fs/iso9660: md5 checksum boot dir files
PATCH 1/1 fs/iso9660: md5 checksum boot dir files
From: Paresh Chaudhary <[email protected]>
Generate md5 checksum for all files of boot directory to allow runtime validation of boot images.
--- fs/iso9660/iso9660.mk | 2 ++ 1 file changed, 2 insertions(+)
fs/iso9660/iso9660.mk +2 -0
@@ -144,6 +144,8 @@ endif # ROOTFS_ISO9660_USE_INITRD define ROOTFS_ISO9660_CMD + $(RM) -rf $(ROOTFS_ISO9660_TARGET_DIR)/boot/checksums.md5 + cd $(ROOTFS_ISO9660_TARGET_DIR)/boot/ && md5sum * > $(ROOTFS_ISO9660_TARGET_DIR)/boot/checksums.md5 $(HOST_DIR)/usr/bin/genisoimage -J -R -b $(ROOTFS_ISO9660_BOOT_IMAGE) \ -no-emul-boot -boot-load-size 4 -boot-info-table \ -o $@ $(ROOTFS_ISO9660_TARGET_DIR)
Signature · 1 line
1.9.1
PATCH 1/1 fs/iso9660: md5 checksum boot dir files
Hello,
Quoted 7 lines · Matt Weber
From: Paresh Chaudhary <[email protected]>
Generate md5 checksum for all files of boot directory to allow runtime validation of boot images.
Signed-off-by Paresh Chaudhary <[email protected]>Signed-off-by Matt Weber <[email protected]>
Why specifically for those images, and not all files of the filesystem?
This really looks like a very use-case specific problem, we certainly can't handle it in generic code like this the patch you're proposing.
Best regards,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH 1/1 fs/iso9660: md5 checksum boot dir files
Thomas,
Quoted 5 lines · Thomas Petazzoni
Hello,
Quoted 2 lines · Matt Weber
From: Paresh Chaudhary <[email protected]>
Quoted 9 lines
Quoted 5 lines
Generate md5 checksum for all files of boot directory to allow runtime validation of boot images.
Signed-off-by Paresh Chaudhary <[email protected]>Signed-off-by Matt Weber <[email protected]>Why specifically for those images, and not all files of the filesystem?
We thought for a iso9600 formatted iso, this was a way to add a quick integrity check capability to the images used for kernel/rootfs. Since the bzimage and initrd are both present in this boot folder. This allows a product's install process to check the integrity of a disk after flashing the iso to a bare drive (mount the new boot partition and run md5sum -c). It also opens up the option for runtime verifying the images you booted from if you add scripting in your rootfs.
Signature · 12 lines
Matthew L Weber / Pr Software Engineer Airborne Information Systems / Security Systems and Software / Secure Platforms MS 131-100, C Ave NE, Cedar Rapids, IA, 52498, USA www.rockwellcollins.com Note: Any Export License Required Information and License Restricted Third Party Intellectual Property (TPIP) content must be encrypted and sent to matthew.weber at corp.rockwellcollins.com. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20161111/11879620/attachment.html>
PATCH 1/1 fs/iso9660: md5 checksum boot dir files
Hello,
Quoted 7 lines · Matthew Weber
We thought for a iso9600 formatted iso, this was a way to add a quick integrity check capability to the images used for kernel/rootfs. Since the bzimage and initrd are both present in this boot folder. This allows a product's install process to check the integrity of a disk after flashing the iso to a bare drive (mount the new boot partition and run md5sum -c). It also opens up the option for runtime verifying the images you booted from if you add scripting in your rootfs.
This all seems interesting, but if we want to solve this problem, we want to solve it globally for all filesystems, and the entire contents of the filesystem, not just the specific /boot directory of the specific iso9660 filesystem.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com