commit ec15716ea63eabb336a2945c9d098ff02632acaa
author David Anderson <dvander@google.com> Tue Feb 01 22:43:46 2022 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Feb 01 22:43:46 2022 +0000
tree 271233d42dd233a52b74f50a1d6b990be2e4df9a
parent 883c888d27199c8e665184d54d6f589b478fbdfe
parent 73274dfed23cfd52ef9eb7bc451369a4936fba5e

Merge "gsid: Add a command-line option for verifying image maps."

daemon.cpp

diff --git a/daemon.cpp b/daemon.cpp
index a1ee809..2123599 100644
--- a/daemon.cpp
+++ b/daemon.cpp
@@ -59,6 +59,9 @@
         } else if (argv[1] == "dump-device-mapper"s) {
             int rc = DumpDeviceMapper();
             exit(rc);
+        } else if (argv[1] == "verify-image-maps"s) {
+            android::gsi::GsiService::VerifyImageMaps();
+            exit(0);
         }
     }
 

gsi_service.cpp

diff --git a/gsi_service.cpp b/gsi_service.cpp
index 4d30a69..c7b3a28 100644
--- a/gsi_service.cpp
+++ b/gsi_service.cpp
@@ -36,6 +36,7 @@
 #include <android/os/IVold.h>
 #include <binder/IServiceManager.h>
 #include <binder/LazyServiceRegistrar.h>
+#include <cutils/android_reboot.h>
 #include <ext4_utils/ext4_utils.h>
 #include <fs_mgr.h>
 #include <libavb/libavb.h>
@@ -1109,6 +1110,28 @@
     }
 }
 
+void GsiService::VerifyImageMaps() {
+    std::vector<std::pair<std::string, std::string>> paths = {
+            {"/metadata/gsi/remount", "/data/gsi/remount"},
+            {"/metadata/gsi/ota", "/data/gsi/ota"},
+    };
+
+    for (const auto& [metadata_dir, data_dir] : paths) {
+        auto impl = ImageManager::Open(metadata_dir, data_dir);
+        if (!impl) {
+            LOG(ERROR) << "Could not open ImageManager for " << metadata_dir << " and " << data_dir;
+            continue;
+        }
+        if (!impl->ValidateImageMaps()) {
+            LOG(ERROR) << "ImageManager for " << metadata_dir
+                       << " failed validation, device data is at risk. Rebooting.";
+            android::base::SetProperty(ANDROID_RB_PROPERTY, "reboot,fastboot");
+            continue;
+        }
+        LOG(INFO) << "ImageManager verification passed for " << metadata_dir;
+    }
+}
+
 static bool GetAvbPublicKeyFromFd(int fd, AvbPublicKey* dst) {
     // Read the AVB footer from EOF.
     int64_t total_size = get_block_device_size(fd);

gsi_service.h

diff --git a/gsi_service.h b/gsi_service.h
index 95f1537..0ec7620 100644
--- a/gsi_service.h
+++ b/gsi_service.h
@@ -80,6 +80,7 @@
     bool should_abort() const { return should_abort_; }
 
     static void RunStartupTasks();
+    static void VerifyImageMaps();
     static std::string GetInstalledImageDir();
     std::string GetActiveDsuSlot();
     std::string GetActiveInstalledImageDir();