ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Init: Load fsverity keys earlier" am: f09ef56056

Browse source 
am: a0cc42381c

Change-Id: I3d94308e9cf428fc1306b927bfd700c87943dbc0
This commit is contained in:
Andreas Gampe 2019-03-15 19:24:30 -07:00 • committed by android-build-merger
commit a7597deed2
1 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
rootdir/init.rc
View file

@ -418,6 +418,13 @@ on post-fs-data
mkdir /data/bootchart 0755 shell shell mkdir /data/bootchart 0755 shell shell
bootchart start bootchart start
# Load fsverity keys. This needs to happen before apexd, as post-install of
# APEXes may rely on keys.
exec -- /system/bin/mini-keyctl dadd asymmetric product_cert /product/etc/security/cacerts_fsverity .fs-verity
exec -- /system/bin/mini-keyctl dadd asymmetric vendor_cert /vendor/etc/security/cacerts_fsverity .fs-verity
# Prevent future key links to fsverity keyring
exec -- /system/bin/mini-keyctl restrict_keyring .fs-verity
# Make sure that apexd is started in the default namespace # Make sure that apexd is started in the default namespace
enter_default_mount_ns enter_default_mount_ns
@ -585,12 +592,6 @@ on post-fs-data
# Set SELinux security contexts on upgrade or policy update. # Set SELinux security contexts on upgrade or policy update.
restorecon --recursive --skip-ce /data restorecon --recursive --skip-ce /data
# load fsverity keys
exec -- /system/bin/mini-keyctl dadd asymmetric product_cert /product/etc/security/cacerts_fsverity .fs-verity
exec -- /system/bin/mini-keyctl dadd asymmetric vendor_cert /vendor/etc/security/cacerts_fsverity .fs-verity
# Prevent future key links to fsverity keyring
exec -- /system/bin/mini-keyctl restrict_keyring .fs-verity
# Check any timezone data in /data is newer than the copy in the runtime module, delete if not. # Check any timezone data in /data is newer than the copy in the runtime module, delete if not.
exec - system system -- /system/bin/tzdatacheck /apex/com.android.runtime/etc/tz /data/misc/zoneinfo exec - system system -- /system/bin/tzdatacheck /apex/com.android.runtime/etc/tz /data/misc/zoneinfo