dm-verity on non-rootfs data partition using initramfs and systemd-veritysetup-generator

verified-boot/README

@@ -1,4 +1,4 @@
-Implementing dm-verity for a rootfs data partition in Clear Linux
+Implementing dm-verity for a non-rootfs data partition in Clear Linux
 
 - Use mixer to create a CLR linux image with the following:
   - Enable support for dm-verity in the CLR linux image.

verified-boot/boot.sh

@@ -4,9 +4,16 @@ initramfs_fname=$2
 echo $boot_dev
 echo $initramfs_fname
 mount $boot_dev mnt
+
+#rm -rf initramfs
+#mkdir initramfs
+#cp init initramfs/
 cd initramfs
 chmod +x init
-find . -print0 | cpio --null -ov --format=newc | gzip -9 > ../mnt/EFI/$initramfs_fname
-#echo "initrd EFI/$initramfs_fname"  >> ../mnt/loader/entries/Clear-linux-native-4.15.4-534.conf
+find . | cpio -o -H newc | gzip > ../mnt/EFI/$initramfs_fname
+#find . -print0 | cpio --null -ov --format=newc | gzip -9 > ../mnt/EFI/$initramfs_fname
+ls ../mnt/EFI
+cat ../mnt/loader/entries/Clear*
 cd ..
-#umount mnt
+#echo "initrd EFI/$initramfs_fname"  >> ../mnt/loader/entries/Clear-linux-native-4.15.4-534.conf
+umount mnt

verified-boot/dm-verity-impl-1.py

@@ -17,28 +17,42 @@ except Exception:
     raise Exception("{0}: {1}".format(cmd, sys.exc_info()))
 print(dev[len(dev) - 1])
 boot_num = 1
-data_num = 3
-hash_num = 4
+rootfs_num = 3
+data_num = 4
+hash_num = 5
 
 boot_dev = dev[0] + "p" + str(boot_num)
+rootfs_dev = dev[0] + "p" + str(rootfs_num)
 data_dev = dev[0] + "p" + str(data_num)
 hash_dev = dev[0] + "p" + str(hash_num)
 verity_name = "root"
+
+boot_gen = "boot.sh"
+initramfs_fname = "initramfs.cpio.gz"
+
 subprocess.check_output("rm -rf mnt".split(" "))
 subprocess.check_output("mkdir mnt".split(" "))
 
-cmd = "blkid {0}".format(data_dev)
-print("Executing: " + cmd)
+print("Creating data files in " + data_dev)
+subprocess.check_output("mount {0} mnt".format(data_dev).split(" "))
+
+subprocess.check_output("touch mnt/file1.sh".split(" "))
 try:
-    res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines()
-except Exception:
-    raise Exception("{0}: {1}".format(cmd, sys.exc_info()))
-s1 = res[0]
-print(s1)
-s2 = " UUID="
-s3 = s1[s1.index(s2) + len(s2):]
-data_dev_uuid = s3.split("\"", 2)[1]
-print("data_dev_uuid = " + data_dev_uuid)
+    outfile = open('mnt/file1.sh','w')
+    outfile.write("echo Testing dm-verity data1...")
+    outfile.close()
+except IOError:
+    print("I/O error")
+
+subprocess.check_output("touch mnt/file2.sh".split(" "))
+try:
+    outfile = open('mnt/file2.sh','w')
+    outfile.write("echo Testing dm-verity data2...")
+    outfile.close()
+except IOError:
+    print("I/O error")
+
+subprocess.check_output("umount mnt".split(" "))
 
 cmd = "veritysetup --verbose --data-block-size=1024 --hash-block-size=1024 format {0} {1}".format(data_dev, hash_dev)
 print("Executing: " + cmd)
@@ -46,7 +60,9 @@ try:
     res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines()
 except Exception:
     raise Exception("{0}: {1}".format(cmd, sys.exc_info()))
+
 print(res[len(res) - 1])
+
 salt_str = res[len(res) - 3]
 root_hash_str = res[len(res) - 2]
 print(salt_str)
@@ -56,7 +72,9 @@ root_hash = root_hash_str.replace('Root hash:      	','')
 print(salt)
 print(root_hash)
 
