blob: 8fa2807b18ebd093ac97b58a4298d9d3c77bc9a5 [file] [log] [blame]
Jooyung Han347d9f22021-05-28 00:05:14 +09001// Copyright 2021, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Microdroid Manager
16
Andrew Sculld64ae7d2022-10-05 17:41:43 +000017mod dice;
Jiyong Park21ce2c52021-08-28 02:32:17 +090018mod instance;
Jooyung Hanf48ceb42021-06-01 18:00:04 +090019mod ioutil;
Jooyung Han7a343f92021-09-08 22:53:11 +090020mod payload;
Keir Fraser933f0ac2022-10-12 08:23:28 +000021mod swap;
Alice Wang59a9e562022-10-04 15:24:10 +000022mod vm_payload_service;
Jooyung Han347d9f22021-05-28 00:05:14 +090023
Alice Wang285a3d22023-03-01 11:36:29 +000024use crate::dice::{DiceDriver, derive_sealing_key, format_payload_config_descriptor};
Inseob Kime379e7d2022-07-22 18:55:18 +090025use crate::instance::{ApexData, ApkData, InstanceDisk, MicrodroidData, RootHash};
Alice Wang59a9e562022-10-04 15:24:10 +000026use crate::vm_payload_service::register_vm_payload_service;
Alan Stokes2bead0d2022-09-05 16:58:34 +010027use android_system_virtualizationcommon::aidl::android::system::virtualizationcommon::ErrorCode::ErrorCode;
David Brazdil73988ea2022-11-11 15:10:32 +000028use android_system_virtualmachineservice::aidl::android::system::virtualmachineservice::IVirtualMachineService::IVirtualMachineService;
Inseob Kim090b70b2022-11-16 20:01:14 +090029use android_system_virtualization_payload::aidl::android::system::virtualization::payload::IVmPayloadService::{
30 VM_APK_CONTENTS_PATH,
31 VM_PAYLOAD_SERVICE_SOCKET_NAME,
Shikha Panwarddc124b2022-11-28 19:17:54 +000032 ENCRYPTEDSTORE_MOUNTPOINT,
Inseob Kim090b70b2022-11-16 20:01:14 +090033};
Jooyung Handd0a1732021-11-23 15:26:20 +090034use anyhow::{anyhow, bail, ensure, Context, Error, Result};
Alice Wang1bf3d782022-09-28 07:56:36 +000035use apkverify::{get_public_key_der, verify, V4Signature};
Alice Wang43c884b2022-10-24 09:42:40 +000036use binder::Strong;
Alice Wang62f7e642023-02-10 09:55:13 +000037use diced_open_dice::OwnedDiceArtifacts;
Inseob Kim197748b2021-12-01 19:49:00 +090038use glob::glob;
Inseob Kim197748b2021-12-01 19:49:00 +090039use itertools::sorted;
David Brazdila07a1792022-10-25 13:37:57 +010040use libc::VMADDR_CID_HOST;
Alice Wang2a5306e2023-06-05 09:18:32 +000041use log::{error, info};
Alice Wang7e6c9352023-02-15 15:44:13 +000042use keystore2_crypto::ZVec;
Alan Stokes0d1ef782022-09-27 13:46:35 +010043use microdroid_metadata::{write_metadata, Metadata, PayloadMetadata};
Seungjae Yoofd9a0622022-10-14 10:01:29 +090044use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080045use nix::sys::signal::Signal;
Andrew Sculla0d1b1a2022-05-24 19:32:47 +000046use openssl::sha::Sha512;
Jooyung Han4a9b3bf2021-09-10 17:19:00 +090047use payload::{get_apex_data_from_payload, load_metadata, to_metadata};
Andrew Scull34916a72022-01-30 21:34:24 +000048use rand::Fill;
David Brazdila2125dd2022-12-14 16:37:44 +000049use rpcbinder::RpcSession;
Inseob Kim090b70b2022-11-16 20:01:14 +090050use rustutils::sockets::android_get_control_socket;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090051use rustutils::system_properties;
Joel Galenson482704c2021-07-29 15:53:53 -070052use rustutils::system_properties::PropertyWatcher;
Alan Stokes3ba10fd2022-10-06 15:46:51 +010053use std::borrow::Cow::{Borrowed, Owned};
Andrew Scullb2f44472022-01-21 14:41:34 +000054use std::convert::TryInto;
Inseob Kim7ff121c2022-11-14 18:13:23 +090055use std::env;
Shikha Panwardef7ef92023-01-06 08:35:48 +000056use std::ffi::CString;
Jaewan Kim3124ef02023-03-23 19:25:20 +090057use std::fs::{self, create_dir, OpenOptions, File};
58use std::io::{Read, Write};
Nikita Ioffe3452ee22022-12-15 00:31:56 +000059use std::os::unix::process::CommandExt;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -080060use std::os::unix::process::ExitStatusExt;
Alice Wangfd222fd2023-05-25 09:37:38 +000061use std::os::unix::io::{FromRawFd, OwnedFd};
Jooyung Hanf48ceb42021-06-01 18:00:04 +090062use std::path::Path;
Inseob Kim217038e2021-11-25 11:15:06 +090063use std::process::{Child, Command, Stdio};
Jiyong Park8611a6c2021-07-09 18:17:44 +090064use std::str;
Jiyong Parkbb4a9872021-09-06 15:59:21 +090065use std::time::{Duration, SystemTime};
Jooyung Han634e2d72021-06-10 16:27:38 +090066
67const WAIT_TIMEOUT: Duration = Duration::from_secs(10);
Inseob Kim197748b2021-12-01 19:49:00 +090068const MAIN_APK_PATH: &str = "/dev/block/by-name/microdroid-apk";
69const MAIN_APK_IDSIG_PATH: &str = "/dev/block/by-name/microdroid-apk-idsig";
70const MAIN_APK_DEVICE_NAME: &str = "microdroid-apk";
71const EXTRA_APK_PATH_PATTERN: &str = "/dev/block/by-name/extra-apk-*";
72const EXTRA_IDSIG_PATH_PATTERN: &str = "/dev/block/by-name/extra-idsig-*";
Jooyung Han19c1d6c2021-08-06 14:08:16 +090073const DM_MOUNTED_APK_PATH: &str = "/dev/block/mapper/microdroid-apk";
Andrew Scullab72ec52022-03-14 09:10:52 +000074const AVF_STRICT_BOOT: &str = "/sys/firmware/devicetree/base/chosen/avf,strict-boot";
75const AVF_NEW_INSTANCE: &str = "/sys/firmware/devicetree/base/chosen/avf,new-instance";
Jaewan Kim3124ef02023-03-23 19:25:20 +090076const AVF_DEBUG_POLICY_RAMDUMP: &str = "/sys/firmware/devicetree/base/avf/guest/common/ramdump";
Inseob Kime379e7d2022-07-22 18:55:18 +090077const DEBUG_MICRODROID_NO_VERIFIED_BOOT: &str =
78 "/sys/firmware/devicetree/base/virtualization/guest/debug-microdroid,no-verified-boot";
Jooyung Han347d9f22021-05-28 00:05:14 +090079
Alan Stokes4fb201c2023-02-08 17:39:05 +000080const APKDMVERITY_BIN: &str = "/system/bin/apkdmverity";
81const ENCRYPTEDSTORE_BIN: &str = "/system/bin/encryptedstore";
82const ZIPFUSE_BIN: &str = "/system/bin/zipfuse";
83
Jiyong Parkbb4a9872021-09-06 15:59:21 +090084const APEX_CONFIG_DONE_PROP: &str = "apex_config.done";
Seungjae Yoofa22bb02022-12-08 16:38:42 +090085const DEBUGGABLE_PROP: &str = "ro.boot.microdroid.debuggable";
Jiyong Parkbb4a9872021-09-06 15:59:21 +090086
