openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

adb: add overlayfs handling for readonly system filesystems 

adb verity-on setup overlayfs directories, do not skip if verity
feature not configured for device.

adb verity-off teardown overlayfs directories, do not skip if verity
feature not configured for device.

adb remount setup overlayfs directories and mount if possible, and
do so without a reboot if possible.

Test: compile
Bug: 109821005
Bug: 110985612
Change-Id: I28c4c23fea44b886c5523f0286a523f0b0485df0
This commit is contained in:
Mark Salyzyn 2018-06-18 14:45:56 -07:00
parent d9e6c2020e
commit c60153f742
2 changed files with 62 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
adb/daemon/remount_service.cpp
View File

@ -30,6 +30,7 @@
#include <sys/vfs.h>
#include <unistd.h>
#include <memory>
#include <set>
#include <string>
#include <vector>
@ -38,28 +39,30 @@
#include <bootloader_message/bootloader_message.h>
#include <cutils/android_reboot.h>
#include <ext4_utils/ext4_utils.h>
#include <fs_mgr.h>
#include <fs_mgr_overlayfs.h>
#include "adb.h"
#include "adb_io.h"
#include "adb_unique_fd.h"
#include "adb_utils.h"
#include "fs_mgr.h"
#include "set_verity_enable_state_service.h"
// Returns the device used to mount a directory in /proc/mounts.
// Returns the last device used to mount a directory in /proc/mounts.
// This will find overlayfs entry where upperdir=lowerdir, to make sure
// remount is associated with the correct directory.
static std::string find_proc_mount(const char* dir) {
std::unique_ptr<FILE, int(*)(FILE*)> fp(setmntent("/proc/mounts", "r"), endmntent);
if (!fp) {
return "";
}
std::string mnt_fsname;
if (!fp) return mnt_fsname;
mntent* e;
while ((e = getmntent(fp.get())) != nullptr) {
if (strcmp(dir, e->mnt_dir) == 0) {
return e->mnt_fsname;
mnt_fsname = e->mnt_fsname;
}
}
return "";
return mnt_fsname;
}
// Returns the device used to mount a directory in the fstab.
@ -81,6 +84,7 @@ static std::string find_mount(const char* dir, bool is_root) {
}
bool make_block_device_writable(const std::string& dev) {
if ((dev == "overlay") || (dev == "overlayfs")) return true;
int fd = unix_open(dev.c_str(), O_RDONLY | O_CLOEXEC);
if (fd == -1) {
return false;
@ -234,6 +238,14 @@ void remount_service(unique_fd fd, const std::string& cmd) {
partitions.push_back("/system");
}
bool verity_enabled = (system_verified || vendor_verified);
// If we can use overlayfs, lets get it in place first
// before we struggle with determining deduplication operations.
if (!verity_enabled && fs_mgr_overlayfs_setup() && fs_mgr_overlayfs_mount_all()) {
WriteFdExactly(fd.get(), "overlayfs mounted\n");
}
// Find partitions that are deduplicated, and can be un-deduplicated.
std::set<std::string> dedup;
for (const auto& partition : partitions) {
@ -246,8 +258,6 @@ void remount_service(unique_fd fd, const std::string& cmd) {
}
}
bool verity_enabled = (system_verified || vendor_verified);
// Reboot now if the user requested it (and an operation needs a reboot).
if (user_requested_reboot) {
if (!dedup.empty() || verity_enabled) {

48
adb/daemon/set_verity_enable_state_service.cpp
View File

@ -19,6 +19,7 @@
#include "set_verity_enable_state_service.h"
#include "sysdeps.h"
#include <errno.h>
#include <fcntl.h>
#include <inttypes.h>
#include <libavb_user/libavb_user.h>
@ -28,12 +29,14 @@
#include <android-base/properties.h>
#include <android-base/stringprintf.h>
#include <fs_mgr.h>
#include <fs_mgr_overlayfs.h>
#include <fstab/fstab.h>
#include <log/log_properties.h>
#include "adb.h"
#include "adb_io.h"
#include "adb_unique_fd.h"
#include "fs_mgr.h"
#include "remount_service.h"
#include "fec/io.h"
@ -46,6 +49,10 @@ static const bool kAllowDisableVerity = true;
static const bool kAllowDisableVerity = false;
#endif
void suggest_run_adb_root(int fd) {
if (getuid() != 0) WriteFdExactly(fd, "Maybe run adb root?\n");
}
/* Turn verity on/off */
static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
bool enable) {
@ -59,7 +66,7 @@ static bool set_verity_enabled_state(int fd, const char* block_device, const cha
if (!fh) {
WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
WriteFdFmt(fd, "Maybe run adb root?\n");
suggest_run_adb_root(fd);
return false;
}
@ -87,6 +94,17 @@ static bool set_verity_enabled_state(int fd, const char* block_device, const cha
return false;
}
auto change = false;
errno = 0;
if (enable ? fs_mgr_overlayfs_teardown(mount_point, &change)
: fs_mgr_overlayfs_setup(nullptr, mount_point, &change)) {
if (change) {
WriteFdFmt(fd, "%s overlayfs for %s\n", enable ? "disabling" : "using", mount_point);
}
} else if (errno) {
WriteFdFmt(fd, "Overlayfs %s for %s failed with error %s\n", enable ? "teardown" : "setup",
mount_point, strerror(errno));
}
WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
return true;
}
@ -103,6 +121,22 @@ static bool is_avb_device_locked() {
return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";
}
static bool overlayfs_setup(int fd, bool enable) {
auto change = false;
errno = 0;
if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)
: fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {
if (change) {
WriteFdFmt(fd, "%s overlayfs\n", enable ? "disabling" : "using");
}
} else if (errno) {
WriteFdFmt(fd, "Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup",
strerror(errno));
suggest_run_adb_root(fd);
}
return change;
}
/* Use AVB to turn verity on/off */
static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
std::string ab_suffix = get_ab_suffix();
@ -128,6 +162,7 @@ static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity
return false;
}
overlayfs_setup(fd, enable_verity);
WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
return true;
}
@ -150,6 +185,7 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) {
}
if (!android::base::GetBoolProperty("ro.secure", false)) {
overlayfs_setup(fd, enable);
WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");
return;
}
@ -177,13 +213,14 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) {
// Not using AVB - assume VB1.0.
// read all fstab entries at once from all sources
fstab = fs_mgr_read_fstab_default();
if (!fstab) fstab = fs_mgr_read_fstab_default();
if (!fstab) {
WriteFdExactly(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");
WriteFdExactly(fd.get(), "Failed to read fstab\n");
suggest_run_adb_root(fd.get());
return;
}
// Loop through entries looking for ones that vold manages.
// Loop through entries looking for ones that verity manages.
for (int i = 0; i < fstab->num_entries; i++) {
if (fs_mgr_is_verified(&fstab->recs[i])) {
if (set_verity_enabled_state(fd.get(), fstab->recs[i].blk_device,
@ -193,6 +230,7 @@ void set_verity_enabled_state_service(unique_fd fd, bool enable) {
}
}
}
if (!any_changed) any_changed = overlayfs_setup(fd, enable);
if (any_changed) {
WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");