Skip to content

Commit e5f0980

Browse files
kdrag0nkarthik558
authored andcommitted
Revert "proc: cmdline: Patch SafetyNet flags"
On Android 12, userspace enforces vbmeta signature verification based on the bootloader lock state, which is read from verifiedbootstate. This means that spoofing verifiedbootstate=green causes init to bail out during early boot if vbmeta doesn't pass verification: [ 9.229305] init: [libfs_avb]ERROR_VERIFICATION / PUBLIC_KEY_REJECTED isn't allowed [ 9.237357] init: Failed to open AvbHandle: No such file or directory [ 9.244103] init: Failed to setup verity for '/system': No such file or directory [ 9.252018] init: Failed to mount /system: No such file or directory [ 9.258648] init: Failed to mount required partitions early ... [ 9.264738] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00 Given that this workaround is no longer sufficient for passing SafetyNet anyway due to the opportunistic use of hardware-backed attestation, revert it to fix issues booting on Android 12. Stock + custom kernel: FAIL due to hardware attestation Stock + root: PASS with Universal SafetyNet Fix + MagiskHide (which sets the same props) Custom ROM with SafetyNet workarounds: PASS without custom kernel This workaround alone doesn't really help anyone pass. Signed-off-by: Danny Lin <danny@kdrag0n.dev> Signed-off-by: K A R T H I K <karthik.lal558@gmail.com>
1 parent cb25a07 commit e5f0980

File tree

1 file changed

+1
-36
lines changed

1 file changed

+1
-36
lines changed

fs/proc/cmdline.c

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,10 @@
33
#include <linux/init.h>
44
#include <linux/proc_fs.h>
55
#include <linux/seq_file.h>
6-
#include <asm/setup.h>
7-
8-
static char new_command_line[COMMAND_LINE_SIZE];
96

107
static int cmdline_proc_show(struct seq_file *m, void *v)
118
{
12-
seq_puts(m, new_command_line);
13-
seq_putc(m, '\n');
9+
seq_printf(m, "%s\n", saved_command_line);
1410
return 0;
1511
}
1612

@@ -26,39 +22,8 @@ static const struct file_operations cmdline_proc_fops = {
2622
.release = single_release,
2723
};
2824

29-
static void patch_flag(char *cmd, const char *flag, const char *val)
30-
{
31-
size_t flag_len, val_len;
32-
char *start, *end;
33-
34-
start = strstr(cmd, flag);
35-
if (!start)
36-
return;
37-
38-
flag_len = strlen(flag);
39-
val_len = strlen(val);
40-
end = start + flag_len + strcspn(start + flag_len, " ");
41-
memmove(start + flag_len + val_len, end, strlen(end) + 1);
42-
memcpy(start + flag_len, val, val_len);
43-
}
44-
45-
static void patch_safetynet_flags(char *cmd)
46-
{
47-
patch_flag(cmd, "androidboot.verifiedbootstate=", "green");
48-
patch_flag(cmd, "androidboot.veritymode=", "enforcing");
49-
patch_flag(cmd, "androidboot.vbmeta.device_state=", "locked");
50-
}
51-
5225
static int __init proc_cmdline_init(void)
5326
{
54-
strcpy(new_command_line, saved_command_line);
55-
56-
/*
57-
* Patch various flags from command line seen by userspace in order to
58-
* pass SafetyNet checks.
59-
*/
60-
patch_safetynet_flags(new_command_line);
61-
6227
proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
6328
return 0;
6429
}

0 commit comments

Comments
 (0)