1 /* SPDX-License-Identifier: LGPL-2.1+ */
9 #include "alloc-util.h"
12 #include "fstab-util.h"
13 #include "generator.h"
14 #include "hexdecoct.h"
15 #include "id128-util.h"
16 #include "main-func.h"
18 #include "parse-util.h"
19 #include "path-util.h"
20 #include "proc-cmdline.h"
21 #include "specifier.h"
22 #include "string-util.h"
23 #include "unit-name.h"
25 #define SYSTEMD_VERITYSETUP_SERVICE "systemd-veritysetup@root.service"
27 static const char *arg_dest
= NULL
;
28 static bool arg_enabled
= true;
29 static char *arg_root_hash
= NULL
;
30 static char *arg_data_what
= NULL
;
31 static char *arg_hash_what
= NULL
;
33 STATIC_DESTRUCTOR_REGISTER(arg_root_hash
, freep
);
34 STATIC_DESTRUCTOR_REGISTER(arg_data_what
, freep
);
35 STATIC_DESTRUCTOR_REGISTER(arg_hash_what
, freep
);
37 static int create_device(void) {
38 _cleanup_free_
char *u
= NULL
, *v
= NULL
, *d
= NULL
, *e
= NULL
, *u_escaped
= NULL
, *v_escaped
= NULL
, *root_hash_escaped
= NULL
;
39 _cleanup_fclose_
FILE *f
= NULL
;
43 /* If all three pieces of information are missing, then verity is turned off */
44 if (!arg_root_hash
&& !arg_data_what
&& !arg_hash_what
)
47 /* if one of them is missing however, the data is simply incomplete and this is an error */
49 log_error("Verity information incomplete, root hash unspecified.");
51 log_error("Verity information incomplete, root data device unspecified.");
53 log_error("Verity information incomplete, root hash device unspecified.");
55 if (!arg_root_hash
|| !arg_data_what
|| !arg_hash_what
)
58 log_debug("Using root verity data device %s,\n"
60 " and root hash %s.", arg_data_what
, arg_hash_what
, arg_root_hash
);
62 u
= fstab_node_to_udev_node(arg_data_what
);
65 v
= fstab_node_to_udev_node(arg_hash_what
);
69 u_escaped
= specifier_escape(u
);
72 v_escaped
= specifier_escape(v
);
76 r
= unit_name_from_path(u
, ".device", &d
);
78 return log_error_errno(r
, "Failed to generate unit name: %m");
79 r
= unit_name_from_path(v
, ".device", &e
);
81 return log_error_errno(r
, "Failed to generate unit name: %m");
83 root_hash_escaped
= specifier_escape(arg_root_hash
);
84 if (!root_hash_escaped
)
87 r
= generator_open_unit_file(arg_dest
, NULL
, SYSTEMD_VERITYSETUP_SERVICE
, &f
);
93 "Description=Integrity Protection Setup for %%I\n"
94 "Documentation=man:systemd-veritysetup-generator(8) man:systemd-veritysetup@.service(8)\n"
95 "SourcePath=/proc/cmdline\n"
96 "DefaultDependencies=no\n"
97 "Conflicts=umount.target\n"
99 "IgnoreOnIsolate=true\n"
100 "After=cryptsetup-pre.target %s %s\n"
101 "Before=cryptsetup.target umount.target\n"
104 "RemainAfterExit=yes\n"
105 "ExecStart=" ROOTLIBEXECDIR
"/systemd-veritysetup attach root '%s' '%s' '%s'\n"
106 "ExecStop=" ROOTLIBEXECDIR
"/systemd-veritysetup detach root\n",
109 u_escaped
, v_escaped
, root_hash_escaped
);
111 r
= fflush_and_check(f
);
113 return log_error_errno(r
, "Failed to write file unit "SYSTEMD_VERITYSETUP_SERVICE
": %m");
115 to
= strjoina(arg_dest
, "/cryptsetup.target.requires/" SYSTEMD_VERITYSETUP_SERVICE
);
117 (void) mkdir_parents(to
, 0755);
118 if (symlink("../" SYSTEMD_VERITYSETUP_SERVICE
, to
) < 0)
119 return log_error_errno(errno
, "Failed to create symlink %s: %m", to
);
124 static int parse_proc_cmdline_item(const char *key
, const char *value
, void *data
) {
127 if (proc_cmdline_key_streq(key
, "systemd.verity")) {
129 r
= value
? parse_boolean(value
) : 1;
131 log_warning("Failed to parse verity= kernel command line switch %s. Ignoring.", value
);
135 } else if (proc_cmdline_key_streq(key
, "roothash")) {
137 if (proc_cmdline_value_missing(key
, value
))
140 r
= free_and_strdup(&arg_root_hash
, value
);
144 } else if (proc_cmdline_key_streq(key
, "systemd.verity_root_data")) {
146 if (proc_cmdline_value_missing(key
, value
))
149 r
= free_and_strdup(&arg_data_what
, value
);
153 } else if (proc_cmdline_key_streq(key
, "systemd.verity_root_hash")) {
155 if (proc_cmdline_value_missing(key
, value
))
158 r
= free_and_strdup(&arg_hash_what
, value
);
166 static int determine_devices(void) {
167 _cleanup_free_
void *m
= NULL
;
168 sd_id128_t root_uuid
, verity_uuid
;
173 /* Try to automatically derive the root data and hash device paths from the root hash */
178 if (arg_data_what
&& arg_hash_what
)
181 r
= unhexmem(arg_root_hash
, strlen(arg_root_hash
), &m
, &l
);
183 return log_error_errno(r
, "Failed to parse root hash: %s", arg_root_hash
);
184 if (l
< sizeof(sd_id128_t
)) {
185 log_debug("Root hash is shorter than 128 bits (32 characters), ignoring for discovering verity partition.");
189 if (!arg_data_what
) {
190 memcpy(&root_uuid
, m
, sizeof(root_uuid
));
192 arg_data_what
= path_join("/dev/disk/by-partuuid", id128_to_uuid_string(root_uuid
, ids
));
197 if (!arg_hash_what
) {
198 memcpy(&verity_uuid
, (uint8_t*) m
+ l
- sizeof(verity_uuid
), sizeof(verity_uuid
));
200 arg_hash_what
= path_join("/dev/disk/by-partuuid", id128_to_uuid_string(verity_uuid
, ids
));
208 static int run(const char *dest
, const char *dest_early
, const char *dest_late
) {
211 assert_se(arg_dest
= dest
);
213 r
= proc_cmdline_parse(parse_proc_cmdline_item
, NULL
, PROC_CMDLINE_STRIP_RD_PREFIX
);
215 return log_warning_errno(r
, "Failed to parse kernel command line: %m");
217 /* For now we only support the root device on verity. Later on we might want to add support for /etc/veritytab
218 * or similar to define additional mappings */
223 r
= determine_devices();
227 return create_device();
230 DEFINE_MAIN_GENERATOR_FUNCTION(run
);