+kernel_cmdline = "quiet systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num)
 subprocess.check_output("mount {0} mnt".format(boot_dev).split(" "))
+
 for fname in os.listdir('mnt/loader/entries/'):
     if (fnmatch.fnmatch(fname, 'Clear-*')):
         path = "mnt/loader/entries/" + fname
@@ -67,23 +85,25 @@ for fname in os.listdir('mnt/loader/entries/'):
             outfile.close()
         except IOError:
             print("I/O error")
-#        content = re.sub(r"root=PARTUUID=", "cryptdevice=UUID=", content)
-#        kernel_cmdline = ":" + verity_name + " quiet"
-#        content = re.sub(r" quiet", kernel_cmdline, content)
-        kernel_cmdline = "cryptdevice=UUID=" + data_dev_uuid + ":" + str(verity_name) + " root=/dev/mapper/" + str(verity_name) + " systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) + " rootdelay=10 quiet"
-        content = re.sub(r"root=.* quiet", kernel_cmdline, content)
-        content = re.sub(r"rw", "ro", content)
+
+        content = re.sub(r"quiet", kernel_cmdline, content)
+#        content = re.sub(r"init=.* initcall_debug", "", content)
         print(content)
 
         try:
             outfile = open(path, 'w')
             outfile.write(content)
+            outfile.write("initrd EFI/" + initramfs_fname)
             outfile.close()
         except IOError:
             print("I/O error")
+
+#print("Updating boot files..")
 subprocess.check_output("umount mnt".split(" "))
 
-subprocess.check_output("rm -rf mnt".split(" "))
+#subprocess.check_output("sh {0} {1} {2}".format(boot_gen, boot_dev, initramfs_fname).split(" "))
+
+#subprocess.check_output("rm -rf mnt".split(" "))
 
 cmd = "veritysetup --verbose verify {0} {1} {2}".format(data_dev, hash_dev, root_hash)
 print("Executing: " + cmd)

verified-boot/initramfs.sh

@@ -1,13 +1,18 @@
 #!/bin/bash
 rm -rf initramfs
-mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys}
+#mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys}
+cp init initramfs/
+cd initramfs
+find . | cpio -o -H newc | gzip > ../initramfs_data.cpio.gz
+cd ..
 
-mixversion=$(cat mixversion)
-echo $mixversion
-
-cp -a update/image/$mixversion/full/lib64/{libpthread.so.0,librt.so.1,libacl.so.1,libattr.so.1,libcap.so.2,ld-linux-x86-64.so.2,libmount.so.1,libblkid.so.1,libuuid.so.1,libcryptsetup.so.4,libpopt.so.0,libdevmapper.so.1.02,libgcrypt.so.20,libudev.so.1,libgpg-error.so.0,ld-2.27.so,libacl.so.1.1.0,libattr.so.1.1.0,libblkid.so.1.1.0,libcap.so.2.25,libcryptsetup.so.4.7.0,libgcrypt.so.20.2.2,libgpg-error.so.0.22.0,libmount.so.1.1.0,libpopt.so.0.0.0,libpthread-2.27.so,librt-2.27.so,libudev.so.1.6.6,libuuid.so.1.3.0} initramfs/lib64/
-
-cp -a update/image/$mixversion/full/lib64/{haswell/libc.so.6,haswell/libm.so.6,haswell/libgcc_s.so.1,haswell/libc-2.27.so,haswell/libm-2.27.so} initramfs/lib64/haswell/
-
-cp -a update/image/$mixversion/full/sbin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/sbin/
-cp -a update/image/$mixversion/full/bin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/bin/
+#mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys}
+#mixversion=$(cat mixversion)
+#echo $mixversion
+#
+#cp -a update/image/$mixversion/full/lib64/{libpthread.so.0,librt.so.1,libacl.so.1,libattr.so.1,libcap.so.2,ld-linux-x86-64.so.2,libmount.so.1,libblkid.so.1,libuuid.so.1,libcryptsetup.so.4,libpopt.so.0,libdevmapper.so.1.02,libgcrypt.so.20,libudev.so.1,libgpg-error.so.0,ld-2.27.so,libacl.so.1.1.0,libattr.so.1.1.0,libblkid.so.1.1.0,libcap.so.2.25,libcryptsetup.so.4.7.0,libgcrypt.so.20.2.2,libgpg-error.so.0.22.0,libmount.so.1.1.0,libpopt.so.0.0.0,libpthread-2.27.so,librt-2.27.so,libudev.so.1.6.6,libuuid.so.1.3.0} initramfs/lib64/
+#
+#cp -a update/image/$mixversion/full/lib64/{haswell/libc.so.6,haswell/libm.so.6,haswell/libgcc_s.so.1,haswell/libc-2.27.so,haswell/libm-2.27.so} initramfs/lib64/haswell/
+#
+#cp -a update/image/$mixversion/full/sbin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/sbin/
+#cp -a update/image/$mixversion/full/bin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/bin/

