Enabled Signed image validation in Item Updater
Added build level support to enable/disable signed
validation using WANT_SIGNATURE_VERIFY flag.
Change-Id: I93bc72a69b877baa9df27272c0b20426069b7557
Signed-off-by: Jayanth Othayoth <ojayanth@in.ibm.com>
Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
diff --git a/Makefile.am b/Makefile.am
index 4e2b209..10c3bf8 100755
--- a/Makefile.am
+++ b/Makefile.am
@@ -7,8 +7,7 @@
version.hpp \
image_manager.hpp \
item_updater.hpp \
- activation.hpp \
- image_verify.hpp
+ activation.hpp
sbin_PROGRAMS = \
phosphor-version-software-manager \
@@ -38,8 +37,12 @@
version.cpp \
serialize.cpp \
item_updater.cpp \
- item_updater_main.cpp \
- image_verify.cpp
+ item_updater_main.cpp
+
+if WANT_SIGNATURE_VERIFY_BUILD
+noinst_HEADERS += image_verify.hpp
+phosphor_image_updater_SOURCES += image_verify.cpp
+endif
nodist_phosphor_image_updater_SOURCES = \
org/openbmc/Associations/server.cpp
diff --git a/activation.cpp b/activation.cpp
index 823f1fb..8d4b202 100644
--- a/activation.cpp
+++ b/activation.cpp
@@ -4,6 +4,14 @@
#include "serialize.hpp"
#include <phosphor-logging/log.hpp>
+#ifdef WANT_SIGNATURE_VERIFY
+#include <phosphor-logging/elog.hpp>
+#include <phosphor-logging/elog-errors.hpp>
+#include <xyz/openbmc_project/Common/error.hpp>
+#include "image_verify.hpp"
+#include "config.h"
+#endif
+
namespace phosphor
{
namespace software
@@ -15,6 +23,11 @@
using namespace phosphor::logging;
+#ifdef WANT_SIGNATURE_VERIFY
+using InternalFailure =
+ sdbusplus::xyz::openbmc_project::Common::Error::InternalFailure;
+#endif
+
void Activation::subscribeToSystemdSignals()
{
auto method = this->bus.new_method_call(SYSTEMD_BUSNAME, SYSTEMD_PATH,
@@ -60,6 +73,24 @@
std::make_unique<ActivationBlocksTransition>(bus, path);
}
+#ifdef WANT_SIGNATURE_VERIFY
+ using Signature = phosphor::software::image::Signature;
+
+ fs::path uploadDir(IMG_UPLOAD_DIR);
+
+ Signature signature(uploadDir / versionId, SIGNED_IMAGE_CONF_PATH);
+
+ // Validate the signed image.
+ if (!signature.verify())
+ {
+ log<level::ERR>("Error occurred during image validation");
+ report<InternalFailure>();
+
+ return softwareServer::Activation::activation(
+ softwareServer::Activation::Activations::Failed);
+ }
+#endif
+
auto method = bus.new_method_call(SYSTEMD_BUSNAME, SYSTEMD_PATH,
SYSTEMD_INTERFACE, "StartUnit");
method.append("obmc-flash-bmc-ubirw.service", "replace");
diff --git a/configure.ac b/configure.ac
index 6caf4b9..54f8eea 100755
--- a/configure.ac
+++ b/configure.ac
@@ -129,6 +129,13 @@
AC_DEFINE_UNQUOTED([ACTIVE_BMC_MAX_ALLOWED], [$ACTIVE_BMC_MAX_ALLOWED],
[The maximum allowed active BMC versions])
+# setup signature verification
+AC_ARG_ENABLE([verify_signature],
+ AS_HELP_STRING([--enable-verify_signature], [Enable image signature validation.]))
+AS_IF([test "x$enable_verify_signature" == "xyes"], \
+ [AC_DEFINE([WANT_SIGNATURE_VERIFY],[],[Enable image signature validation.])])
+AM_CONDITIONAL([WANT_SIGNATURE_VERIFY_BUILD], [test "x$enable_verify_signature" == "xyes"])
+
AC_DEFINE(BUSNAME_UPDATER, "xyz.openbmc_project.Software.BMC.Updater",
[The item updater DBus busname to own.])