Inseob Kim11f40d02022-06-13 17:16:00 +090087// SYNC WITH virtualizationservice/src/crosvm.rs
88const FAILURE_SERIAL_DEVICE: &str = "/dev/ttyS1";
89
Shikha Panwar566c9672022-11-15 14:39:58 +000090const ENCRYPTEDSTORE_BACKING_DEVICE: &str = "/dev/block/by-name/encryptedstore";
Shikha Panwar566c9672022-11-15 14:39:58 +000091const ENCRYPTEDSTORE_KEY_IDENTIFIER: &str = "encryptedstore_key";
Alice Wang62f7e642023-02-10 09:55:13 +000092const ENCRYPTEDSTORE_KEYSIZE: usize = 32;
Shikha Panwar566c9672022-11-15 14:39:58 +000093
Jooyung Handd0a1732021-11-23 15:26:20 +090094#[derive(thiserror::Error, Debug)]
95enum MicrodroidError {
Inseob Kim11f40d02022-06-13 17:16:00 +090096 #[error("Cannot connect to virtualization service: {0}")]
97 FailedToConnectToVirtualizationService(String),
Jooyung Handd0a1732021-11-23 15:26:20 +090098 #[error("Payload has changed: {0}")]
99 PayloadChanged(String),
100 #[error("Payload verification has failed: {0}")]
101 PayloadVerificationFailed(String),
Jooyung Han5c6d4172021-12-06 14:17:52 +0900102 #[error("Payload config is invalid: {0}")]
103 InvalidConfig(String),
Jooyung Handd0a1732021-11-23 15:26:20 +0900104}
105
Alan Stokes2bead0d2022-09-05 16:58:34 +0100106fn translate_error(err: &Error) -> (ErrorCode, String) {
Jooyung Handd0a1732021-11-23 15:26:20 +0900107 if let Some(e) = err.downcast_ref::<MicrodroidError>() {
108 match e {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100109 MicrodroidError::PayloadChanged(msg) => (ErrorCode::PAYLOAD_CHANGED, msg.to_string()),
Jooyung Handd0a1732021-11-23 15:26:20 +0900110 MicrodroidError::PayloadVerificationFailed(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100111 (ErrorCode::PAYLOAD_VERIFICATION_FAILED, msg.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900112 }
Alan Stokes2bead0d2022-09-05 16:58:34 +0100113 MicrodroidError::InvalidConfig(msg) => {
114 (ErrorCode::PAYLOAD_CONFIG_INVALID, msg.to_string())
115 }
Inseob Kim11f40d02022-06-13 17:16:00 +0900116
117 // Connection failure won't be reported to VS; return the default value
118 MicrodroidError::FailedToConnectToVirtualizationService(msg) => {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100119 (ErrorCode::UNKNOWN, msg.to_string())
Inseob Kim11f40d02022-06-13 17:16:00 +0900120 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900121 }
122 } else {
Alan Stokes2bead0d2022-09-05 16:58:34 +0100123 (ErrorCode::UNKNOWN, err.to_string())
Jooyung Handd0a1732021-11-23 15:26:20 +0900124 }
125}
126
Inseob Kim11f40d02022-06-13 17:16:00 +0900127fn write_death_reason_to_serial(err: &Error) -> Result<()> {
128 let death_reason = if let Some(e) = err.downcast_ref::<MicrodroidError>() {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100129 Borrowed(match e {
Inseob Kim11f40d02022-06-13 17:16:00 +0900130 MicrodroidError::FailedToConnectToVirtualizationService(_) => {
131 "MICRODROID_FAILED_TO_CONNECT_TO_VIRTUALIZATION_SERVICE"
132 }
133 MicrodroidError::PayloadChanged(_) => "MICRODROID_PAYLOAD_HAS_CHANGED",
134 MicrodroidError::PayloadVerificationFailed(_) => {
135 "MICRODROID_PAYLOAD_VERIFICATION_FAILED"
136 }
137 MicrodroidError::InvalidConfig(_) => "MICRODROID_INVALID_PAYLOAD_CONFIG",
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100138 })
Inseob Kim11f40d02022-06-13 17:16:00 +0900139 } else {
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100140 // Send context information back after a separator, to ease diagnosis.
141 // These errors occur before the payload runs, so this should not leak sensitive
142 // information.
143 Owned(format!("MICRODROID_UNKNOWN_RUNTIME_ERROR|{:?}", err))
Inseob Kim11f40d02022-06-13 17:16:00 +0900144 };
145
146 let death_reason_bytes = death_reason.as_bytes();
147 let mut sent_total = 0;
148 while sent_total < death_reason_bytes.len() {
149 // TODO(b/220071963): Sometimes, sending more than 16 bytes at once makes MM hang.
150 let begin = sent_total;
151 let end = std::cmp::min(begin.saturating_add(16), death_reason_bytes.len());
152 OpenOptions::new()
153 .read(false)
154 .write(true)
155 .open(FAILURE_SERIAL_DEVICE)?
156 .write_all(&death_reason_bytes[begin..end])?;
157 sent_total = end;
158 }
159
160 Ok(())
161}
162
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900163fn get_vms_rpc_binder() -> Result<Strong<dyn IVirtualMachineService>> {
David Brazdil73988ea2022-11-11 15:10:32 +0000164 // The host is running a VirtualMachineService for this VM on a port equal
165 // to the CID of this VM.
166 let port = vsock::get_local_cid().context("Could not determine local CID")?;
David Brazdila2125dd2022-12-14 16:37:44 +0000167 RpcSession::new()
168 .setup_vsock_client(VMADDR_CID_HOST, port)
David Brazdil73988ea2022-11-11 15:10:32 +0000169 .context("Could not connect to IVirtualMachineService")
Inseob Kim1b95f2e2021-08-19 13:17:40 +0900170}
171
Inseob Kim437f1052022-06-21 11:30:22 +0900172fn main() -> Result<()> {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900173 // If debuggable, print full backtrace to console log with stdio_to_kmsg
Seungjae Yoofa22bb02022-12-08 16:38:42 +0900174 if system_properties::read_bool(DEBUGGABLE_PROP, true)? {
Inseob Kim7ff121c2022-11-14 18:13:23 +0900175 env::set_var("RUST_BACKTRACE", "full");
176 }
177
Inseob Kim437f1052022-06-21 11:30:22 +0900178 scopeguard::defer! {
179 info!("Shutting down...");
Jooyung Hanbfe086f2021-10-28 10:15:45 +0900180 if let Err(e) = system_properties::write("sys.powerctl", "shutdown") {
181 error!("failed to shutdown {:?}", e);
182 }
Jooyung Han311b1202021-09-14 22:00:16 +0900183 }
Inseob Kim437f1052022-06-21 11:30:22 +0900184
185 try_main().map_err(|e| {
186 error!("Failed with {:?}.", e);
187 if let Err(e) = write_death_reason_to_serial(&e) {
188 error!("Failed to write death reason {:?}", e);
189 }
190 e
191 })
Jooyung Han311b1202021-09-14 22:00:16 +0900192}
193
Alice Wangfd222fd2023-05-25 09:37:38 +0000194/// Prepares a socket file descriptor for the vm payload service.
