commit b0ae9d94d7e55d89e6365897463b0635aa22bd8a
author Victor Hsieh <victorhsieh@google.com> Mon Oct 30 17:19:21 2023 -0700
committer Victor Hsieh <victorhsieh@google.com> Mon Nov 20 15:45:30 2023 -0800
tree 716504a7c9fd175a403e05e87c4d2be37de542c1
parent da56d085c4524888ba337b722168e1d10d846379

Binary Transparency: Log sepolicy hash

The telemetry can help us detect divergence in the field.

Also log vbmeta digest in the new atom. Later we will deprecate
VbmetaDigestReported.

Bug: 308471499
Test: set flag to false; doesn't see hash in the log
Test: set flag to tree; does see hash in the log
Change-Id: I5fbadb5345d7b2dec67d43daa83f43f41ebde655

services/core/java/com/android/server/BinaryTransparencyService.java

diff --git a/services/core/java/com/android/server/BinaryTransparencyService.java b/services/core/java/com/android/server/BinaryTransparencyService.java
index 7907d61..77b6d583 100644
--- a/services/core/java/com/android/server/BinaryTransparencyService.java
+++ b/services/core/java/com/android/server/BinaryTransparencyService.java
@@ -1182,8 +1182,8 @@
 
         // we are only interested in doing things at PHASE_BOOT_COMPLETED
         if (phase == PHASE_BOOT_COMPLETED) {
-            Slog.i(TAG, "Boot completed. Getting VBMeta Digest.");
-            getVBMetaDigestInformation();
+            Slog.i(TAG, "Boot completed. Getting boot integrity data.");
+            collectBootIntegrityInfo();
 
             // Log to statsd
             // TODO(b/264061957): For now, biometric system properties are always collected if users
@@ -1458,10 +1458,19 @@
         }
     }
 
-    private void getVBMetaDigestInformation() {
+    private void collectBootIntegrityInfo() {
         mVbmetaDigest = SystemProperties.get(SYSPROP_NAME_VBETA_DIGEST, VBMETA_DIGEST_UNAVAILABLE);
         Slog.d(TAG, String.format("VBMeta Digest: %s", mVbmetaDigest));
         FrameworkStatsLog.write(FrameworkStatsLog.VBMETA_DIGEST_REPORTED, mVbmetaDigest);
+
+        if (android.security.Flags.binaryTransparencySepolicyHash()) {
+            byte[] sepolicyHash = PackageUtils.computeSha256DigestForLargeFileAsBytes(
+                    "/sys/fs/selinux/policy", PackageUtils.createLargeFileBuffer());
+            String sepolicyHashEncoded = HexEncoding.encodeToString(sepolicyHash, false);
+            Slog.d(TAG, "sepolicy hash: " + sepolicyHashEncoded);
+            FrameworkStatsLog.write(FrameworkStatsLog.BOOT_INTEGRITY_INFO_REPORTED,
+                    sepolicyHashEncoded, mVbmetaDigest);
+        }
     }
 
     /**