From af9cf6b79347f44f65867037a2dfa03a0a3b818d Mon Sep 17 00:00:00 2001 From: Victor Hsieh Date: Fri, 3 Apr 2020 15:24:50 -0700 Subject: [PATCH] Also load fs-verity cert from /system/etc/security/fsverity/ Bug: 153112812 Test: call the API from new CTS test working in progress Change-Id: I1c339c66059d5a2bf4dec5c9082458e2e95c965f --- .../server/security/FileIntegrityService.java | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/security/FileIntegrityService.java b/services/core/java/com/android/server/security/FileIntegrityService.java index 841aca5a8d6f4..225bd82e9a21e 100644 --- a/services/core/java/com/android/server/security/FileIntegrityService.java +++ b/services/core/java/com/android/server/security/FileIntegrityService.java @@ -24,6 +24,7 @@ import android.content.pm.PackageManager; import android.content.pm.PackageManagerInternal; import android.os.Binder; import android.os.Build; +import android.os.Environment; import android.os.IBinder; import android.os.SystemProperties; import android.os.UserHandle; @@ -37,6 +38,7 @@ import java.io.ByteArrayInputStream; import java.io.File; import java.io.IOException; import java.nio.file.Files; +import java.nio.file.Path; import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; @@ -131,12 +133,17 @@ public class FileIntegrityService extends SystemService { // duplicate the same loading logic here. // Load certificates trusted by the device manufacturer. - loadCertificatesFromDirectory("/product/etc/security/fsverity"); + // NB: Directories need to be synced with system/security/fsverity_init/fsverity_init.cpp. + final String relativeDir = "etc/security/fsverity"; + loadCertificatesFromDirectory(Environment.getRootDirectory().toPath() + .resolve(relativeDir)); + loadCertificatesFromDirectory(Environment.getProductDirectory().toPath() + .resolve(relativeDir)); } - private void loadCertificatesFromDirectory(String path) { + private void loadCertificatesFromDirectory(Path path) { try { - File[] files = new File(path).listFiles(); + File[] files = path.toFile().listFiles(); if (files == null) { return; }