From 8a66ad0c66f6912e81d400f4c19baaa0821b190f Mon Sep 17 00:00:00 2001 From: Chris Down Date: Thu, 19 Mar 2026 21:01:54 +0800 Subject: [PATCH 1/4] dissect-image: Fix wrong UUID logged on usr verity partition mismatch When there's a partition mismatch the USR_VERITY branch logs usr_uuid in the mismatch message, but the check is actually against usr_verity_uuid. --- src/shared/dissect-image.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index fa38688411..f81d1f8bec 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -1488,7 +1488,7 @@ static int dissect_image( if (!sd_id128_is_null(usr_verity_uuid) && !sd_id128_equal(usr_verity_uuid, id)) { log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from usr verity hash, ignoring.", SD_ID128_TO_UUID_STRING(id), - SD_ID128_TO_UUID_STRING(usr_uuid)); + SD_ID128_TO_UUID_STRING(usr_verity_uuid)); continue; } From 779e70a8e8f1ef7ae21df39f81eb762e89012478 Mon Sep 17 00:00:00 2001 From: Chris Down Date: Thu, 19 Mar 2026 21:10:21 +0800 Subject: [PATCH 2/4] dissect-image: Merge partition handler code dissect-image has six(!) different branches with basically the same code. Let's avoid that and reduce the spaces for bugs or differing behaviour to subtly creep in. --- src/shared/dissect-image.c | 92 ++++++-------------------------------- 1 file changed, 14 insertions(+), 78 deletions(-) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index f81d1f8bec..f4d45cfd20 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -1395,41 +1395,43 @@ static int dissect_image( if (!fstype) fstype = "vfat"; - } else if (type.designator == PARTITION_ROOT) { + } else if (IN_SET(type.designator, PARTITION_ROOT, PARTITION_USR)) { + sd_id128_t expected_uuid = type.designator == PARTITION_ROOT ? root_uuid : usr_uuid; check_partition_flags(node, pflags, SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS); - /* If a root ID is specified, ignore everything but the root id */ - if (!sd_id128_is_null(root_uuid) && !sd_id128_equal(root_uuid, id)) { - log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from root verity hash, ignoring.", + if (!sd_id128_is_null(expected_uuid) && !sd_id128_equal(expected_uuid, id)) { + log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from %s verity hash, ignoring.", SD_ID128_TO_UUID_STRING(id), - SD_ID128_TO_UUID_STRING(root_uuid)); + SD_ID128_TO_UUID_STRING(expected_uuid), + partition_designator_to_string(type.designator)); continue; } rw = !(pflags & SD_GPT_FLAG_READ_ONLY); growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS); - } else if (type.designator == PARTITION_ROOT_VERITY) { + } else if (IN_SET(type.designator, PARTITION_ROOT_VERITY, PARTITION_USR_VERITY)) { + sd_id128_t expected_uuid = type.designator == PARTITION_ROOT_VERITY ? root_verity_uuid : usr_verity_uuid; check_partition_flags(node, pflags, SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY); m->has_verity = true; - /* If root hash is specified, then ignore everything but the root id */ - if (!sd_id128_is_null(root_verity_uuid) && !sd_id128_equal(root_verity_uuid, id)) { - log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from root verity hash, ignoring.", + if (!sd_id128_is_null(expected_uuid) && !sd_id128_equal(expected_uuid, id)) { + log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from %s verity hash, ignoring.", SD_ID128_TO_UUID_STRING(id), - SD_ID128_TO_UUID_STRING(root_verity_uuid)); + SD_ID128_TO_UUID_STRING(expected_uuid), + partition_designator_to_string(partition_verity_to_data(type.designator))); continue; } fstype = "DM_verity_hash"; rw = false; - } else if (type.designator == PARTITION_ROOT_VERITY_SIG) { + } else if (IN_SET(type.designator, PARTITION_ROOT_VERITY_SIG, PARTITION_USR_VERITY_SIG)) { if (verity && iovec_is_set(&verity->root_hash)) { _cleanup_(iovec_done) struct iovec root_hash = {}; @@ -1448,73 +1450,7 @@ static int dissect_image( found = hexmem(root_hash.iov_base, root_hash.iov_len); expected = hexmem(verity->root_hash.iov_base, verity->root_hash.iov_len); - log_debug("Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(found), strna(expected)); - } - continue; - } - } - - check_partition_flags(node, pflags, - SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY); - - m->has_verity_sig = true; - fstype = "verity_hash_signature"; - rw = false; - - } else if (type.designator == PARTITION_USR) { - - check_partition_flags(node, pflags, - SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY | SD_GPT_FLAG_GROWFS); - - /* If a usr ID is specified, ignore everything but the usr id */ - if (!sd_id128_is_null(usr_uuid) && !sd_id128_equal(usr_uuid, id)) { - log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from usr verity hash, ignoring.", - SD_ID128_TO_UUID_STRING(id), - SD_ID128_TO_UUID_STRING(usr_uuid)); - continue; - } - - rw = !(pflags & SD_GPT_FLAG_READ_ONLY); - growfs = FLAGS_SET(pflags, SD_GPT_FLAG_GROWFS); - - } else if (type.designator == PARTITION_USR_VERITY) { - - check_partition_flags(node, pflags, - SD_GPT_FLAG_NO_AUTO | SD_GPT_FLAG_READ_ONLY); - - m->has_verity = true; - - /* If usr hash is specified, then ignore everything but the usr id */ - if (!sd_id128_is_null(usr_verity_uuid) && !sd_id128_equal(usr_verity_uuid, id)) { - log_debug("Partition UUID '%s' does not match expected UUID '%s' derived from usr verity hash, ignoring.", - SD_ID128_TO_UUID_STRING(id), - SD_ID128_TO_UUID_STRING(usr_verity_uuid)); - continue; - } - - fstype = "DM_verity_hash"; - rw = false; - - } else if (type.designator == PARTITION_USR_VERITY_SIG) { - if (verity && iovec_is_set(&verity->root_hash)) { - _cleanup_(iovec_done) struct iovec root_hash = {}; - - r = acquire_sig_for_roothash( - fd, - start * 512, - size * 512, - &root_hash, - /* ret_root_hash_sig= */ NULL); - if (r < 0) - return r; - if (iovec_memcmp(&verity->root_hash, &root_hash) != 0) { - if (DEBUG_LOGGING) { - _cleanup_free_ char *found = NULL, *expected = NULL; - - found = hexmem(root_hash.iov_base, root_hash.iov_len); - expected = hexmem(verity->root_hash.iov_base, verity->root_hash.iov_len); - - log_debug("Root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(found), strna(expected)); + log_debug("Verity root hash in signature JSON data (%s) doesn't match configured hash (%s).", strna(found), strna(expected)); } continue; } From 91578e529395a0299a1e5eaa6da08e73db6eeacd Mon Sep 17 00:00:00 2001 From: Chris Down Date: Thu, 19 Mar 2026 21:15:44 +0800 Subject: [PATCH 3/4] dissect-image: Consolidate verity validation and setup The verity consistency checks and verity setup code also have parallel blocks for root and usr that do basically identical work. Let's consolidate them and reduce the footprint for bugs or deviance to manifest. --- src/shared/dissect-image.c | 78 ++++++++++++++++---------------------- 1 file changed, 32 insertions(+), 46 deletions(-) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index f4d45cfd20..d68ea0bc97 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -1698,31 +1698,25 @@ static int dissect_image( } } - /* Verity found but no matching