mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-01-12 03:10:13 +00:00
Code Issues Projects Releases Wiki Activity

dm-verity-image-initramfs: Use initramfs-framework

Browse Source 
Switch from this layer's initramfs-dm-verity recipe to poky-provided
initramfs-framework suite to manage veritysetup et al.

This commit also removes initramfs-dm-verity recipe which is not
referred from elsewhere in this meta layer.

Also update the install path of dm-verity.env from /usr/share to
/usr/share/misc in order to better comply with FHS3.0, see
https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
niko.mauno@vaisala.com
2020-09-10 16:17:55 +00:00
committed by Armin Kuster
parent 489f7c900c
commit 45e8b20cd0
3 changed files with 3 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
recipes-core/images/dm-verity-image-initramfs.bb
View File

@@ -4,7 +4,8 @@ DESCRIPTION = "Simple initramfs image for mounting the rootfs over the verity de
IMAGE_FEATURES = ""
PACKAGE_INSTALL = " \
initramfs-dm-verity \
initramfs-module-dmverity \
initramfs-module-udev \
base-files \
busybox \
util-linux-mount \
@@ -24,6 +25,6 @@ IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
inherit core-image
deploy_verity_hash() {
install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/dm-verity.env
install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
}
IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"

13
recipes-core/initrdscripts/initramfs-dm-verity.bb
View File

@@ -1,13 +0,0 @@
SUMMARY = "Simple init script that uses devmapper to mount the rootfs in read-only mode protected by dm-verity"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
SRC_URI = "file://init-dm-verity.sh"
do_install() {
install -m 0755 ${WORKDIR}/init-dm-verity.sh ${D}/init
install -d ${D}/dev
mknod -m 622 ${D}/dev/console c 5 1
}
FILES_${PN} = "/init /dev/console"

46
recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh
View File

@@ -1,46 +0,0 @@
#!/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin
RDEV=""
ROOT_DIR="/new_root"
mkdir -p /proc
mkdir -p /sys
mkdir -p /run
mkdir -p /tmp
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs none /dev
udevd --daemon
udevadm trigger --type=subsystems --action=add
udevadm trigger --type=devices --action=add
udevadm settle --timeout=10
for PARAM in $(cat /proc/cmdline); do
case $PARAM in
root=*)
RDEV=${PARAM#root=}
;;
esac
done
if ! [ -b $RDEV ]; then
echo "Missing root command line argument!"
exit 1
fi
case $RDEV in
UUID=*)
RDEV=$(realpath /dev/disk/by-uuid/${RDEV#UUID=})
;;
esac
. /usr/share/dm-verity.env
echo "Mounting $RDEV over dm-verity as the root filesystem"
veritysetup --data-block-size=1024 --hash-offset=$DATA_SIZE create rootfs $RDEV $RDEV $ROOT_HASH
mkdir -p $ROOT_DIR
mount -o ro /dev/mapper/rootfs $ROOT_DIR
exec switch_root $ROOT_DIR /sbin/init