mirror of
https://git.yoctoproject.org/meta-security
synced 2026-07-16 03:47:21 +00:00
initramfs-framework: Add dmverity module
Add 'initramfs-module-dmverity' as an extension to poky upstream provided initramfs-framework suite via matchingly named bbappend file. Together with pre-existing 'initramfs-module-udev' this module can be used to facilitate dm-verity rootfs mounting from initramfs context that is bundled with Linux kernel. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
committed by
Armin Kuster
parent
170945ff9f
commit
489f7c900c
@@ -0,0 +1,53 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
dmverity_enabled() {
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
dmverity_run() {
|
||||||
|
DATA_SIZE="__not_set__"
|
||||||
|
ROOT_HASH="__not_set__"
|
||||||
|
|
||||||
|
. /usr/share/misc/dm-verity.env
|
||||||
|
|
||||||
|
case "${bootparam_root}" in
|
||||||
|
ID=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-id/${bootparam_root#ID=})"
|
||||||
|
;;
|
||||||
|
LABEL=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-label/${bootparam_root#LABEL=})"
|
||||||
|
;;
|
||||||
|
PARTLABEL=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-partlabel/${bootparam_root#PARTLABEL=})"
|
||||||
|
;;
|
||||||
|
PARTUUID=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-partuuid/${bootparam_root#PARTUUID=})"
|
||||||
|
;;
|
||||||
|
PATH=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-path/${bootparam_root#PATH=})"
|
||||||
|
;;
|
||||||
|
UUID=*)
|
||||||
|
RDEV="$(realpath /dev/disk/by-uuid/${bootparam_root#UUID=})"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
RDEV="${bootparam_root}"
|
||||||
|
esac
|
||||||
|
|
||||||
|
if ! [ -b "${RDEV}" ]; then
|
||||||
|
echo "Root device resolution failed"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
veritysetup \
|
||||||
|
--data-block-size=1024 \
|
||||||
|
--hash-offset=${DATA_SIZE} \
|
||||||
|
create rootfs \
|
||||||
|
${RDEV} \
|
||||||
|
${RDEV} \
|
||||||
|
${ROOT_HASH}
|
||||||
|
|
||||||
|
mount \
|
||||||
|
-o ro \
|
||||||
|
/dev/mapper/rootfs \
|
||||||
|
${ROOTFS_DIR} || exit 2
|
||||||
|
}
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
|
||||||
|
|
||||||
|
SRC_URI_append = "\
|
||||||
|
file://dmverity \
|
||||||
|
"
|
||||||
|
|
||||||
|
do_install_append() {
|
||||||
|
# dm-verity
|
||||||
|
install ${WORKDIR}/dmverity ${D}/init.d/80-dmverity
|
||||||
|
}
|
||||||
|
|
||||||
|
PACKAGES_append = " initramfs-module-dmverity"
|
||||||
|
|
||||||
|
SUMMARY_initramfs-module-dmverity = "initramfs dm-verity rootfs support"
|
||||||
|
RDEPENDS_initramfs-module-dmverity = "${PN}-base"
|
||||||
|
FILES_initramfs-module-dmverity = "/init.d/80-dmverity"
|
||||||
Reference in New Issue
Block a user