@@ -10,11 +10,15 @@
# assure data integrity, the root hash must be stored in a trusted location
# or cryptographically signed and verified.
#
+# Optionally, we can store the hash data on a separate device or partition
+# for improved compartmentalization and ease of use/deployment.
+#
# Usage:
# DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image
# DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs
+# DM_VERITY_SEPARATE_HASH = "1" # optional; store hash on separate dev
# IMAGE_CLASSES += "dm-verity-img"
-#
+
# The resulting image can then be used to implement the device mapper block
# integrity checking on the target device.
@@ -28,6 +32,9 @@ DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024"
# Define the hash block size to use in veritysetup.
DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
+# Should we store the hash data on a separate device/partition?
+DM_VERITY_SEPARATE_HASH ?= "0"
+
# Process the output from veritysetup and generate the corresponding .env
# file. The output from veritysetup is not very machine-friendly so we need to
# convert it to some better format. Let's drop the first line (doesn't contain
@@ -50,6 +57,35 @@ process_verity() {
# Add partition size
echo "DATA_SIZE=$SIZE" >> $ENV
+
+ # Add whether we are storing the hash data separately
+ echo "SEPARATE_HASH=${DM_VERITY_SEPARATE_HASH}" >> $ENV
+
+ # Configured for single partition use of veritysetup? OK, we are done.
+ if [ ${DM_VERITY_SEPARATE_HASH} -eq 0 ]; then
+ return
+ fi
+
+ # Craft up the UUIDs that are part of the verity standard for root & hash
+ # while we are here and in shell. Re-read our output to get ROOT_HASH
+ # and then cut it in 1/2 ; HI for data UUID and LO for hash-data UUID.
+ # https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
+
+ ROOT_HASH=$(cat $ENV | grep ^ROOT_HASH | sed 's/ROOT_HASH=//' | tr a-f A-F)
+ ROOT_HI=$(echo "obase=16;ibase=16;$ROOT_HASH/2^80" | /usr/bin/bc)
+ ROOT_LO=$(echo "obase=16;ibase=16;$ROOT_HASH%2^80" | /usr/bin/bc)
+
+ # Hyphenate as per UUID spec and as expected by wic+sgdisk parameters.
+ # Prefix with leading zeros, in case hash chunks weren't using highest bits
+ # "bc" needs upper case, /dev/disk/by-partuuid/ is lower case. <sigh>
+ ROOT_UUID=$(echo 00000000$ROOT_HI | sed 's/.*\(.\{32\}\)$/\1/' | \
+ sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
+ RHASH_UUID=$(echo 00000000$ROOT_LO | sed 's/.*\(.\{32\}\)$/\1/' | \
+ sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
+
+ # Emit the values needed for a veritysetup run in the initramfs
+ echo "ROOT_UUID=$ROOT_UUID" >> $ENV
+ echo "RHASH_UUID=$RHASH_UUID" >> $ENV
}
verity_setup() {
@@ -57,6 +93,8 @@ verity_setup() {
local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE
local SIZE=$(stat --printf="%s" $INPUT)
local OUTPUT=$INPUT.verity
+ local OUTPUT_HASH=$INPUT.verity
+ local HASH_OFFSET=""
local SETUP_ARGS=""
local SAVED_ARGS="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.args"
@@ -69,12 +107,19 @@ verity_setup() {
fi
SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align)
+ # Assume some users may want separate hash vs. appended hash
+ if [ ${DM_VERITY_SEPARATE_HASH} -eq 1 ]; then
+ OUTPUT_HASH=$INPUT.vhash
+ else
+ HASH_OFFSET="--hash-offset="$SIZE
+ fi
+
cp -a $INPUT $OUTPUT
SETUP_ARGS=" \
--data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} \
--hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} \
- --hash-offset=$SIZE format $OUTPUT $OUTPUT \
+ $HASH_OFFSET format $OUTPUT $OUTPUT_HASH \
"
echo "veritysetup $SETUP_ARGS" > $SAVED_ARGS
@@ -84,6 +129,13 @@ verity_setup() {
veritysetup $SETUP_ARGS | tail -n +2 | process_verity
}
+# make "dateless" symlink for the hash so the wks can find it.
+verity_hash() {
+ cd ${IMGDEPLOYDIR}
+ ln -sf ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.vhash \
+ ${IMAGE_BASENAME}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.vhash
+}
+
VERITY_TYPES = " \
ext2.verity ext3.verity ext4.verity \
btrfs.verity \
@@ -94,10 +146,12 @@ IMAGE_TYPES += "${VERITY_TYPES}"
CONVERSIONTYPES += "verity"
CONVERSION_CMD:verity = "verity_setup ${type}"
CONVERSION_DEPENDS_verity = "cryptsetup-native"
+IMAGE_CMD:vhash = "verity_hash"
python __anonymous() {
verity_image = d.getVar('DM_VERITY_IMAGE')
verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
+ verity_hash = d.getVar('DM_VERITY_SEPARATE_HASH')
image_fstypes = d.getVar('IMAGE_FSTYPES')
pn = d.getVar('PN')
@@ -112,6 +166,8 @@ python __anonymous() {
bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type')
d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type)
+ if verity_hash == "1":
+ d.appendVar('IMAGE_FSTYPES', ' vhash')
# If we're using wic: we'll have to use partition images and not the rootfs
# source plugin so add the appropriate dependency.
There are essentially two ways for dealing with where to put the hash data for dm-verity block integrity checks. You can store both in a single partition, by using ~95% of the storage space for the filesystem and the remaining 5% tail for the hash, or you can use a completely separate partition (or even device) for storing the hash data elsewhere. Method A relies on using a hash offset argument during creation, which is generally OK from a scripted use case but is error prone when run from the command line and the offset calculated manually. Method B has the advantage of using the basic partition/device compartmentalization of the kernel to ensure the fs data doesn't overwrite the hash or vice versa. It takes any possible errors due to math miscalculations completely off the table. At the moment, our current support is hard coded to only support the offset method A. Here we add support for separate hash as per B. As multiple partitions are now in play, we use the UUID creation standard adopted by the systemd/verity community which implicitly links the root and hash partitions by splitting the top roothash in two for the UUIDs of the components. This change optionally creates the separate hash file but no examples use it yet. Further commits will implement an example. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> --- classes/dm-verity-img.bbclass | 60 +++++++++++++++++++++++++++++++++-- 1 file changed, 58 insertions(+), 2 deletions(-)