From bb369f025fc0d2af98f0ecebdc7978f02dd322b7 Mon Sep 17 00:00:00 2001 From: Reagan Lopez Date: Fri, 23 Mar 2018 00:08:24 +0000 Subject: [PATCH] dm-verity on non-rootfs data partition using systemd-veritysetup-generator - Successful --- verified-boot/README | 7 +++++ verified-boot/dm-verity-impl-1.py | 41 ++++++++++++++++++++----- verified-boot/release-image-config.json | 13 +++++--- 3 files changed, 48 insertions(+), 13 deletions(-) diff --git a/verified-boot/README b/verified-boot/README index 73d5c91..30e7f7c 100644 --- a/verified-boot/README +++ b/verified-boot/README @@ -13,3 +13,10 @@ Implementing dm-verity for a non-rootfs data partition in Clear Linux E.g "sudo dd if=release.img of=/dev/sdd bs=4M status=progress" - Boot the target system from the USB stick. + On login, the non-rootfs partition is activated with dm-verity. + "dmsetup table" shows the details of the dm-verity hash table. + "lsblk -f" shows the data and hash partitions. + +- Mount /dev/mapper/root to a mount folder and access the contents of the partition. + E.g. "mount /dev/mapper/root /mnt/datadev/" + "sh /mnt/datadev/file1.sh" diff --git a/verified-boot/dm-verity-impl-1.py b/verified-boot/dm-verity-impl-1.py index 7826760..ada22cb 100644 --- a/verified-boot/dm-verity-impl-1.py +++ b/verified-boot/dm-verity-impl-1.py @@ -17,15 +17,38 @@ except Exception: raise Exception("{0}: {1}".format(cmd, sys.exc_info())) print(dev[len(dev) - 1]) boot_num = 1 -data_num = 3 -hash_num = 4 +rootfs_num = 3 +data_num = 4 +hash_num = 5 boot_dev = dev[0] + "p" + str(boot_num) +rootfs_dev = dev[0] + "p" + str(rootfs_num) data_dev = dev[0] + "p" + str(data_num) hash_dev = dev[0] + "p" + str(hash_num) verity_name = "root" + +print("Creating data files in " + data_dev) subprocess.check_output("rm -rf mnt".split(" ")) subprocess.check_output("mkdir mnt".split(" ")) +subprocess.check_output("mount {0} mnt".format(data_dev).split(" ")) + +subprocess.check_output("touch mnt/file1.sh".split(" ")) +try: + outfile = open('mnt/file1.sh','w') + outfile.write("echo Testing dm-verity data1...") + outfile.close() +except IOError: + print("I/O error") + +subprocess.check_output("touch mnt/file2.sh".split(" ")) +try: + outfile = open('mnt/file2.sh','w') + outfile.write("echo Testing dm-verity data2...") + outfile.close() +except IOError: + print("I/O error") + +subprocess.check_output("umount mnt".split(" ")) cmd = "veritysetup --verbose --data-block-size=1024 --hash-block-size=1024 format {0} {1}".format(data_dev, hash_dev) print("Executing: " + cmd) @@ -33,7 +56,9 @@ try: res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines() except Exception: raise Exception("{0}: {1}".format(cmd, sys.exc_info())) + print(res[len(res) - 1]) + salt_str = res[len(res) - 3] root_hash_str = res[len(res) - 2] print(salt_str) @@ -43,7 +68,10 @@ root_hash = root_hash_str.replace('Root hash: ','') print(salt) print(root_hash) + +kernel_cmdline = "quiet systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) subprocess.check_output("mount {0} mnt".format(boot_dev).split(" ")) + for fname in os.listdir('mnt/loader/entries/'): if (fnmatch.fnmatch(fname, 'Clear-*')): path = "mnt/loader/entries/" + fname @@ -54,12 +82,8 @@ for fname in os.listdir('mnt/loader/entries/'): outfile.close() except IOError: print("I/O error") - content = re.sub(r"root=PARTUUID=", "cryptdevice=UUID=", content) - kernel_cmdline = ":" + verity_name + " quiet" - content = re.sub(r" quiet", kernel_cmdline, content) - kernel_cmdline = "root=/dev/mapper/" + str(verity_name) + " systemd.verity=yes roothash=" + root_hash + " systemd.verity_root_data=/dev/sda" + str(data_num) + " systemd.verity_root_hash=/dev/sda" + str(hash_num) + " rootdelay=10 quiet" + content = re.sub(r"quiet", kernel_cmdline, content) - content = re.sub(r"rw", "ro", content) print(content) try: @@ -68,11 +92,12 @@ for fname in os.listdir('mnt/loader/entries/'): outfile.close() except IOError: print("I/O error") -subprocess.check_output("umount mnt".split(" ")) +subprocess.check_output("umount mnt".split(" ")) subprocess.check_output("rm -rf mnt".split(" ")) cmd = "veritysetup --verbose verify {0} {1} {2}".format(data_dev, hash_dev, root_hash) + print("Executing: " + cmd) try: res = subprocess.check_output(cmd.split(" ")).decode("utf-8").splitlines() diff --git a/verified-boot/release-image-config.json b/verified-boot/release-image-config.json index da77088..52a655f 100644 --- a/verified-boot/release-image-config.json +++ b/verified-boot/release-image-config.json @@ -1,16 +1,19 @@ { "DestinationType" : "virtual", - "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "64M", "type" : "EFI" }, + "PartitionLayout" : [ { "disk" : "release.img", "partition" : 1, "size" : "32M", "type" : "EFI" }, { "disk" : "release.img", "partition" : 2, "size" : "16M", "type" : "swap" }, - { "disk" : "release.img", "partition" : 3, "size" : "3G", "type" : "linux" }, - { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" } ], + { "disk" : "release.img", "partition" : 3, "size" : "6G", "type" : "linux" }, + { "disk" : "release.img", "partition" : 4, "size" : "500M", "type" : "linux" }, + { "disk" : "release.img", "partition" : 5, "size" : "200M", "type" : "linux" } ], "FilesystemTypes" : [ { "disk" : "release.img", "partition" : 1, "type" : "vfat" }, { "disk" : "release.img", "partition" : 2, "type" : "swap" }, { "disk" : "release.img", "partition" : 3, "type" : "ext4" }, - { "disk" : "release.img", "partition" : 4, "type" : "ext4" } ], + { "disk" : "release.img", "partition" : 4, "type" : "ext4" }, + { "disk" : "release.img", "partition" : 5, "type" : "ext4" } ], "PartitionMountPoints" : [ { "disk" : "release.img", "partition" : 1, "mount" : "/boot" }, { "disk" : "release.img", "partition" : 3, "mount" : "/" }, - { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/hashdev" } ], + { "disk" : "release.img", "partition" : 4, "mount" : "/mnt/datadev" }, + { "disk" : "release.img", "partition" : 5, "mount" : "/mnt/hashdev" } ], "Version": "latest", "Bundles": ["kernel-native", "os-core-update", "editors", "containers-basic", "network-basic", "openssh-server"] }