rootfs? Something is off, refuse. */ - if (!m->partitions[PARTITION_ROOT].found && - (m->partitions[PARTITION_ROOT_VERITY].found || - m->partitions[PARTITION_ROOT_VERITY_SIG].found)) + /* Verity found but no matching data partition? Something is off, refuse. */ + FOREACH_ELEMENT(dd, ((const PartitionDesignator[]) { PARTITION_ROOT, PARTITION_USR })) { + PartitionDesignator dv = partition_verity_hash_of(*dd); + PartitionDesignator ds = partition_verity_sig_of(*dd); + + if (!m->partitions[*dd].found && (m->partitions[dv].found || m->partitions[ds].found)) return log_debug_errno( SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Found root verity hash partition without matching root data partition."); + "Found %s verity hash partition without matching %s data partition.", + partition_designator_to_string(*dd), + partition_designator_to_string(*dd)); - /* Hmm, we found a signature partition but no Verity data? Something is off. */ - if (m->partitions[PARTITION_ROOT_VERITY_SIG].found && !m->partitions[PARTITION_ROOT_VERITY].found) - return log_debug_errno(SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Found root verity signature partition without matching root verity hash partition."); - - /* as above */ - if (!m->partitions[PARTITION_USR].found && - (m->partitions[PARTITION_USR_VERITY].found || - m->partitions[PARTITION_USR_VERITY_SIG].found)) + if (m->partitions[ds].found && !m->partitions[dv].found) return log_debug_errno( SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Found usr verity hash partition without matching usr data partition."); - - /* as above */ - if (m->partitions[PARTITION_USR_VERITY_SIG].found && !m->partitions[PARTITION_USR_VERITY].found) - return log_debug_errno(SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Found usr verity signature partition without matching usr verity hash partition."); + "Found %s verity signature partition without matching %s verity hash partition.", + partition_designator_to_string(*dd), + partition_designator_to_string(*dd)); + } /* If root and /usr are combined then insist that the architecture matches */ if (m->partitions[PARTITION_ROOT].found && @@ -1827,35 +1821,27 @@ static int dissect_image( /* If we have an explicit root hash and found the partitions for it, then we are ready to use * Verity, set things up for it */ - if (verity->designator < 0 || verity->designator == PARTITION_ROOT) { - if (!m->partitions[PARTITION_ROOT].found) - return log_debug_errno( - SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Verity enabled root partition was requested but did not find a root data partition."); + PartitionDesignator d = verity->designator < 0 || verity->designator == PARTITION_ROOT + ? PARTITION_ROOT : PARTITION_USR; + PartitionDesignator dv = partition_verity_hash_of(d); + assert(dv >= 0); - if (!m->partitions[PARTITION_ROOT_VERITY].found) - return log_debug_errno( - SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Verity enabled root partition was requested but did not find a root verity hash partition."); + if (!m->partitions[d].found) + return log_debug_errno( + SYNTHETIC_ERRNO(EADDRNOTAVAIL), + "Verity enabled %s partition was requested but did not find a %s data partition.", + partition_designator_to_string(d), + partition_designator_to_string(d)); - /* If we found a verity setup, then the root partition is necessarily read-only. */ - m->partitions[PARTITION_ROOT].rw = false; - } else { - assert(verity->designator == PARTITION_USR); + if (!m->partitions[dv].found) + return