Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 1 | // Copyright 2021, The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | //! Microdroid Manager |
| 16 | |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 17 | mod dice; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 18 | mod instance; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 19 | mod ioutil; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 20 | mod payload; |
Keir Fraser | 933f0ac | 2022-10-12 08:23:28 +0000 | [diff] [blame] | 21 | mod swap; |
Alice Wang | 59a9e56 | 2022-10-04 15:24:10 +0000 | [diff] [blame] | 22 | mod vm_payload_service; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 23 | |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 24 | use crate::dice::{DiceContext, DiceDriver}; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 25 | use crate::instance::{ApexData, ApkData, InstanceDisk, MicrodroidData, RootHash}; |
Alice Wang | 59a9e56 | 2022-10-04 15:24:10 +0000 | [diff] [blame] | 26 | use crate::vm_payload_service::register_vm_payload_service; |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 27 | use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode; |
David Brazdil | 73988ea | 2022-11-11 15:10:32 +0000 | [diff] [blame] | 28 | use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::IVirtualMachineService; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 29 | use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::{ |
| 30 | VM_APK_CONTENTS_PATH, |
| 31 | VM_PAYLOAD_SERVICE_SOCKET_NAME, |
Shikha Panwar | ddc124b | 2022-11-28 19:17:54 +0000 | [diff] [blame] | 32 | ENCRYPTEDSTORE_MOUNTPOINT, |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 33 | }; |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 34 | use anyhow::{anyhow, bail, ensure, Context, Error, Result}; |
Alice Wang | 1bf3d78 | 2022-09-28 07:56:36 +0000 | [diff] [blame] | 35 | use apkverify::{get_public_key_der, verify, V4Signature}; |
Alice Wang | 43c884b | 2022-10-24 09:42:40 +0000 | [diff] [blame] | 36 | use binder::Strong; |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 37 | use diced_utils::cbor::{encode_header, encode_number}; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 38 | use glob::glob; |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 39 | use itertools::sorted; |
David Brazdil | a07a179 | 2022-10-25 13:37:57 +0100 | [diff] [blame] | 40 | use libc::VMADDR_CID_HOST; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 41 | use log::{error, info, warn}; |
Alan Stokes | 0d1ef78 | 2022-09-27 13:46:35 +0100 | [diff] [blame] | 42 | use microdroid_metadata::{write_metadata, Metadata, PayloadMetadata}; |
Seungjae Yoo | fd9a062 | 2022-10-14 10:01:29 +0900 | [diff] [blame] | 43 | use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig}; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 44 | use nix::fcntl::{fcntl, F_SETFD, FdFlag}; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 45 | use nix::sys::signal::Signal; |
Andrew Scull | a0d1b1a | 2022-05-24 19:32:47 +0000 | [diff] [blame] | 46 | use openssl::sha::Sha512; |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 47 | use payload::{get_apex_data_from_payload, load_metadata, to_metadata}; |
Andrew Scull | 34916a7 | 2022-01-30 21:34:24 +0000 | [diff] [blame] | 48 | use rand::Fill; |
Andrew Walbran | 7eb5ca4 | 2022-08-08 15:33:34 +0000 | [diff] [blame] | 49 | use rpcbinder::get_vsock_rpc_interface; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 50 | use rustutils::sockets::android_get_control_socket; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 51 | use rustutils::system_properties; |
Joel Galenson | 482704c | 2021-07-29 15:53:53 -0700 | [diff] [blame] | 52 | use rustutils::system_properties::PropertyWatcher; |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 53 | use std::borrow::Cow::{Borrowed, Owned}; |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 54 | use std::convert::TryInto; |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 55 | use std::env; |
David Brazdil | 451cc96 | 2022-10-14 14:08:12 +0100 | [diff] [blame] | 56 | use std::fs::{self, create_dir, OpenOptions}; |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 57 | use std::io::Write; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 58 | use std::os::unix::process::ExitStatusExt; |
Jooyung Han | f48ceb4 | 2021-06-01 18:00:04 +0900 | [diff] [blame] | 59 | use std::path::Path; |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 60 | use std::process::{Child, Command, Stdio}; |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 61 | use std::str; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 62 | use std::time::{Duration, SystemTime}; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 63 | |
| 64 | const WAIT_TIMEOUT: Duration = Duration::from_secs(10); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 65 | const MAIN_APK_PATH: &str = "/dev/block/by-name/microdroid-apk"; |
| 66 | const MAIN_APK_IDSIG_PATH: &str = "/dev/block/by-name/microdroid-apk-idsig"; |
| 67 | const MAIN_APK_DEVICE_NAME: &str = "microdroid-apk"; |
| 68 | const EXTRA_APK_PATH_PATTERN: &str = "/dev/block/by-name/extra-apk-*"; |
| 69 | const EXTRA_IDSIG_PATH_PATTERN: &str = "/dev/block/by-name/extra-idsig-*"; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 70 | const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk"; |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 71 | const APKDMVERITY_BIN: &str = "/system/bin/apkdmverity"; |
| 72 | const ZIPFUSE_BIN: &str = "/system/bin/zipfuse"; |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 73 | const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot"; |
| 74 | const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance"; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 75 | const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str = |
| 76 | "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot"; |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 77 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 78 | const APEX_CONFIG_DONE_PROP: &str = "apex_config.done"; |
