Merge "Enable fsverity signature checking" am: aaee497db2 am: 0d8d105e32

am: f0ac994384 Change-Id: I400ba966f1e23400bb3e4a2f3bb8ab0b3ba10368
2019-03-19 10:11:11 -07:00 · 2019-03-19 10:11:11 -07:00 · ed98d4f249
parent 44cbfa1ac7 f0ac994384
commit ed98d4f249
1 changed files with 2 additions and 0 deletions
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@ -424,6 +424,8 @@ on post-fs-data
    exec -- /system/bin/mini-keyctl dadd asymmetric vendor_cert /vendor/etc/security/cacerts_fsverity .fs-verity
    # Prevent future key links to fsverity keyring
    exec -- /system/bin/mini-keyctl restrict_keyring .fs-verity
+    # Enforce fsverity signature checking
+    write /proc/sys/fs/verity/require_signatures 1

    # Make sure that apexd is started in the default namespace
    enter_default_mount_ns