summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorniko.mauno@vaisala.com <niko.mauno@vaisala.com>2020-09-10 16:17:55 +0000
committerArmin Kuster <akuster808@gmail.com>2020-09-12 08:55:28 -0700
commit45e8b20cd022eb7b20d72c23db9fcc6824f08c7a (patch)
treed0584f071751145a6f6be87be7617cc2d7b08a7a
parent489f7c900c365e4b3198cff2f2fd7c38623b77e8 (diff)
downloadmeta-security-45e8b20cd022eb7b20d72c23db9fcc6824f08c7a.tar.gz
dm-verity-image-initramfs: Use initramfs-framework
Switch from this layer's initramfs-dm-verity recipe to poky-provided initramfs-framework suite to manage veritysetup et al. This commit also removes initramfs-dm-verity recipe which is not referred from elsewhere in this meta layer. Also update the install path of dm-verity.env from /usr/share to /usr/share/misc in order to better comply with FHS3.0, see https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--recipes-core/images/dm-verity-image-initramfs.bb5
-rw-r--r--recipes-core/initrdscripts/initramfs-dm-verity.bb13
-rw-r--r--recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh46
3 files changed, 3 insertions, 61 deletions
diff --git a/recipes-core/images/dm-verity-image-initramfs.bb b/recipes-core/images/dm-verity-image-initramfs.bb
index e791c19..6a1058d 100644
--- a/recipes-core/images/dm-verity-image-initramfs.bb
+++ b/recipes-core/images/dm-verity-image-initramfs.bb
@@ -4,7 +4,8 @@ DESCRIPTION = "Simple initramfs image for mounting the rootfs over the verity de
4IMAGE_FEATURES = "" 4IMAGE_FEATURES = ""
5 5
6PACKAGE_INSTALL = " \ 6PACKAGE_INSTALL = " \
7 initramfs-dm-verity \ 7 initramfs-module-dmverity \
8 initramfs-module-udev \
8 base-files \ 9 base-files \
9 busybox \ 10 busybox \
10 util-linux-mount \ 11 util-linux-mount \
@@ -24,6 +25,6 @@ IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
24inherit core-image 25inherit core-image
25 26
26deploy_verity_hash() { 27deploy_verity_hash() {
27 install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/dm-verity.env 28 install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
28} 29}
29IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;" 30IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
diff --git a/recipes-core/initrdscripts/initramfs-dm-verity.bb b/recipes-core/initrdscripts/initramfs-dm-verity.bb
deleted file mode 100644
index b614956..0000000
--- a/recipes-core/initrdscripts/initramfs-dm-verity.bb
+++ /dev/null
@@ -1,13 +0,0 @@
1SUMMARY = "Simple init script that uses devmapper to mount the rootfs in read-only mode protected by dm-verity"
2LICENSE = "MIT"
3LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
4
5SRC_URI = "file://init-dm-verity.sh"
6
7do_install() {
8 install -m 0755 ${WORKDIR}/init-dm-verity.sh ${D}/init
9 install -d ${D}/dev
10 mknod -m 622 ${D}/dev/console c 5 1
11}
12
13FILES_${PN} = "/init /dev/console"
diff --git a/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh b/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh
deleted file mode 100644
index 307d2c7..0000000
--- a/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh
+++ /dev/null
@@ -1,46 +0,0 @@
1#!/bin/sh
2
3PATH=/sbin:/bin:/usr/sbin:/usr/bin
4RDEV=""
5ROOT_DIR="/new_root"
6
7mkdir -p /proc
8mkdir -p /sys
9mkdir -p /run
10mkdir -p /tmp
11mount -t proc proc /proc
12mount -t sysfs sysfs /sys
13mount -t devtmpfs none /dev
14
15udevd --daemon
16udevadm trigger --type=subsystems --action=add
17udevadm trigger --type=devices --action=add
18udevadm settle --timeout=10
19
20for PARAM in $(cat /proc/cmdline); do
21 case $PARAM in
22 root=*)
23 RDEV=${PARAM#root=}
24 ;;
25 esac
26done
27
28if ! [ -b $RDEV ]; then
29 echo "Missing root command line argument!"
30 exit 1
31fi
32
33case $RDEV in
34 UUID=*)
35 RDEV=$(realpath /dev/disk/by-uuid/${RDEV#UUID=})
36 ;;
37esac
38
39. /usr/share/dm-verity.env
40
41echo "Mounting $RDEV over dm-verity as the root filesystem"
42
43veritysetup --data-block-size=1024 --hash-offset=$DATA_SIZE create rootfs $RDEV $RDEV $ROOT_HASH
44mkdir -p $ROOT_DIR
45mount -o ro /dev/mapper/rootfs $ROOT_DIR
46exec switch_root $ROOT_DIR /sbin/init