otasigcheck and backuptools from CM
Change-Id: I1b582d57ed58176db83ec046e68884cd9e4a1b6a
Add otasigcheck.sh from cm
Change-Id: I930b06ccd1d8fc2b10bdb5e98418efb05ca28e71
diff --git a/config/common.mk b/config/common.mk
index 73e7559..f4e890f 100644
--- a/config/common.mk
+++ b/config/common.mk
@@ -32,6 +32,10 @@
vendor/slim/prebuilt/common/bin/99-backup.sh:system/addon.d/99-backup.sh \
vendor/slim/prebuilt/common/etc/backup.conf:system/etc/backup.conf
+# Signature compatibility validation
+PRODUCT_COPY_FILES += \
+ vendor/slim/prebuilt/common/bin/otasigcheck.sh:system/bin/otasigcheck.sh
+
# SLIM-specific init file
PRODUCT_COPY_FILES += \
vendor/slim/prebuilt/common/etc/init.local.rc:root/init.slim.rc
diff --git a/prebuilt/common/bin/backuptool.functions b/prebuilt/common/bin/backuptool.functions
index 833460f..10d66a4 100644
--- a/prebuilt/common/bin/backuptool.functions
+++ b/prebuilt/common/bin/backuptool.functions
@@ -5,7 +5,7 @@
export C=/tmp/backupdir
export S=/system
-export V=9
+export V=12
backup_file() {
if [ -e "$1" ]; then
diff --git a/prebuilt/common/bin/backuptool.sh b/prebuilt/common/bin/backuptool.sh
index 9e67f48..7b3e39d 100755
--- a/prebuilt/common/bin/backuptool.sh
+++ b/prebuilt/common/bin/backuptool.sh
@@ -5,7 +5,7 @@
export C=/tmp/backupdir
export S=/system
-export V=Slim-4.4
+export V=Slim-5.0
# Preserve /system/addon.d in /tmp/addon.d
preserve_addon_d() {
@@ -20,14 +20,44 @@
rm -rf /tmp/addon.d/
}
-# Check for proper Slim version
-check_version() {
- if ( ! grep -q "ro.slim.version=$V.*" /system/build.prop); then
- echo "Not running backup from incompatible version"
- exit
+# Proceed only if /system is the expected major and minor version
+check_prereq() {
+if ( ! grep -q "^ro.slim.version=$V.*" /system/build.prop ); then
+ echo "Not backing up files from incompatible version: $V"
+ return 0
+fi
+return 1
+}
+
+check_blacklist() {
+ if [ -f /system/addon.d/blacklist ];then
+ ## Discard any known bad backup scripts
+ cd /$1/addon.d/
+ for f in *sh; do
+ s=$(md5sum $f | awk {'print $1'})
+ grep -q $s /system/addon.d/blacklist && rm -f $f
+ done
fi
}
+check_whitelist() {
+ found=0
+ if [ -f /system/addon.d/whitelist ];then
+ ## forcefully keep any version-independent stuff
+ cd /$1/addon.d/
+ for f in *sh; do
+ s=$(md5sum $f | awk {'print $1'})
+ grep -q $s /system/addon.d/whitelist
+ if [ $? -eq 0 ]; then
+ found=1
+ else
+ rm -f $f
+ fi
+ done
+ fi
+ return $found
+}
+
# Execute /system/addon.d/*.sh scripts with $1 parameter
run_stage() {
for script in $(find /tmp/addon.d/ -name '*.sh' |sort -n); do
@@ -37,15 +67,25 @@
case "$1" in
backup)
- check_version
mkdir -p $C
+ if check_prereq; then
+ if check_whitelist system; then
+ exit 127
+ fi
+ fi
+ check_blacklist system
preserve_addon_d
run_stage pre-backup
run_stage backup
run_stage post-backup
;;
restore)
- check_version
+ if check_prereq; then
+ if check_whitelist tmp; then
+ exit 127
+ fi
+ fi
+ check_blacklist tmp
run_stage pre-restore
run_stage restore
run_stage post-restore
diff --git a/prebuilt/common/bin/blacklist b/prebuilt/common/bin/blacklist
new file mode 100644
index 0000000..03c36c4
--- /dev/null
+++ b/prebuilt/common/bin/blacklist
@@ -0,0 +1,4 @@
+80f99c594f7b82c4cbe533e3f5447729
+29f4bab6bae5959458678869350dc888
+77d73f73da664f3592e712b7e7c107c1
+a5019b358023a3a6ae8be3f3380ba5ca
diff --git a/prebuilt/common/bin/otasigcheck.sh b/prebuilt/common/bin/otasigcheck.sh
new file mode 100644
index 0000000..7bf1228
--- /dev/null
+++ b/prebuilt/common/bin/otasigcheck.sh
@@ -0,0 +1,25 @@
+#!/sbin/sh
+
+# Validate that the incoming OTA is compatible with an already-installed
+# system
+
+grep -q "Command:.*\"--wipe\_data\"" /tmp/recovery.log
+if [ $? -eq 0 ]; then
+ echo "Data will be wiped after install; skipping signature check..."
+ exit 0
+fi
+
+if [ -f /data/system/packages.xml -a -f /tmp/releasekey ]; then
+ relCert=$(grep -A3 'package name="com.android.htmlviewer"' /data/system/packages.xml | grep "cert index" | head -n 1 | sed -e 's|.*"\([[:digit:]][[:digit:]]*\)".*|\1|g')
+
+ # Tools missing? Err on the side of caution and exit cleanly
+ if [ "z$relCert" == "z" ]; then exit 0; fi
+
+ grep "cert index=\"$relCert\"" /data/system/packages.xml | grep -q `cat /tmp/releasekey`
+ if [ $? -ne 0 ]; then
+ echo "You have an installed system that isn't signed with this build's key, aborting..."
+ exit 124
+ fi
+fi
+
+exit 0
diff --git a/prebuilt/common/bin/whitelist b/prebuilt/common/bin/whitelist
new file mode 100644
index 0000000..ca3f017
--- /dev/null
+++ b/prebuilt/common/bin/whitelist
@@ -0,0 +1 @@
+b0a27bcb5c7504a81e1450a8313e37cb