src/veritysetup/veritysetup-generator.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <stdbool.h>
   5 #include <stdlib.h>
   6 #include <sys/stat.h>
   7 #include <unistd.h>
   8
   9 #include "alloc-util.h"
  10 #include "fd-util.h"
  11 #include "fileio.h"
  12 #include "fstab-util.h"
  13 #include "generator.h"
  14 #include "hexdecoct.h"
  15 #include "id128-util.h"
  16 #include "main-func.h"
  17 #include "mkdir.h"
  18 #include "parse-util.h"
  19 #include "path-util.h"
  20 #include "proc-cmdline.h"
  21 #include "specifier.h"
  22 #include "string-util.h"
  23 #include "unit-name.h"
  24
  25 #define SYSTEMD_VERITYSETUP_SERVICE "systemd-veritysetup@root.service"
  26
  27 static const char *arg_dest = NULL;
  28 static bool arg_enabled = true;
  29 static bool arg_read_veritytab = true;
  30 static const char *arg_veritytab = NULL;
  31 static char *arg_root_hash = NULL;
  32 static char *arg_data_what = NULL;
  33 static char *arg_hash_what = NULL;
  34 static char *arg_options = NULL;
  35
  36 STATIC_DESTRUCTOR_REGISTER(arg_root_hash, freep);
  37 STATIC_DESTRUCTOR_REGISTER(arg_data_what, freep);
  38 STATIC_DESTRUCTOR_REGISTER(arg_hash_what, freep);
  39 STATIC_DESTRUCTOR_REGISTER(arg_options, freep);
  40
  41 static int create_device(void) {
  42         _cleanup_free_ char *u = NULL, *v = NULL, *d = NULL, *e = NULL, *u_escaped = NULL, *v_escaped = NULL,
  43                             *root_hash_escaped = NULL, *options_escaped = NULL;
  44         _cleanup_fclose_ FILE *f = NULL;
  45         const char *to;
  46         int r;
  47
  48         /* If all three pieces of information are missing, then verity is turned off */
  49         if (!arg_root_hash && !arg_data_what && !arg_hash_what)
  50                 return 0;
  51
  52         /* if one of them is missing however, the data is simply incomplete and this is an error */
  53         if (!arg_root_hash)
  54                 log_error("Verity information incomplete, root hash unspecified.");
  55         if (!arg_data_what)
  56                 log_error("Verity information incomplete, root data device unspecified.");
  57         if (!arg_hash_what)
  58                 log_error("Verity information incomplete, root hash device unspecified.");
  59
  60         if (!arg_root_hash || !arg_data_what || !arg_hash_what)
  61                 return -EINVAL;
  62
  63         log_debug("Using root verity data device %s,\n"
  64                   "                  hash device %s,\n"
  65                   "                      options %s,\n"
  66                   "                and root hash %s.", arg_data_what, arg_hash_what, arg_options, arg_root_hash);
  67
  68         u = fstab_node_to_udev_node(arg_data_what);
  69         if (!u)
  70                 return log_oom();
  71         v = fstab_node_to_udev_node(arg_hash_what);
  72         if (!v)
  73                 return log_oom();
  74
  75         u_escaped = specifier_escape(u);
  76         if (!u_escaped)
  77                 return log_oom();
  78         v_escaped = specifier_escape(v);
  79         if (!v_escaped)
  80                 return log_oom();
  81
  82         r = unit_name_from_path(u, ".device", &d);
  83         if (r < 0)
  84                 return log_error_errno(r, "Failed to generate unit name: %m");
  85         r = unit_name_from_path(v, ".device", &e);
  86         if (r < 0)
  87                 return log_error_errno(r, "Failed to generate unit name: %m");
  88
  89         options_escaped = specifier_escape(arg_options ?: "");
  90         if (!options_escaped)
  91                 return log_oom();
  92
  93         root_hash_escaped = specifier_escape(arg_root_hash);
  94         if (!root_hash_escaped)
  95                 return log_oom();
  96
  97         r = generator_open_unit_file(arg_dest, NULL, SYSTEMD_VERITYSETUP_SERVICE, &f);
  98         if (r < 0)
  99                 return r;
 100
 101         fprintf(f,
 102                 "[Unit]\n"
 103                 "Description=Integrity Protection Setup for %%I\n"
 104                 "Documentation=man:systemd-veritysetup-generator(8) man:systemd-veritysetup@.service(8)\n"
 105                 "SourcePath=/proc/cmdline\n"
 106                 "DefaultDependencies=no\n"
 107                 "Conflicts=umount.target\n"
 108                 "BindsTo=%s %s\n"
 109                 "IgnoreOnIsolate=true\n"
 110                 "After=veritysetup-pre.target systemd-udevd-kernel.socket %s %s\n"
