diff options
Diffstat (limited to 'classes')
| -rw-r--r-- | classes/aide-base.bbclass | 11 | ||||
| -rw-r--r-- | classes/aide-db-init.bbclass | 52 | ||||
| -rw-r--r-- | classes/dm-verity-img.bbclass | 148 | ||||
| -rw-r--r-- | classes/sanity-meta-security.bbclass | 2 |
4 files changed, 202 insertions, 11 deletions
diff --git a/classes/aide-base.bbclass b/classes/aide-base.bbclass new file mode 100644 index 0000000..36cc454 --- /dev/null +++ b/classes/aide-base.bbclass @@ -0,0 +1,11 @@ +# +# Copyright 2022 Armin Kuster <akuster808@gmail.com> +# + +STAGING_AIDE_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/aida" +AIDE_INCLUDE_DIRS ?= "/lib" +AIDE_SKIP_DIRS ?= "/lib/modules/.\*" + +AIDE_SCAN_POSTINIT ?= "0" +AIDE_RESCAN_POSTINIT ?= "0" + diff --git a/classes/aide-db-init.bbclass b/classes/aide-db-init.bbclass new file mode 100644 index 0000000..800006f --- /dev/null +++ b/classes/aide-db-init.bbclass @@ -0,0 +1,52 @@ +# +# Copyright 2022 Armin Kuster <akuster808@gmail.com> +# +# This class creates the initial aide database durning +# the build cycle allowing for that set being skipped during boot +# It has an additional benefit of having not being tamper with +# after build. +# +# To have the aide db created during build +# 1. Extend local.conf: +# INHERIT += "adie-init-db" +# +# These are the defaults as defined in aide-base.bbclass +# They can be overriden in your local.conf or other distro include +# +# To define where the share directory should be. +# STAGING_AIDE_DIR = "${TMPDIR}/work-shared/${MACHINE}/aida" +# +# To define which directories should be inclued in a scan +# AIDE_INCLUDE_DIRS ?= "/lib" +# +# To exclude directories and files from being scanned +# AIDE_SKIP_DIRS ?= "/lib/modules/.\*" +# +# To controll if a db init should happen at postint +# AIDE_SCAN_POSTINIT ?= "0" +# +# To cotroll if a db recan should be run at postinit +# AIDE_RESCAN_POSTINIT ?= "0" + +inherit aide-base + +aide_init_db() { + for dir in ${AIDE_INCLUDE_DIRS}; do + echo "${IMAGE_ROOTFS}${dir} NORMAL" >> ${STAGING_AIDE_DIR}/aide.conf + done + for dir in ${AIDE_SKIP_DIRS}; do + echo "!${IMAGE_ROOTFS}${dir}" >> ${STAGING_AIDE_DIR}/aide.conf + done + + + ${STAGING_AIDE_DIR}/bin/aide -c ${STAGING_AIDE_DIR}/aide.conf --init + gunzip ${STAGING_AIDE_DIR}/lib/aide.db.gz + # strip out native path + sed -i -e 's:${IMAGE_ROOTFS}::' ${STAGING_AIDE_DIR}/lib/aide.db + gzip -9 ${STAGING_AIDE_DIR}/lib/aide.db + cp -f ${STAGING_AIDE_DIR}/lib/aide.db.gz ${IMAGE_ROOTFS}${libdir}/aide +} + +EXTRA_IMAGEDEPENDS:append = " aide-native" + +ROOTFS_POSTPROCESS_COMMAND:append = " aide_init_db;" diff --git a/classes/dm-verity-img.bbclass b/classes/dm-verity-img.bbclass index 16d395b..7f79548 100644 --- a/classes/dm-verity-img.bbclass +++ b/classes/dm-verity-img.bbclass @@ -10,11 +10,22 @@ # assure data integrity, the root hash must be stored in a trusted location # or cryptographically signed and verified. # +# Optionally, we can store the hash data on a separate device or partition +# for improved compartmentalization and ease of use/deployment. +# # Usage: # DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image # DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs +# DM_VERITY_SEPARATE_HASH = "1" # optional; store hash on separate dev # IMAGE_CLASSES += "dm-verity-img" # +# Using the GPT UUIDs specified in the standard can also be useful in that +# they are displayed and translated in cfdisk output. +# +# DM_VERITY_ROOT_GUID = <UUID for your architecture and root-fs> +# DM_VERITY_RHASH_GUID = <UUID for your architecture and verity-hash> +# https://uapi-group.org/specifications/specs/discoverable_partitions_specification/ + # The resulting image can then be used to implement the device mapper block # integrity checking on the target device. @@ -22,13 +33,35 @@ # is stored where it can be installed into associated initramfs rootfs. STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity" +# location of images, default current image recipe. Set to DEPLOY_DIR_IMAGE +# if non-verity images want to embed the .wks and verity image. +DM_VERITY_DEPLOY_DIR ?