1) {
92 write_console(fd, "Could not open block device %s (%s).\n",
93 block_device, strerror(errno));
94 write_console(fd, "Maybe run adb remount?\n");
95 goto errout;
96 }
97
98 // find the start of the verity metadata
99 if (get_target_device_size(fd, (char*)block_device, &device_length) < 0) {
100 write_console(fd, "Could not get target device size.\n");
101 goto errout;
102 }
103
104 if (lseek64(device, device_length, SEEK_SET) < 0) {
105 write_console(fd,
106 "Could not seek to start of verity metadata block.\n");
107 goto errout;
108 }
109
110 // check the magic number
111 if (adb_read(device, &magic_number, sizeof(magic_number))
112 != sizeof(magic_number)) {
113 write_console(fd, "Couldn't read magic number!\n");
114 goto errout;
115 }
116
117 if (magic_number == VERITY_METADATA_MAGIC_DISABLE) {
118 write_console(fd, "Verity already disabled on %s\n", mount_point);
119 goto errout;
120 }
121
122 if (magic_number != VERITY_METADATA_MAGIC_NUMBER) {
123 write_console(fd,
124 "Couldn't find verity metadata at offset %"PRIu64"!\n",
125 device_length);
126 goto errout;
127 }
128
129 if (lseek64(device, device_length, SEEK_SET) < 0) {
130 write_console(fd,
131 "Could not seek to start of verity metadata block.\n");
132 goto errout;
133 }
134
135 if (adb_write(device, &voff, sizeof(voff)) != sizeof(voff)) {
136 write_console(fd, "Could not set verity disabled flag on device %s\n",
137 block_device);
138 goto errout;
139 }
140
141 write_console(fd, "Verity disabled on %s\n", mount_point);
142 retval = 0;
143 errout:
144 if (device != -1)
145 adb_close(device);
146 return retval;
147 }
148
disable_verity_service(int fd,void * cookie)149 void disable_verity_service(int fd, void* cookie)
150 {
151 #ifdef ALLOW_ADBD_DISABLE_VERITY
152 char fstab_filename[PROPERTY_VALUE_MAX + sizeof(FSTAB_PREFIX)];
153 char propbuf[PROPERTY_VALUE_MAX];
154 int i;
155 bool any_disabled = false;
156
157 property_get("ro.secure", propbuf, "0");
158 if (strcmp(propbuf, "1")) {
159 write_console(fd, "verity not enabled - ENG build\n");
160 goto errout;
161 }
162
163 property_get("ro.debuggable", propbuf, "0");
164 if (strcmp(propbuf, "1")) {
165 write_console(fd, "verity cannot be disabled - USER build\n");
166 goto errout;
167 }
168
169 property_get("ro.hardware", propbuf, "");
170 snprintf(fstab_filename, sizeof(fstab_filename), FSTAB_PREFIX"%s", propbuf);
171
172 fstab = fs_mgr_read_fstab(fstab_filename);
173 if (!fstab) {
174 write_console(fd, "Failed to open %s\nMaybe run adb root?\n",
175 fstab_filename);
176 goto errout;
177 }
178
179 /* Loop through entries looking for ones that vold manages */
180 for (i = 0; i < fstab->num_entries; i++) {
181 if(fs_mgr_is_verified(&fstab->recs[i])) {
182 if (!disable_verity(fd, fstab->recs[i].blk_device,
183 fstab->recs[i].mount_point)) {
184 any_disabled = true;
185 }
186 }
187 }
188
189 if (any_disabled) {
190 write_console(fd,
191 "Now reboot your device for settings to take effect\n");
192 }
193 #else
194 write_console(fd, "disable-verity only works for userdebug builds\n");
195 #endif
196
197 errout:
198 adb_close(fd);
199 }
200