1 /*
2 * Copyright (C) 2014 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define TRACE_TAG ADB
18
19 #include "sysdeps.h"
20
21 #include <fcntl.h>
22 #include <inttypes.h>
23 #include <libavb_user/libavb_user.h>
24 #include <stdarg.h>
25 #include <stdio.h>
26 #include <sys/stat.h>
27
28 #include "android-base/properties.h"
29 #include "android-base/stringprintf.h"
30 #include <log/log_properties.h>
31
32 #include "adb.h"
33 #include "adb_io.h"
34 #include "adb_unique_fd.h"
35 #include "fs_mgr.h"
36 #include "remount_service.h"
37
38 #include "fec/io.h"
39
40 struct fstab *fstab;
41
42 #ifdef ALLOW_ADBD_DISABLE_VERITY
43 static const bool kAllowDisableVerity = true;
44 #else
45 static const bool kAllowDisableVerity = false;
46 #endif
47
48 /* Turn verity on/off */
set_verity_enabled_state(int fd,const char * block_device,const char * mount_point,bool enable)49 static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
50 bool enable) {
51 if (!make_block_device_writable(block_device)) {
52 WriteFdFmt(fd, "Could not make block device %s writable (%s).\n",
53 block_device, strerror(errno));
54 return false;
55 }
56
57 fec::io fh(block_device, O_RDWR);
58
59 if (!fh) {
60 WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
61 WriteFdFmt(fd, "Maybe run adb root?\n");
62 return false;
63 }
64
65 fec_verity_metadata metadata;
66
67 if (!fh.get_verity_metadata(metadata)) {
68 WriteFdFmt(fd, "Couldn't find verity metadata!\n");
69 return false;
70 }
71
72 if (!enable && metadata.disabled) {
73 WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point);
74 return false;
75 }
76
77 if (enable && !metadata.disabled) {
78 WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point);
79 return false;
80 }
81
82 if (!fh.set_verity_status(enable)) {
83 WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n",
84 enable ? "enabled" : "disabled",
85 block_device, strerror(errno));
86 return false;
87 }
88
89 WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
90 return true;
91 }
92
93 /* Helper function to get A/B suffix, if any. If the device isn't
94 * using A/B the empty string is returned. Otherwise either "_a",
95 * "_b", ... is returned.
96 */
get_ab_suffix()97 static std::string get_ab_suffix() {
98 return android::base::GetProperty("ro.boot.slot_suffix", "");
99 }
100
is_avb_device_locked()101 static bool is_avb_device_locked() {
102 return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";
103 }
104
105 /* Use AVB to turn verity on/off */
set_avb_verity_enabled_state(int fd,AvbOps * ops,bool enable_verity)106 static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
107 std::string ab_suffix = get_ab_suffix();
108 bool verity_enabled;
109
110 if (is_avb_device_locked()) {
111 WriteFdFmt(fd, "Device is locked. Please unlock the device first\n");
112 return false;
113 }
114
115 if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) {
116 WriteFdFmt(fd, "Error getting verity state. Try adb root first?\n");
117 return false;
118 }
119
120 if ((verity_enabled && enable_verity) || (!verity_enabled && !enable_verity)) {
121 WriteFdFmt(fd, "verity is already %s\n", verity_enabled ? "enabled" : "disabled");
122 return false;
123 }
124
125 if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) {
126 WriteFdFmt(fd, "Error setting verity\n");
127 return false;
128 }
129
130 WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
131 return true;
132 }
133
set_verity_enabled_state_service(int fd,void * cookie)134 void set_verity_enabled_state_service(int fd, void* cookie) {
135 unique_fd closer(fd);
136 bool any_changed = false;
137
138 bool enable = (cookie != NULL);
139
140 // Figure out if we're using VB1.0 or VB2.0 (aka AVB) - by
141 // contract, androidboot.vbmeta.digest is set by the bootloader
142 // when using AVB).
143 bool using_avb = !android::base::GetProperty("ro.boot.vbmeta.digest", "").empty();
144
145 // If using AVB, dm-verity is used on any build so we want it to
146 // be possible to disable/enable on any build (except USER). For
147 // VB1.0 dm-verity is only enabled on certain builds.
148 if (!using_avb) {
149 if (!kAllowDisableVerity) {
150 WriteFdFmt(fd, "%s-verity only works for userdebug builds\n",
151 enable ? "enable" : "disable");
152 }
153
154 if (!android::base::GetBoolProperty("ro.secure", false)) {
155 WriteFdFmt(fd, "verity not enabled - ENG build\n");
156 return;
157 }
158 }
159
160 // Should never be possible to disable dm-verity on a USER build
161 // regardless of using AVB or VB1.0.
162 if (!__android_log_is_debuggable()) {
163 WriteFdFmt(fd, "verity cannot be disabled/enabled - USER build\n");
164 return;
165 }
166
167 if (using_avb) {
168 // Yep, the system is using AVB.
169 AvbOps* ops = avb_ops_user_new();
170 if (ops == nullptr) {
171 WriteFdFmt(fd, "Error getting AVB ops\n");
172 return;
173 }
174 if (set_avb_verity_enabled_state(fd, ops, enable)) {
175 any_changed = true;
176 }
177 avb_ops_user_free(ops);
178 } else {
179 // Not using AVB - assume VB1.0.
180
181 // read all fstab entries at once from all sources
182 fstab = fs_mgr_read_fstab_default();
183 if (!fstab) {
184 WriteFdFmt(fd, "Failed to read fstab\nMaybe run adb root?\n");
185 return;
186 }
187
188 // Loop through entries looking for ones that vold manages.
189 for (int i = 0; i < fstab->num_entries; i++) {
190 if (fs_mgr_is_verified(&fstab->recs[i])) {
191 if (set_verity_enabled_state(fd, fstab->recs[i].blk_device,
192 fstab->recs[i].mount_point, enable)) {
193 any_changed = true;
194 }
195 }
196 }
197 }
198
199 if (any_changed) {
200 WriteFdFmt(fd, "Now reboot your device for settings to take effect\n");
201 }
202 }
203