mirror of
https://git.yoctoproject.org/meta-security
synced 2026-04-20 23:40:05 +00:00
dm-verity-image-initramfs: Use initramfs-framework
Switch from this layer's initramfs-dm-verity recipe to poky-provided initramfs-framework suite to manage veritysetup et al. This commit also removes initramfs-dm-verity recipe which is not referred from elsewhere in this meta layer. Also update the install path of dm-verity.env from /usr/share to /usr/share/misc in order to better comply with FHS3.0, see https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
committed by
Armin Kuster
parent
489f7c900c
commit
45e8b20cd0
@@ -4,7 +4,8 @@ DESCRIPTION = "Simple initramfs image for mounting the rootfs over the verity de
|
|||||||
IMAGE_FEATURES = ""
|
IMAGE_FEATURES = ""
|
||||||
|
|
||||||
PACKAGE_INSTALL = " \
|
PACKAGE_INSTALL = " \
|
||||||
initramfs-dm-verity \
|
initramfs-module-dmverity \
|
||||||
|
initramfs-module-udev \
|
||||||
base-files \
|
base-files \
|
||||||
busybox \
|
busybox \
|
||||||
util-linux-mount \
|
util-linux-mount \
|
||||||
@@ -24,6 +25,6 @@ IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
|
|||||||
inherit core-image
|
inherit core-image
|
||||||
|
|
||||||
deploy_verity_hash() {
|
deploy_verity_hash() {
|
||||||
install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/dm-verity.env
|
install -D -m 0644 ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env
|
||||||
}
|
}
|
||||||
IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
|
IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"
|
||||||
|
|||||||
@@ -1,13 +0,0 @@
|
|||||||
SUMMARY = "Simple init script that uses devmapper to mount the rootfs in read-only mode protected by dm-verity"
|
|
||||||
LICENSE = "MIT"
|
|
||||||
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
|
|
||||||
|
|
||||||
SRC_URI = "file://init-dm-verity.sh"
|
|
||||||
|
|
||||||
do_install() {
|
|
||||||
install -m 0755 ${WORKDIR}/init-dm-verity.sh ${D}/init
|
|
||||||
install -d ${D}/dev
|
|
||||||
mknod -m 622 ${D}/dev/console c 5 1
|
|
||||||
}
|
|
||||||
|
|
||||||
FILES_${PN} = "/init /dev/console"
|
|
||||||
@@ -1,46 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
PATH=/sbin:/bin:/usr/sbin:/usr/bin
|
|
||||||
RDEV=""
|
|
||||||
ROOT_DIR="/new_root"
|
|
||||||
|
|
||||||
mkdir -p /proc
|
|
||||||
mkdir -p /sys
|
|
||||||
mkdir -p /run
|
|
||||||
mkdir -p /tmp
|
|
||||||
mount -t proc proc /proc
|
|
||||||
mount -t sysfs sysfs /sys
|
|
||||||
mount -t devtmpfs none /dev
|
|
||||||
|
|
||||||
udevd --daemon
|
|
||||||
udevadm trigger --type=subsystems --action=add
|
|
||||||
udevadm trigger --type=devices --action=add
|
|
||||||
udevadm settle --timeout=10
|
|
||||||
|
|
||||||
for PARAM in $(cat /proc/cmdline); do
|
|
||||||
case $PARAM in
|
|
||||||
root=*)
|
|
||||||
RDEV=${PARAM#root=}
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
if ! [ -b $RDEV ]; then
|
|
||||||
echo "Missing root command line argument!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
case $RDEV in
|
|
||||||
UUID=*)
|
|
||||||
RDEV=$(realpath /dev/disk/by-uuid/${RDEV#UUID=})
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
. /usr/share/dm-verity.env
|
|
||||||
|
|
||||||
echo "Mounting $RDEV over dm-verity as the root filesystem"
|
|
||||||
|
|
||||||
veritysetup --data-block-size=1024 --hash-offset=$DATA_SIZE create rootfs $RDEV $RDEV $ROOT_HASH
|
|
||||||
mkdir -p $ROOT_DIR
|
|
||||||
mount -o ro /dev/mapper/rootfs $ROOT_DIR
|
|
||||||
exec switch_root $ROOT_DIR /sbin/init
|
|
||||||
Reference in New Issue
Block a user