adb: add overlayfs handling for readonly system filesystems
adb verity-on setup overlayfs directories, do not skip if verity
feature not configured for device.
adb verity-off teardown overlayfs directories, do not skip if verity
feature not configured for device.
adb remount setup overlayfs directories and mount if possible, and
do so without a reboot if possible.
Test: compile
Bug: 109821005
Bug: 110985612
Change-Id: I28c4c23fea44b886c5523f0286a523f0b0485df0
diff --git a/adb/daemon/remount_service.cpp b/adb/daemon/remount_service.cpp
index 0e79d82..f7017dd 100644
--- a/adb/daemon/remount_service.cpp
+++ b/adb/daemon/remount_service.cpp
@@ -30,6 +30,7 @@
#include <sys/vfs.h>
#include <unistd.h>
+#include <memory>
#include <set>
#include <string>
#include <vector>
@@ -38,28 +39,30 @@
#include <bootloader_message/bootloader_message.h>
#include <cutils/android_reboot.h>
#include <ext4_utils/ext4_utils.h>
+#include <fs_mgr.h>
+#include <fs_mgr_overlayfs.h>
#include "adb.h"
#include "adb_io.h"
#include "adb_unique_fd.h"
#include "adb_utils.h"
-#include "fs_mgr.h"
#include "set_verity_enable_state_service.h"
-// Returns the device used to mount a directory in /proc/mounts.
+// Returns the last device used to mount a directory in /proc/mounts.
+// This will find overlayfs entry where upperdir=lowerdir, to make sure
+// remount is associated with the correct directory.
static std::string find_proc_mount(const char* dir) {
std::unique_ptr<FILE, int(*)(FILE*)> fp(setmntent("/proc/mounts", "r"), endmntent);
- if (!fp) {
- return "";
- }
+ std::string mnt_fsname;
+ if (!fp) return mnt_fsname;
mntent* e;
while ((e = getmntent(fp.get())) != nullptr) {
if (strcmp(dir, e->mnt_dir) == 0) {
- return e->mnt_fsname;
+ mnt_fsname = e->mnt_fsname;
}
}
- return "";
+ return mnt_fsname;
}
// Returns the device used to mount a directory in the fstab.
@@ -81,6 +84,7 @@
}
bool make_block_device_writable(const std::string& dev) {
+ if ((dev == "overlay") || (dev == "overlayfs")) return true;
int fd = unix_open(dev.c_str(), O_RDONLY | O_CLOEXEC);
if (fd == -1) {
return false;
@@ -234,6 +238,14 @@
partitions.push_back("/system");
}
+ bool verity_enabled = (system_verified || vendor_verified);
+
+ // If we can use overlayfs, lets get it in place first
+ // before we struggle with determining deduplication operations.
+ if (!verity_enabled && fs_mgr_overlayfs_setup() && fs_mgr_overlayfs_mount_all()) {
+ WriteFdExactly(fd.get(), "overlayfs mounted\n");
+ }
+
// Find partitions that are deduplicated, and can be un-deduplicated.
std::set<std::string> dedup;
for (const auto& partition : partitions) {
@@ -246,8 +258,6 @@
}
}
- bool verity_enabled = (system_verified || vendor_verified);
-
// Reboot now if the user requested it (and an operation needs a reboot).
if (user_requested_reboot) {
if (!dedup.empty() || verity_enabled) {
diff --git a/adb/daemon/set_verity_enable_state_service.cpp b/adb/daemon/set_verity_enable_state_service.cpp
index 2b6ec21..3676de5 100644
--- a/adb/daemon/set_verity_enable_state_service.cpp
+++ b/adb/daemon/set_verity_enable_state_service.cpp
@@ -19,6 +19,7 @@
#include "set_verity_enable_state_service.h"
#include "sysdeps.h"
+#include <errno.h>
#include <fcntl.h>
#include <inttypes.h>
#include <libavb_user/libavb_user.h>
@@ -28,12 +29,14 @@
#include <android-base/properties.h>
#include <android-base/stringprintf.h>
+#include <fs_mgr.h>
+#include <fs_mgr_overlayfs.h>
+#include <fstab/fstab.h>
#include <log/log_properties.h>
#include "adb.h"
#include "adb_io.h"
#include "adb_unique_fd.h"
-#include "fs_mgr.h"
#include "remount_service.h"
#include "fec/io.h"
@@ -46,6 +49,10 @@
static const bool kAllowDisableVerity = false;
#endif
+void suggest_run_adb_root(int fd) {
+ if (getuid() != 0) WriteFdExactly(fd, "Maybe run adb root?\n");
+}
+
/* Turn verity on/off */
static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
bool enable) {
@@ -59,7 +66,7 @@
if (!fh) {
WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
- WriteFdFmt(fd, "Maybe run adb root?\n");
+ suggest_run_adb_root(fd);
return false;
}
@@ -87,6 +94,17 @@
return false;
}
+ auto change = false;
+ errno = 0;
+ if (enable ? fs_mgr_overlayfs_teardown(mount_point, &change)
+ : fs_mgr_overlayfs_setup(nullptr, mount_point, &change)) {
+ if (change) {
+ WriteFdFmt(fd, "%s overlayfs for %s\n", enable ? "disabling" : "using", mount_point);
+ }
+ } else if (errno) {
+ WriteFdFmt(fd, "Overlayfs %s for %s failed with error %s\n", enable ? "teardown" : "setup",
+ mount_point, strerror(errno));
+ }
WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
return true;
}
@@ -103,6 +121,22 @@
return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";
}
+static bool overlayfs_setup(int fd, bool enable) {
+ auto change = false;
+ errno = 0;
+ if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)
+ : fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {
+ if (change) {
+ WriteFdFmt(fd, "%s overlayfs\n", enable ? "disabling" : "using");
+ }
+ } else if (errno) {
+ WriteFdFmt(fd, "Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup",
+ strerror(errno));
+ suggest_run_adb_root(fd);
+ }
+ return change;
+}
+
/* Use AVB to turn verity on/off */
static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
std::string ab_suffix = get_ab_suffix();
@@ -128,6 +162,7 @@
return false;
}
+ overlayfs_setup(fd, enable_verity);
WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
return true;
}
@@ -150,6 +185,7 @@
}
if (!android::base::GetBoolProperty("ro.secure", false)) {
+ overlayfs_setup(fd, enable);
WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");
return;
}
@@ -177,13 +213,14 @@
// Not using AVB - assume VB1.0.
// read all fstab entries at once from all sources
- fstab = fs_mgr_read_fstab_default();
+ if (!fstab) fstab = fs_mgr_read_fstab_default();
if (!fstab) {
- WriteFdExactly(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");
+ WriteFdExactly(fd.get(), "Failed to read fstab\n");
+ suggest_run_adb_root(fd.get());
return;
}
- // Loop through entries looking for ones that vold manages.
+ // Loop through entries looking for ones that verity manages.
for (int i = 0; i < fstab->num_entries; i++) {
if (fs_mgr_is_verified(&fstab->recs[i])) {
if (set_verity_enabled_state(fd.get(), fstab->recs[i].blk_device,
@@ -193,6 +230,7 @@
}
}
}
+ if (!any_changed) any_changed = overlayfs_setup(fd, enable);
if (any_changed) {
WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");