blob: 2f212d6c7bcb78a9fac3a0048b60d615ca749e07 [file] [log] [blame]
Andrew Geissler1fe918a2020-05-15 14:16:47 -05001# SPDX-License-Identifier: MIT
2#
3# Copyright (C) 2020 BayLibre SAS
4# Author: Bartosz Golaszewski <bgolaszewski@baylibre.com>
5#
6# This bbclass allows creating of dm-verity protected partition images. It
7# generates a device image file with dm-verity hash data appended at the end
8# plus the corresponding .env file containing additional information needed
9# to mount the image such as the root hash in the form of ell variables. To
10# assure data integrity, the root hash must be stored in a trusted location
11# or cryptographically signed and verified.
12#
Patrick Williams520786c2023-06-25 16:20:36 -050013# Optionally, we can store the hash data on a separate device or partition
14# for improved compartmentalization and ease of use/deployment.
15#
Andrew Geissler1fe918a2020-05-15 14:16:47 -050016# Usage:
17# DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image
18# DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs
Patrick Williams520786c2023-06-25 16:20:36 -050019# DM_VERITY_SEPARATE_HASH = "1" # optional; store hash on separate dev
Andrew Geissler1fe918a2020-05-15 14:16:47 -050020# IMAGE_CLASSES += "dm-verity-img"
21#
Patrick Williams520786c2023-06-25 16:20:36 -050022# Using the GPT UUIDs specified in the standard can also be useful in that
23# they are displayed and translated in cfdisk output.
24#
25# DM_VERITY_ROOT_GUID = <UUID for your architecture and root-fs>
26# DM_VERITY_RHASH_GUID = <UUID for your architecture and verity-hash>
27# https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
28
Andrew Geissler1fe918a2020-05-15 14:16:47 -050029# The resulting image can then be used to implement the device mapper block
30# integrity checking on the target device.
31
Andrew Geisslercc589282020-09-18 13:34:40 -050032# Define the location where the DM_VERITY_IMAGE specific dm-verity root hash
33# is stored where it can be installed into associated initramfs rootfs.
34STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity"
35
Patrick Williams169d7bc2024-01-05 11:33:25 -060036# location of images, default current image recipe. Set to DEPLOY_DIR_IMAGE
37# if non-verity images want to embed the .wks and verity image.
38DM_VERITY_DEPLOY_DIR ?= "${IMGDEPLOYDIR}"
39
Andrew Geissler5199d832021-09-24 16:47:35 -050040# Define the data block size to use in veritysetup.
41DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024"
42
Andrew Geissler2daf84b2023-03-31 09:57:23 -050043# Define the hash block size to use in veritysetup.
44DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
45
Patrick Williams520786c2023-06-25 16:20:36 -050046# Should we store the hash data on a separate device/partition?
47DM_VERITY_SEPARATE_HASH ?= "0"
48
49# These are arch specific. We could probably intelligently auto-assign these?
50# Take x86-64 values as defaults. No impact on functionality currently.
51# See SD_GPT_ROOT_X86_64 and SD_GPT_ROOT_X86_64_VERITY in the spec.
52# Note - these are passed directly to sgdisk so hyphens needed.
53DM_VERITY_ROOT_GUID ?= "4f68bce3-e8cd-4db1-96e7-fbcaf984b709"
54DM_VERITY_RHASH_GUID ?= "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5"
55
Patrick Williams169d7bc2024-01-05 11:33:25 -060056DEPENDS += "bc-native"
57
Andrew Geissler1fe918a2020-05-15 14:16:47 -050058# Process the output from veritysetup and generate the corresponding .env
59# file. The output from veritysetup is not very machine-friendly so we need to
60# convert it to some better format. Let's drop the first line (doesn't contain
61# any useful info) and feed the rest to a script.
62process_verity() {
Andrew Geisslercc589282020-09-18 13:34:40 -050063 local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env"
Patrick Williams520786c2023-06-25 16:20:36 -050064 local WKS_INC="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.wks.in"
Andrew Geisslercc589282020-09-18 13:34:40 -050065 rm -f $ENV
Andrew Geissler1fe918a2020-05-15 14:16:47 -050066
67 # Each line contains a key and a value string delimited by ':'. Read the
68 # two parts into separate variables and process them separately. For the
69 # key part: convert the names to upper case and replace spaces with
70 # underscores to create correct shell variable names. For the value part:
71 # just trim all white-spaces.
