Android Explorations

Android 4.4 introduced a number of security enhancements , most notably SELinux in enforcing mode. One security feature that initially got some press attention, because it was presumably aiming to 'end all custom firmware', but hasn't been described in much detail, is verified boot . This post will briefly explain how verified boot works and then show how to configure and enable it on a Nexus device. Verified boot with dm-verity Android's verified boot implementation is based on the dm-verity device-mapper block integrity checking target. Device-mapper is a Linux kernel framework that provides a generic way to implement virtual block devices. It is used to implement volume management ( LVM ), full-disk encryption ( dm-crypt ), RAIDs and even distributed replicated storage ( DRBD ). Device-mapper works by essentially mapping a virtual block device to one or more physical block devices, optionally modifying transferred data in transit. For example, dm-crypt decrypts re...