Seungjae Yoo | fa22bb0 | 2022-12-08 16:38:42 +0900 | [diff] [blame] | 79 | const DEBUGGABLE_PROP: &str = "ro.boot.microdroid.debuggable"; |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 80 | const APK_MOUNT_DONE_PROP: &str = "microdroid_manager.apk.mounted"; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 81 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 82 | // SYNC WITH virtualizationservice/src/crosvm.rs |
| 83 | const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1"; |
| 84 | |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 85 | /// Identifier for the key used for encrypted store. |
| 86 | const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore"; |
| 87 | const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore"; |
| 88 | const ENCRYPTEDSTORE_KEY_IDENTIFIER: &str = "encryptedstore_key"; |
Shikha Panwar | 195f89c | 2022-11-23 16:20:34 +0000 | [diff] [blame] | 89 | const ENCRYPTEDSTORE_KEYSIZE: u32 = 32; |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 90 | |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 91 | #[derive(thiserror::Error, Debug)] |
| 92 | enum MicrodroidError { |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 93 | #[error("Cannot connect to virtualization service: {0}")] |
| 94 | FailedToConnectToVirtualizationService(String), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 95 | #[error("Payload has changed: {0}")] |
| 96 | PayloadChanged(String), |
| 97 | #[error("Payload verification has failed: {0}")] |
| 98 | PayloadVerificationFailed(String), |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 99 | #[error("Payload config is invalid: {0}")] |
| 100 | InvalidConfig(String), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 101 | } |
| 102 | |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 103 | fn translate_error(err: &Error) -> (ErrorCode, String) { |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 104 | if let Some(e) = err.downcast_ref::<MicrodroidError>() { |
| 105 | match e { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 106 | MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()), |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 107 | MicrodroidError::PayloadVerificationFailed(msg) => { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 108 | (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string()) |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 109 | } |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 110 | MicrodroidError::InvalidConfig(msg) => { |
| 111 | (ErrorCode::PAYLOAD_CONFIG_INVALID, msg.to_string()) |
| 112 | } |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 113 | |
| 114 | // Connection failure won't be reported to VS; return the default value |
| 115 | MicrodroidError::FailedToConnectToVirtualizationService(msg) => { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 116 | (ErrorCode::UNKNOWN, msg.to_string()) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 117 | } |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 118 | } |
| 119 | } else { |
Alan Stokes | 2bead0d | 2022-09-05 16:58:34 +0100 | [diff] [blame] | 120 | (ErrorCode::UNKNOWN, err.to_string()) |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 121 | } |
| 122 | } |
| 123 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 124 | fn write_death_reason_to_serial(err: &Error) -> Result<()> { |
| 125 | let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() { |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 126 | Borrowed(match e { |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 127 | MicrodroidError::FailedToConnectToVirtualizationService(_) => { |
| 128 | "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE" |
| 129 | } |
| 130 | MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED", |
| 131 | MicrodroidError::PayloadVerificationFailed(_) => { |
| 132 | "MICRODROID_PAYLOAD_VERIFICATION_FAILED" |
| 133 | } |
| 134 | MicrodroidError::InvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG", |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 135 | }) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 136 | } else { |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 137 | // Send context information back after a separator, to ease diagnosis. |
| 138 | // These errors occur before the payload runs, so this should not leak sensitive |
| 139 | // information. |
| 140 | Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err)) |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 141 | }; |
| 142 | |
| 143 | let death_reason_bytes = death_reason.as_bytes(); |
| 144 | let mut sent_total = 0; |
| 145 | while sent_total < death_reason_bytes.len() { |
| 146 | // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang. |
| 147 | let begin = sent_total; |
| 148 | let end = std::cmp::min(begin.saturating_add(16), death_reason_bytes.len()); |
| 149 | OpenOptions::new() |
| 150 | .read(false) |
| 151 | .write(true) |
| 152 | .open(FAILURE_SERIAL_DEVICE)? |
| 153 | .write_all(&death_reason_bytes[begin..end])?; |
| 154 | sent_total = end; |
| 155 | } |
| 156 | |
| 157 | Ok(()) |
| 158 | } |
| 159 | |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 160 | fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> { |
David Brazdil | 73988ea | 2022-11-11 15:10:32 +0000 | [diff] [blame] | 161 | // The host is running a VirtualMachineService for this VM on a port equal |
| 162 | // to the CID of this VM. |
| 163 | let port = vsock::get_local_cid().context("Could not determine local CID")?; |
| 164 | get_vsock_rpc_interface(VMADDR_CID_HOST, port) |
| 165 | .context("Could not connect to IVirtualMachineService") |
Inseob Kim | 1b95f2e | 2021-08-19 13:17:40 +0900 | [diff] [blame] | 166 | } |
| 167 | |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 168 | fn main() -> Result<()> { |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 169 | // If debuggable, print full backtrace to console log with stdio_to_kmsg |
Seungjae Yoo | fa22bb0 | 2022-12-08 16:38:42 +0900 | [diff] [blame] | 170 | if system_properties::read_bool(DEBUGGABLE_PROP, true)? { |
Inseob Kim | 7ff121c | 2022-11-14 18:13:23 +0900 | [diff] [blame] | 171 | env::set_var("RUST_BACKTRACE", "full"); |
| 172 | } |
| 173 | |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 174 | scopeguard::defer! { |
| 175 | info!("Shutting down..."); |
Jooyung Han | bfe086f | 2021-10-28 10:15:45 +0900 | [diff] [blame] | 176 | if let Err(e) = system_properties::write("sys.powerctl", "shutdown") { |
