mirror of
https://github.com/jiazhang0/meta-secure-core.git
synced 2026-07-27 14:28:45 +00:00
@@ -1,89 +1,52 @@
|
|||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
|
|
||||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin"
|
PATH="/sbin:/bin:/usr/sbin:/usr/bin"
|
||||||
|
ROOTFS_MOUNT="/rootfs"
|
||||||
|
INIT="/sbin/init"
|
||||||
|
|
||||||
ROOT_MOUNT="/rootfs"
|
mkdir /proc /sys /run
|
||||||
MOUNT="/bin/mount"
|
mount -t proc none /proc
|
||||||
UMOUNT="/bin/umount"
|
mount -t sysfs none /sys
|
||||||
|
mount -t devtmpfs none /dev
|
||||||
|
mount -t tmpfs none /run
|
||||||
|
|
||||||
# Copied from initramfs-framework. The core of this script probably should be
|
cmdline="`cat /proc/cmdline`"
|
||||||
# turned into initramfs-framework modules to reduce duplication.
|
for arg in $cmdline; do
|
||||||
udev_daemon() {
|
optarg=`expr "x$arg" : 'x[^=]*=\(.*\)'`
|
||||||
PROGS="/sbin/udev/udevd /sbin/udevd /lib/udev/udevd /lib/systemd/systemd-udevd"
|
|
||||||
|
|
||||||
for o in $PROGS; do
|
case "$arg" in
|
||||||
if [ -x "$o" ]; then
|
root=*)
|
||||||
echo "$o"
|
ROOTFS_DEV="$optarg"
|
||||||
return 0
|
;;
|
||||||
fi
|
init=*)
|
||||||
done
|
INIT="$optarg"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
return 1
|
[ -z "$ROOTFS_DEV" ] && {
|
||||||
|
echo "exiting on missing the kernel parameter root= ..."
|
||||||
|
exit 1
|
||||||
}
|
}
|
||||||
|
|
||||||
_UDEV_DAEMON="`udev_daemon`"
|
mkdir -p "$ROOTFS_MOUNT"
|
||||||
|
|
||||||
early_setup() {
|
|
||||||
mount -t proc proc /proc
|
|
||||||
mount -t sysfs sysfs /sys
|
|
||||||
mount -t devtmpfs none /dev
|
|
||||||
mount -t tmpfs none /run
|
|
||||||
|
|
||||||
$_UDEV_DAEMON --daemon
|
|
||||||
udevadm trigger --action=add
|
|
||||||
}
|
|
||||||
|
|
||||||
read_args() {
|
|
||||||
[ -z "$CMDLINE" ] && CMDLINE="`cat /proc/cmdline`"
|
|
||||||
for arg in $CMDLINE; do
|
|
||||||
optarg=`expr "x$arg" : 'x[^=]*=\(.*\)'`
|
|
||||||
case "$arg" in
|
|
||||||
root=*)
|
|
||||||
ROOT_DEVICE="$optarg"
|
|
||||||
;;
|
|
||||||
rootdelay=*)
|
|
||||||
ROOT_DELAY="$optarg"
|
|
||||||
;;
|
|
||||||
init=*)
|
|
||||||
INIT="$optarg"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
fatal() {
|
|
||||||
echo $1 >$CONSOLE
|
|
||||||
echo >$CONSOLE
|
|
||||||
exec sh
|
|
||||||
}
|
|
||||||
|
|
||||||
early_setup
|
|
||||||
|
|
||||||
read_args
|
|
||||||
|
|
||||||
[ -z "$CONSOLE" ] && CONSOLE="/dev/console"
|
|
||||||
[ -z "$INIT" ] && INIT="/sbin/init"
|
|
||||||
|
|
||||||
udevadm settle --timeout=3
|
|
||||||
killall "${_UDEV_DAEMON##*/}" 2>/dev/null
|
|
||||||
|
|
||||||
mkdir -p "$ROOT_MOUNT"
|
|
||||||
|
|
||||||
try_to_mount_rootfs() {
|
try_to_mount_rootfs() {
|
||||||
local mount_flags="rw,noatime,iversion"
|
local mount_flags="rw,noatime,iversion"
|
||||||
|
|
||||||
mount -o "$mount_flags" "$ROOT_DEVICE" "$ROOT_MOUNT" \
|
mount -o "$mount_flags" "$ROOTFS_DEV" "$ROOTFS_MOUNT" \
|
||||||
2>/dev/null && return 0
|
2>/dev/null && return 0
|
||||||
|
|
||||||
[ -x /init.cryptfs ] &&
|
[ -x /init.cryptfs ] &&
|
||||||
/init.cryptfs "$ROOT_MOUNT" "$ROOT_DEVICE" \
|
/init.cryptfs "$ROOTFS_MOUNT" "$ROOTFS_DEV" \
|
||||||
"$mount_flags" OVERCROOTFS && return 0
|
"$mount_flags" OVERCROOTFS && return 0
|
||||||
|
|
||||||
return 1
|
return 1
|
||||||
}
|
}
|
||||||
|
|
||||||
echo "Waiting for root device to be ready..."
