Feature: add AVB verification status for boot v0-v2

pull/66/head
cfig 4 years ago
parent 1505433aa9
commit 66c264b504
No known key found for this signature in database
GPG Key ID: B104C307F0FDABB7

@ -465,14 +465,16 @@ class Avb {
}
}
fun verifyAVBIntegrity(fileName: String, avbtool: String) {
fun verifyAVBIntegrity(fileName: String, avbtool: String): Boolean {
val cmdline = "python $avbtool verify_image --image $fileName"
log.info(cmdline)
try {
DefaultExecutor().execute(CommandLine.parse(cmdline))
} catch (e: Exception) {
throw IllegalArgumentException("$fileName failed integrity check by \"$cmdline\"")
log.error("$fileName failed integrity check by \"$cmdline\"")
return false
}
return true
}
fun updateVbmeta(fileName: String) {

@ -95,7 +95,11 @@ data class BootV2(
theInfo.osPatchLevel = bh2.osPatchLevel
if (Avb.hasAvbFooter(fileName)) {
theInfo.verify = "VB2.0"
Avb.verifyAVBIntegrity(fileName, String.format(Helper.prop("avbtool"), "v1.2"))
if (Avb.verifyAVBIntegrity(fileName, String.format(Helper.prop("avbtool"), "v1.2"))) {
theInfo.verify += " PASS"
} else {
theInfo.verify += " FAIL"
}
} else {
theInfo.verify = "VB1.0"
}
@ -219,7 +223,7 @@ data class BootV2(
}
fun extractVBMeta(): BootV2 {
if (this.info.verify == "VB2.0") {
if (this.info.verify.startsWith("VB2.0")) {
Avb().parseVbMeta(info.output)
if (File("vbmeta.img").exists()) {
log.warn("Found vbmeta.img, parsing ...")
@ -241,9 +245,14 @@ data class BootV2(
val tab = AsciiTable().let {
it.addRule()
it.addRow("image info", workDir + info.output.removeSuffix(".img") + ".json")
if (this.info.verify == "VB2.0") {
if (this.info.verify.startsWith("VB2.0")) {
it.addRule()
it.addRow("AVB info", Avb.getJsonFileName(info.output))
val verifyStatus = if (this.info.verify.contains("PASS")) {
"verified"
} else {
"verify fail"
}
it.addRow("AVB info [$verifyStatus]", Avb.getJsonFileName(info.output))
}
//kernel
it.addRule()
@ -499,7 +508,7 @@ data class BootV2(
fun sign(): BootV2 {
//unify with v1.1/v1.2 avbtool
val avbtool = String.format(Helper.prop("avbtool"), "v1.2")
if (info.verify == "VB2.0") {
if (info.verify.startsWith("VB2.0")) {
Signer.signAVB(info.output, this.info.imageSize, avbtool)
log.info("Adding hash_footer with verified-boot 2.0 style")
} else {

@ -51,11 +51,8 @@ class BootHeaderV3(
this.headerSize = (info[4] as UInt).toInt()
//5,6,7,8 reserved
this.headerVersion = (info[9] as UInt).toInt()
this.cmdline = info[10] as String
this.signatureSize = (info[11] as UInt).toInt()
assert(this.headerSize in intArrayOf(BOOT_IMAGE_HEADER_V3_SIZE, BOOT_IMAGE_HEADER_V4_SIZE))
}

Loading…
Cancel
Save