2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
3 # ex: ts=8 sw=4 sts=4 et filetype=sh
7 export SYSTEMD_LOG_LEVEL
=debug
11 if [ -z "${image_dir}" ]; then
19 image_dir
="$(mktemp -d -t -p /tmp tmp.XXXXXX)"
20 if [ -z "${image_dir}" ] ||
[ ! -d "${image_dir}" ]; then
21 echo "mktemp under /tmp failed"
27 cp /usr
/share
/minimal.
* "${image_dir}/"
28 image
="${image_dir}/minimal"
29 roothash
="$(cat ${image}.roothash)"
31 /usr
/lib
/systemd
/systemd-dissect
${image}.raw |
grep -q -F "Found read-only 'root' partition of type squashfs with verity"
32 /usr
/lib
/systemd
/systemd-dissect
${image}.raw |
grep -q -F "MARKER=1"
33 /usr
/lib
/systemd
/systemd-dissect
${image}.raw |
grep -q -F -f /usr
/lib
/os-release
35 mv ${image}.verity
${image}.fooverity
36 mv ${image}.roothash
${image}.foohash
37 /usr
/lib
/systemd
/systemd-dissect
${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity |
grep -q -F "Found read-only 'root' partition of type squashfs with verity"
38 /usr
/lib
/systemd
/systemd-dissect
${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity |
grep -q -F "MARKER=1"
39 /usr
/lib
/systemd
/systemd-dissect
${image}.raw --root-hash=${roothash} --verity-data=${image}.fooverity |
grep -q -F -f /usr
/lib
/os-release
40 mv ${image}.fooverity
${image}.verity
41 mv ${image}.foohash
${image}.roothash
43 mkdir
-p ${image_dir}/mount
${image_dir}/mount2
44 /usr
/lib
/systemd
/systemd-dissect
--mount ${image}.raw
${image_dir}/mount
45 cat ${image_dir}/mount
/usr
/lib
/os-release |
grep -q -F -f /usr
/lib
/os-release
46 cat ${image_dir}/mount
/etc
/os-release |
grep -q -F -f /usr
/lib
/os-release
47 cat ${image_dir}/mount
/usr
/lib
/os-release |
grep -q -F "MARKER=1"
48 # Verity volume should be shared (opened only once)
49 /usr
/lib
/systemd
/systemd-dissect
--mount ${image}.raw
${image_dir}/mount2
50 verity_count
=$
(ls -1 /dev
/mapper
/ |
grep -c verity
)
51 # In theory we should check that count is exactly one. In practice, libdevmapper
52 # randomly and unpredictably fails with an unhelpful EINVAL when a device is open
53 # (and even mounted and in use), so best-effort is the most we can do for now
54 if [ ${verity_count} -lt 1 ]; then
55 echo "Verity device ${image}.raw not found in /dev/mapper/"
58 umount
${image_dir}/mount
59 umount
${image_dir}/mount2
61 systemd-run
-t --property RootImage
=${image}.raw
/usr
/bin
/cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
62 mv ${image}.verity
${image}.fooverity
63 mv ${image}.roothash
${image}.foohash
64 systemd-run
-t --property RootImage
=${image}.raw --property RootHash=${image}.foohash --property RootVerity=${image}.fooverity
/usr
/bin
/cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
65 systemd-run
-t --property RootImage
=${image}.raw --property RootHash=${roothash} --property RootVerity=${image}.fooverity
/usr
/bin
/cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
66 mv ${image}.fooverity
${image}.verity
67 mv ${image}.foohash
${image}.roothash
69 # Make a GPT disk on the fly, with the squashfs as partition 1 and the verity hash tree as partition 2
71 if [ "${machine}" = "x86_64" ]; then
72 root_guid
=4f68bce3-e8cd-4db1-96e7-fbcaf984b709
73 verity_guid
=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5
74 elif [ "${machine}" = "i386" ] || [ "${machine}" = "i686" ] || [ "${machine}" = "x86" ]; then
75 root_guid
=44479540-f297-41b2-9af7-d131d5f0458a
76 verity_guid
=d13c5d3b-b5d1-422a-b29f-9454fdc89d76
77 elif [ "${machine}" = "aarch64" ] || [ "${machine}" = "aarch64_be" ] || [ "${machine}" = "armv8b" ] || [ "${machine}" = "armv8l" ]; then
78 root_guid
=b921b045-1df0-41c3-af44-4c6f280d3fae
79 verity_guid
=df3300ce-d69f-4c92-978c-9bfb0f38d820
80 elif [ "${machine}" = "arm" ]; then
81 root_guid
=69dad710-2ce4-4e3c-b16c-21a1d49abed3
82 verity_guid
=7386cdf2-203c-47a9-a498-f2ecce45a2d6
83 elif [ "${machine}" = "ia64" ]; then
84 root_guid
=993d8d3d-f80e-4225-855a-9daf8ed7ea97
85 verity_guid
=86ed10d5-b607-45bb-8957-d350f23d0571
87 echo "Unexpected uname -m: ${machine} in testsuite-50.sh, please fix me"
90 # du rounds up to block size, which is more helpful for partitioning
