blob: e4cdb4087aa811573cb156a1fd0096aa7220e692 [file] [log] [blame]
Victor Hsieh272aa242021-02-01 14:19:20 -08001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Victor Hsieh51789de2021-08-06 16:50:49 -070017//! compsvc is a service to run compilation tasks in a PVM upon request. It is able to set up
Victor Hsiehebb1d902021-08-06 13:00:18 -070018//! file descriptors backed by authfs (via authfs_service) and pass the file descriptors to the
Victor Hsieh51789de2021-08-06 16:50:49 -070019//! actual compiler.
Victor Hsieh272aa242021-02-01 14:19:20 -080020
Alan Stokes126fd512021-12-16 15:00:01 +000021use anyhow::{Context, Result};
Alan Stokes3189af02021-09-30 17:51:19 +010022use binder_common::new_binder_exception;
Alan Stokes126fd512021-12-16 15:00:01 +000023use compos_common::binder::to_binder_result;
Victor Hsieh9ed27182021-08-25 15:52:42 -070024use log::warn;
25use std::default::Default;
Victor Hsieh51789de2021-08-06 16:50:49 -070026use std::path::PathBuf;
Alan Stokes183d7d32021-12-08 16:10:45 +000027use std::sync::RwLock;
Victor Hsieh272aa242021-02-01 14:19:20 -080028
Victor Hsieh616f8222022-01-14 13:06:32 -080029use crate::compilation::{odrefresh, OdrefreshContext};
Alan Stokes223a7462022-01-20 14:12:24 +000030use crate::signing_key::{Signer, SigningKey};
Victor Hsieh51789de2021-08-06 16:50:49 -070031use authfs_aidl_interface::aidl::com::android::virt::fs::IAuthFsService::IAuthFsService;
Victor Hsieh23f73592021-08-06 18:08:24 -070032use compos_aidl_interface::aidl::com::android::compos::{
33 CompOsKeyData::CompOsKeyData,
34 ICompOsService::{BnCompOsService, ICompOsService},
Victor Hsieh272aa242021-02-01 14:19:20 -080035};
Victor Hsieh272aa242021-02-01 14:19:20 -080036use compos_aidl_interface::binder::{
Alan Stokes3189af02021-09-30 17:51:19 +010037 BinderFeatures, ExceptionCode, Interface, Result as BinderResult, Strong,
Victor Hsieh272aa242021-02-01 14:19:20 -080038};
Alan Stokes46a1dff2021-12-14 10:56:05 +000039use compos_common::odrefresh::ODREFRESH_PATH;
Victor Hsieh272aa242021-02-01 14:19:20 -080040
Victor Hsiehebb1d902021-08-06 13:00:18 -070041const AUTHFS_SERVICE_NAME: &str = "authfs_service";
Alan Stokes9e2c5d52021-07-21 11:29:10 +010042
Victor Hsieha64194b2021-08-06 17:43:36 -070043/// Constructs a binder object that implements ICompOsService.
Victor Hsieh9ebf7ee2021-09-03 16:14:14 -070044pub fn new_binder() -> Result<Strong<dyn ICompOsService>> {
Victor Hsieh23f73592021-08-06 18:08:24 -070045 let service = CompOsService {
Victor Hsiehf9968692021-11-18 11:34:39 -080046 odrefresh_path: PathBuf::from(ODREFRESH_PATH),
Alan Stokes223a7462022-01-20 14:12:24 +000047 signing_key: SigningKey::new()?,
Alan Stokes183d7d32021-12-08 16:10:45 +000048 key_blob: RwLock::new(Vec::new()),
Victor Hsieh23f73592021-08-06 18:08:24 -070049 };
Victor Hsieha64194b2021-08-06 17:43:36 -070050 Ok(BnCompOsService::new_binder(service, BinderFeatures::default()))
Alan Stokes9e2c5d52021-07-21 11:29:10 +010051}
52
Victor Hsieha64194b2021-08-06 17:43:36 -070053struct CompOsService {
Victor Hsiehf9968692021-11-18 11:34:39 -080054 odrefresh_path: PathBuf,
Alan Stokes223a7462022-01-20 14:12:24 +000055 signing_key: SigningKey,
Alan Stokes183d7d32021-12-08 16:10:45 +000056 key_blob: RwLock<Vec<u8>>,
Victor Hsieh272aa242021-02-01 14:19:20 -080057}
58
Victor Hsieh9ed27182021-08-25 15:52:42 -070059impl CompOsService {
Alan Stokes46a1dff2021-12-14 10:56:05 +000060 fn new_signer(&self) -> BinderResult<Signer> {
