Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move fs-verity setup to post-commit

Browse Source 
When fs-verity is being enabled, it currently drops the file/APK's page
cache and can cause performance issue. Move the work to post-commit
where the slower tasks are done. It's done before ART components because
in the future we'd like to add the APK's fs-verity digest to the
odex/vdex's header.

Bug: 259179666
Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.ApkVerityInstallTest
Test: atest ApkVerityTest
Test: atest ChecksumsTest
Change-Id: I49f58b4976978bb5310f3589fff37d6bf0858a0f
This commit is contained in:
Victor Hsieh
2022-11-22 11:53:13 -08:00
parent 90cef8f473
commit bafc261690
1 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
services/core/java/com/android/server/pm/InstallPackageHelper.java
View File

@@ -1816,8 +1816,6 @@ final class InstallPackageHelper {
// Collect files we care for fs-verity setup.
ArrayMap<String, String> fsverityCandidates = new ArrayMap<>();
// NB: These files will become only accessible if the signing key is loaded in kernel's
// .fs-verity keyring.
fsverityCandidates.put(pkg.getBaseApkPath(),
VerityUtils.getFsveritySignatureFilePath(pkg.getBaseApkPath()));
@@ -1855,20 +1853,6 @@ final class InstallPackageHelper {
throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,
"fs-verity signature does not verify against a known key");
}
} else {
// Without signature, we don't need to access the digest right away and can
// enable fs-verity in background (since this is a blocking call).
new Thread("fsverity-setup") {
@Override public void run() {
try {
VerityUtils.setUpFsverity(filePath, (byte[]) null);
} catch (IOException e) {
// There's nothing we can do if the setup failed. Since fs-verity is
// optional, just ignore the error for now.
Slog.e(TAG, "Failed to enable fs-verity to " + filePath);
}
}
}.start();
}
} catch (IOException e) {
throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,
@@ -2243,6 +2227,22 @@ final class InstallPackageHelper {
}
incrementalStorages.add(storage);
}
try {
if (!VerityUtils.hasFsverity(pkg.getBaseApkPath())) {
VerityUtils.setUpFsverity(pkg.getBaseApkPath(), (byte[]) null);
}
for (String path : pkg.getSplitCodePaths()) {
if (!VerityUtils.hasFsverity(path)) {
VerityUtils.setUpFsverity(path, (byte[]) null);
}
}
} catch (IOException e) {
// There's nothing we can do if the setup failed. Since fs-verity is
// optional, just ignore the error for now.
Slog.e(TAG, "Failed to fully enable fs-verity to " + packageName);
}
// Hardcode previousAppId to 0 to disable any data migration (http://b/221088088)
mAppDataHelper.prepareAppDataPostCommitLIF(pkg, 0);
if (installRequest.isClearCodeCache()) {