91 root_size
="$(du -k ${image}.raw | cut -f1)"
92 verity_size
="$(du -k ${image}.verity | cut -f1)"
93 # 4MB seems to be the minimum size blkid will accept, below that probing fails
94 dd if=/dev
/zero of
=${image}.gpt bs=512 count=$((8192+${root_size}*2+${verity_size}*2))
95 # sfdisk seems unhappy if the size overflows into the next unit, eg: 1580KiB will be interpreted as 1MiB
96 # so do some basic rounding up if the minimal image is more than 1 MB
97 if [ ${root_size} -ge 1024 ]; then
98 root_size
="$((${root_size}/1024 + 1))MiB"
100 root_size
="${root_size}KiB"
102 verity_size
="${verity_size}KiB"
103 uuid
="$(head -c 32 ${image}.roothash | cut -c -8)-$(head -c 32 ${image}.roothash | cut -c 9-12)-$(head -c 32 ${image}.roothash | cut -c 13-16)-$(head -c 32 ${image}.roothash | cut -c 17-20)-$(head -c 32 ${image}.roothash | cut -c 21-)"
104 echo -e "label: gpt\nsize=${root_size}, type=${root_guid}, uuid=${uuid}" | sfdisk ${image}.gpt
105 uuid="$
(tail -c 32 ${image}.roothash | cut -c -8)-$(tail -c 32 ${image}.roothash | cut -c 9-12)-$(tail -c 32 ${image}.roothash | cut -c 13-16)-$(tail -c 32 ${image}.roothash | cut -c 17-20)-$(tail -c 32 ${image}.roothash | cut
-c 21-)"
106 echo -e "size
=${verity_size}, type=${verity_guid}, uuid=${uuid}" | sfdisk ${image}.gpt
--append
107 sfdisk
--part-label ${image}.gpt
1 "Root Partition"
108 sfdisk
--part-label ${image}.gpt
2 "Verity Partition"
109 loop
="$(losetup --show -P -f ${image}.gpt)"
110 dd if=${image}.raw of
=${loop}p1
111 dd if=${image}.verity of
=${loop}p2
114 /usr
/lib
/systemd
/systemd-dissect
--root-hash ${roothash} ${image}.gpt | grep -q "Found read-only 'root' partition (UUID $(head -c 32 ${image}.roothash
)) of
type squashfs
for .
* with verity on partition
#1"
115 /usr
/lib
/systemd
/systemd-dissect
--root-hash ${roothash} ${image}.gpt | grep -q "Found read-only 'root-verity' partition (UUID $(tail -c 32 ${image}.roothash
)) of
type DM_verity_hash
for .
* on partition
#2"
116 /usr
/lib
/systemd
/systemd-dissect
--root-hash ${roothash} ${image}.gpt |
grep -q -F "MARKER=1"
117 /usr
/lib
/systemd
/systemd-dissect
--root-hash ${roothash} ${image}.gpt |
grep -q -F -f /usr
/lib
/os-release
119 /usr
/lib
/systemd
/systemd-dissect
--root-hash ${roothash} --mount ${image}.gpt ${image_dir}/mount
120 cat ${image_dir}/mount
/usr
/lib
/os-release |
grep -q -F -f /usr
/lib
/os-release
121 cat ${image_dir}/mount
/etc
/os-release |
grep -q -F -f /usr
/lib
/os-release
122 cat ${image_dir}/mount
/usr
/lib
/os-release |
grep -q -F "MARKER=1"
123 umount
${image_dir}/mount
125 systemd-run
-t --property RootImage
=${image}.gpt
--property RootHash
=${roothash} /usr
/bin
/cat /usr
/lib
/os-release |
grep -q -F "MARKER=1"
127 systemd-run
-t --property RootImage
=${image}.raw
--property RootImageOptions
="1:ro,noatime 2:ro,dev nosuid,dev" --property MountAPIVFS
=yes mount |
grep -F "squashfs" |
grep -q -F "nosuid"
128 systemd-run
-t --property RootImage
=${image}.gpt
--property RootImageOptions
="1:ro,noatime 1:ro,dev" --property MountAPIVFS
=yes mount |
grep -F "squashfs" |
grep -q -F "noatime"
130 cat > /run
/systemd
/system
/testservice-50a.service
<<EOF
135 RootImage=${image}.raw
136 RootImageOptions=1:ro,noatime,nosuid 2:ro,dev noatime,dev
137 RootImageOptions=nosuid,dev
139 systemctl start testservice-50a.service
140 journalctl
-b -u testservice-50a.service |
grep -F "squashfs" |
grep -q -F "noatime"
141 journalctl
-b -u testservice-50a.service |
grep -F "squashfs" |
grep -q -F -v "nosuid"
143 cat > /run
/systemd
/system
/testservice-50b.service
<<EOF
148 RootImage=${image}.gpt
149 RootImageOptions=1:ro,noatime,nosuid 2:ro,dev nosuid,dev
150 RootImageOptions=2:ro,dev nosuid,dev,%%foo
152 systemctl start testservice-50b.service
153 journalctl
-b -u testservice-50b.service |
grep -F "squashfs" |
grep -q -F "noatime"
155 # Check that specifier escape is applied %%foo -> %foo
156 busctl get-property org.freedesktop.systemd1
/org
/freedesktop
/systemd
1/unit
/testservice_2d50b_2eservice org.freedesktop.systemd1.Service RootImageOptions |
grep -F "nosuid,dev,%foo"