195///
196/// # Safety requirement
197///
198/// The caller must ensure that this function is the only place that claims ownership
199/// of the file descriptor and it is called only once.
200unsafe fn prepare_vm_payload_service_socket() -> Result<OwnedFd> {
201 let raw_fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?;
Inseob Kim090b70b2022-11-16 20:01:14 +0900202
Alice Wangfd222fd2023-05-25 09:37:38 +0000203 // Creating OwnedFd for stdio FDs is not safe.
204 if [libc::STDIN_FILENO, libc::STDOUT_FILENO, libc::STDERR_FILENO].contains(&raw_fd) {
205 bail!("File descriptor {raw_fd} is standard I/O descriptor");
206 }
207 // SAFETY: Initializing OwnedFd for a RawFd created by the init.
208 // We checked that the integer value corresponds to a valid FD and that the caller
209 // ensures that this is the only place to claim its ownership.
210 Ok(unsafe { OwnedFd::from_raw_fd(raw_fd) })
Inseob Kim090b70b2022-11-16 20:01:14 +0900211}
212
Jooyung Han311b1202021-09-14 22:00:16 +0900213fn try_main() -> Result<()> {
Dan Albert04e5dbd2023-05-08 22:49:40 +0000214 let _ignored = kernlog::init();
Jooyung Han347d9f22021-05-28 00:05:14 +0900215 info!("started.");
216
Alice Wangfd222fd2023-05-25 09:37:38 +0000217 // SAFETY: This is the only place we take the ownership of the fd of the vm payload service.
218 //
Alice Wang2a5306e2023-06-05 09:18:32 +0000219 // To ensure that the CLOEXEC flag is set on the file descriptor as early as possible,
220 // it is necessary to fetch the socket corresponding to vm_payload_service at the
221 // very beginning, as android_get_control_socket() sets the CLOEXEC flag on the file
222 // descriptor.
Alice Wangfd222fd2023-05-25 09:37:38 +0000223 let vm_payload_service_fd = unsafe { prepare_vm_payload_service_socket()? };
Inseob Kim090b70b2022-11-16 20:01:14 +0900224
Jiyong Park202856e2022-08-22 16:04:26 +0900225 load_crashkernel_if_supported().context("Failed to load crashkernel")?;
226
Keir Fraser933f0ac2022-10-12 08:23:28 +0000227 swap::init_swap().context("Failed to initialise swap")?;
228 info!("swap enabled.");
229
Inseob Kim11f40d02022-06-13 17:16:00 +0900230 let service = get_vms_rpc_binder()
231 .context("cannot connect to VirtualMachineService")
232 .map_err(|e| MicrodroidError::FailedToConnectToVirtualizationService(e.to_string()))?;
Seungjae Yoofd9a0622022-10-14 10:01:29 +0900233
Alice Wangfd222fd2023-05-25 09:37:38 +0000234 match try_run_payload(&service, vm_payload_service_fd) {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900235 Ok(code) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900236 if code == 0 {
237 info!("task successfully finished");
238 } else {
239 error!("task exited with exit code: {}", code);
240 }
Shikha Panwardef7ef92023-01-06 08:35:48 +0000241 if let Err(e) = post_payload_work() {
242 error!(
243 "Failed to run post payload work. It is possible that certain tasks
244 like syncing encrypted store might be incomplete. Error: {:?}",
245 e
246 );
247 };
248
249 info!("notifying payload finished");
250 service.notifyPayloadFinished(code)?;
Jooyung Han5c6d4172021-12-06 14:17:52 +0900251 Ok(())
252 }
253 Err(err) => {
Jooyung Han5c6d4172021-12-06 14:17:52 +0900254 let (error_code, message) = translate_error(&err);
255 service.notifyError(error_code, &message)?;
256 Err(err)
257 }
Jooyung Handd0a1732021-11-23 15:26:20 +0900258 }
259}
260
Shikha Panwardef7ef92023-01-06 08:35:48 +0000261fn post_payload_work() -> Result<()> {
262 // Sync the encrypted storage filesystem (flushes the filesystem caches).
263 if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
264 let mountpoint = CString::new(ENCRYPTEDSTORE_MOUNTPOINT).unwrap();
265
266 let ret = unsafe {
267 let dirfd = libc::open(
268 mountpoint.as_ptr(),
269 libc::O_DIRECTORY | libc::O_RDONLY | libc::O_CLOEXEC,
270 );
271 ensure!(dirfd >= 0, "Unable to open {:?}", mountpoint);
272 let ret = libc::syncfs(dirfd);
273 libc::close(dirfd);
274 ret
275 };
276 if ret != 0 {
277 error!("failed to sync encrypted storage.");
278 return Err(anyhow!(std::io::Error::last_os_error()));
279 }
280 }
281 Ok(())
282}
Alan Stokes1f417c92022-09-29 15:13:28 +0100283fn dice_derivation(
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000284 dice: DiceDriver,
Alan Stokes1f417c92022-09-29 15:13:28 +0100285 verified_data: &MicrodroidData,
286 payload_metadata: &PayloadMetadata,
Alice Wang62f7e642023-02-10 09:55:13 +0000287) -> Result<OwnedDiceArtifacts> {
Andrew Scullb2f44472022-01-21 14:41:34 +0000288 // Calculate compound digests of code and authorities
Andrew Sculla0d1b1a2022-05-24 19:32:47 +0000289 let mut code_hash_ctx = Sha512::new();
290 let mut authority_hash_ctx = Sha512::new();
Andrew Scullb2f44472022-01-21 14:41:34 +0000291 code_hash_ctx.update(verified_data.apk_data.root_hash.as_ref());
292 authority_hash_ctx.update(verified_data.apk_data.pubkey.as_ref());
Inseob Kimb2519c52022-04-14 02:10:09 +0900293 for extra_apk in &verified_data.extra_apks_data {
Andrew Scullb2f44472022-01-21 14:41:34 +0000294 code_hash_ctx.update(extra_apk.root_hash.as_ref());
295 authority_hash_ctx.update(extra_apk.pubkey.as_ref());
296 }
Inseob Kimb2519c52022-04-14 02:10:09 +0900297 for apex in &verified_data.apex_data {
Andrew Scullb2f44472022-01-21 14:41:34 +0000298 code_hash_ctx.update(apex.root_digest.as_ref());
299 authority_hash_ctx.update(apex.public_key.as_ref());
300 }
Andrew Sculla0d1b1a2022-05-24 19:32:47 +0000301 let code_hash = code_hash_ctx.finish();
302 let authority_hash = authority_hash_ctx.finish();
Andrew Scullb2f44472022-01-21 14:41:34 +0000303
Alice Wang285a3d22023-03-01 11:36:29 +0000304 let config_descriptor = format_payload_config_descriptor(payload_metadata)?;
Andrew Scullb2f44472022-01-21 14:41:34 +0000305
Seungjae Yoofa22bb02022-12-08 16:38:42 +0900306 // Check debuggability, conservatively assuming it is debuggable
307 let debuggable = system_properties::read_bool(DEBUGGABLE_PROP, true)?;
Andrew Scull65ddfc42022-02-14 21:03:58 +0000308
Andrew Scullb2f44472022-01-21 14:41:34 +0000309 // Send the details to diced
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000310 let hidden = verified_data.salt.clone().try_into().unwrap();
Alice Wang285a3d22023-03-01 11:36:29 +0000311 dice.derive(code_hash, &config_descriptor, authority_hash, debuggable, hidden)
Alan Stokes1f417c92022-09-29 15:13:28 +0100312}
313
Andrew Scullab72ec52022-03-14 09:10:52 +0000314fn is_strict_boot() -> bool {
315 Path::new(AVF_STRICT_BOOT).exists()
316}
317
318fn is_new_instance() -> bool {
319 Path::new(AVF_NEW_INSTANCE).exists()
320}
321
Inseob Kime379e7d2022-07-22 18:55:18 +0900322fn is_verified_boot() -> bool {
323 !Path::new(DEBUG_MICRODROID_NO_VERIFIED_BOOT).exists()
324}
325
Inseob Kimab1037d2023-02-08 17:03:31 +0900326fn should_export_tombstones(config: &VmPayloadConfig) -> bool {
327 match config.export_tombstones {
328 Some(b) => b,
329 None => system_properties::read_bool(DEBUGGABLE_PROP, true).unwrap_or(false),
330 }
331}
332
Jaewan Kim3124ef02023-03-23 19:25:20 +0900333/// Get debug policy value in bool. It's true iff the value is explicitly set to <1>.