| 177 | error!("failed to shutdown {:?}", e); |
| 178 | } |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 179 | } |
Inseob Kim | 437f105 | 2022-06-21 11:30:22 +0900 | [diff] [blame] | 180 | |
| 181 | try_main().map_err(|e| { |
| 182 | error!("Failed with {:?}.", e); |
| 183 | if let Err(e) = write_death_reason_to_serial(&e) { |
| 184 | error!("Failed to write death reason {:?}", e); |
| 185 | } |
| 186 | e |
| 187 | }) |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 188 | } |
| 189 | |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 190 | fn set_cloexec_on_vm_payload_service_socket() -> Result<()> { |
| 191 | let fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?; |
| 192 | |
| 193 | fcntl(fd, F_SETFD(FdFlag::FD_CLOEXEC))?; |
| 194 | |
| 195 | Ok(()) |
| 196 | } |
| 197 | |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 198 | fn try_main() -> Result<()> { |
Andrew Scull | e127cff | 2022-02-15 15:34:04 +0000 | [diff] [blame] | 199 | let _ = kernlog::init(); |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 200 | info!("started."); |
| 201 | |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 202 | if let Err(e) = set_cloexec_on_vm_payload_service_socket() { |
| 203 | warn!("Failed to set cloexec on vm payload socket: {:?}", e); |
| 204 | } |
| 205 | |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 206 | load_crashkernel_if_supported().context("Failed to load crashkernel")?; |
| 207 | |
Keir Fraser | 933f0ac | 2022-10-12 08:23:28 +0000 | [diff] [blame] | 208 | swap::init_swap().context("Failed to initialise swap")?; |
| 209 | info!("swap enabled."); |
| 210 | |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 211 | let service = get_vms_rpc_binder() |
| 212 | .context("cannot connect to VirtualMachineService") |
| 213 | .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?; |
Seungjae Yoo | fd9a062 | 2022-10-14 10:01:29 +0900 | [diff] [blame] | 214 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 215 | match try_run_payload(&service) { |
| 216 | Ok(code) => { |
| 217 | info!("notifying payload finished"); |
| 218 | service.notifyPayloadFinished(code)?; |
| 219 | if code == 0 { |
| 220 | info!("task successfully finished"); |
| 221 | } else { |
| 222 | error!("task exited with exit code: {}", code); |
| 223 | } |
| 224 | Ok(()) |
| 225 | } |
| 226 | Err(err) => { |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 227 | let (error_code, message) = translate_error(&err); |
| 228 | service.notifyError(error_code, &message)?; |
| 229 | Err(err) |
| 230 | } |
Jooyung Han | dd0a173 | 2021-11-23 15:26:20 +0900 | [diff] [blame] | 231 | } |
| 232 | } |
| 233 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 234 | fn dice_derivation( |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 235 | dice: DiceDriver, |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 236 | verified_data: &MicrodroidData, |
| 237 | payload_metadata: &PayloadMetadata, |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 238 | ) -> Result<DiceContext> { |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 239 | // Calculate compound digests of code and authorities |
Andrew Scull | a0d1b1a | 2022-05-24 19:32:47 +0000 | [diff] [blame] | 240 | let mut code_hash_ctx = Sha512::new(); |
| 241 | let mut authority_hash_ctx = Sha512::new(); |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 242 | code_hash_ctx.update(verified_data.apk_data.root_hash.as_ref()); |
| 243 | authority_hash_ctx.update(verified_data.apk_data.pubkey.as_ref()); |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 244 | for extra_apk in &verified_data.extra_apks_data { |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 245 | code_hash_ctx.update(extra_apk.root_hash.as_ref()); |
| 246 | authority_hash_ctx.update(extra_apk.pubkey.as_ref()); |
| 247 | } |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 248 | for apex in &verified_data.apex_data { |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 249 | code_hash_ctx.update(apex.root_digest.as_ref()); |
| 250 | authority_hash_ctx.update(apex.public_key.as_ref()); |
| 251 | } |
Andrew Scull | a0d1b1a | 2022-05-24 19:32:47 +0000 | [diff] [blame] | 252 | let code_hash = code_hash_ctx.finish(); |
| 253 | let authority_hash = authority_hash_ctx.finish(); |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 254 | |
| 255 | // { |
| 256 | // -70002: "Microdroid payload", |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 257 | // ? -71000: tstr // payload_config_path |
| 258 | // ? -71001: PayloadConfig |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 259 | // } |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 260 | // PayloadConfig = { |
| 261 | // 1: tstr // payload_binary_path |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 262 | // } |
| 263 | |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 264 | let mut config_desc = vec![ |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 265 | 0xa2, // map(2) |
| 266 | 0x3a, 0x00, 0x01, 0x11, 0x71, // -70002 |
| 267 | 0x72, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x64, 0x72, 0x6f, 0x69, 0x64, 0x20, 0x70, 0x61, 0x79, |
| 268 | 0x6c, 0x6f, 0x61, 0x64, // "Microdroid payload" |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 269 | ]; |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 270 | |
| 271 | match payload_metadata { |
| 272 | PayloadMetadata::config_path(payload_config_path) => { |
| 273 | encode_negative_number(-71000, &mut config_desc)?; |
| 274 | encode_tstr(payload_config_path, &mut config_desc)?; |
| 275 | } |
| 276 | PayloadMetadata::config(payload_config) => { |
| 277 | encode_negative_number(-71001, &mut config_desc)?; |
| 278 | encode_header(5, 1, &mut config_desc)?; // map(1) |
| 279 | encode_number(1, &mut config_desc)?; |
| 280 | encode_tstr(&payload_config.payload_binary_path, &mut config_desc)?; |
| 281 | } |
| 282 | } |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 283 | |
Seungjae Yoo | fa22bb0 | 2022-12-08 16:38:42 +0900 | [diff] [blame] | 284 | // Check debuggability, conservatively assuming it is debuggable |
| 285 | let debuggable = system_properties::read_bool(DEBUGGABLE_PROP, true)?; |
