mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-10 06:26:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

build_image: Add arm64 rootfs verification

Browse Source 
Signed-off-by: Geoff Levand <geoff@infradead.org>
This commit is contained in:
Geoff Levand 2016-12-13 13:46:05 -08:00
parent 4ca0c5bc19
commit 2839b73177
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
build_library/build_image_util.sh
View File

@ -310,9 +310,11 @@ finish_image() {
fi fi
# Only enable rootfs verification on supported boards. # Only enable rootfs verification on supported boards.
if [[ "${FLAGS_board}" != amd64-usr ]]; then case "${FLAGS_board}" in
FLAGS_enable_rootfs_verification=${FLAGS_FALSE} amd64-usr) verity_offset=64 ;;
fi arm64-usr) verity_offset=512 ;;
*) FLAGS_enable_rootfs_verification=${FLAGS_FALSE} ;;
esac
# Copy kernel to support dm-verity boots # Copy kernel to support dm-verity boots
sudo mkdir -p "${root_fs_dir}/boot/coreos" sudo mkdir -p "${root_fs_dir}/boot/coreos"
@ -368,11 +370,14 @@ finish_image() {
--root_hash="${BUILD_DIR}/${image_name%.bin}_verity.txt" \ --root_hash="${BUILD_DIR}/${image_name%.bin}_verity.txt" \
"${BUILD_DIR}/${image_name}" "${BUILD_DIR}/${image_name}"
# Magic alert! Root hash injection works by replacing a seldom-used rdev # Magic alert! Root hash injection works by writing the hash value to a
# error message in the uncompressed section of the kernel that happens to # known unused SHA256-sized location in the kernel image.
# be exactly SHA256-sized. Our modified GRUB extracts it to the cmdline. # For amd64 the rdev error message is used.
# For arm64 an area between the EFI headers and the kernel text is used.
# Our modified GRUB extracts the hash and adds it to the cmdline.
printf %s "$(cat ${BUILD_DIR}/${image_name%.bin}_verity.txt)" | \ printf %s "$(cat ${BUILD_DIR}/${image_name%.bin}_verity.txt)" | \
sudo dd of="${root_fs_dir}/boot/coreos/vmlinuz-a" conv=notrunc seek=64 count=64 bs=1 sudo dd of="${root_fs_dir}/boot/coreos/vmlinuz-a" conv=notrunc \
seek=${verity_offset} count=64 bs=1
fi fi
# Sign the kernel after /usr is in a consistent state and verity is calculated # Sign the kernel after /usr is in a consistent state and verity is calculated