72 IFS=":"
73 while read KEY VAL; do
Andrew Geisslercc589282020-09-18 13:34:40 -050074 printf '%s=%s\n' \
75 "$(echo "$KEY" | tr '[:lower:]' '[:upper:]' | sed 's/ /_/g')" \
76 "$(echo "$VAL" | tr -d ' \t')" >> $ENV
Andrew Geissler1fe918a2020-05-15 14:16:47 -050077 done
78
79 # Add partition size
80 echo "DATA_SIZE=$SIZE" >> $ENV
Patrick Williams520786c2023-06-25 16:20:36 -050081
82 # Add whether we are storing the hash data separately
83 echo "SEPARATE_HASH=${DM_VERITY_SEPARATE_HASH}" >> $ENV
84
85 # Configured for single partition use of veritysetup? OK, we are done.
86 if [ ${DM_VERITY_SEPARATE_HASH} -eq 0 ]; then
87 return
88 fi
89
90 # Craft up the UUIDs that are part of the verity standard for root & hash
91 # while we are here and in shell. Re-read our output to get ROOT_HASH
92 # and then cut it in 1/2 ; HI for data UUID and LO for hash-data UUID.
93 # https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
94
95 ROOT_HASH=$(cat $ENV | grep ^ROOT_HASH | sed 's/ROOT_HASH=//' | tr a-f A-F)
Patrick Williams169d7bc2024-01-05 11:33:25 -060096 ROOT_HI=$(echo "obase=16;ibase=16;$ROOT_HASH/2^80" | bc)
97 ROOT_LO=$(echo "obase=16;ibase=16;$ROOT_HASH%2^80" | bc)
Patrick Williams520786c2023-06-25 16:20:36 -050098
99 # Hyphenate as per UUID spec and as expected by wic+sgdisk parameters.
100 # Prefix with leading zeros, in case hash chunks weren't using highest bits
101 # "bc" needs upper case, /dev/disk/by-partuuid/ is lower case. <sigh>
102 ROOT_UUID=$(echo 00000000$ROOT_HI | sed 's/.*\(.\{32\}\)$/\1/' | \
103 sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
104 RHASH_UUID=$(echo 00000000$ROOT_LO | sed 's/.*\(.\{32\}\)$/\1/' | \
105 sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f )
106
107 # Emit the values needed for a veritysetup run in the initramfs
108 echo "ROOT_UUID=$ROOT_UUID" >> $ENV
109 echo "RHASH_UUID=$RHASH_UUID" >> $ENV
110
111 # Create wks.in fragment with build specific UUIDs for partitions.
112 # Unfortunately the wks.in does not support line continuations...
113 # First, the unappended filesystem data partition.
Patrick Williams169d7bc2024-01-05 11:33:25 -0600114 echo 'part / --source rawcopy --ondisk sda --sourceparams="file=${DM_VERITY_DEPLOY_DIR}/${DM_VERITY_IMAGE}-${MACHINE}.rootfs.${DM_VERITY_IMAGE_TYPE}.verity" --part-name verityroot --part-type="${DM_VERITY_ROOT_GUID}"'" --uuid=\"$ROOT_UUID\"" > $WKS_INC
Patrick Williams520786c2023-06-25 16:20:36 -0500115
116 # note: no default mount point for hash data partition
Patrick Williams169d7bc2024-01-05 11:33:25 -0600117 echo 'part --source rawcopy --ondisk sda --sourceparams="file=${DM_VERITY_DEPLOY_DIR}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.vhash" --part-name verityhash --part-type="${DM_VERITY_RHASH_GUID}"'" --uuid=\"$RHASH_UUID\"" >> $WKS_INC
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500118}
119
120verity_setup() {
121 local TYPE=$1
Patrick Williams169d7bc2024-01-05 11:33:25 -0600122 local INPUT=${IMAGE_NAME}.$TYPE
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500123 local SIZE=$(stat --printf="%s" $INPUT)
124 local OUTPUT=$INPUT.verity
Patrick Williams520786c2023-06-25 16:20:36 -0500125 local OUTPUT_HASH=$INPUT.verity
126 local HASH_OFFSET=""
127 local SETUP_ARGS=""
128 local SAVED_ARGS="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.args"
129
130 install -d ${STAGING_VERITY_DIR}
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500131
Andrew Geissler2daf84b2023-03-31 09:57:23 -0500132 if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then
133 align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE}
134 else
135 align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE}
136 fi
137 SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align)
138
Patrick Williams520786c2023-06-25 16:20:36 -0500139 # Assume some users may want separate hash vs. appended hash
140 if [ ${DM_VERITY_SEPARATE_HASH} -eq 1 ]; then
141 OUTPUT_HASH=$INPUT.vhash
142 else
143 HASH_OFFSET="--hash-offset="$SIZE
144 fi
145
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500146 cp -a $INPUT $OUTPUT
147
Patrick Williams520786c2023-06-25 16:20:36 -0500148 SETUP_ARGS=" \
149 --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} \
150 --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} \
151 $HASH_OFFSET format $OUTPUT $OUTPUT_HASH \
152 "
153
154 echo "veritysetup $SETUP_ARGS" > $SAVED_ARGS
155
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500156 # Let's drop the first line of output (doesn't contain any useful info)
157 # and feed the rest to another function.