Andrew Scull | 65ddfc4 | 2022-02-14 21:03:58 +0000 | [diff] [blame] | 286 | |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 287 | // Send the details to diced |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 288 | let hidden = verified_data.salt.clone().try_into().unwrap(); |
Seungjae Yoo | fa22bb0 | 2022-12-08 16:38:42 +0900 | [diff] [blame] | 289 | dice.derive(code_hash, &config_desc, authority_hash, debuggable, hidden) |
Andrew Scull | b2f4447 | 2022-01-21 14:41:34 +0000 | [diff] [blame] | 290 | } |
| 291 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 292 | fn encode_tstr(tstr: &str, buffer: &mut Vec<u8>) -> Result<()> { |
| 293 | let bytes = tstr.as_bytes(); |
| 294 | encode_header(3, bytes.len().try_into().unwrap(), buffer)?; |
| 295 | buffer.extend_from_slice(bytes); |
| 296 | Ok(()) |
| 297 | } |
| 298 | |
| 299 | fn encode_negative_number(n: i64, buffer: &mut dyn Write) -> Result<()> { |
| 300 | ensure!(n < 0); |
| 301 | let n = -1 - n; |
| 302 | encode_header(1, n.try_into().unwrap(), buffer) |
| 303 | } |
| 304 | |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 305 | fn is_strict_boot() -> bool { |
| 306 | Path::new(AVF_STRICT_BOOT).exists() |
| 307 | } |
| 308 | |
| 309 | fn is_new_instance() -> bool { |
| 310 | Path::new(AVF_NEW_INSTANCE).exists() |
| 311 | } |
| 312 | |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 313 | fn is_verified_boot() -> bool { |
| 314 | !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists() |
| 315 | } |
| 316 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 317 | fn try_run_payload(service: &Strong<dyn IVirtualMachineService>) -> Result<i32> { |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 318 | let metadata = load_metadata().context("Failed to load payload metadata")?; |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 319 | let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 320 | |
Jooyung Han | 311b120 | 2021-09-14 22:00:16 +0900 | [diff] [blame] | 321 | let mut instance = InstanceDisk::new().context("Failed to load instance.img")?; |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 322 | let saved_data = |
| 323 | instance.read_microdroid_data(&dice).context("Failed to read identity data")?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 324 | |
Andrew Scull | ab72ec5 | 2022-03-14 09:10:52 +0000 | [diff] [blame] | 325 | if is_strict_boot() { |
| 326 | // Provisioning must happen on the first boot and never again. |
| 327 | if is_new_instance() { |
| 328 | ensure!( |
| 329 | saved_data.is_none(), |
| 330 | MicrodroidError::InvalidConfig("Found instance data on first boot.".to_string()) |
| 331 | ); |
| 332 | } else { |
| 333 | ensure!( |
| 334 | saved_data.is_some(), |
| 335 | MicrodroidError::InvalidConfig("Instance data not found.".to_string()) |
| 336 | ); |
| 337 | }; |
| 338 | } |
| 339 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 340 | // Verify the payload before using it. |
Inseob Kim | 11f40d0 | 2022-06-13 17:16:00 +0900 | [diff] [blame] | 341 | let verified_data = verify_payload(&metadata, saved_data.as_ref()) |
| 342 | .context("Payload verification failed") |
| 343 | .map_err(|e| MicrodroidError::PayloadVerificationFailed(e.to_string()))?; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 344 | |
| 345 | // In case identity is ignored (by debug policy), we should reuse existing payload data, even |
| 346 | // when the payload is changed. This is to keep the derived secret same as before. |
| 347 | let verified_data = if let Some(saved_data) = saved_data { |
| 348 | if !is_verified_boot() { |
| 349 | if saved_data != verified_data { |
| 350 | info!("Detected an update of the payload, but continue (regarding debug policy)") |
| 351 | } |
| 352 | } else { |
| 353 | ensure!( |
| 354 | saved_data == verified_data, |
| 355 | MicrodroidError::PayloadChanged(String::from( |
| 356 | "Detected an update of the payload which isn't supported yet." |
| 357 | )) |
| 358 | ); |
| 359 | info!("Saved data is verified."); |
| 360 | } |
| 361 | saved_data |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 362 | } else { |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 363 | info!("Saving verified data."); |
Andrew Scull | d64ae7d | 2022-10-05 17:41:43 +0000 | [diff] [blame] | 364 | instance |
| 365 | .write_microdroid_data(&verified_data, &dice) |
| 366 | .context("Failed to write identity data")?; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 367 | verified_data |
| 368 | }; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 369 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 370 | let payload_metadata = metadata.payload.ok_or_else(|| { |
| 371 | MicrodroidError::InvalidConfig("No payload config in metadata".to_string()) |
| 372 | })?; |
Alan Stokes | 0d1ef78 | 2022-09-27 13:46:35 +0100 | [diff] [blame] | 373 | |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 374 | // To minimize the exposure to untrusted data, derive dice profile as soon as possible. |
| 375 | info!("DICE derivation for payload"); |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 376 | let dice_context = dice_derivation(dice, &verified_data, &payload_metadata)?; |
| 377 | |
| 378 | // Run encryptedstore binary to prepare the storage |
| 379 | let encryptedstore_child = if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() { |
| 380 | info!("Preparing encryptedstore ..."); |
| 381 | Some(prepare_encryptedstore(&dice_context).context("encryptedstore run")?) |
| 382 | } else { |
| 383 | None |
| 384 | }; |
Inseob Kim | b2519c5 | 2022-04-14 02:10:09 +0900 | [diff] [blame] | 385 | |
Jooyung Han | a6d11eb | 2021-09-10 11:48:05 +0900 | [diff] [blame] | 386 | // Before reading a file from the APK, start zipfuse |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 387 | run_zipfuse( |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 388 | MountForExec::Allowed, |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 389 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0", |
| 390 | Path::new("/dev/block/mapper/microdroid-apk"), |
Alice Wang | 6bbb6da | 2022-10-26 12:44:06 +0000 | [diff] [blame] | 391 | Path::new(VM_APK_CONTENTS_PATH), |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 392 | Some(APK_MOUNT_DONE_PROP), |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 393 | ) |
| 394 | .context("Failed to run zipfuse")?; |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 395 | |
