2

As I understand it, if an Android device’s bootloader is locked (fastboot oem lock), it should check the installed system on boot to verify that it’s signed with some (the manufacturer’s?) signing keys. I’ve seen several warnings not to lock the bootloader again after installing a custom ROM like LineageOS because the bootloader would complain about the modified system image and refuse to boot.

However, I have two Android devices on which I have installed custom ROMs:

I’ve subsequently re-locked the bootloader on both devices and, surprisingly, not experienced any issues so far. For the Fairphone 3, I originally assumed that this works because /e/ OS is officially supported by the manufacturer, so I thought that the /e/ OS images are probably signed with some official keys. However, I don’t think there is any such support in the case of the OnePlus One (which is also long out of manufacturer support by now). Another hint is this forum post on the Fairphone forums, which reports the following:

I relocked the bootloader (fastboot flashing lock), it automatically wiped my user data, and booted successfully! Also, after restoring my data, I was able to upgrade from last-week’s release to the new release of today - all without problems.

Now, this does raise a lot of security questions though. I did not realize that LineageOS, /e/ and even Fairphone where all signing their builds with google test keys - essentially rendering the OS build integrity checks meaningless… I guess in fact that means that it doesnt really matter which keys are being used, as they are simply not checked? Any key would be accepted?

So, my question is: Why does running /e/ OS or LineageOS with a locked bootloader work in these cases? What is the significance of the Google test keys here – do the bootloaders just always accept them?

Improve this question
5
  • 2
    May be because some new devices support user-settable root of trust. Details here: Is there a way to root an Android phone without unlocking the bootloader?.
    – Irfan Latif
    Jun 24, 2021 at 17:15
  • @IrfanLatif Ah, interesting! However, since you say “new devices”, this doesn’t sound like it would have been available at the time when the OnePlus One was released (2014)? I also don’t understand how it fits in with the statement about the Google test keys.
    – Socob
    Jun 24, 2021 at 18:18
  • 1
    The official LOS subreddit has a comprehensive post on this topic. Still I'd advise against it because it makes recovering from failures much harder.
    – Andy Yan
    Jun 30, 2021 at 2:20
  • @AndyYan Thanks, that was a very helpful and detailed overview. I would say the most relevant part is: There are also a few phones (like the original Pixel/XL and OnePlus phones like the 5/5t and older) that don't support AVB v2, but can have their bootloaders relocked because they simply *never* check to see if the OS is signed by the vendor, just that it has some valid signature on it. This implies that the OnePlus One doesn’t check the origin of the signature, explaining that case. I suppose the Fairphone 3 is a similar case, then?
    – Socob
    Jul 1, 2021 at 12:04
  • so in essence, re-locking does not make sense, because in the few models where it does work, it gets you no extra security, and otherwise just breaks your boot
    – xeruf
    Mar 7, 2022 at 7:17

0

Reset to default

You must log in to answer this question.