1 /* SPDX-License-Identifier: LGPL-2.1+ */
9 #include "alloc-util.h"
12 #include "fstab-util.h"
13 #include "generator.h"
14 #include "hexdecoct.h"
15 #include "id128-util.h"
17 #include "parse-util.h"
18 #include "proc-cmdline.h"
19 #include "specifier.h"
20 #include "string-util.h"
21 #include "unit-name.h"
23 #define SYSTEMD_VERITYSETUP_SERVICE "systemd-veritysetup@root.service"
25 static char *arg_dest
= NULL
;
26 static bool arg_enabled
= true;
27 static char *arg_root_hash
= NULL
;
28 static char *arg_data_what
= NULL
;
29 static char *arg_hash_what
= NULL
;
31 static int create_device(void) {
32 _cleanup_free_
char *u
= NULL
, *v
= NULL
, *d
= NULL
, *e
= NULL
, *u_escaped
= NULL
, *v_escaped
= NULL
, *root_hash_escaped
= NULL
;
33 _cleanup_fclose_
FILE *f
= NULL
;
37 /* If all three pieces of information are missing, then verity is turned off */
38 if (!arg_root_hash
&& !arg_data_what
&& !arg_hash_what
)
41 /* if one of them is missing however, the data is simply incomplete and this is an error */
43 log_error("Verity information incomplete, root hash unspecified.");
45 log_error("Verity information incomplete, root data device unspecified.");
47 log_error("Verity information incomplete, root hash device unspecified.");
49 if (!arg_root_hash
|| !arg_data_what
|| !arg_hash_what
)
52 log_debug("Using root verity data device %s,\n"
54 " and root hash %s.", arg_data_what
, arg_hash_what
, arg_root_hash
);
56 u
= fstab_node_to_udev_node(arg_data_what
);
59 v
= fstab_node_to_udev_node(arg_hash_what
);
63 u_escaped
= specifier_escape(u
);
66 v_escaped
= specifier_escape(v
);
70 r
= unit_name_from_path(u
, ".device", &d
);
72 return log_error_errno(r
, "Failed to generate unit name: %m");
73 r
= unit_name_from_path(v
, ".device", &e
);
75 return log_error_errno(r
, "Failed to generate unit name: %m");
77 root_hash_escaped
= specifier_escape(arg_root_hash
);
78 if (!root_hash_escaped
)
81 r
= generator_open_unit_file(arg_dest
, NULL
, SYSTEMD_VERITYSETUP_SERVICE
, &f
);
87 "Description=Integrity Protection Setup for %%I\n"
88 "Documentation=man:systemd-veritysetup-generator(8) man:systemd-veritysetup@.service(8)\n"
89 "SourcePath=/proc/cmdline\n"
90 "DefaultDependencies=no\n"
91 "Conflicts=umount.target\n"
93 "IgnoreOnIsolate=true\n"
94 "After=cryptsetup-pre.target %s %s\n"
95 "Before=cryptsetup.target umount.target\n"
98 "RemainAfterExit=yes\n"
99 "ExecStart=" ROOTLIBEXECDIR
"/systemd-veritysetup attach root '%s' '%s' '%s'\n"
100 "ExecStop=" ROOTLIBEXECDIR
"/systemd-veritysetup detach root\n",
103 u_escaped
, v_escaped
, root_hash_escaped
);
105 r
= fflush_and_check(f
);
107 return log_error_errno(r
, "Failed to write file unit "SYSTEMD_VERITYSETUP_SERVICE
": %m");
109 to
= strjoina(arg_dest
, "/cryptsetup.target.requires/" SYSTEMD_VERITYSETUP_SERVICE
);
111 (void) mkdir_parents(to
, 0755);
112 if (symlink("../" SYSTEMD_VERITYSETUP_SERVICE
, to
) < 0)
113 return log_error_errno(errno
, "Failed to create symlink %s: %m", to
);
118 static int parse_proc_cmdline_item(const char *key
, const char *value
, void *data
) {
121 if (streq(key
, "systemd.verity")) {
123 r
= value
? parse_boolean(value
) : 1;
125 log_warning("Failed to parse verity= kernel command line switch %s. Ignoring.", value
);
129 } else if (streq(key
, "roothash")) {
131 if (proc_cmdline_value_missing(key
, value
))
134 r
= free_and_strdup(&arg_root_hash
, value
);
138 } else if (streq(key
, "systemd.verity_root_data")) {
140 if (proc_cmdline_value_missing(key
, value
))
143 r
= free_and_strdup(&arg_data_what
, value
);
147 } else if (streq(key
, "systemd.verity_root_hash")) {
149 if (proc_cmdline_value_missing(key
, value
))
152 r
= free_and_strdup(&arg_hash_what
, value
);
160 static int determine_devices(void) {
161 _cleanup_free_
void *m
= NULL
;
162 sd_id128_t root_uuid
, verity_uuid
;
167 /* Try to automatically derive the root data and hash device paths from the root hash */
172 if (arg_data_what
&& arg_hash_what
)
175 r
= unhexmem(arg_root_hash
, strlen(arg_root_hash
), &m
, &l
);
177 return log_error_errno(r
, "Failed to parse root hash: %s", arg_root_hash
);
178 if (l
< sizeof(sd_id128_t
)) {
179 log_debug("Root hash is shorter than 128 bits (32 characters), ignoring for discovering verity partition.");
183 if (!arg_data_what
) {
184 memcpy(&root_uuid
, m
, sizeof(root_uuid
));
186 arg_data_what
= strjoin("/dev/disk/by-partuuid/", id128_to_uuid_string(root_uuid
, ids
));
191 if (!arg_hash_what
) {
192 memcpy(&verity_uuid
, (uint8_t*) m
+ l
- sizeof(verity_uuid
), sizeof(verity_uuid
));
194 arg_hash_what
= strjoin("/dev/disk/by-partuuid/", id128_to_uuid_string(verity_uuid
, ids
));
202 int main(int argc
, char *argv
[]) {
205 if (argc
> 1 && argc
!= 4) {
206 log_error("This program takes three or no arguments.");
213 log_set_prohibit_ipc(true);
214 log_set_target(LOG_TARGET_AUTO
);
215 log_parse_environment();
220 r
= proc_cmdline_parse(parse_proc_cmdline_item
, NULL
, PROC_CMDLINE_STRIP_RD_PREFIX
);
222 log_warning_errno(r
, "Failed to parse kernel command line: %m");
226 /* For now we only support the root device on verity. Later on we might want to add support for /etc/veritytab
227 * or similar to define additional mappings */
234 r
= determine_devices();
249 return r
< 0 ? EXIT_FAILURE
: EXIT_SUCCESS
;