/* Turn verity on/off */ static int set_verity_enabled_state(int fd, const char *block_device, const char* mount_point, bool enable) { if (!make_block_device_writable(block_device)) { WriteFdFmt(fd, "Could not make block device %s writable (%s).\n", block_device, strerror(errno)); return -1; } fec::io fh(block_device, O_RDWR); if (!fh) { WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno)); WriteFdFmt(fd, "Maybe run adb root?\n"); return -1; } fec_verity_metadata metadata; if (!fh.get_verity_metadata(metadata)) { WriteFdFmt(fd, "Couldn't find verity metadata!\n"); return -1; } if (!enable && metadata.disabled) { WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point); return -1; } if (enable && !metadata.disabled) { WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point); return -1; } if (!fh.set_verity_status(enable)) { WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n", enable ? "enabled" : "disabled", block_device, strerror(errno)); return -1; } WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point); return 0; }
static bool remount_partition(int fd, const char* dir) { if (!directory_exists(dir)) { return true; } std::string dev = find_mount(dir); if (dev.empty()) { return true; } if (!make_block_device_writable(dev)) { WriteFdFmt(fd, "remount of %s failed; couldn't make block device %s writable: %s\n", dir, dev.c_str(), strerror(errno)); return false; } if (mount(dev.c_str(), dir, "none", MS_REMOUNT, nullptr) == -1) { WriteFdFmt(fd, "remount of %s failed: %s\n", dir, strerror(errno)); return false; } return true; }
/* Turn verity on/off */ static int set_verity_enabled_state(int fd, const char *block_device, const char* mount_point, bool enable) { uint32_t magic_number; const uint32_t new_magic = enable ? VERITY_METADATA_MAGIC_NUMBER : VERITY_METADATA_MAGIC_DISABLE; uint64_t device_length = 0; int device = -1; int retval = -1; if (make_block_device_writable(block_device)) { write_console(fd, "Could not make block device %s writable (%s).\n", block_device, strerror(errno)); goto errout; } device = adb_open(block_device, O_RDWR | O_CLOEXEC); if (device == -1) { write_console(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno)); write_console(fd, "Maybe run adb remount?\n"); goto errout; } // find the start of the verity metadata if (get_target_device_size(fd, (char*)block_device, &device_length) < 0) { write_console(fd, "Could not get target device size.\n"); goto errout; } if (lseek64(device, device_length, SEEK_SET) < 0) { write_console(fd, "Could not seek to start of verity metadata block.\n"); goto errout; } // check the magic number if (adb_read(device, &magic_number, sizeof(magic_number)) != sizeof(magic_number)) { write_console(fd, "Couldn't read magic number!\n"); goto errout; } if (!enable && magic_number == VERITY_METADATA_MAGIC_DISABLE) { write_console(fd, "Verity already disabled on %s\n", mount_point); goto errout; } if (enable && magic_number == VERITY_METADATA_MAGIC_NUMBER) { write_console(fd, "Verity already enabled on %s\n", mount_point); goto errout; } if (magic_number != VERITY_METADATA_MAGIC_NUMBER && magic_number != VERITY_METADATA_MAGIC_DISABLE) { write_console(fd, "Couldn't find verity metadata at offset %" PRIu64 "!\n", device_length); goto errout; } if (lseek64(device, device_length, SEEK_SET) < 0) { write_console(fd, "Could not seek to start of verity metadata block.\n"); goto errout; } if (adb_write(device, &new_magic, sizeof(new_magic)) != sizeof(new_magic)) { write_console( fd, "Could not set verity %s flag on device %s with error %s\n", enable ? "enabled" : "disabled", block_device, strerror(errno)); goto errout; } write_console(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point); retval = 0; errout: if (device != -1) adb_close(device); return retval; }