 111                 "Before=veritysetup.target umount.target\n"
 112                 "\n[Service]\n"
 113                 "Type=oneshot\n"
 114                 "RemainAfterExit=yes\n"
 115                 "ExecStart=" ROOTLIBEXECDIR "/systemd-veritysetup attach root '%s' '%s' '%s' '%s'\n"
 116                 "ExecStop=" ROOTLIBEXECDIR "/systemd-veritysetup detach root\n",
 117                 d, e,
 118                 d, e,
 119                 u_escaped, v_escaped, root_hash_escaped, options_escaped);
 120
 121         r = fflush_and_check(f);
 122         if (r < 0)
 123                 return log_error_errno(r, "Failed to write file unit "SYSTEMD_VERITYSETUP_SERVICE": %m");
 124
 125         to = strjoina(arg_dest, "/veritysetup.target.requires/" SYSTEMD_VERITYSETUP_SERVICE);
 126
 127         (void) mkdir_parents(to, 0755);
 128         if (symlink("../" SYSTEMD_VERITYSETUP_SERVICE, to) < 0)
 129                 return log_error_errno(errno, "Failed to create symlink %s: %m", to);
 130
 131         return 0;
 132 }
 133
 134 static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
 135         int r;
 136
 137         if (proc_cmdline_key_streq(key, "systemd.verity")) {
 138
 139                 r = value ? parse_boolean(value) : 1;
 140                 if (r < 0)
 141                         log_warning("Failed to parse verity= kernel command line switch %s. Ignoring.", value);
 142                 else
 143                         arg_enabled = r;
 144
 145         } else if (streq(key, "veritytab")) {
 146
 147                 r = value ? parse_boolean(value) : 1;
 148                 if (r < 0)
 149                         log_warning("Failed to parse veritytab= kernel command line switch %s. Ignoring.", value);
 150                 else
 151                         arg_read_veritytab = r;
 152
 153         } else if (proc_cmdline_key_streq(key, "roothash")) {
 154
 155                 if (proc_cmdline_value_missing(key, value))
 156                         return 0;
 157
 158                 r = free_and_strdup(&arg_root_hash, value);
 159                 if (r < 0)
 160                         return log_oom();
 161
 162         } else if (proc_cmdline_key_streq(key, "systemd.verity_root_data")) {
 163
 164                 if (proc_cmdline_value_missing(key, value))
 165                         return 0;
 166
 167                 r = free_and_strdup(&arg_data_what, value);
 168                 if (r < 0)
 169                         return log_oom();
 170
 171         } else if (proc_cmdline_key_streq(key, "systemd.verity_root_hash")) {
 172
 173                 if (proc_cmdline_value_missing(key, value))
 174                         return 0;
 175
 176                 r = free_and_strdup(&arg_hash_what, value);
 177                 if (r < 0)
 178                         return log_oom();
 179
 180         } else if (proc_cmdline_key_streq(key, "systemd.verity_root_options")) {
 181
 182                 if (proc_cmdline_value_missing(key, value))
 183                         return 0;
 184
 185                 r = free_and_strdup(&arg_options, value);
 186                 if (r < 0)
 187                         return log_oom();
 188
 189         }
 190
 191         return 0;
 192 }
 193
 194 static int determine_devices(void) {
 195         _cleanup_free_ void *m = NULL;
 196         sd_id128_t root_uuid, verity_uuid;
 197         char ids[ID128_UUID_STRING_MAX];
 198         size_t l;
 199         int r;
 200
 201         /* Try to automatically derive the root data and hash device paths from the root hash */
 202
 203         if (!arg_root_hash)
 204                 return 0;
 205
 206         if (arg_data_what && arg_hash_what)
 207                 return 0;
 208
 209         r = unhexmem(arg_root_hash, strlen(arg_root_hash), &m, &l);
 210         if (r < 0)
 211                 return log_error_errno(r, "Failed to parse root hash: %s", arg_root_hash);
 212         if (l < sizeof(sd_id128_t)) {
 213                 log_debug("Root hash is shorter than 128 bits (32 characters), ignoring for discovering verity partition.");
 214                 return 0;
 215         }
 216
 217         if (!arg_data_what) {
 218                 memcpy(&root_uuid, m, sizeof(root_uuid));
 219
 220                 arg_data_what = path_join("/dev/disk/by-partuuid", id128_to_uuid_string(root_uuid, ids));
 221                 if (!arg_data_what)
 222                         return log_oom();
 223         }
 224
 225         if (!arg_hash_what) {
