From afe86cc0884fddd22a898ff34356bb40e4cfc357 Mon Sep 17 00:00:00 2001
From: Martijn Coenen <maco@google.com>
Date: Thu, 12 Nov 2020 11:01:24 +0100
Subject: [PATCH] Call early-boot-ended from init.

To make sure it's always called after apexd has run.

Bug: 168585635
Bug: 173005594
Test: inspect logs
Change-Id: Iaff175dea6a658523cdedb8b6894ca23af62bcbf
---
 rootdir/init.rc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/rootdir/init.rc b/rootdir/init.rc
index 746fc61dc..e290072c6 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -807,6 +807,10 @@ on post-fs-data
     wait_for_prop apexd.status activated
     perform_apex_config
 
+    # After apexes are mounted, tell keymaster early boot has ended, so it will
+    # stop allowing use of early-boot keys
+    exec - system system -- /system/bin/vdc keymaster early-boot-ended
+
     # Special-case /data/media/obb per b/64566063
     mkdir /data/media 0770 media_rw media_rw encryption=None
     exec - media_rw media_rw -- /system/bin/chattr +F /data/media