Andrew Scull | 4d262dc | 2022-10-21 13:14:33 +0000 | [diff] [blame] | 396 | // Restricted APIs are only allowed to be used by platform or test components. Infer this from |
| 397 | // the use of a VM config file since those can only be used by platform and test components. |
| 398 | let allow_restricted_apis = match payload_metadata { |
| 399 | PayloadMetadata::config_path(_) => true, |
| 400 | PayloadMetadata::config(_) => false, |
| 401 | }; |
| 402 | |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 403 | let config = load_config(payload_metadata).context("Failed to load payload metadata")?; |
Shikha Panwar | 6f03c94 | 2022-04-13 20:26:50 +0000 | [diff] [blame] | 404 | |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 405 | let task = config |
| 406 | .task |
| 407 | .as_ref() |
| 408 | .ok_or_else(|| MicrodroidError::InvalidConfig("No task in VM config".to_string()))?; |
| 409 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 410 | if config.extra_apks.len() != verified_data.extra_apks_data.len() { |
| 411 | return Err(anyhow!( |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 412 | "config expects {} extra apks, but found {}", |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 413 | config.extra_apks.len(), |
| 414 | verified_data.extra_apks_data.len() |
| 415 | )); |
| 416 | } |
| 417 | mount_extra_apks(&config)?; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 418 | |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 419 | // Wait until apex config is done. (e.g. linker configuration for apexes) |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 420 | wait_for_apex_config_done()?; |
| 421 | |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 422 | setup_config_sysprops(&config)?; |
| 423 | |
Inseob Kim | cd9c1dd | 2022-07-13 17:13:45 +0900 | [diff] [blame] | 424 | // Start tombstone_transmit if enabled |
| 425 | if config.export_tombstones { |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 426 | control_service("start", "tombstone_transmit")?; |
Inseob Kim | cd9c1dd | 2022-07-13 17:13:45 +0900 | [diff] [blame] | 427 | } else { |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 428 | control_service("stop", "tombstoned")?; |
Inseob Kim | cd9c1dd | 2022-07-13 17:13:45 +0900 | [diff] [blame] | 429 | } |
| 430 | |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 431 | // Wait until zipfuse has mounted the APK so we can access the payload |
| 432 | wait_for_property_true(APK_MOUNT_DONE_PROP).context("Failed waiting for APK mount done")?; |
| 433 | |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 434 | register_vm_payload_service(allow_restricted_apis, service.clone(), dice_context)?; |
| 435 | |
Shikha Panwar | ddc124b | 2022-11-28 19:17:54 +0000 | [diff] [blame] | 436 | // Wait for encryptedstore to finish mounting the storage (if enabled) before setting |
| 437 | // microdroid_manager.init_done. Reason is init stops uneventd after that. |
| 438 | // Encryptedstore, however requires ueventd |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 439 | if let Some(mut child) = encryptedstore_child { |
| 440 | let exitcode = child.wait().context("Wait for encryptedstore child")?; |
| 441 | ensure!(exitcode.success(), "Unable to prepare encrypted storage. Exitcode={}", exitcode); |
| 442 | } |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 443 | |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 444 | wait_for_property_true("dev.bootcomplete").context("failed waiting for dev.bootcomplete")?; |
Shikha Panwar | 3f6f6a5 | 2022-11-29 17:28:36 +0000 | [diff] [blame] | 445 | system_properties::write("microdroid_manager.init_done", "1") |
| 446 | .context("set microdroid_manager.init_done")?; |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 447 | info!("boot completed, time to run payload"); |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 448 | exec_task(task, service).context("Failed to run payload") |
Alan Stokes | 01b3ef0 | 2022-09-22 17:43:24 +0100 | [diff] [blame] | 449 | } |
| 450 | |
| 451 | fn control_service(action: &str, service: &str) -> Result<()> { |
| 452 | system_properties::write(&format!("ctl.{}", action), service) |
| 453 | .with_context(|| format!("Failed to {} {}", action, service)) |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 454 | } |
| 455 | |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 456 | struct ApkDmverityArgument<'a> { |
| 457 | apk: &'a str, |
| 458 | idsig: &'a str, |
| 459 | name: &'a str, |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 460 | saved_root_hash: Option<&'a RootHash>, |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 461 | } |
| 462 | |
| 463 | fn run_apkdmverity(args: &[ApkDmverityArgument]) -> Result<Child> { |
| 464 | let mut cmd = Command::new(APKDMVERITY_BIN); |
| 465 | |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 466 | for argument in args { |
| 467 | cmd.arg("--apk").arg(argument.apk).arg(argument.idsig).arg(argument.name); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 468 | if let Some(root_hash) = argument.saved_root_hash { |
| 469 | cmd.arg(&to_hex_string(root_hash)); |
| 470 | } else { |
| 471 | cmd.arg("none"); |
| 472 | } |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 473 | } |
| 474 | |
| 475 | cmd.spawn().context("Spawn apkdmverity") |
| 476 | } |
| 477 | |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 478 | enum MountForExec { |
| 479 | Allowed, |
| 480 | Disallowed, |
| 481 | } |
| 482 | |
| 483 | fn run_zipfuse( |
| 484 | noexec: MountForExec, |
| 485 | option: &str, |
| 486 | zip_path: &Path, |
| 487 | mount_dir: &Path, |
| 488 | ready_prop: Option<&str>, |
| 489 | ) -> Result<Child> { |
Andrew Scull | cc339a1 | 2022-07-04 12:44:19 +0000 | [diff] [blame] | 490 | let mut cmd = Command::new(ZIPFUSE_BIN); |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 491 | if let MountForExec::Disallowed = noexec { |
Andrew Scull | cc339a1 | 2022-07-04 12:44:19 +0000 | [diff] [blame] | 492 | cmd.arg("--noexec"); |
| 493 | } |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 494 | if let Some(property_name) = ready_prop { |
| 495 | cmd.args(["-p", property_name]); |
| 496 | } |
