| # Copyright 2020 The ChromiumOS Authors | |
| # Use of this source code is governed by a BSD-style license that can be | |
| # found in the LICENSE file. | |
| description "Add fs-verity certficates required for ARCVM" | |
| author "chromium-os-dev@chromium.org" | |
| # We only needs to load the certificates once per boot, since .fs-verity keyring | |
| # is a singleton in the kernel. Also, the task need to finish before /data can | |
| # be used. | |
| start on starting system-services | |
| # The task is short-lived and must not be interrupted during the execution. | |
| oom score never | |
| task | |
| script | |
| # Add certificates to the keyring only if the feature is enabled. | |
| if [ -e /sys/fs/ext4/features/verity ]; then | |
| # Add the CTS release certificate from AOSP. | |
| keyctl padd asymmetric fsv-play %keyring:.fs-verity < \ | |
| /usr/share/arcvm/fsverity-certs/fsverity-release.x509.der | |
| # Add the Play FSI certificate. | |
| keyctl padd asymmetric fsv-cts %keyring:.fs-verity < \ | |
| /usr/share/arcvm/fsverity-certs/play_store_fsi_cert.der | |
| # Add the GMS certificate. | |
| keyctl padd asymmetric fsv-gms %keyring:.fs-verity < \ | |
| /usr/share/arcvm/fsverity-certs/gms_fsverity_cert.der | |
| # Since these are currently the only certificates in the whole OS, make the | |
| # keyring restricted to accept no more certificates. | |
| keyctl restrict_keyring %keyring:.fs-verity | |
| fi | |
| end script |