p96705831
/
platform_build
forked from openkylin/platform_build
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Appending per-partition os_version into AVB props 

os_version is important for keymaster version binding, where it
refuses to perform operations with a key that is bound to an old
system version.  This ensures that an attacker who discovers a
weakness in an old version of system or TEE software cannot roll a
device back to the vulnerable version and use keys created with the
newer version.

Previously, os_version for system.img is added into boot.img header
for bootloader to read the value then pass to TEE before booting the
HLOS. However, with project Treble to modularize each partition, all
images are now in the trajectory to be built independently (still
on-going). Also, in the Generic System Image (GSI) compliance test,
the os_version in OEM's boot.img cannot reflect the actual version of
GSI.

This CL adds per-partition os_versions into AVB metadata, which is
readable by bootloader via libavb without file system dependency. It's
still unclear for how os_version in non-system partition should be used.
We just add them for completeness here.

See more details in:
https://source.android.com/security/keystore/version-binding

Bug: 132233601
Test: build and avbtool info_image $OUT/vbmeta.img
      - Prop: com.android.build.boot.os_version -> '10'
      - Prop: com.android.build.system.os_version -> '10'
      - Prop: com.android.build.system.security_patch -> '2019-06-05'
      - Prop: com.android.build.vendor.os_version -> '10'
      - Prop: com.android.build.vendor.security_patch -> '2019-06-05'
      - Prop: com.android.build.product.os_version -> '10'
      - Prop: com.android.build.product.security_patch -> '2019-06-05'

Change-Id: I21a77420f2e8a3456f7a8cae5158eb8fc41319e7
This commit is contained in:
Bowgo Tsai 2019-05-14 16:57:03 +08:00
parent bc7e3f98f4
commit 9b54801b58
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
core/Makefile
View File

@ -3067,18 +3067,30 @@ ifneq ($(words $(sort $(INTERNAL_AVB_PARTITIONS_IN_CHAINED_VBMETA_IMAGES))),$(wo
$(error BOARD_AVB_VBMETA_SYSTEM and BOARD_AVB_VBMETA_VENDOR cannot have duplicates)
endif
# Appends security patch level as a AVB property descriptor
# Appends os version and security patch level as a AVB property descriptor
BOARD_AVB_SYSTEM_ADD_HASHTREE_FOOTER_ARGS += \
--prop com.android.build.system.os_version:$(PLATFORM_VERSION) \
--prop com.android.build.system.security_patch:$(PLATFORM_SECURITY_PATCH)
BOARD_AVB_PRODUCT_ADD_HASHTREE_FOOTER_ARGS += \
--prop com.android.build.product.os_version:$(PLATFORM_VERSION) \
--prop com.android.build.product.security_patch:$(PLATFORM_SECURITY_PATCH)
BOARD_AVB_PRODUCT_SERVICES_ADD_HASHTREE_FOOTER_ARGS += \
--prop com.android.build.product_services.os_version:$(PLATFORM_VERSION) \
--prop com.android.build.product_services.security_patch:$(PLATFORM_SECURITY_PATCH)
# The following vendor- and odm-specific images needs explicitly set per board.
BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS += \
--prop com.android.build.boot.os_version:$(PLATFORM_VERSION)
BOARD_AVB_VENDOR_ADD_HASHTREE_FOOTER_ARGS += \
--prop com.android.build.vendor.os_version:$(PLATFORM_VERSION)
BOARD_AVB_ODM_ADD_HASHTREE_FOOTER_ARGS += \
--prop com.android.build.odm.os_version:$(PLATFORM_VERSION)
# The following vendor- and odm-specific images needs explicit SPL set per board.
ifdef BOOT_SECURITY_PATCH
BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS += \
--prop com.android.build.boot.security_patch:$(BOOT_SECURITY_PATCH)