334fn get_debug_policy_bool(path: &'static str) -> Result<Option<bool>> {
335 let mut file = match File::open(path) {
336 Ok(dp) => dp,
337 Err(e) => {
338 info!("{e:?}. Assumes <0>");
339 return Ok(Some(false));
340 }
341 };
342 let mut log: [u8; 4] = Default::default();
343 file.read_exact(&mut log).context("Malformed data in {path}")?;
344 // DT spec uses big endian although Android is always little endian.
345 Ok(Some(u32::from_be_bytes(log) == 1))
346}
347
Alice Wangfd222fd2023-05-25 09:37:38 +0000348fn try_run_payload(
349 service: &Strong<dyn IVirtualMachineService>,
350 vm_payload_service_fd: OwnedFd,
351) -> Result<i32> {
Jooyung Han311b1202021-09-14 22:00:16 +0900352 let metadata = load_metadata().context("Failed to load payload metadata")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000353 let dice = DiceDriver::new(Path::new("/dev/open-dice0")).context("Failed to load DICE")?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900354
Jooyung Han311b1202021-09-14 22:00:16 +0900355 let mut instance = InstanceDisk::new().context("Failed to load instance.img")?;
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000356 let saved_data =
357 instance.read_microdroid_data(&dice).context("Failed to read identity data")?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900358
Andrew Scullab72ec52022-03-14 09:10:52 +0000359 if is_strict_boot() {
360 // Provisioning must happen on the first boot and never again.
361 if is_new_instance() {
362 ensure!(
363 saved_data.is_none(),
364 MicrodroidError::InvalidConfig("Found instance data on first boot.".to_string())
365 );
366 } else {
367 ensure!(
368 saved_data.is_some(),
369 MicrodroidError::InvalidConfig("Instance data not found.".to_string())
370 );
371 };
372 }
373
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900374 // Verify the payload before using it.
Inseob Kim11f40d02022-06-13 17:16:00 +0900375 let verified_data = verify_payload(&metadata, saved_data.as_ref())
376 .context("Payload verification failed")
377 .map_err(|e| MicrodroidError::PayloadVerificationFailed(e.to_string()))?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900378
379 // In case identity is ignored (by debug policy), we should reuse existing payload data, even
380 // when the payload is changed. This is to keep the derived secret same as before.
381 let verified_data = if let Some(saved_data) = saved_data {
382 if !is_verified_boot() {
383 if saved_data != verified_data {
384 info!("Detected an update of the payload, but continue (regarding debug policy)")
385 }
386 } else {
387 ensure!(
388 saved_data == verified_data,
389 MicrodroidError::PayloadChanged(String::from(
390 "Detected an update of the payload which isn't supported yet."
391 ))
392 );
393 info!("Saved data is verified.");
394 }
395 saved_data
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900396 } else {
Jooyung Han7a343f92021-09-08 22:53:11 +0900397 info!("Saving verified data.");
Andrew Sculld64ae7d2022-10-05 17:41:43 +0000398 instance
399 .write_microdroid_data(&verified_data, &dice)
400 .context("Failed to write identity data")?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900401 verified_data
402 };
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900403
Alan Stokes1f417c92022-09-29 15:13:28 +0100404 let payload_metadata = metadata.payload.ok_or_else(|| {
405 MicrodroidError::InvalidConfig("No payload config in metadata".to_string())
406 })?;
Alan Stokes0d1ef782022-09-27 13:46:35 +0100407
Inseob Kimb2519c52022-04-14 02:10:09 +0900408 // To minimize the exposure to untrusted data, derive dice profile as soon as possible.
409 info!("DICE derivation for payload");
Alice Wang62f7e642023-02-10 09:55:13 +0000410 let dice_artifacts = dice_derivation(dice, &verified_data, &payload_metadata)?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000411
412 // Run encryptedstore binary to prepare the storage
413 let encryptedstore_child = if Path::new(ENCRYPTEDSTORE_BACKING_DEVICE).exists() {
414 info!("Preparing encryptedstore ...");
Alice Wang62f7e642023-02-10 09:55:13 +0000415 Some(prepare_encryptedstore(&dice_artifacts).context("encryptedstore run")?)
Shikha Panwar566c9672022-11-15 14:39:58 +0000416 } else {
417 None
418 };
Inseob Kimb2519c52022-04-14 02:10:09 +0900419
Alan Stokes960c9032022-12-07 16:53:45 +0000420 let mut zipfuse = Zipfuse::default();
421
Jooyung Hana6d11eb2021-09-10 11:48:05 +0900422 // Before reading a file from the APK, start zipfuse
Alan Stokes960c9032022-12-07 16:53:45 +0000423 zipfuse.mount(
Alan Stokes60f82202022-10-07 16:40:07 +0100424 MountForExec::Allowed,
Inseob Kim217038e2021-11-25 11:15:06 +0900425 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:system_file:s0",
426 Path::new("/dev/block/mapper/microdroid-apk"),
Alice Wang6bbb6da2022-10-26 12:44:06 +0000427 Path::new(VM_APK_CONTENTS_PATH),
Alan Stokes960c9032022-12-07 16:53:45 +0000428 "microdroid_manager.apk.mounted".to_owned(),
429 )?;
Jiyong Park21ce2c52021-08-28 02:32:17 +0900430
Andrew Scull4d262dc2022-10-21 13:14:33 +0000431 // Restricted APIs are only allowed to be used by platform or test components. Infer this from
432 // the use of a VM config file since those can only be used by platform and test components.
