diff mbox series

[meta-security,3/7] dm-verity: save veritysetup args beside runtime environment

Message ID 20230621171335.1354905-4-paul.gortmaker@windriver.com
State New
Headers show
Series dm-verity: separate device for hash storage | expand

Commit Message

Paul Gortmaker June 21, 2023, 5:13 p.m. UTC
We already have this directory to save the environment variable settings
so they can be copied into the initramfs for runtime setup.

There are quite a few veritysetup args, and the nature of storing the
hash data after the filesystem data in an "oversized" partition can be
error prone due to rounding, fencepost errors, etc.

Save a copy of what we used for ease of debug inspection, and for basic
cut and paste use in experimentation and tweaking.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
 classes/dm-verity-img.bbclass | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/classes/dm-verity-img.bbclass b/classes/dm-verity-img.bbclass
index b279fa8..e190c87 100644
--- a/classes/dm-verity-img.bbclass
+++ b/classes/dm-verity-img.bbclass
@@ -34,7 +34,6 @@  DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
 # any useful info) and feed the rest to a script.
 process_verity() {
     local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env"
-    install -d ${STAGING_VERITY_DIR}
     rm -f $ENV
 
     # Each line contains a key and a value string delimited by ':'. Read the
@@ -59,6 +58,9 @@  verity_setup() {
     local SIZE=$(stat --printf="%s" $INPUT)
     local OUTPUT=$INPUT.verity
     local SETUP_ARGS=""
+    local SAVED_ARGS="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.args"
+
+    install -d ${STAGING_VERITY_DIR}
 
     if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then
         align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE}
@@ -75,6 +77,8 @@  verity_setup() {
         --hash-offset=$SIZE format $OUTPUT $OUTPUT \
     "
 
+    echo "veritysetup $SETUP_ARGS" > $SAVED_ARGS
+
     # Let's drop the first line of output (doesn't contain any useful info)
     # and feed the rest to another function.
     veritysetup $SETUP_ARGS | tail -n +2 | process_verity