SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

veritysetup-generator: generate service for usr device

Browse Source 
If 'usrhash' is present as a kernel command line parameter, generate a
veritysetup service for usr.
Also recognize systemd.verity_usr_* parameters.
This commit is contained in:
Mark Boudreau
2021-11-19 15:53:36 -05:00
parent 1ccfb792e4
commit 78b408d2d9
1 changed files with 138 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/veritysetup/veritysetup-generator.c
+138 -53
View File
@@ -22,53 +22,69 @@
#include "string-util.h"
#include "unit-name.h"
#define SYSTEMD_VERITYSETUP_SERVICE "systemd-veritysetup@root.service"
#define SYSTEMD_VERITYSETUP_SERVICE_ROOT "systemd-veritysetup@root.service"
#define SYSTEMD_VERITYSETUP_SERVICE_USR "systemd-veritysetup@usr.service"
static const char *arg_dest = NULL;
static bool arg_enabled = true;
static bool arg_read_veritytab = true;
static const char *arg_veritytab = NULL;
static char *arg_root_hash = NULL;
static char *arg_data_what = NULL;
static char *arg_hash_what = NULL;
static char *arg_options = NULL;
static char *arg_root_data_what = NULL;
static char *arg_root_hash_what = NULL;
static char *arg_root_options = NULL;
static char *arg_usr_hash = NULL;
static char *arg_usr_data_what = NULL;
static char *arg_usr_hash_what = NULL;
static char *arg_usr_options = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_root_hash, freep);
STATIC_DESTRUCTOR_REGISTER(arg_data_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_hash_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_options, freep);
STATIC_DESTRUCTOR_REGISTER(arg_root_data_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_root_hash_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_root_options, freep);
STATIC_DESTRUCTOR_REGISTER(arg_usr_hash, freep);
STATIC_DESTRUCTOR_REGISTER(arg_usr_data_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_usr_hash_what, freep);
STATIC_DESTRUCTOR_REGISTER(arg_usr_options, freep);
static int create_device(
const char *name,
const char *service,
const char *hash,
const char *data_what,
const char *hash_what,
const char *options) {
static int create_device(void) {
_cleanup_free_ char *u = NULL, *v = NULL, *d = NULL, *e = NULL, *u_escaped = NULL, *v_escaped = NULL,
*root_hash_escaped = NULL, *options_escaped = NULL;
*hash_escaped = NULL, *options_escaped = NULL;
_cleanup_fclose_ FILE *f = NULL;
const char *to;
const char *to, *from;
int r;
assert(name);
assert(service);
/* If all three pieces of information are missing, then verity is turned off */
if (!arg_root_hash && !arg_data_what && !arg_hash_what)
if (!hash && !data_what && !hash_what)
return 0;
/* if one of them is missing however, the data is simply incomplete and this is an error */
if (!arg_root_hash)
log_error("Verity information incomplete, root hash unspecified.");
if (!arg_data_what)
log_error("Verity information incomplete, root data device unspecified.");
if (!arg_hash_what)
log_error("Verity information incomplete, root hash device unspecified.");
if (!hash)
log_error("Verity information for %s incomplete, hash unspecified.", name);
if (!data_what)
log_error("Verity information for %s incomplete, data device unspecified.", name);
if (!hash_what)
log_error("Verity information for %s incomplete, hash device unspecified.", name);
if (!arg_root_hash || !arg_data_what || !arg_hash_what)
if (!hash || !data_what || !hash_what)
return -EINVAL;
log_debug("Using root verity data device %s,\n"
" hash device %s,\n"
" options %s,\n"
" and root hash %s.", arg_data_what, arg_hash_what, arg_options, arg_root_hash);
log_debug("Using %s verity data device %s, hash device %s, options %s, and hash %s.", name, data_what, hash_what, options, hash);
u = fstab_node_to_udev_node(arg_data_what);
u = fstab_node_to_udev_node(data_what);
if (!u)
return log_oom();
v = fstab_node_to_udev_node(arg_hash_what);
v = fstab_node_to_udev_node(hash_what);
if (!v)
return log_oom();
@@ -86,15 +102,15 @@ static int create_device(void) {
if (r < 0)
return log_error_errno(r, "Failed to generate unit name: %m");
options_escaped = specifier_escape(strempty(arg_options));
options_escaped = specifier_escape(strempty(options));
if (!options_escaped)
return log_oom();
root_hash_escaped = specifier_escape(arg_root_hash);
if (!root_hash_escaped)
hash_escaped = specifier_escape(hash);
if (!hash_escaped)
return log_oom();
r = generator_open_unit_file(arg_dest, NULL, SYSTEMD_VERITYSETUP_SERVICE, &f);
r = generator_open_unit_file(arg_dest, NULL, service, &f);
if (r < 0)
return r;
@@ -112,25 +128,35 @@ static int create_device(void) {
"\n[Service]\n"
"Type=oneshot\n"
"RemainAfterExit=yes\n"
"ExecStart=" ROOTLIBEXECDIR "/systemd-veritysetup attach root '%s' '%s' '%s' '%s'\n"
"ExecStop=" ROOTLIBEXECDIR "/systemd-veritysetup detach root\n",
"ExecStart=" ROOTLIBEXECDIR "/systemd-veritysetup attach '%s' '%s' '%s' '%s' '%s'\n"