433 let allow_restricted_apis = match payload_metadata {
434 PayloadMetadata::config_path(_) => true,
435 PayloadMetadata::config(_) => false,
436 };
437
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100438 let config = load_config(payload_metadata).context("Failed to load payload metadata")?;
Shikha Panwar6f03c942022-04-13 20:26:50 +0000439
Alan Stokes01b3ef02022-09-22 17:43:24 +0100440 let task = config
441 .task
442 .as_ref()
443 .ok_or_else(|| MicrodroidError::InvalidConfig("No task in VM config".to_string()))?;
444
Alice Wang061478b2023-04-11 13:26:17 +0000445 ensure!(
446 config.extra_apks.len() == verified_data.extra_apks_data.len(),
447 "config expects {} extra apks, but found {}",
448 config.extra_apks.len(),
449 verified_data.extra_apks_data.len()
450 );
Alan Stokes960c9032022-12-07 16:53:45 +0000451 mount_extra_apks(&config, &mut zipfuse)?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900452
Jooyung Han5c6d4172021-12-06 14:17:52 +0900453 // Wait until apex config is done. (e.g. linker configuration for apexes)
Jooyung Han5c6d4172021-12-06 14:17:52 +0900454 wait_for_apex_config_done()?;
455
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000456 setup_config_sysprops(&config)?;
457
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000458 // Set export_tombstones if enabled
Inseob Kimab1037d2023-02-08 17:03:31 +0900459 if should_export_tombstones(&config) {
Shikha Panwar1a6efcd2023-02-03 19:23:43 +0000460 // This property is read by tombstone_handler.
461 system_properties::write("microdroid_manager.export_tombstones.enabled", "1")
462 .context("set microdroid_manager.export_tombstones.enabled")?;
Inseob Kimcd9c1dd2022-07-13 17:13:45 +0900463 }
464
Alan Stokes960c9032022-12-07 16:53:45 +0000465 // Wait until zipfuse has mounted the APKs so we can access the payload
466 zipfuse.wait_until_done()?;
Alan Stokes60f82202022-10-07 16:40:07 +0100467
Alice Wangfd222fd2023-05-25 09:37:38 +0000468 register_vm_payload_service(
469 allow_restricted_apis,
470 service.clone(),
471 dice_artifacts,
472 vm_payload_service_fd,
473 )?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000474
Shikha Panwarddc124b2022-11-28 19:17:54 +0000475 // Wait for encryptedstore to finish mounting the storage (if enabled) before setting
476 // microdroid_manager.init_done. Reason is init stops uneventd after that.
477 // Encryptedstore, however requires ueventd
Shikha Panwar566c9672022-11-15 14:39:58 +0000478 if let Some(mut child) = encryptedstore_child {
479 let exitcode = child.wait().context("Wait for encryptedstore child")?;
480 ensure!(exitcode.success(), "Unable to prepare encrypted storage. Exitcode={}", exitcode);
481 }
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100482
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000483 wait_for_property_true("dev.bootcomplete").context("failed waiting for dev.bootcomplete")?;
Shikha Panwar3f6f6a52022-11-29 17:28:36 +0000484 system_properties::write("microdroid_manager.init_done", "1")
485 .context("set microdroid_manager.init_done")?;
Inseob Kimc16b0cc2023-01-26 14:57:24 +0900486
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000487 info!("boot completed, time to run payload");
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100488 exec_task(task, service).context("Failed to run payload")
Alan Stokes01b3ef02022-09-22 17:43:24 +0100489}
490
Inseob Kim217038e2021-11-25 11:15:06 +0900491struct ApkDmverityArgument<'a> {
492 apk: &'a str,
493 idsig: &'a str,
494 name: &'a str,
Inseob Kim197748b2021-12-01 19:49:00 +0900495 saved_root_hash: Option<&'a RootHash>,
Inseob Kim217038e2021-11-25 11:15:06 +0900496}
497
498fn run_apkdmverity(args: &[ApkDmverityArgument]) -> Result<Child> {
499 let mut cmd = Command::new(APKDMVERITY_BIN);
500
Inseob Kim217038e2021-11-25 11:15:06 +0900501 for argument in args {
502 cmd.arg("--apk").arg(argument.apk).arg(argument.idsig).arg(argument.name);
Inseob Kim197748b2021-12-01 19:49:00 +0900503 if let Some(root_hash) = argument.saved_root_hash {
504 cmd.arg(&to_hex_string(root_hash));
505 } else {
506 cmd.arg("none");
507 }
Inseob Kim217038e2021-11-25 11:15:06 +0900508 }
509
510 cmd.spawn().context("Spawn apkdmverity")
511}
512
Alan Stokes60f82202022-10-07 16:40:07 +0100513enum MountForExec {
514 Allowed,
515 Disallowed,
516}
517
Alan Stokes960c9032022-12-07 16:53:45 +0000518#[derive(Default)]
519struct Zipfuse {
520 ready_properties: Vec<String>,
521}
522
523impl Zipfuse {
Jiyong Park231f9692023-01-09 19:36:21 +0900524 const MICRODROID_PAYLOAD_UID: u32 = 0; // TODO(b/264861173) should be non-root
525 const MICRODROID_PAYLOAD_GID: u32 = 0; // TODO(b/264861173) should be non-root
Alan Stokes960c9032022-12-07 16:53:45 +0000526 fn mount(
527 &mut self,
528 noexec: MountForExec,
529 option: &str,
530 zip_path: &Path,
531 mount_dir: &Path,
532 ready_prop: String,
533 ) -> Result<Child> {
534 let mut cmd = Command::new(ZIPFUSE_BIN);
535 if let MountForExec::Disallowed = noexec {
536 cmd.arg("--noexec");
537 }
538 cmd.args(["-p", &ready_prop, "-o", option]);
Jiyong Park231f9692023-01-09 19:36:21 +0900539 cmd.args(["-u", &Self::MICRODROID_PAYLOAD_UID.to_string()]);
540 cmd.args(["-g", &Self::MICRODROID_PAYLOAD_GID.to_string()]);
Alan Stokes960c9032022-12-07 16:53:45 +0000541 cmd.arg(zip_path).arg(mount_dir);
542 self.ready_properties.push(ready_prop);
543 cmd.spawn().with_context(|| format!("Failed to run zipfuse for {mount_dir:?}"))
Andrew Scullcc339a12022-07-04 12:44:19 +0000544 }
Alan Stokes960c9032022-12-07 16:53:45 +0000545
546 fn wait_until_done(self) -> Result<()> {
547 // We check the last-started check first in the hope that by the time it is done
548 // all or most of the others will also be done, minimising the number of times we
549 // block on a property.
550 for property in self.ready_properties.into_iter().rev() {
551 wait_for_property_true(&property)
552 .with_context(|| format!("Failed waiting for {property}"))?;
553 }
554 Ok(())
Alan Stokes60f82202022-10-07 16:40:07 +0100555 }
Inseob Kim217038e2021-11-25 11:15:06 +0900556}
557
Inseob Kime379e7d2022-07-22 18:55:18 +0900558fn write_apex_payload_data(
559 saved_data: Option<&MicrodroidData>,
560 apex_data_from_payload: &[ApexData],
561) -> Result<()> {
562 if let Some(saved_apex_data) = saved_data.map(|d| &d.apex_data) {
563 // We don't support APEX updates. (assuming that update will change root digest)
564 ensure!(
565 saved_apex_data == apex_data_from_payload,
566 MicrodroidError::PayloadChanged(String::from("APEXes have changed."))
567 );
568 let apex_metadata = to_metadata(apex_data_from_payload);
569 // Pass metadata(with public keys and root digests) to apexd so that it uses the passed
570 // metadata instead of the default one (/dev/block/by-name/payload-metadata)
571 OpenOptions::new()
572 .create_new(true)
573 .write(true)
574 .open("/apex/vm-payload-metadata")
575 .context("Failed to open /apex/vm-payload-metadata")
576 .and_then(|f| write_metadata(&apex_metadata, f))?;
577 }
578 Ok(())
579}
580
Jooyung Han7a343f92021-09-08 22:53:11 +0900581// Verify payload before executing it. For APK payload, Full verification (which is slow) is done
582// when the root_hash values from the idsig file and the instance disk are different. This function
583// returns the verified root hash (for APK payload) and pubkeys (for APEX payloads) that can be
584// saved to the instance disk.
585fn verify_payload(
586 metadata: &Metadata,
587 saved_data: Option<&MicrodroidData>,
588) -> Result<MicrodroidData> {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900589 let start_time = SystemTime::now();
590
Inseob Kim197748b2021-12-01 19:49:00 +0900591 // Verify main APK
Inseob Kim197748b2021-12-01 19:49:00 +0900592 let root_hash_from_idsig = get_apk_root_hash_from_idsig(MAIN_APK_IDSIG_PATH)?;
Alice Wang061478b2023-04-11 13:26:17 +0000593 let root_hash_trustful =
594 saved_data.map(|d| d.apk_data.root_hash_eq(root_hash_from_idsig.as_ref())).unwrap_or(false);
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900595
Jiyong Parkf7dea252021-09-08 01:42:54 +0900596 // If root_hash can be trusted, pass it to apkdmverity so that it uses the passed root_hash
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900597 // instead of the value read from the idsig file.
Inseob Kim197748b2021-12-01 19:49:00 +0900598 let main_apk_argument = {
599 ApkDmverityArgument {
600 apk: MAIN_APK_PATH,
601 idsig: MAIN_APK_IDSIG_PATH,
602 name: MAIN_APK_DEVICE_NAME,
603 saved_root_hash: if root_hash_trustful {
604 Some(root_hash_from_idsig.as_ref())
605 } else {
606 None
607 },
608 }
609 };
610 let mut apkdmverity_arguments = vec![main_apk_argument];
611
612 // Verify extra APKs
613 // For now, we can't read the payload config, so glob APKs and idsigs.
614 // Later, we'll see if it matches with the payload config.
615
616 // sort globbed paths to match apks (extra-apk-{idx}) and idsigs (extra-idsig-{idx})
617 // e.g. "extra-apk-0" corresponds to "extra-idsig-0"
618 let extra_apks =
619 sorted(glob(EXTRA_APK_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>();
620 let extra_idsigs =
621 sorted(glob(EXTRA_IDSIG_PATH_PATTERN)?.collect::<Result<Vec<_>, _>>()?).collect::<Vec<_>>();
Alice Wang061478b2023-04-11 13:26:17 +0000622 ensure!(
623 extra_apks.len() == extra_idsigs.len(),
624 "Extra apks/idsigs mismatch: {} apks but {} idsigs",
625 extra_apks.len(),
626 extra_idsigs.len()
627 );
Inseob Kim197748b2021-12-01 19:49:00 +0900628
Alice Wang061478b2023-04-11 13:26:17 +0000629 let extra_root_hashes_from_idsig: Vec<_> = extra_idsigs
Inseob Kim197748b2021-12-01 19:49:00 +0900630 .iter()
Alice Wang061478b2023-04-11 13:26:17 +0000631 .map(|idsig| {
632 get_apk_root_hash_from_idsig(idsig).expect("Can't find root hash from extra idsig")
Inseob Kim197748b2021-12-01 19:49:00 +0900633 })
634 .collect();
635
Alice Wang061478b2023-04-11 13:26:17 +0000636 let extra_root_hashes_trustful: Vec<_> = if let Some(data) = saved_data {
637 extra_root_hashes_from_idsig
638 .iter()
639 .enumerate()
640 .map(|(i, root_hash)| data.extra_apk_root_hash_eq(i, root_hash))
641 .collect()
642 } else {
643 vec![false; extra_root_hashes_from_idsig.len()]
644 };
645 let extra_apk_names: Vec<_> =
646 (0..extra_apks.len()).map(|i| format!("extra-apk-{}", i)).collect();
647
648 for (i, extra_apk) in extra_apks.iter().enumerate() {
Inseob Kim197748b2021-12-01 19:49:00 +0900649 apkdmverity_arguments.push({
650 ApkDmverityArgument {
Alice Wang061478b2023-04-11 13:26:17 +0000651 apk: extra_apk.to_str().unwrap(),
Inseob Kim197748b2021-12-01 19:49:00 +0900652 idsig: extra_idsigs[i].to_str().unwrap(),
653 name: &extra_apk_names[i],
654 saved_root_hash: if extra_root_hashes_trustful[i] {
655 Some(&extra_root_hashes_from_idsig[i])
656 } else {
657 None
658 },
659 }
660 });
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900661 }
662
663 // Start apkdmverity and wait for the dm-verify block
Inseob Kim197748b2021-12-01 19:49:00 +0900664 let mut apkdmverity_child = run_apkdmverity(&apkdmverity_arguments)?;
Jooyung Han7a343f92021-09-08 22:53:11 +0900665
Jooyung Hanc8deb472021-09-13 13:48:25 +0900666 // While waiting for apkdmverity to mount APK, gathers public keys and root digests from
667 // APEX payload.
Jooyung Han7a343f92021-09-08 22:53:11 +0900668 let apex_data_from_payload = get_apex_data_from_payload(metadata)?;
Inseob Kime379e7d2022-07-22 18:55:18 +0900669
670 // Writing /apex/vm-payload-metadata is to verify that the payload isn't changed.
671 // Skip writing it if the debug policy ignoring identity is on
672 if is_verified_boot() {
673 write_apex_payload_data(saved_data, &apex_data_from_payload)?;
Jooyung Han4a9b3bf2021-09-10 17:19:00 +0900674 }
Inseob Kime379e7d2022-07-22 18:55:18 +0900675
Jooyung Han4a9b3bf2021-09-10 17:19:00 +0900676 // Start apexd to activate APEXes
677 system_properties::write("ctl.start", "apexd-vm")?;
Jooyung Han7a343f92021-09-08 22:53:11 +0900678
Inseob Kim217038e2021-11-25 11:15:06 +0900679 // TODO(inseob): add timeout
680 apkdmverity_child.wait()?;
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900681
Jiyong Parkf7dea252021-09-08 01:42:54 +0900682 // Do the full verification if the root_hash is un-trustful. This requires the full scanning of
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900683 // the APK file and therefore can be very slow if the APK is large. Note that this step is
Jiyong Parkf7dea252021-09-08 01:42:54 +0900684 // taken only when the root_hash is un-trustful which can be either when this is the first boot
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900685 // of the VM or APK was updated in the host.
686 // TODO(jooyung): consider multithreading to make this faster
Inseob Kim197748b2021-12-01 19:49:00 +0900687 let main_apk_pubkey = get_public_key_from_apk(DM_MOUNTED_APK_PATH, root_hash_trustful)?;
688 let extra_apks_data = extra_root_hashes_from_idsig
689 .into_iter()
690 .enumerate()
691 .map(|(i, extra_root_hash)| {
692 let mount_path = format!("/dev/block/mapper/{}", &extra_apk_names[i]);
693 let apk_pubkey = get_public_key_from_apk(&mount_path, extra_root_hashes_trustful[i])?;
694 Ok(ApkData { root_hash: extra_root_hash, pubkey: apk_pubkey })
695 })
696 .collect::<Result<Vec<_>>>()?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900697
698 info!("payload verification successful. took {:#?}", start_time.elapsed().unwrap());
699
Andrew Scull34916a72022-01-30 21:34:24 +0000700 // Use the salt from a verified instance, or generate a salt for a new instance.
701 let salt = if let Some(saved_data) = saved_data {
702 saved_data.salt.clone()
Pierre-Clément Tosicecb0aa2023-02-08 16:57:54 +0000703 } else if is_strict_boot() {
704 // No need to add more entropy as a previous stage must have used a new, random salt.
705 vec![0u8; 64]
Andrew Scull34916a72022-01-30 21:34:24 +0000706 } else {
707 let mut salt = vec![0u8; 64];
708 salt.as_mut_slice().try_fill(&mut rand::thread_rng())?;
709 salt
710 };
711
Jiyong Parkf7dea252021-09-08 01:42:54 +0900712 // At this point, we can ensure that the root_hash from the idsig file is trusted, either by
713 // fully verifying the APK or by comparing it with the saved root_hash.
Jooyung Han7a343f92021-09-08 22:53:11 +0900714 Ok(MicrodroidData {
Andrew Scull34916a72022-01-30 21:34:24 +0000715 salt,
Inseob Kim197748b2021-12-01 19:49:00 +0900716 apk_data: ApkData { root_hash: root_hash_from_idsig, pubkey: main_apk_pubkey },
717 extra_apks_data,
Jooyung Han7a343f92021-09-08 22:53:11 +0900718 apex_data: apex_data_from_payload,
719 })
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900720}
721
Alan Stokes960c9032022-12-07 16:53:45 +0000722fn mount_extra_apks(config: &VmPayloadConfig, zipfuse: &mut Zipfuse) -> Result<()> {
Inseob Kim197748b2021-12-01 19:49:00 +0900723 // For now, only the number of apks is important, as the mount point and dm-verity name is fixed
724 for i in 0..config.extra_apks.len() {
Alan Stokes960c9032022-12-07 16:53:45 +0000725 let mount_dir = format!("/mnt/extra-apk/{i}");
Inseob Kim197748b2021-12-01 19:49:00 +0900726 create_dir(Path::new(&mount_dir)).context("Failed to create mount dir for extra apks")?;
727
728 // don't wait, just detach
Alan Stokes960c9032022-12-07 16:53:45 +0000729 zipfuse.mount(
Alan Stokes60f82202022-10-07 16:40:07 +0100730 MountForExec::Disallowed,
Inseob Kim197748b2021-12-01 19:49:00 +0900731 "fscontext=u:object_r:zipfusefs:s0,context=u:object_r:extra_apk_file:s0",
Alan Stokes960c9032022-12-07 16:53:45 +0000732 Path::new(&format!("/dev/block/mapper/extra-apk-{i}")),
Inseob Kim197748b2021-12-01 19:49:00 +0900733 Path::new(&mount_dir),
Alan Stokes960c9032022-12-07 16:53:45 +0000734 format!("microdroid_manager.extra_apk.mounted.{i}"),
735 )?;
Inseob Kim197748b2021-12-01 19:49:00 +0900736 }
737
738 Ok(())
739}
740
Nikita Ioffe57bc8d72022-11-27 00:50:50 +0000741fn setup_config_sysprops(config: &VmPayloadConfig) -> Result<()> {
742 if config.enable_authfs {
743 system_properties::write("microdroid_manager.authfs.enabled", "1")
744 .context("failed to write microdroid_manager.authfs.enabled")?;
745 }
746 system_properties::write("microdroid_manager.config_done", "1")
747 .context("failed to write microdroid_manager.config_done")?;
748 Ok(())
749}
750
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900751// Waits until linker config is generated
752fn wait_for_apex_config_done() -> Result<()> {
Alan Stokes60f82202022-10-07 16:40:07 +0100753 wait_for_property_true(APEX_CONFIG_DONE_PROP).context("Failed waiting for apex config done")
754}
755
756fn wait_for_property_true(property_name: &str) -> Result<()> {
757 let mut prop = PropertyWatcher::new(property_name)?;
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900758 loop {
Andrew Walbrand9c766e2023-05-10 15:15:39 +0000759 prop.wait(None)?;
Alan Stokes60f82202022-10-07 16:40:07 +0100760 if system_properties::read_bool(property_name, false)? {
Jiyong Parkbb4a9872021-09-06 15:59:21 +0900761 break;
762 }
763 }
Jooyung Han19c1d6c2021-08-06 14:08:16 +0900764 Ok(())
765}
766
Alice Wang89cff012022-09-26 10:05:16 +0000767fn get_apk_root_hash_from_idsig<P: AsRef<Path>>(idsig_path: P) -> Result<Box<RootHash>> {
768 Ok(V4Signature::from_idsig_path(idsig_path)?.hashing_info.raw_root_hash)
Jiyong Park21ce2c52021-08-28 02:32:17 +0900769}
770
Inseob Kim197748b2021-12-01 19:49:00 +0900771fn get_public_key_from_apk(apk: &str, root_hash_trustful: bool) -> Result<Box<[u8]>> {
Alan Stokes25f69362023-03-06 16:51:54 +0000772 let current_sdk = get_current_sdk()?;
Inseob Kim197748b2021-12-01 19:49:00 +0900773 if !root_hash_trustful {
Alan Stokes25f69362023-03-06 16:51:54 +0000774 verify(apk, current_sdk).context(MicrodroidError::PayloadVerificationFailed(format!(
Inseob Kim197748b2021-12-01 19:49:00 +0900775 "failed to verify {}",
776 apk
777 )))
778 } else {
Alan Stokes25f69362023-03-06 16:51:54 +0000779 get_public_key_der(apk, current_sdk)
Inseob Kim197748b2021-12-01 19:49:00 +0900780 }
781}
782
Alan Stokes25f69362023-03-06 16:51:54 +0000783fn get_current_sdk() -> Result<u32> {
784 let current_sdk = system_properties::read("ro.build.version.sdk")?;
785 let current_sdk = current_sdk.ok_or_else(|| anyhow!("SDK version missing"))?;
786 current_sdk.parse().context("Malformed SDK version")
787}
788
Alan Stokes1f417c92022-09-29 15:13:28 +0100789fn load_config(payload_metadata: PayloadMetadata) -> Result<VmPayloadConfig> {
790 match payload_metadata {
791 PayloadMetadata::config_path(path) => {
792 let path = Path::new(&path);
793 info!("loading config from {:?}...", path);
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100794 let file = ioutil::wait_for_file(path, WAIT_TIMEOUT)
795 .with_context(|| format!("Failed to read {:?}", path))?;
Alan Stokes1f417c92022-09-29 15:13:28 +0100796 Ok(serde_json::from_reader(file)?)
797 }
798 PayloadMetadata::config(payload_config) => {
799 let task = Task {
800 type_: TaskType::MicrodroidLauncher,
Alan Stokes8f12f2b2023-01-09 09:19:20 +0000801 command: payload_config.payload_binary_name,
Alan Stokes1f417c92022-09-29 15:13:28 +0100802 };
803 Ok(VmPayloadConfig {
804 os: OsConfig { name: "microdroid".to_owned() },
805 task: Some(task),
806 apexes: vec![],
807 extra_apks: vec![],
808 prefer_staged: false,
Inseob Kimab1037d2023-02-08 17:03:31 +0900809 export_tombstones: None,
Alan Stokes1f417c92022-09-29 15:13:28 +0100810 enable_authfs: false,
811 })
812 }
813 }
Jooyung Han634e2d72021-06-10 16:27:38 +0900814}
815
Jaewan Kim3124ef02023-03-23 19:25:20 +0900816/// Loads the crashkernel into memory using kexec if debuggable or debug policy says so.
817/// The VM should be loaded with `crashkernel=' parameter in the cmdline to allocate memory
818/// for crashkernel.
Jiyong Park202856e2022-08-22 16:04:26 +0900819fn load_crashkernel_if_supported() -> Result<()> {
820 let supported = std::fs::read_to_string("/proc/cmdline")?.contains(" crashkernel=");
821 info!("ramdump supported: {}", supported);
Jaewan Kim3124ef02023-03-23 19:25:20 +0900822
823 if !supported {
824 return Ok(());
825 }
826
827 let debuggable = system_properties::read_bool(DEBUGGABLE_PROP, true)?;
828 let ramdump = get_debug_policy_bool(AVF_DEBUG_POLICY_RAMDUMP)?.unwrap_or_default();
829 let requested = debuggable | ramdump;
830
831 if requested {
Jiyong Park202856e2022-08-22 16:04:26 +0900832 let status = Command::new("/system/bin/kexec_load").status()?;
833 if !status.success() {
834 return Err(anyhow!("Failed to load crashkernel: {:?}", status));
835 }
Jaewan Kim3124ef02023-03-23 19:25:20 +0900836 info!("ramdump is loaded: debuggable={debuggable}, ramdump={ramdump}");
Jiyong Park202856e2022-08-22 16:04:26 +0900837 }
838 Ok(())
839}
840
Inseob Kim090b70b2022-11-16 20:01:14 +0900841/// Executes the given task.
Jooyung Han5c6d4172021-12-06 14:17:52 +0900842fn exec_task(task: &Task, service: &Strong<dyn IVirtualMachineService>) -> Result<i32> {
Jiyong Park8611a6c2021-07-09 18:17:44 +0900843 info!("executing main task {:?}...", task);
David Brazdil451cc962022-10-14 14:08:12 +0100844 let mut command = match task.type_ {
845 TaskType::Executable => Command::new(&task.command),
846 TaskType::MicrodroidLauncher => {
847 let mut command = Command::new("/system/bin/microdroid_launcher");
848 command.arg(find_library_path(&task.command)?);
849 command
850 }
851 };
Nikita Ioffe3452ee22022-12-15 00:31:56 +0000852
853 unsafe {
854 // SAFETY: we are not accessing any resource of the parent process.
855 command.pre_exec(|| {
856 info!("dropping capabilities before executing payload");
857 // It is OK to continue with payload execution even if the calls below fail, since
858 // whether process can use a capability is controlled by the SELinux. Dropping the
859 // capabilities here is just another defense-in-depth layer.
860 if let Err(e) = cap::drop_inheritable_caps() {
861 error!("failed to drop inheritable capabilities: {:?}", e);
862 }
863 if let Err(e) = cap::drop_bounding_set() {
864 error!("failed to drop bounding set: {:?}", e);
865 }
866 Ok(())
867 });
868 }
869
Inseob Kim090b70b2022-11-16 20:01:14 +0900870 command.stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
Inseob Kim7f61fe72021-08-20 20:50:47 +0900871
872 info!("notifying payload started");
Inseob Kimc7d28c72021-10-25 14:28:10 +0000873 service.notifyPayloadStarted()?;
Inseob Kim7f61fe72021-08-20 20:50:47 +0900874
Inseob Kim86ca0162021-10-20 02:21:02 +0000875 let exit_status = command.spawn()?.wait()?;
Frederick Mayleb5f7b6b2022-11-11 15:24:03 -0800876 match exit_status.code() {
877 Some(exit_code) => Ok(exit_code),
878 None => Err(match exit_status.signal() {
879 Some(signal) => anyhow!(
880 "Payload exited due to signal: {} ({})",
881 signal,
882 Signal::try_from(signal).map_or("unknown", |s| s.as_str())
883 ),
884 None => anyhow!("Payload has neither exit code nor signal"),
885 }),
886 }
Jooyung Han347d9f22021-05-28 00:05:14 +0900887}
Jooyung Han634e2d72021-06-10 16:27:38 +0900888
Jooyung Han634e2d72021-06-10 16:27:38 +0900889fn find_library_path(name: &str) -> Result<String> {
890 let mut watcher = PropertyWatcher::new("ro.product.cpu.abilist")?;
891 let value = watcher.read(|_name, value| Ok(value.trim().to_string()))?;
892 let abi = value.split(',').next().ok_or_else(|| anyhow!("no abilist"))?;
Alice Wang6bbb6da2022-10-26 12:44:06 +0000893 let path = format!("{}/lib/{}/{}", VM_APK_CONTENTS_PATH, abi, name);
Jooyung Han634e2d72021-06-10 16:27:38 +0900894
Alan Stokes3ba10fd2022-10-06 15:46:51 +0100895 let metadata = fs::metadata(&path).with_context(|| format!("Unable to access {}", path))?;
Jooyung Han634e2d72021-06-10 16:27:38 +0900896 if !metadata.is_file() {
897 bail!("{} is not a file", &path);
898 }
899
900 Ok(path)
901}
Jiyong Park21ce2c52021-08-28 02:32:17 +0900902
903fn to_hex_string(buf: &[u8]) -> String {
904 buf.iter().map(|b| format!("{:02X}", b)).collect()
905}
Shikha Panwar566c9672022-11-15 14:39:58 +0000906
Alice Wang62f7e642023-02-10 09:55:13 +0000907fn prepare_encryptedstore(dice_artifacts: &OwnedDiceArtifacts) -> Result<Child> {
Shikha Panwar566c9672022-11-15 14:39:58 +0000908 // Use a fixed salt to scope the derivation to this API.
909 // Generated using hexdump -vn32 -e'14/1 "0x%02X, " 1 "\n"' /dev/urandom
910 // TODO(b/241541860) : Move this (& other salts) to a salt container, i.e. a global enum
911 let salt = [
912 0xFC, 0x1D, 0x35, 0x7B, 0x96, 0xF3, 0xEF, 0x17, 0x78, 0x7D, 0x70, 0xED, 0xEA, 0xFE, 0x1D,
913 0x6F, 0xB3, 0xF9, 0x40, 0xCE, 0xDD, 0x99, 0x40, 0xAA, 0xA7, 0x0E, 0x92, 0x73, 0x90, 0x86,
914 0x4A, 0x75,
915 ];
Alice Wang7e6c9352023-02-15 15:44:13 +0000916 let mut key = ZVec::new(ENCRYPTEDSTORE_KEYSIZE)?;
917 derive_sealing_key(dice_artifacts, &salt, ENCRYPTEDSTORE_KEY_IDENTIFIER.as_bytes(), &mut key)?;
Shikha Panwar566c9672022-11-15 14:39:58 +0000918
919 let mut cmd = Command::new(ENCRYPTEDSTORE_BIN);
920 cmd.arg("--blkdevice")
921 .arg(ENCRYPTEDSTORE_BACKING_DEVICE)
922 .arg("--key")
923 .arg(hex::encode(&*key))
Shikha Panwar9fd198f2022-11-18 17:43:43 +0000924 .args(["--mountpoint", ENCRYPTEDSTORE_MOUNTPOINT])
Shikha Panwar566c9672022-11-15 14:39:58 +0000925 .spawn()
926 .context("encryptedstore failed")
927}