diff --git a/verified-boot/README b/verified-boot/README index 932d250..73d5c91 100644 --- a/verified-boot/README +++ b/verified-boot/README @@ -1,4 +1,4 @@ -Implementing dm-verity for a rootfs data partition in Clear Linux +Implementing dm-verity for a non-rootfs data partition in Clear Linux - Use mixer to create a CLR linux image with the following: - Enable support for dm-verity in the CLR linux image. diff --git a/verified-boot/boot.sh b/verified-boot/boot.sh index 6c702e8..06dbaa4 100644 --- a/verified-boot/boot.sh +++ b/verified-boot/boot.sh @@ -4,9 +4,16 @@ initramfs_fname=$2 echo $boot_dev echo $initramfs_fname mount $boot_dev mnt + +#rm -rf initramfs +#mkdir initramfs +#cp init initramfs/ cd initramfs chmod +x init -find . -print0 | cpio --null -ov --format=newc | gzip -9 > ../mnt/EFI/$initramfs_fname -#echo "initrd EFI/$initramfs_fname" >> ../mnt/loader/entries/Clear-linux-native-4.15.4-534.conf +find . | cpio -o -H newc | gzip > ../mnt/EFI/$initramfs_fname +#find . -print0 | cpio --null -ov --format=newc | gzip -9 > ../mnt/EFI/$initramfs_fname +ls ../mnt/EFI +cat ../mnt/loader/entries/Clear* cd .. -#umount mnt +#echo "initrd EFI/$initramfs_fname" >> ../mnt/loader/entries/Clear-linux-native-4.15.4-534.conf +umount mnt diff --git a/verified-boot/dm-verity-impl-1.py b/verified-boot/dm-verity-impl-1.py index c81872f..21bcb26 100644 --- a/verified-boot/dm-verity-impl-1.py +++ b/verified-boot/dm-verity-impl-1.py @@ -17,28 +17,42 @@ except Exception: raise Exception("{0}: {1}".format(cmd, sys.exc_info())) print(dev[len(dev) - 1]) boot_num = 1 -data_num = 3 -hash_num = 4 +rootfs_num = 3 +data_num = 4 +hash_num = 5 boot_dev = dev[0] + "p" + str(boot_num) +rootfs_dev = dev[0] + "p" + str(rootfs_num) data_dev = dev[0] + "p" + str(data_num) hash_dev = dev[0] + "p" + str(hash_num) verity_name = "root" + +boot_gen = "boot.sh" +initramfs_fname = "initramfs.cpio.gz" + subprocess.check_output("rm -rf mnt".split(" ")) subprocess.check_output("mkdir mnt".split(" ")) -cmd = "blkid {0}".format(data_dev) -print("Executing: " + cmd) +print("Creating data files in " + data_dev) +subprocess.check_output("mount {0} mnt".format(data_dev).split(" ")) + +subprocess.check_output("touch mnt/file1.sh".split(" ")) try: - res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines() -except Exception: - raise Exception("{0}: {1}".format(cmd, sys.exc_info())) -s1 = res[0] -print(s1) -s2 = " UUID=" -s3 = s1[s1.index(s2) + len(s2):] -data_dev_uuid = s3.split("\"", 2)[1] -print("data_dev_uuid = " + data_dev_uuid) + outfile = open('mnt/file1.sh','w') + outfile.write("echo Testing dm-verity data1...") + outfile.close() +except IOError: + print("I/O error") + +subprocess.check_output("touch mnt/file2.sh".split(" ")) +try: + outfile = open('mnt/file2.sh','w') + outfile.write("echo Testing dm-verity data2...") + outfile.close() +except IOError: + print("I/O error") + +subprocess.check_output("umount mnt".split(" ")) cmd = "veritysetup --verbose --data-block-size=1024 --hash-block-size=1024 format {0} {1}".format(data_dev, hash_dev) print("Executing: " + cmd) @@ -46,7 +60,9 @@ try: res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines() except Exception: raise Exception("{0}: {1}".format(cmd, sys.exc_info())) + print(res[len(res) - 1]) + salt_str = res[len(res) - 3] root_hash_str = res[len(res) - 2] print(salt_str) @@ -56,7 +72,9 @@ root_hash = root_hash_str.replace('Root hash: ','') print(salt) print(root_hash) +kernel_cmdline = "quiet systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) subprocess.check_output("mount {0} mnt".format(boot_dev).split(" ")) + for fname in os.listdir('mnt/loader/entries/'): if (fnmatch.fnmatch(fname, 'Clear-*')): path = "mnt/loader/entries/" + fname @@ -67,23 +85,25 @@ for fname in os.listdir('mnt/loader/entries/'): outfile.close() except IOError: print("I/O error") -# content = re.sub(r"root=PARTUUID=", "cryptdevice=UUID=", content) -# kernel_cmdline = ":" + verity_name + " quiet" -# content = re.sub(r" quiet", kernel_cmdline, content) - kernel_cmdline = "cryptdevice=UUID=" + data_dev_uuid + ":" + str(verity_name) + " root=/dev/mapper/" + str(verity_name) + " systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) + " rootdelay=10 quiet" - content = re.sub(r"root=.