Inseob Kim | add7b7f | 2022-11-21 15:06:05 +0900 | [diff] [blame] | 497 | cmd.arg("-o").arg(option).arg(zip_path).arg(mount_dir).spawn().context("Spawn zipfuse") |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 498 | } |
| 499 | |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 500 | fn write_apex_payload_data( |
| 501 | saved_data: Option<&MicrodroidData>, |
| 502 | apex_data_from_payload: &[ApexData], |
| 503 | ) -> Result<()> { |
| 504 | if let Some(saved_apex_data) = saved_data.map(|d| &d.apex_data) { |
| 505 | // We don't support APEX updates. (assuming that update will change root digest) |
| 506 | ensure!( |
| 507 | saved_apex_data == apex_data_from_payload, |
| 508 | MicrodroidError::PayloadChanged(String::from("APEXes have changed.")) |
| 509 | ); |
| 510 | let apex_metadata = to_metadata(apex_data_from_payload); |
| 511 | // Pass metadata(with public keys and root digests) to apexd so that it uses the passed |
| 512 | // metadata instead of the default one (/dev/block/by-name/payload-metadata) |
| 513 | OpenOptions::new() |
| 514 | .create_new(true) |
| 515 | .write(true) |
| 516 | .open("/apex/vm-payload-metadata") |
| 517 | .context("Failed to open /apex/vm-payload-metadata") |
| 518 | .and_then(|f| write_metadata(&apex_metadata, f))?; |
| 519 | } |
| 520 | Ok(()) |
| 521 | } |
| 522 | |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 523 | // Verify payload before executing it. For APK payload, Full verification (which is slow) is done |
| 524 | // when the root_hash values from the idsig file and the instance disk are different. This function |
| 525 | // returns the verified root hash (for APK payload) and pubkeys (for APEX payloads) that can be |
| 526 | // saved to the instance disk. |
| 527 | fn verify_payload( |
| 528 | metadata: &Metadata, |
| 529 | saved_data: Option<&MicrodroidData>, |
| 530 | ) -> Result<MicrodroidData> { |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 531 | let start_time = SystemTime::now(); |
| 532 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 533 | // Verify main APK |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 534 | let root_hash = saved_data.map(|d| &d.apk_data.root_hash); |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 535 | let root_hash_from_idsig = get_apk_root_hash_from_idsig(MAIN_APK_IDSIG_PATH)?; |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 536 | let root_hash_trustful = root_hash == Some(&root_hash_from_idsig); |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 537 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 538 | // If root_hash can be trusted, pass it to apkdmverity so that it uses the passed root_hash |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 539 | // instead of the value read from the idsig file. |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 540 | let main_apk_argument = { |
| 541 | ApkDmverityArgument { |
| 542 | apk: MAIN_APK_PATH, |
| 543 | idsig: MAIN_APK_IDSIG_PATH, |
| 544 | name: MAIN_APK_DEVICE_NAME, |
| 545 | saved_root_hash: if root_hash_trustful { |
| 546 | Some(root_hash_from_idsig.as_ref()) |
| 547 | } else { |
| 548 | None |
| 549 | }, |
| 550 | } |
| 551 | }; |
| 552 | let mut apkdmverity_arguments = vec![main_apk_argument]; |
| 553 | |
| 554 | // Verify extra APKs |
| 555 | // For now, we can't read the payload config, so glob APKs and idsigs. |
| 556 | // Later, we'll see if it matches with the payload config. |
| 557 | |
| 558 | // sort globbed paths to match apks (extra-apk-{idx}) and idsigs (extra-idsig-{idx}) |
| 559 | // e.g. "extra-apk-0" corresponds to "extra-idsig-0" |
| 560 | let extra_apks = |
| 561 | sorted(glob(EXTRA_APK_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>(); |
| 562 | let extra_idsigs = |
| 563 | sorted(glob(EXTRA_IDSIG_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>(); |
| 564 | if extra_apks.len() != extra_idsigs.len() { |
| 565 | return Err(anyhow!( |
| 566 | "Extra apks/idsigs mismatch: {} apks but {} idsigs", |
| 567 | extra_apks.len(), |
| 568 | extra_idsigs.len() |
| 569 | )); |
| 570 | } |
| 571 | let extra_apks_count = extra_apks.len(); |
| 572 | |
| 573 | let (extra_apk_names, extra_root_hashes_from_idsig): (Vec<_>, Vec<_>) = extra_idsigs |
| 574 | .iter() |
| 575 | .enumerate() |
| 576 | .map(|(i, extra_idsig)| { |
| 577 | ( |
| 578 | format!("extra-apk-{}", i), |
Alice Wang | 89cff01 | 2022-09-26 10:05:16 +0000 | [diff] [blame] | 579 | get_apk_root_hash_from_idsig(extra_idsig) |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 580 | .expect("Can't find root hash from extra idsig"), |
| 581 | ) |
| 582 | }) |
| 583 | .unzip(); |
| 584 | |
| 585 | let saved_extra_root_hashes: Vec<_> = saved_data |
| 586 | .map(|d| d.extra_apks_data.iter().map(|apk_data| &apk_data.root_hash).collect()) |
| 587 | .unwrap_or_else(Vec::new); |
| 588 | let extra_root_hashes_trustful: Vec<_> = extra_root_hashes_from_idsig |
| 589 | .iter() |
| 590 | .enumerate() |
| 591 | .map(|(i, root_hash_from_idsig)| { |
| 592 | saved_extra_root_hashes.get(i).copied() == Some(root_hash_from_idsig) |
| 593 | }) |
| 594 | .collect(); |
| 595 | |
| 596 | for i in 0..extra_apks_count { |
| 597 | apkdmverity_arguments.push({ |
| 598 | ApkDmverityArgument { |
| 599 | apk: extra_apks[i].to_str().unwrap(), |
| 600 | idsig: extra_idsigs[i].to_str().unwrap(), |
| 601 | name: &extra_apk_names[i], |
| 602 | saved_root_hash: if extra_root_hashes_trustful[i] { |
| 603 | Some(&extra_root_hashes_from_idsig[i]) |
| 604 | } else { |
| 605 | None |
| 606 | }, |
| 607 | } |
| 608 | }); |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 609 | } |
| 610 | |
| 611 | // Start apkdmverity and wait for the dm-verify block |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 612 | let mut apkdmverity_child = run_apkdmverity(&apkdmverity_arguments)?; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 613 | |
Jooyung Han | c8deb47 | 2021-09-13 13:48:25 +0900 | [diff] [blame] | 614 | // While waiting for apkdmverity to mount APK, gathers public keys and root digests from |
| 615 | // APEX payload. |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 616 | let apex_data_from_payload = get_apex_data_from_payload(metadata)?; |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 617 | |
| 618 | // Writing /apex/vm-payload-metadata is to verify that the payload isn't changed. |
| 619 | // Skip writing it if the debug policy ignoring identity is on |