|
echo "Waiting for root device to be ready ..."
|
||||||
while [ 1 ] ; do
|
|
||||||
|
while [ 1 ]; do
|
||||||
try_to_mount_rootfs && break
|
try_to_mount_rootfs && break
|
||||||
sleep 0.1
|
sleep 0.1
|
||||||
done
|
done
|
||||||
@@ -91,24 +54,18 @@ done
|
|||||||
# Move the mount points of some filesystems over to
|
# Move the mount points of some filesystems over to
|
||||||
# the corresponding directories under the real root filesystem.
|
# the corresponding directories under the real root filesystem.
|
||||||
for dir in `cat /proc/mounts | grep -v rootfs | awk '{ print $2 }'` ; do
|
for dir in `cat /proc/mounts | grep -v rootfs | awk '{ print $2 }'` ; do
|
||||||
mkdir -p $ROOT_MOUNT/${dir##*/}
|
mkdir -p "$ROOTFS_MOUNT"/${dir##*/}
|
||||||
mount -nv --move "$dir" $ROOT_MOUNT/${dir##*/}
|
mount -nv --move "$dir" "$ROOTFS_MOUNT"/${dir##*/}
|
||||||
done
|
done
|
||||||
|
|
||||||
cd "$ROOT_MOUNT"
|
cd "$ROOTFS_MOUNT"
|
||||||
|
|
||||||
# If we pass args to bash, it will assume they are text files
|
|
||||||
# to source and run.
|
|
||||||
if [ "$INIT" == "/bin/bash" ] || [ "$INIT" == "/bin/sh" ]; then
|
|
||||||
CMDLINE=""
|
|
||||||
fi
|
|
||||||
|
|
||||||
# !!! The Big Fat Warnings !!!
|
# !!! The Big Fat Warnings !!!
|
||||||
#
|
#
|
||||||
# The IMA policy may enforce appraising the executable and verifying the
|
# The IMA policy may enforce appraising the executable and verifying the
|
||||||
# signature stored in xattr. However, ramfs doesn't support xattr, and all
|
# signature stored in xattr. However, ramfs doesn't support xattr, and all
|
||||||
# other initializations must *NOT* be placed after IMA initialization!
|
# other initializations must *NOT* be placed after IMA initialization!
|
||||||
[ -x /init.ima ] && /init.ima "$ROOT_MOUNT" && {
|
[ -x /init.ima ] && /init.ima "$ROOTFS_MOUNT" && {
|
||||||
# switch_root is an exception. We call it in the real rootfs and it
|
# switch_root is an exception. We call it in the real rootfs and it
|
||||||
# should be already signed properly.
|
# should be already signed properly.
|
||||||
switch_root="usr/sbin/switch_root.static"
|
switch_root="usr/sbin/switch_root.static"
|
||||||
@@ -116,5 +73,8 @@ fi
|
|||||||
switch_root="switch_root"
|
switch_root="switch_root"
|
||||||
}
|
}
|
||||||
|
|
||||||
exec "$switch_root" "$ROOT_MOUNT" "$INIT" "$CMDLINE" ||
|
exec "$switch_root" "$ROOTFS_MOUNT" "$INIT" || {
|
||||||
fatal "Couldn't switch_root, dropping to shell"
|
"$ROOTFS_MOUNT/bin/echo.coreutils" "Couldn't switch to the real rootfs"
|
||||||
|
# Cause kernel panic.
|
||||||
|
exit 2
|
||||||
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user