summaryrefslogtreecommitdiffstats
path: root/install/include (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-02-13Force off-device package installation with FUSETianjie Xu1-0/+4
The non-A/B package installation is subject to TOC/TOU flaw if the attacker can switch the package in the middle of installation. And the most pratical case is to store the package on an external device, e.g. a sdcard, and swap the device in the middle. To prevent that, we can adopt the same protection as used in sideloading a package with FUSE. Specifically, when we install the package with FUSE, we read the entire package to cryptographically verify its signature. The hash for each transfer block is recorded in the memory (TOC), and the subsequent reads (TOU) will be rejected upon dectecting a mismatch. This CL forces the package installation with FUSE when the package stays on a removable media. Bug: 136498130 Test: Run bin/recovery --update_package with various paths; and packages are installed from FUSE as expected Test: recovery_unit_test - no new failures Change-Id: Ia5afd19854c3737110339fd59491b96708926ae5 Merged-In: I35119c2334895aa0ef4ed71b3ddd08f280c0c031
2020-02-13Revert "Force package installation with FUSE unless the package stores on device"Raman Tenneti1-4/+0
This reverts commit 5e6c4e9a91674826bf11cab604250b41a9326fd8. Reason for revert: BUG: 149432069 - build failure on git_qt-qpr1-dev-plus-aosp on docs. 'otautil/roots.h' file not found is the error. Forrest run: https://android-build.googleplex.com/builds/forrest/run/L85900000460577420 Change-Id: I35119c2334895aa0ef4ed71b3ddd08f280c0c031 Merged-In: I35119c2334895aa0ef4ed71b3ddd08f280c0c031
2020-01-22Force package installation with FUSE unless the package stores on deviceTianjie Xu1-0/+4
The non-A/B package installation is subject to TOC/TOU flaw if the attacker can switch the package in the middle of installation. And the most pratical case is to store the package on an external device, e.g. a sdcard, and swap the device in the middle. To prevent that, we can adopt the same protection as used in sideloading a package with FUSE. Specifically, when we install the package with FUSE, we read the entire package to cryptographically verify its signature. The hash for each transfer block is recorded in the memory (TOC), and the subsequent reads (TOU) will be rejected upon dectecting a mismatch. This CL forces the package installation with FUSE when the package stays on a removable media. Bug: 136498130 Test: Run bin/recovery --update_package with various paths; and packages are installed from FUSE as expected Test: recovery_component_test - all passing Change-Id: Ibc9b095036a2fa624e8edf6c347ed4f12aef072f Merged-In: Ibc9b095036a2fa624e8edf6c347ed4f12aef072f
2020-01-21Force package installation with FUSE unless the package stores on deviceTianjie Xu1-0/+4
The non-A/B package installation is subject to TOC/TOU flaw if the attacker can switch the package in the middle of installation. And the most pratical case is to store the package on an external device, e.g. a sdcard, and swap the device in the middle. To prevent that, we can adopt the same protection as used in sideloading a package with FUSE. Specifically, when we install the package with FUSE, we read the entire package to cryptographically verify its signature. The hash for each transfer block is recorded in the memory (TOC), and the subsequent reads (TOU) will be rejected upon dectecting a mismatch. This CL forces the package installation with FUSE when the package stays on a removable media. Bug: 136498130 Test: Run bin/recovery --update_package with various paths; and packages are installed from FUSE as expected Test: recovery_component_test - all passing Merged-In: Ibc9b095036a2fa624e8edf6c347ed4f12aef072f Change-Id: Ibc9b095036a2fa624e8edf6c347ed4f12aef072f
2019-12-18Delete VINTF compatibility check during OTA.Yifan Hong1-4/+0
Test: sideload OTA Bug: 139300422 Change-Id: I3369b69242ccd7a64540a0c2d754a5d6fc50d072