"ExecStop=" ROOTLIBEXECDIR "/systemd-veritysetup detach '%s' \n",
d, e,
d, e,
u_escaped, v_escaped, root_hash_escaped, options_escaped);
name, u_escaped, v_escaped, hash_escaped, options_escaped,
name);
r = fflush_and_check(f);
if (r < 0)
return log_error_errno(r, "Failed to write file unit "SYSTEMD_VERITYSETUP_SERVICE": %m");
return log_error_errno(r, "Failed to write file unit %s: %m", service);
to = strjoina(arg_dest, "/veritysetup.target.requires/" SYSTEMD_VERITYSETUP_SERVICE);
to = strjoina(arg_dest, "/veritysetup.target.requires/", service);
from = strjoina("../", service);
(void) mkdir_parents(to, 0755);
if (symlink("../" SYSTEMD_VERITYSETUP_SERVICE, to) < 0)
if (symlink(from, to) < 0)
return log_error_errno(errno, "Failed to create symlink %s: %m", to);
return 0;
}
static int create_root_device(void) {
return create_device("root", SYSTEMD_VERITYSETUP_SERVICE_ROOT, arg_root_hash, arg_root_data_what, arg_root_hash_what, arg_root_options);
}
static int create_usr_device(void) {
return create_device("usr", SYSTEMD_VERITYSETUP_SERVICE_USR, arg_usr_hash, arg_usr_data_what, arg_usr_hash_what, arg_usr_options);
}
static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
int r;
@@ -164,7 +190,7 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_data_what, value);
r = free_and_strdup(&arg_root_data_what, value);
if (r < 0)
return log_oom();
@@ -173,7 +199,7 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_hash_what, value);
r = free_and_strdup(&arg_root_hash_what, value);
if (r < 0)
return log_oom();
@@ -182,7 +208,43 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_options, value);
r = free_and_strdup(&arg_root_options, value);
if (r < 0)
return log_oom();
} else if (proc_cmdline_key_streq(key, "usrhash")) {
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_usr_hash, value);
if (r < 0)
return log_oom();
} else if (proc_cmdline_key_streq(key, "systemd.verity_usr_data")) {
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_usr_data_what, value);
if (r < 0)
return log_oom();
} else if (proc_cmdline_key_streq(key, "systemd.verity_usr_hash")) {
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_usr_hash_what, value);
if (r < 0)
return log_oom();
} else if (proc_cmdline_key_streq(key, "systemd.verity_usr_options")) {
if (proc_cmdline_value_missing(key, value))
return 0;
r = free_and_strdup(&arg_usr_options, value);
if (r < 0)
return log_oom();
@@ -191,47 +253,66 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
return 0;
}
static int determine_devices(void) {
static int determine_device(
const char *name,
const char *hash,
char **data_what,
char **hash_what) {
sd_id128_t data_uuid, verity_uuid;
_cleanup_free_ void *m = NULL;
sd_id128_t root_uuid, verity_uuid;
size_t l;
int r;
/* Try to automatically derive the root data and hash device paths from the root hash */
assert(name);
assert(data_what);
assert(hash_what);
if (!arg_root_hash)
if (!hash)
return 0;
if (arg_data_what && arg_hash_what)
if (*data_what && *hash_what)
return 0;
r = unhexmem(arg_root_hash, strlen(arg_root_hash), &m, &l);
r = unhexmem(hash, strlen(hash), &m, &l);
if (r < 0)
return log_error_errno(r, "Failed to parse root hash: %s", arg_root_hash);
return log_error_errno(r, "Failed to parse hash: %s", hash);
if (l < sizeof(sd_id128_t)) {
log_debug("Root hash is shorter than 128 bits (32 characters), ignoring for discovering verity partition.");
log_debug("Root hash for %s is shorter than 128 bits (32 characters), ignoring for discovering verity partition.", name);
return 0;
}
if (!arg_data_what) {
memcpy(&root_uuid, m, sizeof(root_uuid));
if (!*data_what) {
memcpy(&data_uuid, m, sizeof(data_uuid));
arg_data_what = path_join("/dev/disk/by-partuuid", ID128_TO_UUID_STRING(root_uuid));
if (!arg_data_what)
*data_what = path_join("/dev/disk/by-partuuid", ID128_TO_UUID_STRING(data_uuid));
if (!*data_what)
return log_oom();
}
if (!arg_hash_what) {
if (!*hash_what) {
memcpy(&verity_uuid, (uint8_t*) m + l - sizeof(verity_uuid), sizeof(verity_uuid));
arg_hash_what = path_join("/dev/disk/by-partuuid", ID128_TO_UUID_STRING(verity_uuid));
if (!arg_hash_what)
*hash_what = path_join("/dev/disk/by-partuuid", ID128_TO_UUID_STRING(verity_uuid));
if (!*hash_what)
return log_oom();
}
log_info("Using data device %s and hash device %s for %s.", *data_what, *hash_what, name);
return 1;
}
static int determine_devices(void) {
int r;
r = determine_device("root", arg_root_hash, &arg_root_data_what, &arg_root_hash_what);
if (r < 0)
return r;
return determine_device("usr", arg_usr_hash, &arg_usr_data_what, &arg_usr_hash_what);
}
static int create_disk(
const char *name,
const char *data_device,
@@ -446,7 +527,11 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
if (r < 0)
return r;
return create_device();
r = create_root_device();
if (r < 0)
return r;
return create_usr_device();
}
DEFINE_MAIN_GENERATOR_FUNCTION(run);