 226                 memcpy(&verity_uuid, (uint8_t*) m + l - sizeof(verity_uuid), sizeof(verity_uuid));
 227
 228                 arg_hash_what = path_join("/dev/disk/by-partuuid", id128_to_uuid_string(verity_uuid, ids));
 229                 if (!arg_hash_what)
 230                         return log_oom();
 231         }
 232
 233         return 1;
 234 }
 235
 236 static int create_disk(
 237                 const char *name,
 238                 const char *data_device,
 239                 const char *hash_device,
 240                 const char *roothash,
 241                 const char *options,
 242                 const char *source) {
 243
 244         _cleanup_free_ char *n = NULL, *dd = NULL, *du = NULL, *hd = NULL, *hu = NULL, *e = NULL,
 245                             *du_escaped = NULL, *hu_escaped = NULL, *name_escaped = NULL;
 246         _cleanup_fclose_ FILE *f = NULL;
 247         const char *dmname;
 248         bool noauto, nofail, netdev, attach_in_initrd;
 249         int r;
 250
 251         assert(name);
 252         assert(data_device);
 253         assert(hash_device);
 254         assert(roothash);
 255
 256         noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0");
 257         nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0");
 258         netdev = fstab_test_option(options, "_netdev\0");
 259         attach_in_initrd = fstab_test_option(options, "x-initrd.attach\0");
 260
 261         name_escaped = specifier_escape(name);
 262         if (!name_escaped)
 263                 return log_oom();
 264
 265         e = unit_name_escape(name);
 266         if (!e)
 267                 return log_oom();
 268
 269         du = fstab_node_to_udev_node(data_device);
 270         if (!du)
 271                 return log_oom();
 272
 273         hu = fstab_node_to_udev_node(hash_device);
 274         if (!hu)
 275                 return log_oom();
 276
 277         r = unit_name_build("systemd-veritysetup", e, ".service", &n);
 278         if (r < 0)
 279                 return log_error_errno(r, "Failed to generate unit name: %m");
 280
 281         du_escaped = specifier_escape(du);
 282         if (!du_escaped)
 283                 return log_oom();
 284
 285         hu_escaped = specifier_escape(hu);
 286         if (!hu_escaped)
 287                 return log_oom();
 288
 289         r = unit_name_from_path(du, ".device", &dd);
 290         if (r < 0)
 291                 return log_error_errno(r, "Failed to generate unit name: %m");
 292
 293         r = unit_name_from_path(hu, ".device", &hd);
 294         if (r < 0)
 295                 return log_error_errno(r, "Failed to generate unit name: %m");
 296
 297         r = generator_open_unit_file(arg_dest, NULL, n, &f);
 298         if (r < 0)
 299                 return r;
 300
 301         r = generator_write_veritysetup_unit_section(f, source);
 302         if (r < 0)
 303                 return r;
 304
 305         if (netdev)
 306                 fprintf(f, "After=remote-fs-pre.target\n");
 307
 308         /* If initrd takes care of attaching the disk then it should also detach it during shutdown. */
 309         if (!attach_in_initrd)
 310                 fprintf(f, "Conflicts=umount.target\n");
 311
 312         if (!nofail)
 313                 fprintf(f,
 314                         "Before=%s\n",
 315                         netdev ? "remote-veritysetup.target" : "veritysetup.target");
 316
 317         if (path_startswith(du, "/dev/"))
 318                 fprintf(f,
 319                         "BindsTo=%s\n"
 320                         "After=%s\n"
 321                         "Before=umount.target\n",
 322                         dd, dd);
 323         else
 324                 /* For loopback devices, add systemd-tmpfiles-setup-dev.service
 325                    dependency to ensure that loopback support is available in
 326                    the kernel (/dev/loop-control needs to exist) */
 327                 fprintf(f,
 328                         "RequiresMountsFor=%s\n"
 329                         "Requires=systemd-tmpfiles-setup-dev.service\n"
 330                         "After=systemd-tmpfiles-setup-dev.service\n",
 331                         du_escaped);
 332
 333         if (path_startswith(hu, "/dev/"))
 334                 fprintf(f,
 335                         "BindsTo=%s\n"
 336                         "After=%s\n"
 337                         "Before=umount.target\n",
 338                         hd, hd);
 339         else