= "${IMGDEPLOYDIR}" + +# Define the data block size to use in veritysetup. +DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" + +# Define the hash block size to use in veritysetup. +DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096" + +# Should we store the hash data on a separate device/partition? +DM_VERITY_SEPARATE_HASH ?= "0" + +# These are arch specific. We could probably intelligently auto-assign these? +# Take x86-64 values as defaults. No impact on functionality currently. +# See SD_GPT_ROOT_X86_64 and SD_GPT_ROOT_X86_64_VERITY in the spec. +# Note - these are passed directly to sgdisk so hyphens needed. +DM_VERITY_ROOT_GUID ?= "4f68bce3-e8cd-4db1-96e7-fbcaf984b709" +DM_VERITY_RHASH_GUID ?= "2c7357ed-ebd2-46d9-aec1-23d437ec2bf5" + +DEPENDS += "bc-native" + # Process the output from veritysetup and generate the corresponding .env # file. The output from veritysetup is not very machine-friendly so we need to # convert it to some better format. Let's drop the first line (doesn't contain # any useful info) and feed the rest to a script. process_verity() { local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env" - install -d ${STAGING_VERITY_DIR} + local WKS_INC="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.wks.in" rm -f $ENV # Each line contains a key and a value string delimited by ':'. Read the @@ -45,30 +78,127 @@ process_verity() { # Add partition size echo "DATA_SIZE=$SIZE" >> $ENV + + # Add whether we are storing the hash data separately + echo "SEPARATE_HASH=${DM_VERITY_SEPARATE_HASH}" >> $ENV + + # Configured for single partition use of veritysetup? OK, we are done. + if [ ${DM_VERITY_SEPARATE_HASH} -eq 0 ]; then + return + fi + + # Craft up the UUIDs that are part of the verity standard for root & hash + # while we are here and in shell. Re-read our output to get ROOT_HASH + # and then cut it in 1/2 ; HI for data UUID and LO for hash-data UUID. + # https://uapi-group.org/specifications/specs/discoverable_partitions_specification/ + + ROOT_HASH=$(cat $ENV | grep ^ROOT_HASH | sed 's/ROOT_HASH=//' | tr a-f A-F) + ROOT_HI=$(echo "obase=16;ibase=16;$ROOT_HASH/2^80" | bc) + ROOT_LO=$(echo "obase=16;ibase=16;$ROOT_HASH%2^80" | bc) + + # Hyphenate as per UUID spec and as expected by wic+sgdisk parameters. + # Prefix with leading zeros, in case hash chunks weren't using highest bits + # "bc" needs upper case, /dev/disk/by-partuuid/ is lower case. <sigh> + ROOT_UUID=$(echo 00000000$ROOT_HI | sed 's/.*\(.\{32\}\)$/\1/' | \ + sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f ) + RHASH_UUID=$(echo 00000000$ROOT_LO | sed 's/.*\(.\{32\}\)$/\1/' | \ + sed 's/./-&/9;s/./-&/14;s/./-&/19;s/./-&/24' | tr A-F a-f ) + + # Emit the values needed for a veritysetup run in the initramfs + echo "ROOT_UUID=$ROOT_UUID" >> $ENV + echo "RHASH_UUID=$RHASH_UUID" >> $ENV + + # Create wks.in fragment with build specific UUIDs for partitions. + # Unfortunately the wks.in does not support line continuations... + # First, the unappended filesystem data partition. + echo 'part / --source rawcopy --ondisk sda --sourceparams="file=${DM_VERITY_DEPLOY_DIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --part-name verityroot --part-type="${DM_VERITY_ROOT_GUID}"'" --uuid=\"$ROOT_UUID\"" > $WKS_INC + + # note: no default mount point for hash data partition + echo 'part --source rawcopy --ondisk sda --sourceparams="file=${DM_VERITY_DEPLOY_DIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.vhash" --part-name verityhash --part-type="${DM_VERITY_RHASH_GUID}"'" --uuid=\"$RHASH_UUID\"" >> $WKS_INC } verity_setup() { local TYPE=$1 - local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE + local INPUT=${IMAGE_NAME}.