From 0e49df4485a3d68b474ca3cc9854a2c36379851b Mon Sep 17 00:00:00 2001 From: Victor Hsieh Date: Thu, 29 Sep 2022 14:47:50 -0700 Subject: [PATCH] Fix imprecise name of a fs-verity helper function Root hash is only part of the fs-verity digest covers. Rename to avoid confusion. Bug: N/A Test: m Change-Id: I12c2a4ac57fb8772483473f951e97474ebd894c9 --- .../com/android/internal/security/VerityUtils.java | 11 +++++++++-- .../core/java/com/android/server/pm/ApkChecksums.java | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/core/java/com/android/internal/security/VerityUtils.java b/core/java/com/android/internal/security/VerityUtils.java index 76f7b2180b34e..cb5820f1ade95 100644 --- a/core/java/com/android/internal/security/VerityUtils.java +++ b/core/java/com/android/internal/security/VerityUtils.java @@ -90,8 +90,15 @@ public abstract class VerityUtils { return (retval == 1); } - /** Returns hash of a root node for the fs-verity enabled file. */ - public static byte[] getFsverityRootHash(@NonNull String filePath) { + /** + * Returns fs-verity digest for the file if enabled, otherwise returns null. The digest is a + * hash of root hash of fs-verity's Merkle tree with extra metadata. + * + * @see + * File digest computation in Linux kernel documentation + * @return Bytes of fs-verity digest + */ + public static byte[] getFsverityDigest(@NonNull String filePath) { byte[] result = new byte[HASH_SIZE_BYTES]; int retval = measureFsverityNative(filePath, result); if (retval < 0) { diff --git a/services/core/java/com/android/server/pm/ApkChecksums.java b/services/core/java/com/android/server/pm/ApkChecksums.java index a2861604caa31..9e93fe04d112c 100644 --- a/services/core/java/com/android/server/pm/ApkChecksums.java +++ b/services/core/java/com/android/server/pm/ApkChecksums.java @@ -650,7 +650,7 @@ public class ApkChecksums { // Skip /product folder. // TODO(b/231354111): remove this hack once we are allowed to change SELinux rules. if (!containsFile(Environment.getProductDirectory(), filePath)) { - byte[] verityHash = VerityUtils.getFsverityRootHash(filePath); + byte[] verityHash = VerityUtils.getFsverityDigest(filePath); if (verityHash != null) { return new ApkChecksum(split, TYPE_WHOLE_MERKLE_ROOT_4K_SHA256, verityHash); }