From a8b24392a1da6c3441f38acd623fbefaaa97d723 Mon Sep 17 00:00:00 2001
From: Orion Hodson <oth@google.com>
Date: Thu, 1 Jul 2021 12:14:47 +0100
Subject: [PATCH] AndroidRuntime: pass odsign verification status to ART

ART will refuse to load on-device generated artifacts if odsign
verification status suggests files have been tampered with.

Bug: 180949581
Test: manual
Change-Id: I772b5b7b191310bf7c7797161a304a1ab6f53c5e
---
 core/jni/AndroidRuntime.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/jni/AndroidRuntime.cpp b/core/jni/AndroidRuntime.cpp
index 1f15dfd1eb1c6..59b4fffb969fd 100644
--- a/core/jni/AndroidRuntime.cpp
+++ b/core/jni/AndroidRuntime.cpp
@@ -743,6 +743,11 @@ int AndroidRuntime::startVm(JavaVM** pJavaVM, JNIEnv** pEnv, bool zygote, bool p
         //addOption("-verbose:jni");
     }
 
+    const bool odsignVerificationSuccess = GetBoolProperty("odsign.verification.success", false);
+    if (!odsignVerificationSuccess) {
+        addOption("-Xdeny-art-apex-data-files");
+    }
+
     property_get("dalvik.vm.execution-mode", propBuf, "");
     if (strcmp(propBuf, "int:portable") == 0) {
         executionMode = kEMIntPortable;