On 12:07-20260825, Atharv Dubey via lists.yoctoproject.org wrote:
> Add an optional dynamic layer enabling dm-verity block-level integrity
> verification of the root filesystem for TI K3 platforms, using
> meta-security's stock dm-verity mechanism as-is.
>
> dm-verity hashes the rootfs at build time; at boot, a dedicated
> initramfs loads the root hash and the kernel checks every block read
> against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain,
> hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way
> circular dependency through kernel-fit-image.bbclass.
>
> DM_VERITY_IMAGE selects which image recipe gets verity-enabled
> (default arago-base-image, overridable in local.conf); all effects are
> scoped to PN == DM_VERITY_IMAGE, so building any other image type is
> unaffected. Only active when the "security" layer and dm-verity-upstream
> feature are enabled.
>
> Signed-off-by: Atharv Dubey <[email protected]>
Hi Athrav, Thanks for the patch
> ---
> meta-ti-bsp/conf/layer.conf | 3 +++
> meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++
> .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++
> .../udev/files/dm-verity.ignorelist | 1 +
> .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++
> meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++
> 6 files changed, 50 insertions(+)
> create mode 100644
> meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> create mode 100644
> meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist
> create mode 100644
> meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in
>
> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> index 3cc54aa4..aca35cd3 100644
> --- a/meta-ti-bsp/conf/layer.conf
> +++ b/meta-ti-bsp/conf/layer.conf
> @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
> LAYERRECOMMENDS_meta-ti-bsp = " \
> openembedded-layer \
> tpm-layer \
> + security \
> "
>
> BBFILES_DYNAMIC += " \
>
> openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend
> \
> tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \
> tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \
> + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \
> + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend
> \
> "
>
> SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> diff --git a/meta-ti-bsp/conf/machine/include/k3.inc
> b/meta-ti-bsp/conf/machine/include/k3.inc
> index 2ebbfb9e..e23e0ead 100644
> --- a/meta-ti-bsp/conf/machine/include/k3.inc
> +++ b/meta-ti-bsp/conf/machine/include/k3.inc
> @@ -64,3 +64,13 @@ FALCON_INCLUDE = ""
> FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc"
>
> require ${FALCON_INCLUDE}
> +
> +# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass +
> +# dm-verity-image-initramfs, used as-is (build-time hashing). Only active
> +# when the security layer is present and this feature is explicitly
> +# requested -- see
> dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> +DISTRO_FEATURES[validitems] += "dm-verity-upstream"
> +
> +DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES',
> 'dm-verity-upstream',
> 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}"
> +
> +require ${DM_VERITY_UPSTREAM_INCLUDE}
> diff --git
> a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
>
> b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> new file mode 100644
> index 00000000..4de9e2fb
> --- /dev/null
> +++
> b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
> @@ -0,0 +1,17 @@
> +# Enables dm-verity to check the rootfs for tampering on TI K3 boards.
> +DM_VERITY_IMAGE ?= "arago-base-image"
> +DM_VERITY_IMAGE_TYPE = "ext4"
> +IMAGE_CLASSES += "dm-verity-img"
> +
> +DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs"
> +
> +python () {
> + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'):
> + return
> +
> + d.setVar('WKS_FILE', 'k3-verity.wks.in')
> + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs')
> + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE
> IMAGE_NAME_SUFFIX IMGDEPLOYDIR')
> + d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' %
> d.getVar('DM_VERITY_INITRAMFS_IMAGE'))
> + d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' %
> (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE')))
> +}
> diff --git
> a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist
>
> b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist
> new file mode 100644
> index 00000000..5af878c9
> --- /dev/null
> +++
> b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist
> @@ -0,0 +1 @@
> +/dev/mmcblk1p2
> diff --git
> a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
>
> b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> new file mode 100644
> index 00000000..3940a24d
> --- /dev/null
> +++
> b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
> @@ -0,0 +1,14 @@
> +# Under dm-verity, the raw root partition looks unmounted to udev's
> +# auto-mount check, so it tries to mount it a second time on its own,
> +# outside of dm-verity's protection. This tells it to skip that partition.
> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
> +
> +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream',
> 'file://dm-verity.ignorelist', '', d)}"
> +
> +do_install:append() {
> + if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true',
> 'false', d)}; then
Add `install -d ${D}${sysconfdir}/udev/mount.ignorelist.d` before
installing the file.
> + install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist
> ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity
> + fi
> +}
> +
> +FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d"
FILES variable just adds the folder here (misses the dm-verity file) it should
be
`FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d/dm-verity"`
> diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in
> b/meta-ti-bsp/files/wic/k3-verity.wks.in
> new file mode 100644
> index 00000000..6ef2c57f
> --- /dev/null
> +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in
> @@ -0,0 +1,5 @@
> +# Disk layout for a board that boots with dm-verity enabled.
> +
> +bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2
> ${TI_WKS_BOOTLOADER_APPEND}"
root variable should not be hardcoded to `/dev/mmcblk1p2`, not all
machines will use the same partition numbering. Better to use uuid.
> +part --source bootimg-efi
> --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz"
> --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M
> +part / --source rawcopy
> --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity"
> --align 1024
-- Yogesh
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#20324):
https://lists.yoctoproject.org/g/meta-ti/message/20324
Mute This Topic: https://lists.yoctoproject.org/mt/120916929/21656
Group Owner: [email protected]
Unsubscribe: https://lists.yoctoproject.org/g/meta-ti/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