| 620 | if is_verified_boot() { |
| 621 | write_apex_payload_data(saved_data, &apex_data_from_payload)?; |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 622 | } |
Inseob Kim | e379e7d | 2022-07-22 18:55:18 +0900 | [diff] [blame] | 623 | |
Jooyung Han | 4a9b3bf | 2021-09-10 17:19:00 +0900 | [diff] [blame] | 624 | // Start apexd to activate APEXes |
| 625 | system_properties::write("ctl.start", "apexd-vm")?; |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 626 | |
Inseob Kim | 217038e | 2021-11-25 11:15:06 +0900 | [diff] [blame] | 627 | // TODO(inseob): add timeout |
| 628 | apkdmverity_child.wait()?; |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 629 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 630 | // Do the full verification if the root_hash is un-trustful. This requires the full scanning of |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 631 | // the APK file and therefore can be very slow if the APK is large. Note that this step is |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 632 | // taken only when the root_hash is un-trustful which can be either when this is the first boot |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 633 | // of the VM or APK was updated in the host. |
| 634 | // TODO(jooyung): consider multithreading to make this faster |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 635 | let main_apk_pubkey = get_public_key_from_apk(DM_MOUNTED_APK_PATH, root_hash_trustful)?; |
| 636 | let extra_apks_data = extra_root_hashes_from_idsig |
| 637 | .into_iter() |
| 638 | .enumerate() |
| 639 | .map(|(i, extra_root_hash)| { |
| 640 | let mount_path = format!("/dev/block/mapper/{}", &extra_apk_names[i]); |
| 641 | let apk_pubkey = get_public_key_from_apk(&mount_path, extra_root_hashes_trustful[i])?; |
| 642 | Ok(ApkData { root_hash: extra_root_hash, pubkey: apk_pubkey }) |
| 643 | }) |
| 644 | .collect::<Result<Vec<_>>>()?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 645 | |
| 646 | info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap()); |
| 647 | |
Andrew Scull | 34916a7 | 2022-01-30 21:34:24 +0000 | [diff] [blame] | 648 | // Use the salt from a verified instance, or generate a salt for a new instance. |
| 649 | let salt = if let Some(saved_data) = saved_data { |
| 650 | saved_data.salt.clone() |
| 651 | } else { |
| 652 | let mut salt = vec![0u8; 64]; |
| 653 | salt.as_mut_slice().try_fill(&mut rand::thread_rng())?; |
| 654 | salt |
| 655 | }; |
| 656 | |
Jiyong Park | f7dea25 | 2021-09-08 01:42:54 +0900 | [diff] [blame] | 657 | // At this point, we can ensure that the root_hash from the idsig file is trusted, either by |
| 658 | // fully verifying the APK or by comparing it with the saved root_hash. |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 659 | Ok(MicrodroidData { |
Andrew Scull | 34916a7 | 2022-01-30 21:34:24 +0000 | [diff] [blame] | 660 | salt, |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 661 | apk_data: ApkData { root_hash: root_hash_from_idsig, pubkey: main_apk_pubkey }, |
| 662 | extra_apks_data, |
Jooyung Han | 7a343f9 | 2021-09-08 22:53:11 +0900 | [diff] [blame] | 663 | apex_data: apex_data_from_payload, |
| 664 | }) |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 665 | } |
| 666 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 667 | fn mount_extra_apks(config: &VmPayloadConfig) -> Result<()> { |
| 668 | // For now, only the number of apks is important, as the mount point and dm-verity name is fixed |
| 669 | for i in 0..config.extra_apks.len() { |
| 670 | let mount_dir = format!("/mnt/extra-apk/{}", i); |
| 671 | create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?; |
| 672 | |
| 673 | // don't wait, just detach |
| 674 | run_zipfuse( |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 675 | MountForExec::Disallowed, |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 676 | "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0", |
| 677 | Path::new(&format!("/dev/block/mapper/extra-apk-{}", i)), |
| 678 | Path::new(&mount_dir), |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 679 | None, |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 680 | ) |
| 681 | .context("Failed to zipfuse extra apks")?; |
| 682 | } |
| 683 | |
| 684 | Ok(()) |
| 685 | } |
| 686 | |
Nikita Ioffe | 57bc8d7 | 2022-11-27 00:50:50 +0000 | [diff] [blame] | 687 | fn setup_config_sysprops(config: &VmPayloadConfig) -> Result<()> { |
| 688 | if config.enable_authfs { |
| 689 | system_properties::write("microdroid_manager.authfs.enabled", "1") |
| 690 | .context("failed to write microdroid_manager.authfs.enabled")?; |
| 691 | } |
| 692 | system_properties::write("microdroid_manager.config_done", "1") |
| 693 | .context("failed to write microdroid_manager.config_done")?; |
| 694 | Ok(()) |
| 695 | } |
| 696 | |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 697 | // Waits until linker config is generated |
| 698 | fn wait_for_apex_config_done() -> Result<()> { |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 699 | wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done") |
| 700 | } |
| 701 | |
| 702 | fn wait_for_property_true(property_name: &str) -> Result<()> { |
| 703 | let mut prop = PropertyWatcher::new(property_name)?; |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 704 | loop { |
| 705 | prop.wait()?; |
Alan Stokes | 60f8220 | 2022-10-07 16:40:07 +0100 | [diff] [blame] | 706 | if system_properties::read_bool(property_name, false)? { |
Jiyong Park | bb4a987 | 2021-09-06 15:59:21 +0900 | [diff] [blame] | 707 | break; |
| 708 | } |
| 709 | } |
Jooyung Han | 19c1d6c | 2021-08-06 14:08:16 +0900 | [diff] [blame] | 710 | Ok(()) |
| 711 | } |
| 712 | |
Alice Wang | 89cff01 | 2022-09-26 10:05:16 +0000 | [diff] [blame] | 713 | fn get_apk_root_hash_from_idsig<P: AsRef<Path>>(idsig_path: P) -> Result<Box<RootHash>> { |
| 714 | Ok(V4Signature::from_idsig_path(idsig_path)?.hashing_info.raw_root_hash) |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 715 | } |
| 716 | |
Inseob Kim | 197748b | 2021-12-01 19:49:00 +0900 | [diff] [blame] | 717 | fn get_public_key_from_apk(apk: &str, root_hash_trustful: bool) -> Result<Box<[u8]>> { |
| 718 | if !root_hash_trustful { |
| 719 | verify(apk).context(MicrodroidError::PayloadVerificationFailed(format!( |
