Changing OS files

[Marshall]

Hello.  Hopefully I'm posting this in the right forum.  If not, please point me the right way.

I was wondering if there was a way to change OS files (specifically /sbin/session_manager_setup.sh) on the running image in developer mode, and to re-sign the OS image, so that it boots in non-developer mode again?

I used make_dev_ssd.sh to mount the partition in read-write mode, which allowed me to change the file.  Then, after switching back to non-developer mode, the OS image isn't bootable any more.  It fails verification on startup and tells me that I need to reinstall ChromeOS.

Is the only solution to build my own version of ChromeOS?  Or is there a simpler way?

Any help would be appreciated!

Thanks, Marshall

[Richard Barnette]

On Dec 19, 2012, at 5:24 PM, Marshall <asl...@gmail.com> wrote:

> Hello. Hopefully I'm posting this in the right forum. If not, please point me the right way.
>
> I was wondering if there was a way to change OS files (specifically /sbin/session_manager_setup.sh) on the running image in developer mode, and to re-sign the OS image, so that it boots in non-developer mode again?
>

No. The verified boot feature means that the system is specifically
designed to test whether the OS that's booting is an image that was
built and delivered by Google. If you change an OS file like this,
the image is no longer what Google built, and can no longer boot
in verified mode.

> I used make_dev_ssd.sh to mount the partition in read-write mode, which allowed me to change the file. Then, after switching back to non-developer mode, the OS image isn't bootable any more. It fails verification on startup and tells me that I need to reinstall ChromeOS.
>
> Is the only solution to build my own version of ChromeOS? Or is there a simpler way?
>

Editing the file as you did it is probably the easiest way to change
it. You can build and install your own copy of Chromium OS, but
you'd still have to boot in developer mode, not verified mode.

If your objective is to have an image with your change, but with
root file system verification turned back on (that is, undo some of
the effects of 'make_dev_ssh.sh'), then you'll have to build your
own Chromium OS image, and boot it in developer mode.

If you want to go back to a stock Chrome OS with verified boot
enabled, you'll need to reinstall. The instructions for that are
here:
http://www.google.com/chromeos/recovery

> Any help would be appreciated!
>
> Thanks, Marshall
>

> --
> Chromium OS discuss mailing list: chromium-...@chromium.org
> View archives, change email options, or unsubscribe:
> http://groups.google.com/a/chromium.org/group/chromium-os-discuss?hl=en

-- jrb

[Marshall]

I had a feeling that's what the answer would be.

Thanks a lot for your help!

--Marshall

[Vadim Bendebury]

well, this depends. If you are prepared to part ways with autoupdate
path (at least until you reinstall chrome os through recovery), you
could actually modify the kernel command line such that it does not
use rootfs verification, which in turn would allow to boot up Chrome
OS even with the modified file system.

I haven't done this in a while, but it used to work a few months ago
last time I tried.

cheers,
/vb

> Any help would be appreciated!
>
> Thanks, Marshall
>

[Dan OBoyle]

Is the implication here that you could build a custom chromium is but still auto update from Google?

Sent from my iPhone

--

--
NOTICE: This e-mail message, including any attachment(s), is for the sole
use of the intended recipient and may contain confidential and privileged
information. Any unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.

[Mike Frysinger]

err, he said "part ways with autoupdate" as in "once you modify
things, you no longer get autoupdates". not sure how you extrapolated
your question from that.
-mike

[Trever]

Since you are apparently interested in changing /sbin/session_manager_setup.sh, you are ultimately changing the Google signed images, which can't be done while maintaining verified boot.

If you don't need to verify that file, you can do stuff like what is described here:

https://sites.google.com/site/chromeoswikisite/home/what-s-new-in-dev-and-beta/shell-acess-with-verified-boot

But that's as close as you'll get unless you have a new enough device that allows you to toggle your RO firmware to RW, and you burn in your own public key, sign your own images with the corresponding private key, and thus have your own (customized) verified boot.

To my knowledge, no one has done that yet though, and it's (obviously) very ambitious, with the potential to brick your device.   If you do go that route, be sure to pass along documentation.  :-)

[Trever]

Sorry I meant if you don't need to *change* that file (did not mean verify- you can NOT selectively verify files within the image).