summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Zeuthen <zeuthen@google.com>2017-08-08 21:18:34 +0200
committerandroid-build-merger <android-build-merger@google.com>2017-08-08 21:18:34 +0200
commitb266fbab195bb8376c85cd1717a1a1376c8e6bb4 (patch)
tree0cffe38491f500d4d1c8ddb03c4c77733d50c462
parentImport translations. DO NOT MERGE (diff)
parentMerge "update_verifier: Support androidboot.veritymode being empty or 'disabled'." am: 399ce66534 am: bb8d04cd3c (diff)
downloadandroid_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar.gz
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar.bz2
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar.lz
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar.xz
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.tar.zst
android_bootable_recovery-b266fbab195bb8376c85cd1717a1a1376c8e6bb4.zip
-rw-r--r--update_verifier/update_verifier.cpp21
1 files changed, 17 insertions, 4 deletions
diff --git a/update_verifier/update_verifier.cpp b/update_verifier/update_verifier.cpp
index b49011a12..4c3cc46cf 100644
--- a/update_verifier/update_verifier.cpp
+++ b/update_verifier/update_verifier.cpp
@@ -252,23 +252,36 @@ int update_verifier(int argc, char** argv) {
// The current slot has not booted successfully.
#if defined(PRODUCT_SUPPORTS_VERITY) || defined(BOARD_AVB_ENABLE)
+ bool skip_verification = false;
std::string verity_mode = android::base::GetProperty("ro.boot.veritymode", "");
if (verity_mode.empty()) {
+ // With AVB it's possible to disable verification entirely and
+ // in this case ro.boot.veritymode is empty.
+#if defined(BOARD_AVB_ENABLE)
+ LOG(WARNING) << "verification has been disabled; marking without verification.";
+ skip_verification = true;
+#else
LOG(ERROR) << "Failed to get dm-verity mode.";
return reboot_device();
+#endif
} else if (android::base::EqualsIgnoreCase(verity_mode, "eio")) {
// We shouldn't see verity in EIO mode if the current slot hasn't booted successfully before.
// Continue the verification until we fail to read some blocks.
LOG(WARNING) << "Found dm-verity in EIO mode.";
+ } else if (android::base::EqualsIgnoreCase(verity_mode, "disabled")) {
+ LOG(WARNING) << "dm-verity in disabled mode; marking without verification.";
+ skip_verification = true;
} else if (verity_mode != "enforcing") {
LOG(ERROR) << "Unexpected dm-verity mode : " << verity_mode << ", expecting enforcing.";
return reboot_device();
}
- static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt";
- if (!verify_image(CARE_MAP_FILE)) {
- LOG(ERROR) << "Failed to verify all blocks in care map file.";
- return reboot_device();
+ if (!skip_verification) {
+ static constexpr auto CARE_MAP_FILE = "/data/ota_package/care_map.txt";
+ if (!verify_image(CARE_MAP_FILE)) {
+ LOG(ERROR) << "Failed to verify all blocks in care map file.";
+ return reboot_device();
+ }
}
#else
LOG(WARNING) << "dm-verity not enabled; marking without verification.";