openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge "Init: Load fsverity keys earlier" 

am: f09ef56056

Change-Id: Id4fa13d970a379d449376be56a37eae1ac1f118b
This commit is contained in:
Andreas Gampe 2019-03-15 19:19:33 -07:00 committed by android-build-merger
parent 7c55e2a88d f09ef56056
commit a0cc42381c
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
rootdir/init.rc
View File

@ -418,6 +418,13 @@ on post-fs-data
mkdir /data/bootchart 0755 shell shell
bootchart start
# Load fsverity keys. This needs to happen before apexd, as post-install of
# APEXes may rely on keys.
exec -- /system/bin/mini-keyctl dadd asymmetric product_cert /product/etc/security/cacerts_fsverity .fs-verity
exec -- /system/bin/mini-keyctl dadd asymmetric vendor_cert /vendor/etc/security/cacerts_fsverity .fs-verity
# Prevent future key links to fsverity keyring
exec -- /system/bin/mini-keyctl restrict_keyring .fs-verity
# Make sure that apexd is started in the default namespace
enter_default_mount_ns
@ -585,12 +592,6 @@ on post-fs-data
# Set SELinux security contexts on upgrade or policy update.
restorecon --recursive --skip-ce /data
# load fsverity keys
exec -- /system/bin/mini-keyctl dadd asymmetric product_cert /product/etc/security/cacerts_fsverity .fs-verity
exec -- /system/bin/mini-keyctl dadd asymmetric vendor_cert /vendor/etc/security/cacerts_fsverity .fs-verity
# Prevent future key links to fsverity keyring
exec -- /system/bin/mini-keyctl restrict_keyring .fs-verity
# Check any timezone data in /data is newer than the copy in the runtime module, delete if not.
exec - system system -- /system/bin/tzdatacheck /apex/com.android.runtime/etc/tz /data/misc/zoneinfo