| commit | 05213860c39399612980ceeeef7d48c128f55ff0 | [log] [tgz] |
|---|---|---|
| author | Pierre-Clément Tosi <ptosi@google.com> | Mon Jan 27 18:25:01 2025 +0000 |
| committer | Pierre-Clément Tosi <ptosi@google.com> | Mon Jan 27 21:49:56 2025 +0000 |
| tree | 161106cc543852efea62b28f324d165de96993f2 | |
| parent | 89f20a687e25ede6370070c29ada17ab29a68c99 [diff] |
pvmfw: rollback: Force fixed RBP for RemoteAttest
If an image pretends to be the RKP VM ("Capability::RemoteAttest"),
force that it goes through the intended fixed-index rollback solution
instead of potentially enabling the use of other RB solutions (such as
deferred) and still adding the RKP VM marker to the DICE chain. This
effectively makes pvmfw ignore the other use-case-specific Capability
values when it recognizes the RKP VM.
More fundamentally, this introduces the logic that pvmfw should always
(and only) check "special" VMs with the appropriate RBP method, an
approach that should survive converting Capability::RemoteAttest into a
separate (re-usable) identifying property (b/378673494) but also adding
support for new fixed RBP methods such as "fixed digest" (b/392628867).
Bug: 377276983
Bug: 391620545
Bug: 392628867
Test: m pvmfw_bin
Change-Id: Ia25a6265ed3f0466ff8bd22411636e5f7a9e5d60
Android Virtualization Framework (AVF) provides secure and private execution environments for executing code. AVF is ideal for security-oriented use cases that require stronger isolation assurances over those offered by Android’s app sandbox.
Visit our public doc site to learn more about what AVF is, what it is for, and how it is structured. This repository contains source code for userspace components of AVF.
If you want a quick start, see the getting started guideline and follow the steps there.
For in-depth explanations about individual topics and components, visit the following links.
AVF components:
AVF APIs:
How-Tos: