pa-fazil
/
android_system_core
mirror of https://github.com/fazilsheik96/android_system_core.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disallow fastboot to modify locked DSU 

This enhances the security requirement by only allowing
the owner app to change a locked DSU.

(Cherry-picked from aosp/2744993)

Bug: 277691885
Bug: 296985785
Test: 1. ensure device is OEM locked
      2. adb shell am start-activity \
         -n com.android.dynsystem/com.android.dynsystem.VerificationActivity \
         -a android.os.image.action.START_INSTALL \
         --el KEY_USERDATA_SIZE 2147483648 \
	 --es KEY_DSU_SLOT foo.lock
      3. adb reboot fastboot
      4. `fastboot gsi disable|wipe` should be blocked

Merged-In: I1a0cb8a074412468d16043ddf4101fbb76490115
Change-Id: I1a0cb8a074412468d16043ddf4101fbb76490115
This commit is contained in:
Chun-Wei Wang 2023-09-07 09:53:11 +08:00
parent e433fde7d2
commit bcbc93f83d
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fastboot/device/commands.cpp
View File

@ -639,6 +639,12 @@ bool UpdateSuperHandler(FastbootDevice* device, const std::vector<std::string>&
return UpdateSuper(device, args[1], wipe);
}
static bool IsLockedDsu() {
std::string active_dsu;
android::gsi::GetActiveDsu(&active_dsu);
return android::base::EndsWith(active_dsu, ".lock");
}
bool GsiHandler(FastbootDevice* device, const std::vector<std::string>& args) {
if (args.size() != 2) {
return device->WriteFail("Invalid arguments");
@ -653,6 +659,11 @@ bool GsiHandler(FastbootDevice* device, const std::vector<std::string>& args) {
return device->WriteStatus(FastbootResult::FAIL, "No GSI is installed");
}
if ((args[1] == "wipe" || args[1] == "disable") && GetDeviceLockStatus() && IsLockedDsu()) {
// Block commands that modify the states of locked DSU
return device->WriteFail("Command not available on locked DSU/devices");
}
if (args[1] == "wipe") {
if (!android::gsi::UninstallGsi()) {
return device->WriteStatus(FastbootResult::FAIL, strerror(errno));