1# SPDX-License-Identifier: MIT 2# 3# Copyright (C) 2020 BayLibre SAS 4# Author: Bartosz Golaszewski <bgolaszewski@baylibre.com> 5# 6# This bbclass allows creating of dm-verity protected partition images. It 7# generates a device image file with dm-verity hash data appended at the end 8# plus the corresponding .env file containing additional information needed 9# to mount the image such as the root hash in the form of ell variables. To 10# assure data integrity, the root hash must be stored in a trusted location 11# or cryptographically signed and verified. 12# 13# Usage: 14# DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image 15# DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs 16# IMAGE_CLASSES += "dm-verity-img" 17# 18# The resulting image can then be used to implement the device mapper block 19# integrity checking on the target device. 20 21# Define the location where the DM_VERITY_IMAGE specific dm-verity root hash 22# is stored where it can be installed into associated initramfs rootfs. 23STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity" 24 25# Define the data block size to use in veritysetup. 26DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" 27 28# Define the hash block size to use in veritysetup. 29DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096" 30 31# Process the output from veritysetup and generate the corresponding .env 32# file. The output from veritysetup is not very machine-friendly so we need to 33# convert it to some better format. Let's drop the first line (doesn't contain 34# any useful info) and feed the rest to a script. 35process_verity() { 36 local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env" 37 install -d ${STAGING_VERITY_DIR} 38 rm -f $ENV 39 40 # Each line contains a key and a value string delimited by ':'. Read the 41 # two parts into separate variables and process them separately. For the 42 # key part: convert the names to upper case and replace spaces with 43 # underscores to create correct shell variable names. For the value part: 44 # just trim all white-spaces. 45 IFS=":" 46 while read KEY VAL; do 47 printf '%s=%s\n' \ 48 "$(echo "$KEY" | tr '[:lower:]' '[:upper:]' | sed 's/ /_/g')" \ 49 "$(echo "$VAL" | tr -d ' \t')" >> $ENV 50 done 51 52 # Add partition size 53 echo "DATA_SIZE=$SIZE" >> $ENV 54} 55 56verity_setup() { 57 local TYPE=$1 58 local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE 59 local SIZE=$(stat --printf="%s" $INPUT) 60 local OUTPUT=$INPUT.verity 61 62 if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then 63 align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} 64 else 65 align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} 66 fi 67 SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align) 68 69 cp -a $INPUT $OUTPUT 70 71 # Let's drop the first line of output (doesn't contain any useful info) 72 # and feed the rest to another function. 73 veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity 74} 75 76VERITY_TYPES = " \ 77 ext2.verity ext3.verity ext4.verity \ 78 btrfs.verity \ 79 erofs.verity erofs-lz4.verity erofs-lz4hc.verity \ 80 squashfs.verity squashfs-xz.verity squashfs-lzo.verity squashfs-lz4.verity squashfs-zst.verity \ 81" 82IMAGE_TYPES += "${VERITY_TYPES}" 83CONVERSIONTYPES += "verity" 84CONVERSION_CMD:verity = "verity_setup ${type}" 85CONVERSION_DEPENDS_verity = "cryptsetup-native" 86 87python __anonymous() { 88 verity_image = d.getVar('DM_VERITY_IMAGE') 89 verity_type = d.getVar('DM_VERITY_IMAGE_TYPE') 90 image_fstypes = d.getVar('IMAGE_FSTYPES') 91 pn = d.getVar('PN') 92 93 if not verity_image or not verity_type: 94 bb.warn('dm-verity-img class inherited but not used') 95 return 96 97 if verity_image != pn: 98 return # This doesn't concern this image 99 100 if len(verity_type.split()) != 1: 101 bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type') 102 103 d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type) 104 105 # If we're using wic: we'll have to use partition images and not the rootfs 106 # source plugin so add the appropriate dependency. 107 if 'wic' in image_fstypes: 108 dep = ' %s:do_image_%s' % (pn, verity_type.replace("-", "_")) 109 d.appendVarFlag('do_image_wic', 'depends', dep) 110} 111