Some devices use the legacy Android/ChromiumOS-specific `dm=` kernel
command line option to configure dm-verity without userspace helpers.
These options are specified in kernel command line descriptors in the
system partition's vbmeta header, which need to be merged into the
parent vbmeta image for the bootloader to see them.
This commit adds support for merging property descriptors and kernel
command line descriptors. Property descriptors are merged based on an
exact string match of the property key. Kernel command line descriptors
are merged based on the (non-empty) text before the first equal sign.
Issue: #203
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
`lineage-20.0-20231109-nightly-taimen-signed.zip` is an example of an
OTA that uses XZ-compressed ramdisks.
Issue: #203
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is done unconditionally because there shouldn't be any real-world
device that uses AVB2 and has a kernel compiled without sha256 support.
Issue: #203
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Older Pixel devices (and ChromiumOS) specify the dm-verity options on
the kernel command line using a custom `dm=` parameter instead of using
dm-init or a userspace helper. This commit updates the avb pack and
repack commands to automatically update the relevant kernel command line
descriptor if it exists.
Issue: #203
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
* Split out requirements from the warnings/caveats section and move it
to the top. Hopefully this helps new users determine whether they can
even use avbroot quicker.
* Split usage section into separate usage, initial install, and updates
sections. This should hopefully make the steps much easier to follow
without a bunch of steps being prefixed with `[Initial setup only]`.
* Explicitly state what arguments are required for Magisk, KernelSU, and
unrooted setups instead of directing users to the advanced usage
section.
* Don't assume that everyone will use Magisk in the other sections.
* Explicitly state the assumption that the device should already running
the OS build that the user wants to patch during initial install.
* Add step to updates section for installing an updated Magisk or
KernelSU app.
* Move command for building the modules from the modules section to the
building from source section.
* Update sample error message in the clear vbmeta flags section to match
what avbroot will actually print out.
* General rewording to try and make things clearer (especially reducing
parenthesized parts).
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Android 11 OTAs use the same `payload.bin` format, but lack the
`metadata.pb` protobuf representation of the OTA metadata. This commit
adds support for parsing the legacy plain-text `metadata` format. Like
before, the output files will still contain both the legacy and
protobuf representations.
Note that the legacy format allowed OEMs to specify arbitrary key/value
pairs. These will be discarded during patching because they cannot be
represented in the protobuf format, which is used in avbroot's internal
representation.
Issue: #195
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
During the migration to avbroot 2.0, these options have been renamed. Reflect this in the Readme.
Signed-off-by: Pascal Roeleven <dev@pascalroeleven.nl>
Previously, the AVB `algorithm_type` field was unconditionally being set
to a value that is compatible with the AVB private key. However, for
indirectly-signed boot images, the value should be set to `None`. Pixel
bootloaders accept the incorrect value, but other devices' bootloaders
might not.
Issue: #186
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Some partitions, like system_ext in the Pixel Experience build for
`avicii`, use SHA1 for the dm-verity hash tree. This is technically
valid, so allow the `avb verify` command to compute these hashes. SHA1
will still be rejected when creating AVB images.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is still not the ideal API, but it makes the code quite a bit more
readable since we no longer have to pass around closures everywhere that
multithreaded reads and writes to the same file are needed.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
avbroot currently has a check to ensure that AVB signature verification
isn't completely disabled by non-zero vbmeta header flags. This is done
to ensure that the user isn't given a false sense of security when the
OS is built in an insecure way. This commit makes a few changes better
reject insecure OTAs.
The first change is extending the non-zero flags check to all vbmeta
images. Previously, only vbmeta images that needed to be updated as a
result of patching/re-signing were checked.
The second change is ensuring that there are no critical partitions
present in `payload.bin`, but missing from the vbmeta descriptors. For
example, if the vbmeta descriptor for `system.img` is missing, the
patching process will fail with a fatal error that cannot be bypassed.
Unfortunately, it's not feasible to check every partition because there
is no known device where every partition is protected by AVB. Google's
Tensor-based devices are the best and only have a single partition not
protected by AVB: `modem`. Qualcomm-based devices have many partitions
not protected by AVB. OnePlus devices have many partitions that are
checked directly (against the appended header) and thus, aren't listed
in any vbmeta image.
Due to this, only partitions that AOSP understands are checked. OEM-
specific partitions (which, security-wise, may be just as important) are
not checked.
The third change is ensuring that there's only a single root of trust
among the vbmeta images. This way, it's impossible to have, for example,
a `vbmeta_unused` image that contains all the descriptors and an empty
`vbmeta` image that's actually read by the bootloader.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
There are a ton of options and simply displaying them in a giant list is
not very readable.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson