User/gmileka/verity hash signing

docs/imagecustomizer/verity-signing-sample/10-mountbootpartition.conf

@@ -0,0 +1 @@
+add_dracutmodules+=" mountbootpartition "

docs/imagecustomizer/verity-signing-sample/90mountbootpartition/module-setup.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+# called by dracut
+check() {
+    return 255
+}
+
+# called by dracut
+depends() {
+    return 0
+}
+
+# called by dracut
+installkernel() {
+    return 0
+}
+
+# called by dracut
+install() {
+    # install utilities
+    inst_multiple lsblk umount
+    # generate udev rule - i.e. schedule things post udev settlement
+    inst_hook pre-udev 30 "$moddir/mountbootpartition-genrules.sh"
+    # script to run post udev to mout
+    inst_script "$moddir/mountbootpartition.sh" "/sbin/mountbootpartition"
+    # script runs early on when systemd is initialized...
+    if dracut_module_included "systemd-initrd"; then
+        inst_script "$moddir/mountbootpartition-generator.sh" "$systemdutildir"/system-generators/dracut-mountbootpartition-generator
+    fi
+    dracut_need_initqueue
+}

docs/imagecustomizer/verity-signing-sample/90mountbootpartition/mountbootpartition-generator.sh

@@ -0,0 +1,79 @@
+#!/bin/sh
+
+set -x
+set -e
+
+echo "Running mountbootpartition-generator.sh" > /dev/kmsg
+
+# type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
+function updateVeritySetupUnit () {
+    systemdDropInDir=/etc/systemd/system
+    verityDropInDir=$systemdDropInDir/[email protected]
+
+    mkdir -p $verityDropInDir
+    verityConfiguration=$verityDropInDir/verity-azl-extension.conf
+
+    cat <<EOF > $verityConfiguration
+[Unit]
+After=bootmountmonitor.service
+Requires=bootmountmonitor.service
+EOF
+
+    chmod 644 $verityConfiguration
+    chown root:root $verityConfiguration
+}
+
+# -----------------------------------------------------------------------------
+function createBootPartitionMonitorScript () {
+    local bootPartitionMonitorCmd=$1
+    local semaphorefile=$2
+
+    cat <<EOF > $bootPartitionMonitorCmd
+#!/bin/sh
+while [ ! -e "$semaphorefile" ]; do
+    echo "Waiting for $semaphorefile to exist..."
+    sleep 1
+done    
+EOF
+    chmod +x $bootPartitionMonitorCmd
+}
+
+# -----------------------------------------------------------------------------
+function createBootPartitionMonitorUnit() {
+    local bootPartitionMonitorCmd=$1
+
+    bootMountMonitorName="bootmountmonitor.service"
+    systemdDropInDir=/etc/systemd/system
+    bootMountMonitorDir=$systemdDropInDir
+    bootMountMonitorUnitFile=$bootMountMonitorDir/$bootMountMonitorName
+
+    cat <<EOF > $bootMountMonitorUnitFile
+[Unit]
+Description=bootpartitionmounter
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+ExecStart=$bootPartitionMonitorCmd
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+EOF
+}
+
+# -----------------------------------------------------------------------------
+
+updateVeritySetupUnit
+
+systemdScriptsDir=/usr/local/bin
+bootPartitionMonitorCmd=$systemdScriptsDir/boot-partition-monitor.sh
+semaphorefile=/run/boot-parition-mount-ready.sem
+
+mkdir -p $systemdScriptsDir
+
+createBootPartitionMonitorScript $bootPartitionMonitorCmd $semaphorefile
+createBootPartitionMonitorUnit $bootPartitionMonitorCmd
+
+echo "mountbootpartition-generator.sh completed successfully." > /dev/kmsg

docs/imagecustomizer/verity-signing-sample/90mountbootpartition/mountbootpartition-genrules.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+echo "Running mountbootpartition-genrules.sh" > /dev/kmsg
+
+# this gets called after all devices have settled.
+/sbin/initqueue --finished --onetime --unique /sbin/mountbootpartition > /dev/kmsg

docs/imagecustomizer/verity-signing-sample/90mountbootpartition/mountbootpartition.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+echo "Running mountbootpartition.sh" 
+
+type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
+bootPartitionUuid=$(getarg pre.verity.mount)
+
+if [[ "$bootPartitionUuid" == "" ]]; then
+    exit 0
+fi
+
+mkdir -p /boot
+mount -U $bootPartitionUuid /boot
+
+echo "done" > /run/boot-parition-mount-ready.sem

docs/imagecustomizer/verity-signing-sample/verity-test.yaml

@@ -0,0 +1,96 @@
+storage:
+  bootType: efi
+  disks:
+  - partitionTableType: gpt
+    maxSize: 5120M
+    partitions:
+    - id: esp
+      type: esp
+      start: 1M
+      end: 9M
+
+    - id: boot
+      start: 9M
+      end: 1024M
+
+    - id: root
+      start: 1024M
+      end: 3072M
+
+    - id: roothash
+      start: 3072M
+      end: 3200M
+
+    - id: var
+      start: 3200M
+
+  verity:
+  - id: verityroot
+    name: root
+    dataDeviceId: root
+    hashDeviceId: roothash
+    corruptionOption: panic
+
+  filesystems:
+  - deviceId: esp
+    type: fat32
+    mountPoint:
+      path: /boot/efi
+      options: umask=0077
+
+  - deviceId: boot
+    type: ext4
+    mountPoint:
+      path: /boot
+
+  - deviceId: verityroot
+    type: ext4
+    mountPoint:
+      path: /
+      options: ro
+
+  - deviceId: var
+    type: ext4
+    mountPoint:
+      path: /var
+
+os:
+  resetBootLoaderType: hard-reset
+  selinux:
+    mode: disabled
+
+  kernelCommandLine:
+    extraCommandLine:
+    - "rd.info"
+    - "console=tty0"
+    - "console=ttyS0"
+
+  packages:
+    install:
+    - openssh-server
+    - veritysetup
+    - vim
+    - lvm2
+
+  additionalFiles:
+  # 90mountbootpartition
+  - source: 90mountbootpartition/module-setup.sh
+    destination: /usr/lib/dracut/modules.d/90mountbootpartition/module-setup.sh
+    permissions: "755"
+  - source: 90mountbootpartition/mountbootpartition-generator.sh
+    destination: /usr/lib/dracut/modules.d/90mountbootpartition/mountbootpartition-generator.sh
+    permissions: "755"
+  - source: 90mountbootpartition/mountbootpartition-genrules.sh
+    destination: /usr/lib/dracut/modules.d/90mountbootpartition/mountbootpartition-genrules.sh
+    permissions: "755"
+  - source: 90mountbootpartition/mountbootpartition.sh
+    destination: /usr/lib/dracut/modules.d/90mountbootpartition/mountbootpartition.sh
+    permissions: "755"
+  # ensure mountbootpartition is included
+  - source: 10-mountbootpartition.conf
+    destination: /etc/dracut.conf.d/10-mountbootpartition.conf
+    permissions: "755"
+
+  services:
+    enable:
+    - sshd