/* Turn verity on/off */
static int set_verity_enabled_state(int fd, const char *block_device,
const char* mount_point, bool enable)
{
if (!make_block_device_writable(block_device)) {
WriteFdFmt(fd, "Could not make block device %s writable (%s).\n",
block_device, strerror(errno));
return -1;
}
fec::io fh(block_device, O_RDWR);
if (!fh) {
WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
WriteFdFmt(fd, "Maybe run adb root?\n");
return -1;
}
fec_verity_metadata metadata;
if (!fh.get_verity_metadata(metadata)) {
WriteFdFmt(fd, "Couldn't find verity metadata!\n");
return -1;
}
if (!enable && metadata.disabled) {
WriteFdFmt(fd, "Verity already disabled on %s\n", mount_point);
return -1;
}
if (enable && !metadata.disabled) {
WriteFdFmt(fd, "Verity already enabled on %s\n", mount_point);
return -1;
}
if (!fh.set_verity_status(enable)) {
WriteFdFmt(fd, "Could not set verity %s flag on device %s with error %s\n",
enable ? "enabled" : "disabled",
block_device, strerror(errno));
return -1;
}
WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
return 0;
}
static bool remount_partition(int fd, const char* dir) {
if (!directory_exists(dir)) {
return true;
}
std::string dev = find_mount(dir);
if (dev.empty()) {
return true;
}
if (!make_block_device_writable(dev)) {
WriteFdFmt(fd, "remount of %s failed; couldn't make block device %s writable: %s\n",
dir, dev.c_str(), strerror(errno));
return false;
}
if (mount(dev.c_str(), dir, "none", MS_REMOUNT, nullptr) == -1) {
WriteFdFmt(fd, "remount of %s failed: %s\n", dir, strerror(errno));
return false;
}
return true;
}
/* Turn verity on/off */
static int set_verity_enabled_state(int fd, const char *block_device,
const char* mount_point, bool enable)
{
uint32_t magic_number;
const uint32_t new_magic = enable ? VERITY_METADATA_MAGIC_NUMBER
: VERITY_METADATA_MAGIC_DISABLE;
uint64_t device_length = 0;
int device = -1;
int retval = -1;
if (make_block_device_writable(block_device)) {
write_console(fd, "Could not make block device %s writable (%s).\n",
block_device, strerror(errno));
goto errout;
}
device = adb_open(block_device, O_RDWR | O_CLOEXEC);
if (device == -1) {
write_console(fd, "Could not open block device %s (%s).\n",
block_device, strerror(errno));
write_console(fd, "Maybe run adb remount?\n");
goto errout;
}
// find the start of the verity metadata
if (get_target_device_size(fd, (char*)block_device, &device_length) < 0) {
write_console(fd, "Could not get target device size.\n");
goto errout;
}
if (lseek64(device, device_length, SEEK_SET) < 0) {
write_console(fd,
"Could not seek to start of verity metadata block.\n");
goto errout;
}
// check the magic number
if (adb_read(device, &magic_number, sizeof(magic_number))
!= sizeof(magic_number)) {
write_console(fd, "Couldn't read magic number!\n");
goto errout;
}
if (!enable && magic_number == VERITY_METADATA_MAGIC_DISABLE) {
write_console(fd, "Verity already disabled on %s\n", mount_point);
goto errout;
}
if (enable && magic_number == VERITY_METADATA_MAGIC_NUMBER) {
write_console(fd, "Verity already enabled on %s\n", mount_point);
goto errout;
}
if (magic_number != VERITY_METADATA_MAGIC_NUMBER
&& magic_number != VERITY_METADATA_MAGIC_DISABLE) {
write_console(fd,
"Couldn't find verity metadata at offset %" PRIu64 "!\n",
device_length);
goto errout;
}
if (lseek64(device, device_length, SEEK_SET) < 0) {
write_console(fd,
"Could not seek to start of verity metadata block.\n");
goto errout;
}
if (adb_write(device, &new_magic, sizeof(new_magic)) != sizeof(new_magic)) {
write_console(
fd, "Could not set verity %s flag on device %s with error %s\n",
enable ? "enabled" : "disabled",
block_device, strerror(errno));
goto errout;
}
write_console(fd, "Verity %s on %s\n",
enable ? "enabled" : "disabled",
mount_point);
retval = 0;
errout:
if (device != -1)
adb_close(device);
return retval;
}
