blob: 0cc64738a4c9c764a717d88c37fe2aaf35633a71 [file] [log] [blame]
Alan Stokeseb97d4a2021-08-26 14:24:32 +01001/*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Alan Stokes17fd36a2021-09-06 17:22:37 +010017//! A tool to verify whether a CompOS instance image and key pair are valid. It starts a CompOS VM
Alan Stokeseb97d4a2021-08-26 14:24:32 +010018//! as part of this. The tool is intended to be run by odsign during boot.
19
Alan Stokes17fd36a2021-09-06 17:22:37 +010020use anyhow::{bail, Context, Result};
21use compos_aidl_interface::binder::ProcessState;
22use compos_common::compos_client::VmInstance;
Alan Stokesb2cc79e2021-09-14 14:08:46 +010023use compos_common::{
24 COMPOS_DATA_ROOT, CURRENT_DIR, INSTANCE_IMAGE_FILE, PENDING_DIR, PRIVATE_KEY_BLOB_FILE,
25 PUBLIC_KEY_FILE,
26};
Alan Stokeseb97d4a2021-08-26 14:24:32 +010027use std::fs::{self, File};
28use std::io::Read;
29use std::path::{Path, PathBuf};
Alan Stokeseb97d4a2021-08-26 14:24:32 +010030
Alan Stokeseb97d4a2021-08-26 14:24:32 +010031const MAX_FILE_SIZE_BYTES: u64 = 8 * 1024;
32
Alan Stokeseb97d4a2021-08-26 14:24:32 +010033fn main() -> Result<()> {
Alan Stokes17fd36a2021-09-06 17:22:37 +010034 android_logger::init_once(
35 android_logger::Config::default()
36 .with_tag("compos_verify_key")
37 .with_min_level(log::Level::Info),
38 );
39
Alan Stokeseb97d4a2021-08-26 14:24:32 +010040 let matches = clap::App::new("compos_verify_key")
41 .arg(
42 clap::Arg::with_name("instance")
43 .long("instance")
44 .takes_value(true)
45 .required(true)
46 .possible_values(&["pending", "current"]),
47 )
48 .get_matches();
49 let do_pending = matches.value_of("instance").unwrap() == "pending";
50
51 let instance_dir: PathBuf =
52 [COMPOS_DATA_ROOT, if do_pending { PENDING_DIR } else { CURRENT_DIR }].iter().collect();
53
54 if !instance_dir.is_dir() {
55 bail!("{} is not a directory", instance_dir.display());
56 }
57
58 // We need to start the thread pool to be able to receive Binder callbacks
59 ProcessState::start_thread_pool();
60
61 let result = verify(&instance_dir).and_then(|_| {
62 if do_pending {
63 // If the pending instance is ok, then it must actually match the current system state,
64 // so we promote it to current.
Alan Stokes17fd36a2021-09-06 17:22:37 +010065 log::info!("Promoting pending to current");
Alan Stokeseb97d4a2021-08-26 14:24:32 +010066 promote_to_current(&instance_dir)
67 } else {
68 Ok(())
69 }
70 });
71
72 if result.is_err() {
73 // This is best efforts, and we still want to report the original error as our result
Alan Stokes17fd36a2021-09-06 17:22:37 +010074 log::info!("Removing {}", instance_dir.display());
Alan Stokeseb97d4a2021-08-26 14:24:32 +010075 if let Err(e) = fs::remove_dir_all(&instance_dir) {
Alan Stokes17fd36a2021-09-06 17:22:37 +010076 log::warn!("Failed to remove directory: {}", e);
Alan Stokeseb97d4a2021-08-26 14:24:32 +010077 }
78 }
79
80 result
81}
82
83fn verify(instance_dir: &Path) -> Result<()> {
84 let blob = instance_dir.join(PRIVATE_KEY_BLOB_FILE);
85 let public_key = instance_dir.join(PUBLIC_KEY_FILE);
Alan Stokes17fd36a2021-09-06 17:22:37 +010086 let instance_image = instance_dir.join(INSTANCE_IMAGE_FILE);
Alan Stokeseb97d4a2021-08-26 14:24:32 +010087
88 let blob = read_small_file(blob).context("Failed to read key blob")?;
89 let public_key = read_small_file(public_key).context("Failed to read public key")?;
Alan Stokes16e027f2021-10-04 17:57:31 +010090 let instance_image = File::open(instance_image).context("Failed to open instance image")?;
Alan Stokeseb97d4a2021-08-26 14:24:32 +010091
Alan Stokes16e027f2021-10-04 17:57:31 +010092 let vm_instance = VmInstance::start(instance_image)?;
Alan Stokes17fd36a2021-09-06 17:22:37 +010093 let service = vm_instance.get_service()?;
Alan Stokeseb97d4a2021-08-26 14:24:32 +010094
95 let result = service.verifySigningKey(&blob, &public_key).context("Verifying signing key")?;
96
97 if !result {
98 bail!("Key files are not valid");
99 }
100
101 Ok(())
102}
103
104fn read_small_file(file: PathBuf) -> Result<Vec<u8>> {
105 let mut file = File::open(file)?;
106 if file.metadata()?.len() > MAX_FILE_SIZE_BYTES {
107 bail!("File is too big");
108 }
109 let mut data = vec![];
110 file.read_to_end(&mut data)?;
111 Ok(data)
112}
113
Alan Stokeseb97d4a2021-08-26 14:24:32 +0100114fn promote_to_current(instance_dir: &Path) -> Result<()> {
115 let current_dir: PathBuf = [COMPOS_DATA_ROOT, CURRENT_DIR].iter().collect();
116
117 // This may fail if the directory doesn't exist - which is fine, we only care about the rename
118 // succeeding.
119 let _ = fs::remove_dir_all(&current_dir);
120
121 fs::rename(&instance_dir, &current_dir)
122 .context("Unable to promote pending instance to current")?;
123 Ok(())
124}