61 let key = &*self.key_blob.read().unwrap();
62 if key.is_empty() {
63 Err(new_binder_exception(ExceptionCode::ILLEGAL_STATE, "Key is not initialized"))
64 } else {
Alan Stokes223a7462022-01-20 14:12:24 +000065 Ok(self.signing_key.new_signer(key))
Alan Stokes46a1dff2021-12-14 10:56:05 +000066 }
Victor Hsieh9ed27182021-08-25 15:52:42 -070067 }
68}
69
Victor Hsieha64194b2021-08-06 17:43:36 -070070impl Interface for CompOsService {}
Victor Hsieh272aa242021-02-01 14:19:20 -080071
Victor Hsieha64194b2021-08-06 17:43:36 -070072impl ICompOsService for CompOsService {
Victor Hsieh8fd03f02021-08-24 17:23:01 -070073 fn initializeSigningKey(&self, key_blob: &[u8]) -> BinderResult<()> {
74 let mut w = self.key_blob.write().unwrap();
75 if w.is_empty() {
76 *w = Vec::from(key_blob);
77 Ok(())
78 } else {
79 Err(new_binder_exception(ExceptionCode::ILLEGAL_STATE, "Cannot re-initialize the key"))
80 }
81 }
82
Victor Hsiehf9968692021-11-18 11:34:39 -080083 fn odrefresh(
84 &self,
85 system_dir_fd: i32,
86 output_dir_fd: i32,
Alan Stokes9646db92021-12-14 13:22:33 +000087 staging_dir_fd: i32,
88 target_dir_name: &str,
Victor Hsiehf9968692021-11-18 11:34:39 -080089 zygote_arch: &str,
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080090 system_server_compiler_filter: &str,
Alan Stokes9646db92021-12-14 13:22:33 +000091 ) -> BinderResult<i8> {
Alan Stokes126fd512021-12-16 15:00:01 +000092 let context = to_binder_result(OdrefreshContext::new(
Victor Hsiehf9968692021-11-18 11:34:39 -080093 system_dir_fd,
94 output_dir_fd,
Alan Stokes9646db92021-12-14 13:22:33 +000095 staging_dir_fd,
Alan Stokes46a1dff2021-12-14 10:56:05 +000096 target_dir_name,
Victor Hsiehf9968692021-11-18 11:34:39 -080097 zygote_arch,
Victor Hsieh9bfbc5f2021-12-16 11:45:10 -080098 system_server_compiler_filter,
Alan Stokes126fd512021-12-16 15:00:01 +000099 ))?;
Alan Stokes46a1dff2021-12-14 10:56:05 +0000100
101 let authfs_service = get_authfs_service()?;
Alan Stokes126fd512021-12-16 15:00:01 +0000102 let exit_code = to_binder_result(
103 odrefresh(&self.odrefresh_path, context, authfs_service, self.new_signer()?)
104 .context("odrefresh failed"),
105 )?;
Alan Stokes46a1dff2021-12-14 10:56:05 +0000106 Ok(exit_code as i8)
Victor Hsiehf9968692021-11-18 11:34:39 -0800107 }
108
Victor Hsieh23f73592021-08-06 18:08:24 -0700109 fn generateSigningKey(&self) -> BinderResult<CompOsKeyData> {
Alan Stokes223a7462022-01-20 14:12:24 +0000110 to_binder_result(self.signing_key.generate())
Victor Hsieh23f73592021-08-06 18:08:24 -0700111 }
112
113 fn verifySigningKey(&self, key_blob: &[u8], public_key: &[u8]) -> BinderResult<bool> {
Alan Stokes223a7462022-01-20 14:12:24 +0000114 Ok(if let Err(e) = self.signing_key.verify(key_blob, public_key) {
Alan Stokes126fd512021-12-16 15:00:01 +0000115 warn!("Signing key verification failed: {:?}", e);
Victor Hsieh23f73592021-08-06 18:08:24 -0700116 false
117 } else {
118 true
119 })
120 }
Alan Stokes71cc11e2022-01-17 10:39:05 +0000121
122 fn getBootCertificateChain(&self) -> BinderResult<Vec<u8>> {
Alan Stokes223a7462022-01-20 14:12:24 +0000123 to_binder_result(self.signing_key.get_boot_certificate_chain())
Alan Stokes71cc11e2022-01-17 10:39:05 +0000124 }
Victor Hsieh272aa242021-02-01 14:19:20 -0800125}
Victor Hsiehebb1d902021-08-06 13:00:18 -0700126
127fn get_authfs_service() -> BinderResult<Strong<dyn IAuthFsService>> {
128 Ok(authfs_aidl_interface::binder::get_interface(AUTHFS_SERVICE_NAME)?)
129}