From bafc2616905afb43b4f167da1384386b85b83cce Mon Sep 17 00:00:00 2001
From: Victor Hsieh <victorhsieh@google.com>
Date: Tue, 22 Nov 2022 11:53:13 -0800
Subject: [PATCH] Move fs-verity setup to post-commit

When fs-verity is being enabled, it currently drops the file/APK's page
cache and can cause performance issue. Move the work to post-commit
where the slower tasks are done. It's done before ART components because
in the future we'd like to add the APK's fs-verity digest to the
odex/vdex's header.

Bug: 259179666
Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.ApkVerityInstallTest
Test: atest ApkVerityTest
Test: atest ChecksumsTest
Change-Id: I49f58b4976978bb5310f3589fff37d6bf0858a0f
---
 .../server/pm/InstallPackageHelper.java       | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java
index 5dd5d81cfbb64..b02d1a8c03536 100644
--- a/services/core/java/com/android/server/pm/InstallPackageHelper.java
+++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java
@@ -1816,8 +1816,6 @@ final class InstallPackageHelper {
 
         // Collect files we care for fs-verity setup.
         ArrayMap<String, String> fsverityCandidates = new ArrayMap<>();
-        // NB: These files will become only accessible if the signing key is loaded in kernel's
-        // .fs-verity keyring.
         fsverityCandidates.put(pkg.getBaseApkPath(),
                 VerityUtils.getFsveritySignatureFilePath(pkg.getBaseApkPath()));
 
@@ -1855,20 +1853,6 @@ final class InstallPackageHelper {
                         throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,
                                 "fs-verity signature does not verify against a known key");
                     }
-                } else {
-                    // Without signature, we don't need to access the digest right away and can
-                    // enable fs-verity in background (since this is a blocking call).
-                    new Thread("fsverity-setup") {
-                        @Override public void run() {
-                            try {
-                                VerityUtils.setUpFsverity(filePath, (byte[]) null);
-                            } catch (IOException e) {
-                                // There's nothing we can do if the setup failed. Since fs-verity is
-                                // optional, just ignore the error for now.
-                                Slog.e(TAG, "Failed to enable fs-verity to " + filePath);
-                            }
-                        }
-                    }.start();
                 }
             } catch (IOException e) {
                 throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,
@@ -2243,6 +2227,22 @@ final class InstallPackageHelper {
                 }
                 incrementalStorages.add(storage);
             }
+
+            try {
+                if (!VerityUtils.hasFsverity(pkg.getBaseApkPath())) {
+                    VerityUtils.setUpFsverity(pkg.getBaseApkPath(), (byte[]) null);
+                }
+                for (String path : pkg.getSplitCodePaths()) {
+                    if (!VerityUtils.hasFsverity(path)) {
+                        VerityUtils.setUpFsverity(path, (byte[]) null);
+                    }
+                }
+            } catch (IOException e) {
+                // There's nothing we can do if the setup failed. Since fs-verity is
+                // optional, just ignore the error for now.
+                Slog.e(TAG, "Failed to fully enable fs-verity to " + packageName);
+            }
+
             // Hardcode previousAppId to 0 to disable any data migration (http://b/221088088)
             mAppDataHelper.prepareAppDataPostCommitLIF(pkg, 0);
             if (installRequest.isClearCodeCache()) {