| 720 | "failed to verify {}", |
| 721 | apk |
| 722 | ))) |
| 723 | } else { |
| 724 | get_public_key_der(apk) |
| 725 | } |
| 726 | } |
| 727 | |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 728 | fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> { |
| 729 | match payload_metadata { |
| 730 | PayloadMetadata::config_path(path) => { |
| 731 | let path = Path::new(&path); |
| 732 | info!("loading config from {:?}...", path); |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 733 | let file = ioutil::wait_for_file(path, WAIT_TIMEOUT) |
| 734 | .with_context(|| format!("Failed to read {:?}", path))?; |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 735 | Ok(serde_json::from_reader(file)?) |
| 736 | } |
| 737 | PayloadMetadata::config(payload_config) => { |
| 738 | let task = Task { |
| 739 | type_: TaskType::MicrodroidLauncher, |
| 740 | command: payload_config.payload_binary_path, |
Alan Stokes | 1f417c9 | 2022-09-29 15:13:28 +0100 | [diff] [blame] | 741 | }; |
| 742 | Ok(VmPayloadConfig { |
| 743 | os: OsConfig { name: "microdroid".to_owned() }, |
| 744 | task: Some(task), |
| 745 | apexes: vec![], |
| 746 | extra_apks: vec![], |
| 747 | prefer_staged: false, |
| 748 | export_tombstones: false, |
| 749 | enable_authfs: false, |
| 750 | }) |
| 751 | } |
| 752 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 753 | } |
| 754 | |
Jiyong Park | 202856e | 2022-08-22 16:04:26 +0900 | [diff] [blame] | 755 | /// Loads the crashkernel into memory using kexec if the VM is loaded with `crashkernel=' parameter |
| 756 | /// in the cmdline. |
| 757 | fn load_crashkernel_if_supported() -> Result<()> { |
| 758 | let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel="); |
| 759 | info!("ramdump supported: {}", supported); |
| 760 | if supported { |
| 761 | let status = Command::new("/system/bin/kexec_load").status()?; |
| 762 | if !status.success() { |
| 763 | return Err(anyhow!("Failed to load crashkernel: {:?}", status)); |
| 764 | } |
| 765 | } |
| 766 | Ok(()) |
| 767 | } |
| 768 | |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 769 | /// Executes the given task. |
Jooyung Han | 5c6d417 | 2021-12-06 14:17:52 +0900 | [diff] [blame] | 770 | fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> { |
Jiyong Park | 8611a6c | 2021-07-09 18:17:44 +0900 | [diff] [blame] | 771 | info!("executing main task {:?}...", task); |
David Brazdil | 451cc96 | 2022-10-14 14:08:12 +0100 | [diff] [blame] | 772 | let mut command = match task.type_ { |
| 773 | TaskType::Executable => Command::new(&task.command), |
| 774 | TaskType::MicrodroidLauncher => { |
| 775 | let mut command = Command::new("/system/bin/microdroid_launcher"); |
| 776 | command.arg(find_library_path(&task.command)?); |
| 777 | command |
| 778 | } |
| 779 | }; |
Inseob Kim | 090b70b | 2022-11-16 20:01:14 +0900 | [diff] [blame] | 780 | command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()); |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 781 | |
| 782 | info!("notifying payload started"); |
Inseob Kim | c7d28c7 | 2021-10-25 14:28:10 +0000 | [diff] [blame] | 783 | service.notifyPayloadStarted()?; |
Inseob Kim | 7f61fe7 | 2021-08-20 20:50:47 +0900 | [diff] [blame] | 784 | |
Inseob Kim | 86ca016 | 2021-10-20 02:21:02 +0000 | [diff] [blame] | 785 | let exit_status = command.spawn()?.wait()?; |
Frederick Mayle | b5f7b6b | 2022-11-11 15:24:03 -0800 | [diff] [blame] | 786 | match exit_status.code() { |
| 787 | Some(exit_code) => Ok(exit_code), |
| 788 | None => Err(match exit_status.signal() { |
| 789 | Some(signal) => anyhow!( |
| 790 | "Payload exited due to signal: {} ({})", |
| 791 | signal, |
| 792 | Signal::try_from(signal).map_or("unknown", |s| s.as_str()) |
| 793 | ), |
| 794 | None => anyhow!("Payload has neither exit code nor signal"), |
| 795 | }), |
| 796 | } |
Jooyung Han | 347d9f2 | 2021-05-28 00:05:14 +0900 | [diff] [blame] | 797 | } |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 798 | |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 799 | fn find_library_path(name: &str) -> Result<String> { |
| 800 | let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?; |
| 801 | let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?; |
| 802 | let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?; |
Alice Wang | 6bbb6da | 2022-10-26 12:44:06 +0000 | [diff] [blame] | 803 | let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name); |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 804 | |
Alan Stokes | 3ba10fd | 2022-10-06 15:46:51 +0100 | [diff] [blame] | 805 | let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?; |
Jooyung Han | 634e2d7 | 2021-06-10 16:27:38 +0900 | [diff] [blame] | 806 | if !metadata.is_file() { |
| 807 | bail!("{} is not a file", &path); |
| 808 | } |
| 809 | |
| 810 | Ok(path) |
| 811 | } |
Jiyong Park | 21ce2c5 | 2021-08-28 02:32:17 +0900 | [diff] [blame] | 812 | |
| 813 | fn to_hex_string(buf: &[u8]) -> String { |
| 814 | buf.iter().map(|b| format!("{:02X}", b)).collect() |
| 815 | } |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 816 | |
| 817 | fn prepare_encryptedstore(dice: &DiceContext) -> Result<Child> { |
| 818 | // Use a fixed salt to scope the derivation to this API. |
| 819 | // Generated using hexdump -vn32 -e'14/1 "0x%02X, " 1 "\n"' /dev/urandom |
| 820 | // TODO(b/241541860) : Move this (& other salts) to a salt container, i.e. a global enum |
| 821 | let salt = [ |
| 822 | 0xFC, 0x1D, 0x35, 0x7B, 0x96, 0xF3, 0xEF, 0x17, 0x78, 0x7D, 0x70, 0xED, 0xEA, 0xFE, 0x1D, |
| 823 | 0x6F, 0xB3, 0xF9, 0x40, 0xCE, 0xDD, 0x99, 0x40, 0xAA, 0xA7, 0x0E, 0x92, 0x73, 0x90, 0x86, |
| 824 | 0x4A, 0x75, |
| 825 | ]; |
| 826 | let key = dice.get_sealing_key( |
| 827 | &salt, |
| 828 | ENCRYPTEDSTORE_KEY_IDENTIFIER.as_bytes(), |
| 829 | ENCRYPTEDSTORE_KEYSIZE, |
| 830 | )?; |
| 831 | |
| 832 | let mut cmd = Command::new(ENCRYPTEDSTORE_BIN); |
| 833 | cmd.arg("--blkdevice") |
| 834 | .arg(ENCRYPTEDSTORE_BACKING_DEVICE) |
| 835 | .arg("--key") |
| 836 | .arg(hex::encode(&*key)) |
Shikha Panwar | 9fd198f | 2022-11-18 17:43:43 +0000 | [diff] [blame] | 837 | .args(["--mountpoint", ENCRYPTEDSTORE_MOUNTPOINT]) |
Shikha Panwar | 566c967 | 2022-11-15 14:39:58 +0000 | [diff] [blame] | 838 | .spawn() |
| 839 | .context("encryptedstore failed") |
| 840 | } |