blob: 93f667d6cdc11257ae8f2ba6300db9f62384a46c [file] [log] [blame]
Andrew Geissler1fe918a2020-05-15 14:16:47 -05001# SPDX-License-Identifier: MIT
2#
3# Copyright (C) 2020 BayLibre SAS
4# Author: Bartosz Golaszewski <bgolaszewski@baylibre.com>
5#
6# This bbclass allows creating of dm-verity protected partition images. It
7# generates a device image file with dm-verity hash data appended at the end
8# plus the corresponding .env file containing additional information needed
9# to mount the image such as the root hash in the form of ell variables. To
10# assure data integrity, the root hash must be stored in a trusted location
11# or cryptographically signed and verified.
12#
13# Usage:
14# DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image
15# DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs
16# IMAGE_CLASSES += "dm-verity-img"
17#
18# The resulting image can then be used to implement the device mapper block
19# integrity checking on the target device.
20
Andrew Geisslercc589282020-09-18 13:34:40 -050021# Define the location where the DM_VERITY_IMAGE specific dm-verity root hash
22# is stored where it can be installed into associated initramfs rootfs.
23STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity"
24
Andrew Geissler5199d832021-09-24 16:47:35 -050025# Define the data block size to use in veritysetup.
26DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024"
27
Andrew Geissler1fe918a2020-05-15 14:16:47 -050028# Process the output from veritysetup and generate the corresponding .env
29# file. The output from veritysetup is not very machine-friendly so we need to
30# convert it to some better format. Let's drop the first line (doesn't contain
31# any useful info) and feed the rest to a script.
32process_verity() {
Andrew Geisslercc589282020-09-18 13:34:40 -050033 local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env"
34 install -d ${STAGING_VERITY_DIR}
35 rm -f $ENV
Andrew Geissler1fe918a2020-05-15 14:16:47 -050036
37 # Each line contains a key and a value string delimited by ':'. Read the
38 # two parts into separate variables and process them separately. For the
39 # key part: convert the names to upper case and replace spaces with
40 # underscores to create correct shell variable names. For the value part:
41 # just trim all white-spaces.
42 IFS=":"
43 while read KEY VAL; do
Andrew Geisslercc589282020-09-18 13:34:40 -050044 printf '%s=%s\n' \
45 "$(echo "$KEY" | tr '[:lower:]' '[:upper:]' | sed 's/ /_/g')" \
46 "$(echo "$VAL" | tr -d ' \t')" >> $ENV
Andrew Geissler1fe918a2020-05-15 14:16:47 -050047 done
48
49 # Add partition size
50 echo "DATA_SIZE=$SIZE" >> $ENV
Andrew Geissler1fe918a2020-05-15 14:16:47 -050051}
52
53verity_setup() {
54 local TYPE=$1
55 local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE
56 local SIZE=$(stat --printf="%s" $INPUT)
57 local OUTPUT=$INPUT.verity
58
59 cp -a $INPUT $OUTPUT
60
61 # Let's drop the first line of output (doesn't contain any useful info)
62 # and feed the rest to another function.
Andrew Geissler5199d832021-09-24 16:47:35 -050063 veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
Andrew Geissler1fe918a2020-05-15 14:16:47 -050064}
65
66VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity"
67IMAGE_TYPES += "${VERITY_TYPES}"
68CONVERSIONTYPES += "verity"
Andrew Geisslerd159c7f2021-09-02 21:05:58 -050069CONVERSION_CMD:verity = "verity_setup ${type}"
Patrick Williams53961c22022-01-20 11:06:23 -060070CONVERSION_DEPENDS_verity = "cryptsetup-native"
Andrew Geissler1fe918a2020-05-15 14:16:47 -050071
72python __anonymous() {
73 verity_image = d.getVar('DM_VERITY_IMAGE')
74 verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
75 image_fstypes = d.getVar('IMAGE_FSTYPES')
76 pn = d.getVar('PN')
77
Andrew Geissler1fe918a2020-05-15 14:16:47 -050078 if not verity_image or not verity_type:
79 bb.warn('dm-verity-img class inherited but not used')
80 return
81
Andrew Geisslercc589282020-09-18 13:34:40 -050082 if verity_image != pn:
83 return # This doesn't concern this image
84
Andrew Geissler1fe918a2020-05-15 14:16:47 -050085 if len(verity_type.split()) is not 1:
86 bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type')
87
88 d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type)
89
90 # If we're using wic: we'll have to use partition images and not the rootfs
91 # source plugin so add the appropriate dependency.
92 if 'wic' in image_fstypes:
93 dep = ' %s:do_image_%s' % (pn, verity_type)
94 d.appendVarFlag('do_image_wic', 'depends', dep)
95}