dm-verity on non-rootfs data partition using systemd-veritysetup-generator

- Successful

verified-boot/README

@@ -13,3 +13,10 @@ Implementing dm-verity for a non-rootfs data partition in Clear Linux
   E.g "sudo dd if=release.img of=/dev/sdd bs=4M status=progress"
 
 - Boot the target system from the USB stick.
+  On login, the non-rootfs partition is activated with dm-verity.
+  "dmsetup table" shows the details of the dm-verity hash table.
+  "lsblk -f" shows the data and hash partitions.
+
+- Mount /dev/mapper/root to a mount folder and access the contents of the partition.
+  E.g. "mount /dev/mapper/root /mnt/datadev/"
+       "sh /mnt/datadev/file1.sh"

verified-boot/dm-verity-impl-1.py

@@ -17,15 +17,38 @@ except Exception:
     raise Exception("{0}: {1}".format(cmd, sys.exc_info()))
 print(dev[len(dev) - 1])
 boot_num = 1
-data_num = 3
-hash_num = 4
+rootfs_num = 3
+data_num = 4
+hash_num = 5
 
 boot_dev = dev[0] + "p" + str(boot_num)
+rootfs_dev = dev[0] + "p" + str(rootfs_num)
 data_dev = dev[0] + "p" + str(data_num)
 hash_dev = dev[0] + "p" + str(hash_num)
 verity_name = "root"
+
+print("Creating data files in " + data_dev)
 subprocess.check_output("rm -rf mnt".split(" "))
 subprocess.check_output("mkdir mnt".split(" "))
+subprocess.check_output("mount {0} mnt".format(data_dev).split(" "))
+
+subprocess.check_output("touch mnt/file1.sh".split(" "))
+try:
+    outfile = open('mnt/file1.sh','w')
+    outfile.write("echo Testing dm-verity data1...")
+    outfile.close()
+except IOError:
+    print("I/O error")
+
+subprocess.check_output("touch mnt/file2.sh".split(" "))
+try:
+    outfile = open('mnt/file2.sh','w')
+    outfile.write("echo Testing dm-verity data2...")
+    outfile.close()
+except IOError:
+    print("I/O error")
+
+subprocess.check_output("umount mnt".split(" "))
 
 cmd = "veritysetup --verbose --data-block-size=1024 --hash-block-size=1024 format {0} {1}".format(data_dev, hash_dev)
 print("Executing: " + cmd)
@@ -33,7 +56,9 @@ try:
     res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines()
 except Exception:
     raise Exception("{0}: {1}".format(cmd, sys.exc_info()))
+
 print(res[len(res) - 1])
+
 salt_str = res[len(res) - 3]
 root_hash_str = res[len(res) - 2]
 print(salt_str)
@@ -43,7 +68,10 @@ root_hash = root_hash_str.replace('Root hash:      	','')
 print(salt)
 print(root_hash)
 
+
+kernel_cmdline = "quiet systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num)
 subprocess.check_output("mount {0} mnt".format(boot_dev).split(" "))
+
 for fname in os.listdir('mnt/loader/entries/'):
     if (fnmatch.fnmatch(fname, 'Clear-*')):
         path = "mnt/loader/entries/" + fname
@@ -54,12 +82,8 @@ for fname in os.listdir('mnt/loader/entries/'):
             outfile.close()
         except IOError:
             print("I/O error")
-        content = re.sub(r"root=PARTUUID=", "cryptdevice=UUID=", content)
-        kernel_cmdline = ":" + verity_name + " quiet"
-        content = re.sub(r" quiet", kernel_cmdline, content)
-        kernel_cmdline = "root=/dev/mapper/" + str(verity_name) + " systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) + " rootdelay=10 quiet"
+
         content = re.sub(r"quiet", kernel_cmdline, content)
-        content = re.sub(r"rw", "ro", content)
         print(content)
 
         try:
@@ -68,11 +92,12 @@ for fname in os.listdir('mnt/loader/entries/'):
             outfile.close()
         except IOError:
             print("I/O error")
-subprocess.check_output("umount mnt".split(" "))
 
+subprocess.check_output("umount mnt".split(" "))
 subprocess.check_output("rm -rf mnt".split(" "))
 
 cmd = "veritysetup --verbose verify {0} {1} {2}".format(data_dev, hash_dev, root_hash)
+
 print("Executing: " + cmd)
 try:
    res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines()

verified-boot/release-image-config.json

@@ -1,16 +1,19 @@
 {
     "DestinationType" : "virtual",
-    "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "64M", "type" : "EFI" },
+    "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "32M", "type" : "EFI" },
                           { "disk" : "release.img", "partition" : 2, "size" : "16M", "type" : "swap" },
-                          { "disk" : "release.img", "partition" : 3, "size" : "3G", "type" : "linux" },
-			  { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" } ],
+                          { "disk" : "release.img", "partition" : 3, "size" : "6G", "type" : "linux" },
+			  { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" },
+                          { "disk" : "release.img", "partition" : 5, "size" : "200M", "type" : "linux" } ],
     "FilesystemTypes" : [ { "disk" : "release.img", "partition" : 1, "type" : "vfat" },
                           { "disk" : "release.img", "partition" : 2, "type" : "swap" },
                           { "disk" : "release.img", "partition" : 3, "type" : "ext4" },
-                          { "disk" : "release.img", "partition" : 4, "type" : "ext4" } ],
+                          { "disk" : "release.img", "partition" : 4, "type" : "ext4" },
+                          { "disk" : "release.img", "partition" : 5, "type" : "ext4" } ],
     "PartitionMountPoints" : [ { "disk" : "release.img", "partition" : 1, "mount" : "/boot" },
                                { "disk" : "release.img", "partition" : 3, "mount" : "/" },
-                               { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/hashdev" } ],
+                               { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/datadev" },
+                               { "disk" : "release.img", "partition" : 5, "mount" : "/mnt/hashdev" } ],
     "Version": "latest",
     "Bundles": ["kernel-native", "os-core-update", "editors", "containers-basic", "network-basic", "openssh-server"]
 }