Patrick Williams520786c2023-06-25 16:20:36 -0500158 veritysetup $SETUP_ARGS | tail -n +2 | process_verity
159}
160
161# make "dateless" symlink for the hash so the wks can find it.
162verity_hash() {
163 cd ${IMGDEPLOYDIR}
Patrick Williams169d7bc2024-01-05 11:33:25 -0600164 ln -sf ${IMAGE_NAME}.${DM_VERITY_IMAGE_TYPE}.vhash \
Patrick Williams520786c2023-06-25 16:20:36 -0500165 ${IMAGE_BASENAME}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.vhash
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500166}
167
Andrew Geissler9347dd42023-03-03 12:38:41 -0600168VERITY_TYPES = " \
169 ext2.verity ext3.verity ext4.verity \
170 btrfs.verity \
171 erofs.verity erofs-lz4.verity erofs-lz4hc.verity \
172 squashfs.verity squashfs-xz.verity squashfs-lzo.verity squashfs-lz4.verity squashfs-zst.verity \
173"
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500174IMAGE_TYPES += "${VERITY_TYPES}"
175CONVERSIONTYPES += "verity"
Andrew Geisslerd159c7f2021-09-02 21:05:58 -0500176CONVERSION_CMD:verity = "verity_setup ${type}"
Patrick Williams53961c22022-01-20 11:06:23 -0600177CONVERSION_DEPENDS_verity = "cryptsetup-native"
Patrick Williams520786c2023-06-25 16:20:36 -0500178IMAGE_CMD:vhash = "verity_hash"
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500179
180python __anonymous() {
181 verity_image = d.getVar('DM_VERITY_IMAGE')
182 verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
Patrick Williams520786c2023-06-25 16:20:36 -0500183 verity_hash = d.getVar('DM_VERITY_SEPARATE_HASH')
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500184 image_fstypes = d.getVar('IMAGE_FSTYPES')
185 pn = d.getVar('PN')
186
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500187 if not verity_image or not verity_type:
188 bb.warn('dm-verity-img class inherited but not used')
189 return
190
Andrew Geisslercc589282020-09-18 13:34:40 -0500191 if verity_image != pn:
192 return # This doesn't concern this image
193
Andrew Geissler2daf84b2023-03-31 09:57:23 -0500194 if len(verity_type.split()) != 1:
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500195 bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type')
196
197 d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type)
Patrick Williams520786c2023-06-25 16:20:36 -0500198 if verity_hash == "1":
199 d.appendVar('IMAGE_FSTYPES', ' vhash')
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500200
201 # If we're using wic: we'll have to use partition images and not the rootfs
202 # source plugin so add the appropriate dependency.
203 if 'wic' in image_fstypes:
Andrew Geisslerd5838332022-05-27 11:33:10 -0500204 dep = ' %s:do_image_%s' % (pn, verity_type.replace("-", "_"))
Andrew Geissler1fe918a2020-05-15 14:16:47 -0500205 d.appendVarFlag('do_image_wic', 'depends', dep)
206}