2019-12-16Mount snapshotted /system in Virtual A/B devicesAlessio Balsini1-0/+9
Mounting /system in Virtual A/B devices may require the creation of the associated snapshot devices. This patch performs all the required initializations prior to attempting the mount of /system. Bug: 139157327 Test: manual /system partition mount on VAB device during OTA Depends-on: I7337bdd38d7016d12d3ee42be1c7893b10e9116d Change-Id: I71a9dfc57e1a1354f1f1edc5d287aca93c0c8924 Signed-off-by: Alessio Balsini <balsini@google.com>
2019-11-11Force merges to complete before wiping data or metadata.David Anderson1-0/+21
After an OTA is applied, a wipe in recovery may overwrite components of dynamic partitions living in userdata. If the OTA has not yet begun merging, we mark the current slot unbootable. If the OTA has begun merging, we wait for the merge to complete. This logic is encapsulated in libsnapshot. Bug: 139156011 Test: manual test Change-Id: Id6544a1b8583afcbba11559d46214ec2e68ffa40
2019-10-16Force package installation with FUSE unless the package stores on deviceTianjie Xu1-0/+4
The non-A/B package installation is subject to TOC/TOU flaw if the attacker can switch the package in the middle of installation. And the most pratical case is to store the package on an external device, e.g. a sdcard, and swap the device in the middle. To prevent that, we can adopt the same protection as used in sideloading a package with FUSE. Specifically, when we install the package with FUSE, we read the entire package to cryptographically verify its signature. The hash for each transfer block is recorded in the memory (TOC), and the subsequent reads (TOU) will be rejected upon dectecting a mismatch. This CL forces the package installation with FUSE when the package stays on a removable media. Bug: 136498130 Test: Run bin/recovery --update_package with various paths; and packages are installed from FUSE as expected Change-Id: Ibc9b095036a2fa624e8edf6c347ed4f12aef072f
2019-06-20Support starting fuse from a block mapTianjie Xu1-1/+8
Factor out a new function from ApplyFromSdcard that installs a package from a local path. Inside this function, we start the fuse and choose the type of data provider depending on the path string. And similar to the existing logic, we treat the package as a block map if the path starts with a '@'. This is part of the effort to install larger than 2GiB packages on ILP32 devices. Bug: 127071893 Test: Build a 32 bit sailfish and create a 3GiB OTA package. Sideload the package, uncrypt and install the package from sdcard. Change-Id: I328ea34fa530731acbce7554bfc3059313ad6ece
2019-06-13InstallPackage now takes a package as parameterTianjie Xu2-5/+15
Therefore InstallPackage() doesn't need to worry about the details of a given Package. Bug: 127071893 Test: run update from /bin/recovery --update_package=@path, sideload a package Change-Id: I0caa36785b43924f884ee398e7ea640d7472a92e
2019-04-30install: Install functions return InstallResult.Tao Bao3-8/+10
Test: `atest recovery_unit_test recovery_component_test` Test: Sideload a package on taimen. Change-Id: I2d42f55a89931ee495ea5c5d9e6b5ee1058e8e52
2019-04-30install: Return bool for a few check functions.Tao Bao2-8/+8
The results from these functions have boolean semantics. They're returning `int` prior to this CL, with some of them mixing 0 and InstallResult. Note that SetUpNonAbUpdateCommands() was returning INSTALL_CORRUPT / INSTALL_ERROR / 0 prior to this change, but all the callers handle INSTALL_CORRUPT and INSTALL_ERROR the same way. This CL changes them to return bool instead. Test: `mmma -j bootable/recovery` Test: TreeHugger Test: Sideload on taimen. Change-Id: Ic1b5dbf79aaca68b53ab8ea2c8ba3d19f988c571
2019-04-30Support wipe command in rescue modexunchang1-2/+1
Bug: 131037235 Test: unit tests pass, run `adb rescue wipe` Change-Id: I22668f2c98fe2d9195d2561f961c28a7c08e712c (cherry picked from commit fedeef6f6d1f7b8f1e5a8b9e77f8dc21ef6b3c95)
2019-04-27Add install/wipe_device.cpp.Tao Bao2-3/+29
