SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dissect: Accept signature for usr+usr-verity+usr-verity-sig images

Browse Source 
An image with usr+usr-verity+usr-verity-sig without sidecar files would not be
detected as signed because it would looke for root-verity-sig instead. Because
dissect was not able to detect it, it also made /usr sysexts using an usr
partition to not be mounted with verity.
This commit is contained in:
Valentin David
2023-09-20 10:21:56 +01:00
committed by Luca Boccassi
parent 6d2d38e76f
commit 01086e76f2
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/dissect-image.c
+11 -3
View File
@@ -1442,8 +1442,11 @@ static int dissect_image(
if (verity->designator >= 0 && !m->partitions[verity->designator].found)
return -EADDRNOTAVAIL;
bool have_verity_sig_partition =
m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR_VERITY_SIG : PARTITION_ROOT_VERITY_SIG].found;
bool have_verity_sig_partition;
if (verity->designator >= 0)
have_verity_sig_partition = m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR_VERITY_SIG : PARTITION_ROOT_VERITY_SIG].found;
else
have_verity_sig_partition = m->partitions[PARTITION_USR_VERITY_SIG].found || m->partitions[PARTITION_ROOT_VERITY_SIG].found;
if (verity->root_hash) {
/* If we have an explicit root hash and found the partitions for it, then we are ready to use
@@ -1475,7 +1478,12 @@ static int dissect_image(
/* If we found an embedded signature partition, we are ready, too. */
m->verity_ready = m->verity_sig_ready = true;
m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR : PARTITION_ROOT].rw = false;
if (verity->designator >= 0)
m->partitions[verity->designator == PARTITION_USR ? PARTITION_USR : PARTITION_ROOT].rw = false;
else if (m->partitions[PARTITION_USR_VERITY_SIG].found)
m->partitions[PARTITION_USR].rw = false;
else if (m->partitions[PARTITION_ROOT_VERITY_SIG].found)
m->partitions[PARTITION_ROOT].rw = false;
}
}