 340                 /* For loopback devices, add systemd-tmpfiles-setup-dev.service
 341                    dependency to ensure that loopback support is available in
 342                    the kernel (/dev/loop-control needs to exist) */
 343                 fprintf(f,
 344                         "RequiresMountsFor=%s\n"
 345                         "Requires=systemd-tmpfiles-setup-dev.service\n"
 346                         "After=systemd-tmpfiles-setup-dev.service\n",
 347                         hu_escaped);
 348
 349         r = generator_write_veritysetup_service_section(f, name, du_escaped, hu_escaped, roothash, options);
 350         if (r < 0)
 351                 return r;
 352
 353         r = fflush_and_check(f);
 354         if (r < 0)
 355                 return log_error_errno(r, "Failed to write unit file %s: %m", n);
 356
 357         if (!noauto) {
 358                 r = generator_add_symlink(arg_dest,
 359                                           netdev ? "remote-veritysetup.target" : "veritysetup.target",
 360                                           nofail ? "wants" : "requires", n);
 361                 if (r < 0)
 362                         return r;
 363         }
 364
 365         dmname = strjoina("dev-mapper-", e, ".device");
 366         return generator_add_symlink(arg_dest, dmname, "requires", n);
 367 }
 368
 369 static int add_veritytab_devices(void) {
 370         _cleanup_fclose_ FILE *f = NULL;
 371         unsigned veritytab_line = 0;
 372         int r;
 373
 374         if (!arg_read_veritytab)
 375                 return 0;
 376
 377         r = fopen_unlocked(arg_veritytab, "re", &f);
 378         if (r < 0) {
 379                 if (errno != ENOENT)
 380                         log_error_errno(errno, "Failed to open %s: %m", arg_veritytab);
 381                 return 0;
 382         }
 383
 384         for (;;) {
 385                 _cleanup_free_ char *line = NULL, *name = NULL, *data_device = NULL, *hash_device = NULL,
 386                                     *roothash = NULL, *options = NULL;
 387                 char *l, *data_uuid, *hash_uuid;
 388
 389                 r = read_line(f, LONG_LINE_MAX, &line);
 390                 if (r < 0)
 391                         return log_error_errno(r, "Failed to read %s: %m", arg_veritytab);
 392                 if (r == 0)
 393                         break;
 394
 395                 veritytab_line++;
 396
 397                 l = strstrip(line);
 398                 if (IN_SET(l[0], 0, '#'))
 399                         continue;
 400
 401                 r = sscanf(l, "%ms %ms %ms %ms %ms", &name, &data_device, &hash_device, &roothash, &options);
 402                 if (!IN_SET(r, 4, 5)) {
 403                         log_error("Failed to parse %s:%u, ignoring.", arg_veritytab, veritytab_line);
 404                         continue;
 405                 }
 406
 407                 data_uuid = startswith(data_device, "UUID=");
 408                 if (!data_uuid)
 409                         data_uuid = path_startswith(data_device, "/dev/disk/by-uuid/");
 410
 411                 hash_uuid = startswith(hash_device, "UUID=");
 412                 if (!hash_uuid)
 413                         hash_uuid = path_startswith(hash_device, "/dev/disk/by-uuid/");
 414
 415                 r = create_disk(name,
 416                                 data_device,
 417                                 hash_device,
 418                                 roothash,
 419                                 options,
 420                                 arg_veritytab);
 421                 if (r < 0)
 422                         return r;
 423         }
 424
 425         return 0;
 426 }
 427
 428 static int run(const char *dest, const char *dest_early, const char *dest_late) {
 429         int r;
 430
 431         assert_se(arg_dest = dest);
 432
 433         arg_veritytab = getenv("SYSTEMD_VERITYTAB") ?: "/etc/veritytab";
 434
 435         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
 436         if (r < 0)
 437                 return log_warning_errno(r, "Failed to parse kernel command line: %m");
 438
 439         if (!arg_enabled)
 440                 return 0;
 441
 442         r = add_veritytab_devices();
 443         if (r < 0)
 444                 return r;
 445
 446         r = determine_devices();
 447         if (r < 0)
 448                 return r;
 449
 450         return create_device();
 451 }
 452
 453 DEFINE_MAIN_GENERATOR_FUNCTION(run);