Prior to this CL, GetWipePartitionList was declared in install.h (libinstall) but defined in recovery.cpp (librecovery). This CL addresses the issue by refactoring wipe-device related functions into install/wipe_device.cpp. Test: atest recovery_component_test Change-Id: I7ebe04ccfda3d793e085403560a0a202752d9ee3
2019-04-26minadbd: Support `adb reboot` under sideload/rescue modes.Tao Bao2-2/+7
Bug: 128415917 Test: Run the following commands under sideload and rescue modes respectively. $ adb reboot $ adb reboot bootloader $ adb reboot recovery $ adb reboot rescue $ adb reboot invalid Change-Id: I84daf63e3360b7b4a0af5e055149a4f54e10ba90 Merged-In: I84daf63e3360b7b4a0af5e055149a4f54e10ba90 (cherry picked from commit 10f441a9dbb91be3124f455439631abcf8e96cde)
2019-04-26Allow entering rescue mode via recovery UI.Tao Bao1-1/+1
Only enabled on debuggable builds. Bug: 128415917 Test: Sideload package on taimen. Test: Choose "Enter rescue" from recovery UI. Change-Id: I913dbdbcffd3179e6fa72ca862f74ca8f1364b02 Merged-In: I913dbdbcffd3179e6fa72ca862f74ca8f1364b02 (cherry picked from commit c6dc325e88a25201aa3856e6532c3ed14203a376)
2019-04-26Support wipe command in rescue modexunchang1-2/+1
Bug: 131037235 Test: unit tests pass, run `adb rescue wipe` Change-Id: I22668f2c98fe2d9195d2561f961c28a7c08e712c
2019-04-24minadbd: Support `adb reboot` under sideload/rescue modes.Tao Bao2-2/+7
Bug: 128415917 Test: Run the following commands under sideload and rescue modes respectively. $ adb reboot $ adb reboot bootloader $ adb reboot recovery $ adb reboot rescue $ adb reboot invalid Change-Id: I84daf63e3360b7b4a0af5e055149a4f54e10ba90
2019-04-17Allow entering rescue mode via recovery UI.Tao Bao1-1/+1
Only enabled on debuggable builds. Bug: 128415917 Test: Sideload package on taimen. Test: Choose "Enter rescue" from recovery UI. Change-Id: I913dbdbcffd3179e6fa72ca862f74ca8f1364b02
2019-04-16DO NOT MERGE: Move load & restore logs to logging.cppxunchang1-2/+0
We perform these steps to perserve the recovery logs when wiping /cache partition. Move them to logging.cpp to keep the actually EraseVolume function concise. Bug: 130166585 Test: unit tests pass, mount cache and check last log after cache Change-Id: Idc52833817a446f3a0148a3dd2112f911c9ef48d (cherry picked from commit 2239b9e4dd08e307ad74dc44b597fd53d2d17de8)
2019-04-16DO NOT MERGE: Move wipe cache|data to libinstallxunchang4-6/+39
Therefore, libinstall becomes the sole owner to handle the request from minadbd service. The change also includes 1. move logging.cpp out of librecovery 2. drop the dependency on common.h 3. now it's more sensible to move the wipe_cache as part of install_package. move the wipe_cache to the end of the function. Bug: 130166585 Test: wipe data and cache from menu Change-Id: I6f356dccdb38015c50acf756bac246f87c30fc1f (cherry picked from commit 316e9717461890dd319dc370970069fe4532a561)
2019-04-16Move load & restore logs to logging.cppxunchang1-2/+0
We perform these steps to perserve the recovery logs when wiping /cache partition. Move them to logging.cpp to keep the actually EraseVolume function concise. Bug: 130166585 Test: unit tests pass, mount cache and check last log after cache Change-Id: Idc52833817a446f3a0148a3dd2112f911c9ef48d
2019-04-15Move wipe cache|data to libinstallxunchang4-6/+39
Therefore, libinstall becomes the sole owner to handle the request from minadbd service. The change also includes 1. move logging.cpp out of librecovery 2. drop the dependency on common.h 3. now it's more sensible to move the wipe_cache as part of install_package. move the wipe_cache to the end of the function. Bug: 130166585 Test: wipe data and cache from menu Change-Id: I6f356dccdb38015c50acf756bac246f87c30fc1f
2019-03-29Move install to separate modulexunchang7-0/+361
Build libinstall as a shared library. Also drop the dependency on the global variables in common.h. Test: unit tests pass, sideload an OTA Change-Id: I30a20047768ce00689fc0e7851c1c5d712a365a0
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 13:56:07 +0100