* quiet", kernel_cmdline, content) - content = re.sub(r"rw", "ro", content) + + content = re.sub(r"quiet", kernel_cmdline, content) +# content = re.sub(r"init=.* initcall_debug", "", content) print(content) try: outfile = open(path, 'w') outfile.write(content) + outfile.write("initrd EFI/" + initramfs_fname) outfile.close() except IOError: print("I/O error") + +#print("Updating boot files..") subprocess.check_output("umount mnt".split(" ")) -subprocess.check_output("rm -rf mnt".split(" ")) +#subprocess.check_output("sh {0} {1} {2}".format(boot_gen, boot_dev, initramfs_fname).split(" ")) + +#subprocess.check_output("rm -rf mnt".split(" ")) cmd = "veritysetup --verbose verify {0} {1} {2}".format(data_dev, hash_dev, root_hash) print("Executing: " + cmd) diff --git a/verified-boot/initramfs.sh b/verified-boot/initramfs.sh index 082b5a9..cbf317e 100644 --- a/verified-boot/initramfs.sh +++ b/verified-boot/initramfs.sh @@ -1,13 +1,18 @@ #!/bin/bash rm -rf initramfs -mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys} +#mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys} +cp init initramfs/ +cd initramfs +find . | cpio -o -H newc | gzip > ../initramfs_data.cpio.gz +cd .. -mixversion=$(cat mixversion) -echo $mixversion - -cp -a update/image/$mixversion/full/lib64/{libpthread.so.0,librt.so.1,libacl.so.1,libattr.so.1,libcap.so.2,ld-linux-x86-64.so.2,libmount.so.1,libblkid.so.1,libuuid.so.1,libcryptsetup.so.4,libpopt.so.0,libdevmapper.so.1.02,libgcrypt.so.20,libudev.so.1,libgpg-error.so.0,ld-2.27.so,libacl.so.1.1.0,libattr.so.1.1.0,libblkid.so.1.1.0,libcap.so.2.25,libcryptsetup.so.4.7.0,libgcrypt.so.20.2.2,libgpg-error.so.0.22.0,libmount.so.1.1.0,libpopt.so.0.0.0,libpthread-2.27.so,librt-2.27.so,libudev.so.1.6.6,libuuid.so.1.3.0} initramfs/lib64/ - -cp -a update/image/$mixversion/full/lib64/{haswell/libc.so.6,haswell/libm.so.6,haswell/libgcc_s.so.1,haswell/libc-2.27.so,haswell/libm-2.27.so} initramfs/lib64/haswell/ - -cp -a update/image/$mixversion/full/sbin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/sbin/ -cp -a update/image/$mixversion/full/bin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/bin/ +#mkdir -p initramfs/{bin,dev,etc,lib,lib64/haswell,mnt/root,proc,root,sbin,sys} +#mixversion=$(cat mixversion) +#echo $mixversion +# +#cp -a update/image/$mixversion/full/lib64/{libpthread.so.0,librt.so.1,libacl.so.1,libattr.so.1,libcap.so.2,ld-linux-x86-64.so.2,libmount.so.1,libblkid.so.1,libuuid.so.1,libcryptsetup.so.4,libpopt.so.0,libdevmapper.so.1.02,libgcrypt.so.20,libudev.so.1,libgpg-error.so.0,ld-2.27.so,libacl.so.1.1.0,libattr.so.1.1.0,libblkid.so.1.1.0,libcap.so.2.25,libcryptsetup.so.4.7.0,libgcrypt.so.20.2.2,libgpg-error.so.0.22.0,libmount.so.1.1.0,libpopt.so.0.0.0,libpthread-2.27.so,librt-2.27.so,libudev.so.1.6.6,libuuid.so.1.3.0} initramfs/lib64/ +# +#cp -a update/image/$mixversion/full/lib64/{haswell/libc.so.6,haswell/libm.so.6,haswell/libgcc_s.so.1,haswell/libc-2.27.so,haswell/libm-2.27.so} initramfs/lib64/haswell/ +# +#cp -a update/image/$mixversion/full/sbin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/sbin/ +#cp -a update/image/$mixversion/full/bin/{bash,sh,coreutils,mkdir,mount,veritysetup} initramfs/bin/ diff --git a/verified-boot/initramfs/bin/ash b/verified-boot/initramfs/bin/ash new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/ash @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/busybox b/verified-boot/initramfs/bin/busybox new file mode 100755 index 0000000..bbab320 Binary files /dev/null and b/verified-boot/initramfs/bin/busybox differ diff --git a/verified-boot/initramfs/bin/cat b/verified-boot/initramfs/bin/cat new file mode 100755 index 0000000..c38db73 Binary files /dev/null and b/verified-boot/initramfs/bin/cat differ diff --git a/verified-boot/initramfs/bin/findfs