$TYPE local SIZE=$(stat --printf="%s" $INPUT) local OUTPUT=$INPUT.verity + local OUTPUT_HASH=$INPUT.verity + local HASH_OFFSET="" + local SETUP_ARGS="" + local SAVED_ARGS="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.args" + + install -d ${STAGING_VERITY_DIR} + + if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then + align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} + else + align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} + fi + SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align) + + # Assume some users may want separate hash vs. appended hash + if [ ${DM_VERITY_SEPARATE_HASH} -eq 1 ]; then + OUTPUT_HASH=$INPUT.vhash + else + HASH_OFFSET="--hash-offset="$SIZE + fi cp -a $INPUT $OUTPUT + SETUP_ARGS=" \ + --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} \ + --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} \ + $HASH_OFFSET format $OUTPUT $OUTPUT_HASH \ + " + + echo "veritysetup $SETUP_ARGS" > $SAVED_ARGS + # Let's drop the first line of output (doesn't contain any useful info) # and feed the rest to another function. - veritysetup --data-block-size=1024 --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity + veritysetup $SETUP_ARGS | tail -n +2 | process_verity +} + +# make "dateless" symlink for the hash so the wks can find it. +verity_hash() { + cd ${IMGDEPLOYDIR} + ln -sf ${IMAGE_NAME}.${DM_VERITY_IMAGE_TYPE}.vhash \ + ${IMAGE_BASENAME}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.vhash } -VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity" +VERITY_TYPES = " \ + ext2.verity ext3.verity ext4.verity \ + btrfs.verity \ + erofs.verity erofs-lz4.verity erofs-lz4hc.verity \ + squashfs.verity squashfs-xz.verity squashfs-lzo.verity squashfs-lz4.verity squashfs-zst.verity \ +" IMAGE_TYPES += "${VERITY_TYPES}" CONVERSIONTYPES += "verity" -CONVERSION_CMD_verity = "verity_setup ${type}" +CONVERSION_CMD:verity = "verity_setup ${type}" CONVERSION_DEPENDS_verity = "cryptsetup-native" +IMAGE_CMD:vhash = "verity_hash" + +def get_verity_fstypes(d): + verity_image = d.getVar('DM_VERITY_IMAGE') + verity_type = d.getVar('DM_VERITY_IMAGE_TYPE') + verity_hash = d.getVar('DM_VERITY_SEPARATE_HASH') + pn = d.getVar('PN') + + fstypes = "" + if not pn.endswith(verity_image): + return fstypes # This doesn't concern this image + + fstypes = verity_type + ".verity" + if verity_hash == "1": + fstypes += " vhash" + + return fstypes + +IMAGE_FSTYPES += "${@get_verity_fstypes(d)}" python __anonymous() { verity_image = d.getVar('DM_VERITY_IMAGE') verity_type = d.getVar('DM_VERITY_IMAGE_TYPE') + verity_hash = d.getVar('DM_VERITY_SEPARATE_HASH') image_fstypes = d.getVar('IMAGE_FSTYPES') pn = d.getVar('PN') @@ -76,17 +206,15 @@ python __anonymous() { bb.warn('dm-verity-img class inherited but not used') return - if verity_image != pn: + if not pn.endswith(verity_image): return # This doesn't concern this image - if len(verity_type.split()) is not 1: + if len(verity_type.split()) != 1: bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type') - d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type) - # If we're using wic: we'll have to use partition images and not the rootfs # source plugin so add the appropriate dependency. if 'wic' in image_fstypes: - dep = ' %s:do_image_%s' % (pn, verity_type) + dep = ' %s:do_image_%s' % (pn, verity_type.replace("-", "_")) d.appendVarFlag('do_image_wic', 'depends', dep) } diff --git a/classes/sanity-meta-security.bbclass b/classes/sanity-meta-security.bbclass index b6c6b9c..f9e2698 100644 --- a/classes/sanity-meta-security.bbclass +++ b/classes/sanity-meta-security.bbclass @@ -1,7 +1,7 @@ addhandler security_bbappend_distrocheck security_bbappend_distrocheck[eventmask] = "bb.event.SanityCheck" python security_bbappend_distrocheck() { - skip_check = e.data.getVar('SKIP_META_SECUIRTY_SANITY_CHECK') == "1" + skip_check = e.data.getVar('SKIP_META_SECURITY_SANITY_CHECK') == "1" if 'security' not in e.data.getVar('DISTRO_FEATURES').split() and not skip_check: bb.warn("You have included the meta-security layer, but \ 'security' has not been enabled in your DISTRO_FEATURES. Some bbappend files \ |