Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Generate a separate fstab file for FIPS mode am: 08c8bc2e40

Browse source 
Original change: https://googleplex-android-review.googlesource.com/c/device/google/gs101/+/15522272

Change-Id: I989dad797866cc82ad11cf2bca3e705370689517
This commit is contained in:
Eric Biggers 2021-08-30 23:16:38 +00:00 • committed by Automerger Merge Worker
commit f8622be0fd
5 changed files with 75 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

55
conf/Android.bp Normal file
View file

@ -0,0 +1,55 @@
/*
* Copyright (C) 2021 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
// By default this device uses hardware-wrapped keys for storage encryption,
// which is intended to offer increased security over the traditional method
// (software keys). However, hardware-wrapped keys aren't compatible with
// FIPS-140 certification of the encryption hardware, and hence we have to
// disable the use of them in FIPS mode. This requires having two fstab files:
// one for the default mode, and one for FIPS mode selectable via
// androidboot.fstab_suffix on the kernel command line. These fstabs should be
// identical with the exception of the encryption settings, so to keep them in
// sync the rules below generate them from a template file.
genrule {
name: "gen_fstab.gs101",
srcs: ["fstab.gs101.in"],
out: ["fstab.gs101"],
cmd: "sed -e s/@fileencryption@/::inlinecrypt_optimized+wrappedkey_v0/" +
" -e s/@metadata_encryption@/:wrappedkey_v0/ $(in) > $(out)",
}
genrule {
name: "gen_fstab.gs101-fips",
srcs: ["fstab.gs101.in"],
out: ["fstab.gs101-fips"],
cmd: "sed -e s/@fileencryption@/aes-256-xts/" +
" -e s/@metadata_encryption@/aes-256-xts/ $(in) > $(out)",
}
prebuilt_etc {
name: "fstab.gs101",
src: ":gen_fstab.gs101",
vendor: true,
vendor_ramdisk_available: true,
}
prebuilt_etc {
name: "fstab.gs101-fips",
src: ":gen_fstab.gs101-fips",
vendor: true,
vendor_ramdisk_available: true,
}

2
conf/fstab.gs101 → conf/fstab.gs101.in
View file

@ -17,7 +17,7 @@ vendor_dlkm /vendor_dlkm
/dev/block/platform/14700000.ufs/by-name/misc /misc emmc defaults wait
/dev/block/platform/14700000.ufs/by-name/metadata /metadata ext4 noatime,nosuid,nodev,data=journal,commit=1 wait,check,formattable,first_stage_mount,metadata_csum
/dev/block/platform/14700000.ufs/by-name/pvmfw /pvmfw emmc defaults wait,slotselect,avb=pvmfw,first_stage_mount
/dev/block/platform/14700000.ufs/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,inlinecrypt,compress_extension=apk,compress_extension=apex,compress_extension=so,atgc,checkpoint_merge latemount,wait,check,quota,formattable,sysfs_path=/dev/sys/block/bootdevice,checkpoint=fs,reservedsize=128M,fileencryption=::inlinecrypt_optimized+wrappedkey_v0,metadata_encryption=:wrappedkey_v0,keydirectory=/metadata/vold/metadata_encryption,fscompress,readahead_size_kb=128
/dev/block/platform/14700000.ufs/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,inlinecrypt,compress_extension=apk,compress_extension=apex,compress_extension=so,atgc,checkpoint_merge latemount,wait,check,quota,formattable,sysfs_path=/dev/sys/block/bootdevice,checkpoint=fs,reservedsize=128M,fileencryption=@fileencryption@,metadata_encryption=@metadata_encryption@,keydirectory=/metadata/vold/metadata_encryption,fscompress,readahead_size_kb=128
/dev/block/platform/14700000.ufs/by-name/vbmeta /vbmeta emmc defaults slotselect,first_stage_mount
/dev/block/zram0 none swap defaults zramsize=3221225472,max_comp_streams=8,zram_backingdev_size=512M
/devices/platform/11110000.usb* auto vfat defaults voldmanaged=usb:auto

4
conf/init.gs101.rc
View file

@ -306,7 +306,7 @@ on late-fs
class_start animation
# Mount RW partitions which need run fsck
mount_all /vendor/etc/fstab.gs101 --late
mount_all --late
on post-fs-data
# Log data folder
@ -503,7 +503,7 @@ on property:persist.vendor.radio.no_modem_board=1
setprop ro.radio.noril yes
on fs
mount_all /vendor/etc/fstab.gs101 --early
mount_all --early
restorecon_recursive /mnt/vendor/efs
chown radio system /mnt/vendor/efs
restorecon_recursive /mnt/vendor/efs_backup