mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-08 21:46:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

build_kernel_image: use a salt for verity.

Browse Source 
BUG=chromium-os:12138
TEST=Adhoc
TESTED_ON=Kaen
Build an image. Look for "Generating root fs hash tree (salt <foo>)." in the
output. Boot the image, grep for 'salt=' in dmesg. All should be well.

Change-Id: If9dbefbd8a875d06ff45cd54704f166c2511c3b7
Signed-off-by: Elly Jones <ellyjones@chromium.org>
Reviewed-on: http://gerrit.chromium.org/gerrit/7174
This commit is contained in:
Elly Jones 2011-09-02 13:25:04 -04:00 committed by Chris Sosa
parent c2a60e2e03
commit 6f568e6a94
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
build_kernel_image.sh
View File

@ -76,6 +76,14 @@ eval set -- "${FLAGS_ARGV}"
# Die on error # Die on error
set -e set -e
make_salt() {
# It is not important that the salt be cryptographically strong; it just needs
# to be different for each release. The purpose of the salt is just to ensure
# that if someone collides a block in one release, they can't reuse it in
# future releases.
xxd -l 32 -p -c 32 /dev/urandom
}
verity_args= verity_args=
# Even with a rootfs_image, root= is not changed unless specified. # Even with a rootfs_image, root= is not changed unless specified.
if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then
@ -100,14 +108,16 @@ if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then
error "Root file system blocks are not 4k!" error "Root file system blocks are not 4k!"
fi fi
info "Generating root fs hash tree." salt=$(make_salt)
info "Generating root fs hash tree (salt $salt)."
# Runs as sudo in case the image is a block device. # Runs as sudo in case the image is a block device.
# First argument to verity is reserved/unused and MUST be 0 # First argument to verity is reserved/unused and MUST be 0
table=$(sudo verity mode=create \ table=$(sudo verity mode=create \
alg=${FLAGS_verity_hash_alg} \ alg=${FLAGS_verity_hash_alg} \
payload=${FLAGS_rootfs_image} \ payload=${FLAGS_rootfs_image} \
payload_blocks=${root_fs_blocks} \ payload_blocks=${root_fs_blocks} \
hashtree=${FLAGS_rootfs_hash}) hashtree=${FLAGS_rootfs_hash} \
salt=$salt)
if [[ -f "${FLAGS_rootfs_hash}" ]]; then if [[ -f "${FLAGS_rootfs_hash}" ]]; then
sudo chmod a+r "${FLAGS_rootfs_hash}" sudo chmod a+r "${FLAGS_rootfs_hash}"
fi fi