fs/squashfs: enable squashfs to generate a verity hashtable
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH 2/2 fs/squashfs: enable squashfs to generate a verity hashtable
Ben, All,
On 2018-03-22 21:06 +0000, Ben Whitten spake thusly:
Quoted 3 lines
For those times that you want to verify that your readonly filesystem hasn't been tampered we can generate a dm-verity hash table. The root hash is enclosed in .table file and must be secured else where.
I don't think this should belong to the squashfs filesystem.
From what I understand, veritysetup is filesystem-agnostic, and can do the hash checksums on any image (even a r/w filesystem as long as it is mounted r/o for example).
My position is that this should be done in a post-image script.
Otherwise, we'd have to add support for other types of similar concepts:
someone will want to crypto-sign the images, then someone will want to encrypt the image, then... then...
The post-image scripts are there to fill this fuctionality: do local fixups and tweaks after the images have been generated.
Of course, this is only my position. Others may disagree... But IIRC we already had a similar discussion in the past, and the conclusion was to move such tings in a post-image script, so...
Regards,
Yann E. MORIN.
Quoted 50 lines
Signed-off-by Ben Whitten <[email protected]>--- fs/squashfs/Config.in | 6 ++++++ fs/squashfs/squashfs.mk | 10 ++++++++++ 2 files changed, 16 insertions(+)fs/squashfs/Config.in +6
-0@@ -28,4 +28,10 @@ config BR2_TARGET_ROOTFS_SQUASHFS4_XZ bool "xz" endchoice + +config BR2_TARGET_ROOTFS_SQUASHFS_VERITY + bool "Generate verity hashtable" + help + As squashfs is readonly it is possible to generate a dm-verity + hashtable for use in verified boot systems. endiffs/squashfs/squashfs.mk +10
-0@@ -5,6 +5,9 @@ ################################################################################ ROOTFS_SQUASHFS_DEPENDENCIES = host-squashfs +ifeq ($(BR2_TARGET_ROOTFS_SQUASHFS_VERITY),y) +ROOTFS_SQUASHFS_DEPENDENCIES += host-cryptsetup +endif ROOTFS_SQUASHFS_ARGS = -noappend -processors $(PARALLEL_JOBS)@@ -24,4 +27,11 @@ define ROOTFS_SQUASHFS_CMD $(HOST_DIR)/bin/mksquashfs $(TARGET_DIR) $@ $(ROOTFS_SQUASHFS_ARGS) endef +ifeq ($(BR2_TARGET_ROOTFS_SQUASHFS_VERITY),y) +define ROOTFS_SQUASHFS_VERITY + $(HOST_DIR)/sbin/veritysetup format $@ [email protected] > [email protected] +endef +ROOTFS_SQUASHFS_POST_GEN_HOOKS += ROOTFS_SQUASHFS_VERITY +endif + $(eval $(rootfs))Signature · 1 line
2.7.4
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 2/2 fs/squashfs: enable squashfs to generate a verity hashtable
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
Ben, All,
On 2018-03-22 21:06 +0000, Ben Whitten spake thusly:Quoted 3 lines
For those times that you want to verify that your readonly filesystem hasn't been tampered we can generate a dm-verity hash table. The root hash is enclosed in .table file and must be secured else where.
Strange, I don't seem to have received the original patch?
Quoted 7 lines
I don't think this should belong to the squashfs filesystem.
From what I understand, veritysetup is filesystem-agnostic, and can do the hash checksums on any image (even a r/w filesystem as long as it is mounted r/o for example).
My position is that this should be done in a post-image script.
I agree! It is quite simple to enable the host-cryptsetup package and call veritysetup format in a post-image script, but there is quite some flexibility in how to use dm-verity (data/hash block size, hashes appended to image or in a separate partition, where to store toplevel hash and offset, ..) which makes it hard to integrate as kconfig options.
Signature · 1 line
Bye, Peter Korsgaard
A message that is not in the archive (sent off-list or not yet received): CAF3==itWkWN+u97nMs+RFxq_e6qiZPKxoutQsQ0DsDgexNfy+A@mail.gmail.com
PATCH 2/2 fs/squashfs: enable squashfs to generate a verity hashtable
Ben, All,
On 2018-03-23 09:32 +0000, Ben Whitten spake thusly:
Quoted 10 lines · On Thu, 22 Mar 2018 at 22:32 Peter Korsgaard <[email protected]> wrote:
Quoted 7 lines
Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
On 2018-03-22 21:06 +0000, Ben Whitten spake thusly:
Quoted 3 lines
For those times that you want to verify that your readonly filesystem hasn't been tampered we can generate a dm-verity hash table. The root hash is enclosed in .table file and must be secured else where.
Strange, I don't seem to have received the original patch?
I think the mailing list ate it as I was not a subscriber at the time. Only the CC went to Yann.
Did you subscribe now? ;-)
Quoted 2 lines
Quoted 2 lines
Quoted 1 line
My position is that this should be done in a post-image script.
I agree!
[--SNIP--]
Quoted 4 lines
Thats fair enough, here is possibly not the right place for it.
I guess its a question of how much should be put into post processing. Generating this after the image means that I'd need to roll ubinize manually per device instead of using the settings in KConfig, which seems a bit messy.
So, you meant that ubinize can use that .table output from verifysetup generates?
Quoted 1 line
The other patch that was eaten decoupled ubi from ubifs to allow this.
Yeah, I still need to have a look at that patch. I already have a few comments about it, but please, repost both to the list so that everyone can see them and understand the replies...
Regards,
Yann E. MORIN.
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'