b/verified-boot/initramfs/bin/findfs new file mode 100755 index 0000000..3459931 Binary files /dev/null and b/verified-boot/initramfs/bin/findfs differ diff --git a/verified-boot/initramfs/bin/ifconfig b/verified-boot/initramfs/bin/ifconfig new file mode 120000 index 0000000..7125971 --- /dev/null +++ b/verified-boot/initramfs/bin/ifconfig @@ -0,0 +1 @@ +../bin/busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/ls b/verified-boot/initramfs/bin/ls new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/ls @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/mkdir b/verified-boot/initramfs/bin/mkdir new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/mkdir @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/mount b/verified-boot/initramfs/bin/mount new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/mount @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/mv b/verified-boot/initramfs/bin/mv new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/mv @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/ps b/verified-boot/initramfs/bin/ps new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/ps @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/route b/verified-boot/initramfs/bin/route new file mode 120000 index 0000000..7125971 --- /dev/null +++ b/verified-boot/initramfs/bin/route @@ -0,0 +1 @@ +../bin/busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/sh b/verified-boot/initramfs/bin/sh new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/sh @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/sleep b/verified-boot/initramfs/bin/sleep new file mode 100755 index 0000000..c38db73 Binary files /dev/null and b/verified-boot/initramfs/bin/sleep differ diff --git a/verified-boot/initramfs/bin/switch_root b/verified-boot/initramfs/bin/switch_root new file mode 100755 index 0000000..e4404e4 Binary files /dev/null and b/verified-boot/initramfs/bin/switch_root differ diff --git a/verified-boot/initramfs/bin/udhcpc b/verified-boot/initramfs/bin/udhcpc new file mode 120000 index 0000000..7125971 --- /dev/null +++ b/verified-boot/initramfs/bin/udhcpc @@ -0,0 +1 @@ +../bin/busybox \ No newline at end of file diff --git a/verified-boot/initramfs/bin/umount b/verified-boot/initramfs/bin/umount new file mode 100755 index 0000000..da4c3d7 Binary files /dev/null and b/verified-boot/initramfs/bin/umount differ diff --git a/verified-boot/initramfs/bin/uname b/verified-boot/initramfs/bin/uname new file mode 120000 index 0000000..c3fa810 --- /dev/null +++ b/verified-boot/initramfs/bin/uname @@ -0,0 +1 @@ +busybox \ No newline at end of file diff --git a/verified-boot/initramfs/init b/verified-boot/initramfs/init new file mode 100755 index 0000000..6ed9503 --- /dev/null +++ b/verified-boot/initramfs/init @@ -0,0 +1,36 @@ +#!/bin/busybox sh + +# Mount the /proc and /sys filesystems. +echo "Inside initramfs..." +bin/mount -t proc none /proc +bin/mount -t sysfs none /sys +cat /proc/cmdline + +echo "Mounting devtmpfs..." +bin/mount -t devtmpfs none /dev + +bin/ls /dev/mapper + +# Do your stuff here. +cmdline() { + local value + value=" $(cat /proc/cmdline) " + value="${value##* $1=}" + value="${value%% *}" + [ "$value" != "" ] && echo "$value" +} + +# Mount the dm-verity data partition +#mount -o ro $(findfs $(cmdline root)) /mnt/root +bin/mount /dev/sda3 /mnt/root +#bin/mount /dev/mapper/root /mnt/root/data + +# Clean up. +echo "initramfs clean up tasks..." +umount /proc +umount /sys +umount /dev + +# Boot the real thing. +echo "Executing switch_root..." +exec switch_root /mnt/root /usr/lib/systemd/systemd-bootchart diff --git a/verified-boot/initramfs/lib64/haswell/libc.so.6 b/verified-boot/initramfs/lib64/haswell/libc.so.6 new file mode 100755 index 0000000..8073445 Binary files /dev/null and b/verified-boot/initramfs/lib64/haswell/libc.so.6 differ diff --git a/verified-boot/initramfs/lib64/ld-linux-x86-64.so.2 b/verified-boot/initramfs/lib64/ld-linux-x86-64.so.2 new file mode 100755 index 0000000..131358a Binary files /dev/null and