verified-boot/initramfs/bin/ash

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/ifconfig

@@ -0,0 +1 @@
+../bin/busybox

verified-boot/initramfs/bin/ls

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/mkdir

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/mount

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/mv

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/ps

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/route

@@ -0,0 +1 @@
+../bin/busybox

verified-boot/initramfs/bin/sh

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/bin/udhcpc

@@ -0,0 +1 @@
+../bin/busybox

verified-boot/initramfs/bin/uname

@@ -0,0 +1 @@
+busybox

verified-boot/initramfs/init

@@ -0,0 +1,36 @@
+#!/bin/busybox sh
+
+# Mount the /proc and /sys filesystems.
+echo "Inside initramfs..."
+bin/mount -t proc none /proc
+bin/mount -t sysfs none /sys
+cat /proc/cmdline
+
+echo "Mounting devtmpfs..."
+bin/mount -t devtmpfs none /dev
+
+bin/ls /dev/mapper
+
+# Do your stuff here.
+cmdline() {
+    local value
+    value=" $(cat /proc/cmdline) "
+    value="${value##* $1=}"
+    value="${value%% *}"
+    [ "$value" != "" ] && echo "$value"
+}
+
+# Mount the dm-verity data partition
+#mount -o ro $(findfs $(cmdline root)) /mnt/root
+bin/mount /dev/sda3 /mnt/root
+#bin/mount /dev/mapper/root /mnt/root/data
+
+# Clean up.
+echo "initramfs clean up tasks..."
+umount /proc
+umount /sys
+umount /dev
+
+# Boot the real thing.
+echo "Executing switch_root..."
+exec switch_root /mnt/root /usr/lib/systemd/systemd-bootchart

verified-boot/release-image-config.json

@@ -3,15 +3,18 @@
     "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "64M", "type" : "EFI" },
                           { "disk" : "release.img", "partition" : 2, "size" : "16M", "type" : "swap" },
                           { "disk" : "release.img", "partition" : 3, "size" : "3G", "type" : "linux" },
-			  { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" } ],
+			  { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" },
+                          { "disk" : "release.img", "partition" : 5, "size" : "200M", "type" : "linux" } ],
     "FilesystemTypes" : [ { "disk" : "release.img", "partition" : 1, "type" : "vfat" },
                           { "disk" : "release.img", "partition" : 2, "type" : "swap" },
                           { "disk" : "release.img", "partition" : 3, "type" : "ext4" },
-                          { "disk" : "release.img", "partition" : 4, "type" : "ext4" } ],
+                          { "disk" : "release.img", "partition" : 4, "type" : "ext4" },
+                          { "disk" : "release.img", "partition" : 5, "type" : "ext4" } ],
     "PartitionMountPoints" : [ { "disk" : "release.img", "partition" : 1, "mount" : "/boot" },
                                { "disk" : "release.img", "partition" : 3, "mount" : "/" },
-                               { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/hashdev" } ],
+                               { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/datadev" },
+                               { "disk" : "release.img", "partition" : 5, "mount" : "/mnt/hashdev" } ],
     "Version": "latest",
-    "Bundles": ["kernel-native", "os-core-update", "editors", "containers-basic", "network-basic", "openssh-server"]
+    "Bundles": ["kernel-native", "os-core", "os-core-update", "editors"]
 }