mirrors/meta-secure-core
1
0
Fork 0
mirror of https://github.com/jiazhang0/meta-secure-core.git synced 2026-07-16 20:56:58 +00:00
Code Issues Projects Releases Wiki Activity

changed init file from the secure-core-image-initramfs to not load an unencrypted rootfs when using full disk encryption.

Browse Source
This commit is contained in:
richard
2020-06-11 14:52:22 +00:00
committed by Jia Zhang
parent 2bd48852e2
commit ca4ead2536
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/initrdscripts/files/init
+11 -7
View File
@@ -4,6 +4,8 @@ PATH="/sbin:/bin:/usr/sbin:/usr/bin"
ROOTFS_MOUNT="/rootfs" ROOTFS_MOUNT="/rootfs"
INIT="/sbin/init" INIT="/sbin/init"
is_encrypted=0
mount -t proc none /proc mount -t proc none /proc
mount -t sysfs none /sys mount -t sysfs none /sys
mount -t devtmpfs none /dev mount -t devtmpfs none /dev
@@ -33,12 +35,14 @@ mkdir -p "$ROOTFS_MOUNT"
try_to_mount_rootfs() { try_to_mount_rootfs() {
local mount_flags="rw,noatime,iversion" local mount_flags="rw,noatime,iversion"
mount -o "$mount_flags" "$ROOTFS_DEV" "$ROOTFS_MOUNT" \ if [ $is_encrypted -eq 1 ] ; then
2>/dev/null && return 0 [ -x /init.cryptfs ] &&
/init.cryptfs "$ROOTFS_MOUNT" "$ROOTFS_DEV" \
[ -x /init.cryptfs ] && "$mount_flags" && return 0
/init.cryptfs "$ROOTFS_MOUNT" "$ROOTFS_DEV" \ else
"$mount_flags" && return 0 mount -o "$mount_flags" "$ROOTFS_DEV" "$ROOTFS_MOUNT" \
2>/dev/null && return 0
fi
return 1 return 1
} }
@@ -76,4 +80,4 @@ exec "$switch_root" "$ROOTFS_MOUNT" "$INIT" || {
"$ROOTFS_MOUNT/bin/echo.coreutils" "Couldn't switch to the real rootfs" "$ROOTFS_MOUNT/bin/echo.coreutils" "Couldn't switch to the real rootfs"
# Cause kernel panic. # Cause kernel panic.
exit 2 exit 2
} }
meta/recipes-core/initrdscripts/initrdscripts-secure-core.bb
+4
View File
@@ -11,6 +11,10 @@ SRC_URI = "\
do_install() { do_install() {
install -m 0755 "${WORKDIR}/init" "${D}/init" install -m 0755 "${WORKDIR}/init" "${D}/init"
if [ "${FULL_DISK_ENCRYPTION}" = "1" ] && [ ${@bb.utils.contains("DISTRO_FEATURES", "luks", 'true', '', d)} ]; then
sed -i '0,/is_encrypted=0/s//is_encrypted=1/' ${D}/init
fi
# Create device nodes expected by kernel in initramfs # Create device nodes expected by kernel in initramfs
# before executing /init. # before executing /init.
install -d "${D}/dev" install -d "${D}/dev"