1 /* SPDX-License-Identifier: LGPL-2.1+ */
9 #include "alloc-util.h"
12 #include "fstab-util.h"
13 #include "generator.h"
14 #include "hexdecoct.h"
15 #include "id128-util.h"
16 #include "main-func.h"
18 #include "parse-util.h"
19 #include "proc-cmdline.h"
20 #include "specifier.h"
21 #include "string-util.h"
22 #include "unit-name.h"
24 #define SYSTEMD_VERITYSETUP_SERVICE "systemd-veritysetup@root.service"
26 static const char *arg_dest
= NULL
;
27 static bool arg_enabled
= true;
28 static char *arg_root_hash
= NULL
;
29 static char *arg_data_what
= NULL
;
30 static char *arg_hash_what
= NULL
;
32 STATIC_DESTRUCTOR_REGISTER(arg_root_hash
, freep
);
33 STATIC_DESTRUCTOR_REGISTER(arg_data_what
, freep
);
34 STATIC_DESTRUCTOR_REGISTER(arg_hash_what
, freep
);
36 static int create_device(void) {
37 _cleanup_free_
char *u
= NULL
, *v
= NULL
, *d
= NULL
, *e
= NULL
, *u_escaped
= NULL
, *v_escaped
= NULL
, *root_hash_escaped
= NULL
;
38 _cleanup_fclose_
FILE *f
= NULL
;
42 /* If all three pieces of information are missing, then verity is turned off */
43 if (!arg_root_hash
&& !arg_data_what
&& !arg_hash_what
)
46 /* if one of them is missing however, the data is simply incomplete and this is an error */
48 log_error("Verity information incomplete, root hash unspecified.");
50 log_error("Verity information incomplete, root data device unspecified.");
52 log_error("Verity information incomplete, root hash device unspecified.");
54 if (!arg_root_hash
|| !arg_data_what
|| !arg_hash_what
)
57 log_debug("Using root verity data device %s,\n"
59 " and root hash %s.", arg_data_what
, arg_hash_what
, arg_root_hash
);
61 u
= fstab_node_to_udev_node(arg_data_what
);
64 v
= fstab_node_to_udev_node(arg_hash_what
);
68 u_escaped
= specifier_escape(u
);
71 v_escaped
= specifier_escape(v
);
75 r
= unit_name_from_path(u
, ".device", &d
);
77 return log_error_errno(r
, "Failed to generate unit name: %m");
78 r
= unit_name_from_path(v
, ".device", &e
);
80 return log_error_errno(r
, "Failed to generate unit name: %m");
82 root_hash_escaped
= specifier_escape(arg_root_hash
);
83 if (!root_hash_escaped
)
86 r
= generator_open_unit_file(arg_dest
, NULL
, SYSTEMD_VERITYSETUP_SERVICE
, &f
);
92 "Description=Integrity Protection Setup for %%I\n"
93 "Documentation=man:systemd-veritysetup-generator(8) man:systemd-veritysetup@.service(8)\n"
94 "SourcePath=/proc/cmdline\n"
95 "DefaultDependencies=no\n"
96 "Conflicts=umount.target\n"
98 "IgnoreOnIsolate=true\n"
99 "After=cryptsetup-pre.target %s %s\n"
100 "Before=cryptsetup.target umount.target\n"
103 "RemainAfterExit=yes\n"
104 "ExecStart=" ROOTLIBEXECDIR
"/systemd-veritysetup attach root '%s' '%s' '%s'\n"
105 "ExecStop=" ROOTLIBEXECDIR
"/systemd-veritysetup detach root\n",
108 u_escaped
, v_escaped
, root_hash_escaped
);
110 r
= fflush_and_check(f
);
112 return log_error_errno(r
, "Failed to write file unit "SYSTEMD_VERITYSETUP_SERVICE
": %m");
114 to
= strjoina(arg_dest
, "/cryptsetup.target.requires/" SYSTEMD_VERITYSETUP_SERVICE
);
116 (void) mkdir_parents(to
, 0755);
117 if (symlink("../" SYSTEMD_VERITYSETUP_SERVICE
, to
) < 0)
118 return log_error_errno(errno
, "Failed to create symlink %s: %m", to
);
123 static int parse_proc_cmdline_item(const char *key
, const char *value
, void *data
) {
126 if (proc_cmdline_key_streq(key
, "systemd.verity")) {
128 r
= value
? parse_boolean(value
) : 1;
130 log_warning("Failed to parse verity= kernel command line switch %s. Ignoring.", value
);
134 } else if (proc_cmdline_key_streq(key
, "roothash")) {
136 if (proc_cmdline_value_missing(key
, value
))
139 r
= free_and_strdup(&arg_root_hash
, value
);
143 } else if (proc_cmdline_key_streq(key
, "systemd.verity_root_data")) {
145 if (proc_cmdline_value_missing(key
, value
))
148 r
= free_and_strdup(&arg_data_what
, value
);
152 } else if (proc_cmdline_key_streq(key
, "systemd.verity_root_hash")) {
154 if (proc_cmdline_value_missing(key
, value
))
157 r
= free_and_strdup(&arg_hash_what
, value
);
165 static int determine_devices(void) {
166 _cleanup_free_
void *m
= NULL
;
167 sd_id128_t root_uuid
, verity_uuid
;
172 /* Try to automatically derive the root data and hash device paths from the root hash */
177 if (arg_data_what
&& arg_hash_what
)
180 r
= unhexmem(arg_root_hash
, strlen(arg_root_hash
), &m
, &l
);
182 return log_error_errno(r
, "Failed to parse root hash: %s", arg_root_hash
);
183 if (l
< sizeof(sd_id128_t
)) {
184 log_debug("Root hash is shorter than 128 bits (32 characters), ignoring for discovering verity partition.");
188 if (!arg_data_what
) {
189 memcpy(&root_uuid
, m
, sizeof(root_uuid
));
191 arg_data_what
= strjoin("/dev/disk/by-partuuid/", id128_to_uuid_string(root_uuid
, ids
));
196 if (!arg_hash_what
) {
197 memcpy(&verity_uuid
, (uint8_t*) m
+ l
- sizeof(verity_uuid
), sizeof(verity_uuid
));
199 arg_hash_what
= strjoin("/dev/disk/by-partuuid/", id128_to_uuid_string(verity_uuid
, ids
));
207 static int run(const char *dest
, const char *dest_early
, const char *dest_late
) {
210 assert_se(arg_dest
= dest
);
212 r
= proc_cmdline_parse(parse_proc_cmdline_item
, NULL
, PROC_CMDLINE_STRIP_RD_PREFIX
);
214 return log_warning_errno(r
, "Failed to parse kernel command line: %m");
216 /* For now we only support the root device on verity. Later on we might want to add support for /etc/veritytab
217 * or similar to define additional mappings */
222 r
= determine_devices();
226 return create_device();
229 DEFINE_MAIN_GENERATOR_FUNCTION(run
);