log_debug_errno( + SYNTHETIC_ERRNO(EADDRNOTAVAIL), + "Verity enabled %s partition was requested but did not find a %s verity hash partition.", + partition_designator_to_string(d), + partition_designator_to_string(d)); - if (!m->partitions[PARTITION_USR].found) - return log_debug_errno( - SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Verity enabled usr partition was requested but did not find a usr data partition."); - - if (!m->partitions[PARTITION_USR_VERITY].found) - return log_debug_errno( - SYNTHETIC_ERRNO(EADDRNOTAVAIL), - "Verity enabled usr partition was requested but did not find a usr verity hash partition."); - - - m->partitions[PARTITION_USR].rw = false; - } + /* If we found a verity setup, then the data partition is necessarily read-only. */ + m->partitions[d].rw = false; m->verity_ready = true; From 15a2fdcd961a5c34e94a33b20540868c143dfd3a Mon Sep 17 00:00:00 2001 From: Chris Down Date: Thu, 19 Mar 2026 21:35:46 +0800 Subject: [PATCH 4/4] dissect-image: Add usr verity partition coverage --- test/units/TEST-50-DISSECT.dissect.sh | 22 +++++++++ test/units/TEST-50-DISSECT.sh | 69 +++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) diff --git a/test/units/TEST-50-DISSECT.dissect.sh b/test/units/TEST-50-DISSECT.dissect.sh index f87bda82ce..d82f8c40fd 100755 --- a/test/units/TEST-50-DISSECT.dissect.sh +++ b/test/units/TEST-50-DISSECT.dissect.sh @@ -160,6 +160,8 @@ mv "$MINIMAL_IMAGE.foohash" "$MINIMAL_IMAGE.roothash" # Derive partition UUIDs from root hash, in UUID syntax ROOT_UUID="$(systemd-id128 -u show "$(head -c 32 "$MINIMAL_IMAGE.roothash")" -u | tail -n 1 | cut -b 6-)" VERITY_UUID="$(systemd-id128 -u show "$(tail -c 32 "$MINIMAL_IMAGE.roothash")" -u | tail -n 1 | cut -b 6-)" +USR_UUID="$ROOT_UUID" +USR_VERITY_UUID="$VERITY_UUID" systemd-dissect --json=short \ --root-hash "$MINIMAL_IMAGE_ROOTHASH" \ @@ -177,6 +179,20 @@ if [[ -n "${OPENSSL_CONFIG:-}" ]]; then fi systemd-dissect --root-hash "$MINIMAL_IMAGE_ROOTHASH" "$MINIMAL_IMAGE.gpt" | grep -F "MARKER=1" >/dev/null systemd-dissect --root-hash "$MINIMAL_IMAGE_ROOTHASH" "$MINIMAL_IMAGE.gpt" | grep -F -f <(sed 's/"//g' "$OS_RELEASE") >/dev/null +systemd-dissect --json=short \ + --usr-hash "$MINIMAL_IMAGE_ROOTHASH" \ + "$MINIMAL_IMAGE.usr.gpt" | \ + grep '{"rw":"ro","designator":"usr","partition_uuid":"'"$USR_UUID"'","partition_label":"Usr Partition","fstype":"squashfs","architecture":"'"$ARCHITECTURE"'","verity":"signed",' >/dev/null +systemd-dissect --json=short \ + --usr-hash "$MINIMAL_IMAGE_ROOTHASH" \ + "$MINIMAL_IMAGE.usr.gpt" | \ + grep '{"rw":"ro","designator":"usr-verity","partition_uuid":"'"$USR_VERITY_UUID"'","partition_label":"Usr Verity Partition","fstype":"DM_verity_hash","architecture":"'"$ARCHITECTURE"'","verity":null,' >/dev/null +if [[ -n "${OPENSSL_CONFIG:-}" ]]; then + systemd-dissect --json=short \ + --usr-hash "$MINIMAL_IMAGE_ROOTHASH" \ + "$MINIMAL_IMAGE.usr.gpt" | \ + grep -E '{"rw":"ro","designator":"usr-verity-sig","partition_uuid":"'".*"'","partition_label":"Usr Signature Partition","fstype":"verity_hash_signature","architecture":"'"$ARCHITECTURE"'","verity":null,' >/dev/null +fi # Test image policies systemd-dissect --validate "$MINIMAL_IMAGE.gpt" @@ -194,6 +210,12 @@ systemd-dissect --validate "$MINIMAL_IMAGE.gpt" --image-policy=root=verity:swap= systemd-dissect --validate "$MINIMAL_IMAGE.gpt" --image-policy=root=signed (! systemd-dissect --validate "$MINIMAL_IMAGE.gpt" --image-policy=root=signed:root-verity-sig=unused+absent) (! systemd-dissect --validate "$MINIMAL_IMAGE.gpt" --image-policy=root=signed:root-verity=unused+absent) +systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=verity +systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=verity:usr-verity-sig=unused+absent +(! systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=verity:usr-verity=unused+absent) +systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=signed +(! systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=signed:usr-verity-sig=unused+absent) +(! systemd-dissect --validate "$MINIMAL_IMAGE.usr.gpt" --image-policy=usr=signed:usr-verity=unused+absent) # Test RootImagePolicy= unit file setting systemd-run --wait -P \ diff --git a/test/units/TEST-50-DISSECT.sh b/test/units/TEST-50-DISSECT.sh index 99e4991402..973f184837 100755 --- a/test/units/TEST-50-DISSECT.sh +++ b/test/units/TEST-50-DISSECT.sh @@ -55,6 +55,9 @@ export OPENSSL_CONFIG export OS_RELEASE export ROOT_GUID export SIGNATURE_GUID +export USR_GUID +export USR_SIGNATURE_GUID +export USR_VERITY_GUID export VERITY_GUID machine="$(uname -m)" @@ -62,51 +65,81 @@ if [[ "$machine" == "x86_64" ]]; then ROOT_GUID=4f68bce3-e8cd-4db1-96e7-fbcaf984b709 VERITY_GUID=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5 SIGNATURE_GUID=41092b05-9fc8-4523-994f-2def0408b176 + USR_GUID=8484680c-9521-48c6-9c11-b0720656f69e + USR_VERITY_GUID=77ff5f63-e7b6-4633-acf4-1565b864c0e6 + USR_SIGNATURE_GUID=e7bb33fb-06cf-4e81-8273-e543b413e2e2 ARCHITECTURE="x86-64" elif [[ "$machine" =~ ^(i386|i686|x86)$ ]]; then ROOT_GUID=44479540-f297-41b2-9af7-d131d5f0458a VERITY_GUID=d13c5d3b-b5d1-422a-b29f-9454fdc89d76 SIGNATURE_GUID=5996fc05-109c-48de-808b-23fa0830b676 + USR_GUID=75250d76-8cc6-458e-bd66-bd47cc81a812 + USR_VERITY_GUID=8f461b0d-14ee-4e81-9aa9-049b6fb97abd + USR_SIGNATURE_GUID=974a71c0-de41-43c3-be5d-5c5ccd1ad2c0 ARCHITECTURE="x86" elif [[ "$machine" =~ ^(aarch64|aarch64_be|armv8b|armv8l)$ ]]; then ROOT_GUID=b921b045-1df0-41c3-af44-4c6f280d3fae VERITY_GUID=df3300ce-d69f-4c92-978c-9bfb0f38d820 SIGNATURE_GUID=6db69de6-29f4-4758-a7a5-962190f00ce3 + USR_GUID=b0e01050-ee5f-4390-949a-9101b17104e9 + USR_VERITY_GUID=6e11a4e7-fbca-4ded-b9e9-e1a512bb664e + USR_SIGNATURE_GUID=c23ce4ff-44bd-4b00-b2d4-b41b3419e02a ARCHITECTURE="arm64" elif [[ "$machine" == "arm" ]]; then ROOT_GUID=69dad710-2ce4-4e3c-b16c-21a1d49abed3 VERITY_GUID=7386cdf2-203c-47a9-a498-f2ecce45a2d6 SIGNATURE_GUID=42b0455f-eb11-491d-98d3-56145ba9d037 + USR_GUID=7d0359a3-02b3-4f0a-865c-654403e70625 + USR_VERITY_GUID=c215d751-7bcd-4649-be90-6627490a4c05 + USR_SIGNATURE_GUID=d7ff812f-37d1-4902-a810-d76ba57b975a ARCHITECTURE="arm" elif [[ "$machine" == "ia64" ]]; then ROOT_GUID=993d8d3d-f80e-4225-855a-9daf8ed7ea97 VERITY_GUID=86ed10d5-b607-45bb-8957-d350f23d0571 SIGNATURE_GUID=e98b36ee-32ba-4882-9b12-0ce14655f46a + USR_GUID=4301d2a6-4e3b-4b2a-bb94-9e0b2c4225ea + USR_VERITY_GUID=6a491e03-3be7-4545-8e38-83320e0ea880 + USR_SIGNATURE_GUID=8de58bc2-2a43-460d-b14e-a76e4a17b47f ARCHITECTURE="ia64" elif [[ "$machine" == "loongarch64" ]]; then ROOT_GUID=77055800-792c-4f94-b39a-98c91b762bb6 VERITY_GUID=f3393b22-e9af-4613-a948-9d3bfbd0c535 SIGNATURE_GUID=5afb67eb-ecc8-4f85-ae8e-ac1e7c50e7d0 + USR_GUID=e611c702-575c-4cbe-9a46-434fa0bf7e3f + USR_VERITY_GUID=f46b2c26-59ae-48f0-9106-c50ed47f673d + USR_SIGNATURE_GUID=b024f315-d330-444c-8461-44bbde524e99 ARCHITECTURE="loongarch64" elif [[ "$machine" == "s390x" ]]; then ROOT_GUID=5eead9a9-fe09-4a1e-a1d7-520d00531306 VERITY_GUID=b325bfbe-c7be-4ab8-8357-139e652d2f6b SIGNATURE_GUID=c80187a5-73a3-491a-901a-017c3fa953e9 + USR_GUID=8a4f5770-50aa-4ed3-874a-99b710db6fea + USR_VERITY_GUID=31741cc4-1a2a-4111-a581-e00b447d2d06 + USR_SIGNATURE_GUID=3f324816-667b-46ae-86ee-9b0c0c6c11b4 ARCHITECTURE="s390x" elif [[ "$machine" == "ppc64le" ]]; then ROOT_GUID=c31c45e6-3f39-412e-80fb-4809c4980599 VERITY_GUID=906bd944-4589-4aae-a4e4-dd983917446a SIGNATURE_GUID=d4a236e7-e873-4c07-bf1d-bf6cf7f1c3c6 + USR_GUID=15bb03af-77e7-4d4a-b12b-c0d084f7491c + USR_VERITY_GUID=ee2b9983-21e8-4153-86d9-b6901a54d1ce + USR_SIGNATURE_GUID=c8bfbd1e-268e-4521-8bba-bf314c399557 ARCHITECTURE="ppc64-le" elif [[ "$machine" == "riscv64" ]]; then ROOT_GUID=72ec70a6-cf74-40e6-bd49-4bda08e8f224 VERITY_GUID=b6ed5582-440b-4209-b8da-5ff7c419ea3d SIGNATURE_GUID=efe0f087-ea8d-4469-821a-4c2a96a8386a + USR_GUID=beaec34b-8442-439b-a40b-984381ed097d + USR_VERITY_GUID=8f1056be-9b05-47c4-81d6-be53128e5b54 + USR_SIGNATURE_GUID=d2f9000a-7a18-453f-b5cd-4d32f77a7b32 ARCHITECTURE="riscv64" elif [[ "$machine" == "riscv32" ]]; then ROOT_GUID=60d5a7fe-8e7d-435c-b714-3dd8162144e1 VERITY_GUID=ae0253be-1167-4007-ac68-43926c14c5de SIGNATURE_GUID=3a112a75-8729-4380-b4cf-764d79934448 + USR_GUID=b933fb22-5c3f-4f91-af90-e2bb0fa50702 + USR_VERITY_GUID=cb1ee4e3-8cd0-4136-a0a4-aa61a32e8730 + USR_SIGNATURE_GUID=c3836a13-3137-45ba-b583-b16c50fe5eb4 ARCHITECTURE="riscv32" else echo "Unexpected uname -m: $machine in TEST-50-DISSECT.sh, please fix me" @@ -197,6 +230,42 @@ udevadm lock --timeout=60 --device="${loop}p3" dd if="$MINIMAL_IMAGE.verity-sig" losetup -d "$loop" udevadm settle --timeout=60 +# Construct the same image with /usr verity partitions to exercise the usr-specific code paths. +usr_size="$(du --apparent-size -k "$MINIMAL_IMAGE.raw" | cut -f1)" +usr_verity_size="$(du --apparent-size -k "$MINIMAL_IMAGE.verity" | cut -f1)" +usr_signature_size=4 +truncate -s $(((8192+usr_size*2+usr_verity_size*2+usr_signature_size*2)*512)) "$MINIMAL_IMAGE.usr.gpt" +if [[ "$usr_size" -ge 1024 ]]; then + usr_size="$((usr_size/1024 + 1))MiB" +else + usr_size="${usr_size}KiB" +fi +usr_verity_size="$((usr_verity_size * 2))KiB" +usr_signature_size="$((usr_signature_size * 2))KiB" +uuid="$(head -c 32 "$MINIMAL_IMAGE.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')" +echo -e "label: gpt\nsize=$usr_size, type=$USR_GUID, uuid=$uuid" | sfdisk "$MINIMAL_IMAGE.usr.gpt" +uuid="$(tail -c 32 "$MINIMAL_IMAGE.roothash" | sed -r 's/(.{8})(.{4})(.{4})(.{4})(.+)/\1-\2-\3-\4-\5/')" +echo -e "size=$usr_verity_size, type=$USR_VERITY_GUID, uuid=$uuid" | sfdisk "$MINIMAL_IMAGE.usr.gpt" --append +echo -e "size=$usr_signature_size, type=$USR_SIGNATURE_GUID" | sfdisk "$MINIMAL_IMAGE.usr.gpt" --append + +sfdisk --part-label "$MINIMAL_IMAGE.usr.gpt" 1 "Usr Partition" +sfdisk --part-label "$MINIMAL_IMAGE.usr.gpt" 2 "Usr Verity Partition" +sfdisk --part-label "$MINIMAL_IMAGE.usr.gpt" 3 "Usr Signature Partition" +loop="$(losetup --show -P -f "$MINIMAL_IMAGE.usr.gpt")" +partitions=( + "${loop:?}p1" + "${loop:?}p2" + "${loop:?}p3" +) +# The kernel sometimes(?) does not emit "add" uevent for loop block partition devices. +# Let's not expect the devices to be initialized. +udevadm wait --timeout=60 --settle --initialized=no "${partitions[@]}" +udevadm lock --timeout=60 --device="${loop}p1" dd if="$MINIMAL_IMAGE.raw" of="${loop}p1" +udevadm lock --timeout=60 --device="${loop}p2" dd if="$MINIMAL_IMAGE.verity" of="${loop}p2" +udevadm lock --timeout=60 --device="${loop}p3" dd if="$MINIMAL_IMAGE.verity-sig" of="${loop}p3" +losetup -d "$loop" +udevadm settle --timeout=60 + : "Run subtests" run_subtests