diff --git a/init/property_service.cpp b/init/property_service.cpp index b0871890f..5fdc959e7 100644 --- a/init/property_service.cpp +++ b/init/property_service.cpp @@ -1410,6 +1410,15 @@ static void ProcessBootconfig() { }); } +static void SetSafetyNetProps() { + + InitPropertySet("ro.boot.flash.locked", "1"); + InitPropertySet("ro.boot.vbmeta.device_state", "locked"); + InitPropertySet("ro.boot.verifiedbootstate", "green"); + InitPropertySet("ro.boot.veritymode", "enforcing"); + +} + void PropertyInit() { selinux_callback cb; cb.func_audit = PropertyAuditCallback; @@ -1424,6 +1433,14 @@ void PropertyInit() { LOG(FATAL) << "Failed to load serialized property info file"; } + // Report a valid verified boot chain to make Google SafetyNet integrity + // checks pass. This needs to be done before parsing the kernel cmdline as + // these properties are read-only and will be set to invalid values with + // androidboot cmdline arguments. + if (!IsRecoveryMode()) { + SetSafetyNetProps(); + } + // If arguments are passed both on the command line and in DT, // properties set in DT always have priority over the command-line ones. ProcessKernelDt();