b/verified-boot/initramfs/lib64/ld-linux-x86-64.so.2 differ diff --git a/verified-boot/initramfs/usr/lib64/haswell/libc.so.6 b/verified-boot/initramfs/usr/lib64/haswell/libc.so.6 new file mode 100755 index 0000000..8073445 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/haswell/libc.so.6 differ diff --git a/verified-boot/initramfs/usr/lib64/ld-linux-x86-64.so.2 b/verified-boot/initramfs/usr/lib64/ld-linux-x86-64.so.2 new file mode 100755 index 0000000..131358a Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/ld-linux-x86-64.so.2 differ diff --git a/verified-boot/initramfs/usr/lib64/libacl.so.1 b/verified-boot/initramfs/usr/lib64/libacl.so.1 new file mode 100755 index 0000000..4b44567 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libacl.so.1 differ diff --git a/verified-boot/initramfs/usr/lib64/libattr.so.1 b/verified-boot/initramfs/usr/lib64/libattr.so.1 new file mode 100755 index 0000000..ace0de4 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libattr.so.1 differ diff --git a/verified-boot/initramfs/usr/lib64/libblkid.so.1 b/verified-boot/initramfs/usr/lib64/libblkid.so.1 new file mode 100755 index 0000000..68c571a Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libblkid.so.1 differ diff --git a/verified-boot/initramfs/usr/lib64/libcap.so.2 b/verified-boot/initramfs/usr/lib64/libcap.so.2 new file mode 100755 index 0000000..586f44c Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libcap.so.2 differ diff --git a/verified-boot/initramfs/usr/lib64/libmount.so.1 b/verified-boot/initramfs/usr/lib64/libmount.so.1 new file mode 100755 index 0000000..03d4d41 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libmount.so.1 differ diff --git a/verified-boot/initramfs/usr/lib64/libpthread.so.0 b/verified-boot/initramfs/usr/lib64/libpthread.so.0 new file mode 100755 index 0000000..5196005 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libpthread.so.0 differ diff --git a/verified-boot/initramfs/usr/lib64/librt.so.1 b/verified-boot/initramfs/usr/lib64/librt.so.1 new file mode 100755 index 0000000..741257e Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/librt.so.1 differ diff --git a/verified-boot/initramfs/usr/lib64/libuuid.so.1 b/verified-boot/initramfs/usr/lib64/libuuid.so.1 new file mode 100755 index 0000000..e046c99 Binary files /dev/null and b/verified-boot/initramfs/usr/lib64/libuuid.so.1 differ diff --git a/verified-boot/release-image-config.json b/verified-boot/release-image-config.json index da77088..d9e254d 100644 --- a/verified-boot/release-image-config.json +++ b/verified-boot/release-image-config.json @@ -3,15 +3,18 @@ "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "64M", "type" : "EFI" }, { "disk" : "release.img", "partition" : 2, "size" : "16M", "type" : "swap" }, { "disk" : "release.img", "partition" : 3, "size" : "3G", "type" : "linux" }, - { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" } ], + { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" }, + { "disk" : "release.img", "partition" : 5, "size" : "200M", "type" : "linux" } ], "FilesystemTypes" : [ { "disk" : "release.img", "partition" : 1, "type" : "vfat" }, { "disk" : "release.img", "partition" : 2, "type" : "swap" }, { "disk" : "release.img", "partition" : 3, "type" : "ext4" }, - { "disk" : "release.img", "partition" : 4, "type" : "ext4" } ], + { "disk" : "release.img", "partition" : 4, "type" : "ext4" }, + { "disk" : "release.img", "partition" : 5, "type" : "ext4" } ], "PartitionMountPoints" : [ { "disk" : "release.img", "partition" : 1, "mount" : "/boot" }, { "disk" : "release.img", "partition" : 3, "mount" : "/" }, - { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/hashdev" } ], + { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/datadev" }, + { "disk" : "release.img", "partition" : 5, "mount" : "/mnt/hashdev" } ], "Version": "latest", - "Bundles": ["kernel-native", "os-core-update", "editors", "containers-basic", "network-basic", "openssh-server"] + "Bundles": ["kernel-native", "os-core", "os-core-update", "editors"] }