diff --git a/core/java/com/android/internal/security/VerityUtils.java b/core/java/com/android/internal/security/VerityUtils.java index 76f7b2180b34e..cb5820f1ade95 100644 --- a/core/java/com/android/internal/security/VerityUtils.java +++ b/core/java/com/android/internal/security/VerityUtils.java @@ -90,8 +90,15 @@ public abstract class VerityUtils { return (retval == 1); } - /** Returns hash of a root node for the fs-verity enabled file. */ - public static byte[] getFsverityRootHash(@NonNull String filePath) { + /** + * Returns fs-verity digest for the file if enabled, otherwise returns null. The digest is a + * hash of root hash of fs-verity's Merkle tree with extra metadata. + * + * @see + * File digest computation in Linux kernel documentation + * @return Bytes of fs-verity digest + */ + public static byte[] getFsverityDigest(@NonNull String filePath) { byte[] result = new byte[HASH_SIZE_BYTES]; int retval = measureFsverityNative(filePath, result); if (retval < 0) { diff --git a/services/core/java/com/android/server/pm/ApkChecksums.java b/services/core/java/com/android/server/pm/ApkChecksums.java index c2f2b0af997ad..ffe0ca0038177 100644 --- a/services/core/java/com/android/server/pm/ApkChecksums.java +++ b/services/core/java/com/android/server/pm/ApkChecksums.java @@ -650,7 +650,7 @@ public class ApkChecksums { // Skip /product folder. // TODO(b/231354111): remove this hack once we are allowed to change SELinux rules. if (!containsFile(Environment.getProductDirectory(), filePath)) { - byte[] verityHash = VerityUtils.getFsverityRootHash(filePath); + byte[] verityHash = VerityUtils.getFsverityDigest(filePath); if (verityHash != null) { return new ApkChecksum(split, TYPE_WHOLE_MERKLE_ROOT_4K_SHA256, verityHash); }