Add script to validate kernel params before we sign images

scripts/image_signing/ensure_secure_kernelparams.sh

Index: scripts/image_signing/ensure_secure_kernelparams.sh
diff --git a/scripts/image_signing/ensure_secure_kernelparams.sh b/scripts/image_signing/ensure_secure_kernelparams.sh
new file mode 100755
index 0000000000000000000000000000000000000000..92e69d503858168abce3a429e8d079b20fadcd93
--- /dev/null
+++ b/scripts/image_signing/ensure_secure_kernelparams.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.

[gauravsh, 2011/01/26 22:55:57]

2011

+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# abort on error
+set -e
+
+# Load common constants and variables.
+. "$(dirname "$0")/common.sh"
+
+if [ $# -ne 1 ]; then
+    echo "Usage $0 <image>"

[gauravsh, 2011/01/26 22:55:57]

nit: use $PROG instead of $0 (for consistency, nothing else)

+    exit 1
+fi
+
+# Load test-expectations data from config
+. "$(dirname "$0")/${0/%.sh/.config}"

[gauravsh, 2011/01/26 22:55:57]

the substitution is a bit cryptic. I would suggest explicitly naming the
expectations file here. Better yet, make the expectation file be an argument
(maybe, optional) to the script.

+
+
+# Given a kernel boot param string which includes ...dm="dmstuff"...
+# this returns the dmstuff by itself.
+get_dmparams() {
+    echo "$1" | sed 's/^.*\ dm="\([^"]*\)".*/\1/'
+}
+
+# Given a kernel boot param string which includes ...dm="stuff"...
+# this returns the param string with the dm="..." section removed.
+# Useful in conjunction with get_dmparams to divide and process
+# the two sections of parameters in seperate passes
+kparams_remove_dm() {
+    echo "$1" | sed 's/dm="[^"]*"//'
+}
+
+# Given a dm param string which includes a long and unpredictable
+# sha1 hash, return the same string with the sha1 hash replaced
+# with a magic placeholder. This same magic placeholder is used
+# in the config file, for comparison purposes.
+dmparams_mangle_sha1() {
+    echo "$1" | sed 's/sha1 [0-9a-fA-F]*/sha1 MAGIC_HASH/'
+}
+
+# main execution starts here
+testpass=true

[gauravsh, 2011/01/26 22:55:57]

all globals should be all uppercase. if you prefer, you can encapsulate the
whole loop into a main() function and a "main $@" that starts off the main
script.

+image="$1"
+kernelblob="$(make_temp_file)"
+extract_image_partition "$image" 2 "$kernelblob"
+rootfs="$(make_temp_dir)"
+mount_image_partition_ro "$image" 3 "$rootfs"
+
+# Pick the right set of test-expectation data to use
+board=$(grep CHROMEOS_RELEASE_BOARD= "$rootfs/etc/lsb-release" | \

[gauravsh, 2011/01/26 22:55:57]

Note that this will not work on an already signed image since we change the
release board then. (x86-mario may become x86-mario-pvtkeys etc.) 

+        cut -d = -f 2 | tr - _)
+eval "required_kparams=(\${required_kparams_$board[@]})"
+eval "optional_kparams=(\${optional_kparams_$board[@]})"
+eval "required_dmparams=\"\$required_dmparams_$board\""
+
+# Divide the dm params from the rest and process seperately
+kparams="$(dump_kernel_config "$kernelblob")"

[gauravsh, 2011/01/26 22:55:57]

nit: i think you probably don't need the extra quotes around $(). There is an
unofficial chrome os sh style guide which talks about avoid excessive quoting.
Can't seem to find it now.

+dmparams="$(dmparams_mangle_sha1 "$(get_dmparams "$kparams")")"
+kparams_nodm="$(kparams_remove_dm "$kparams")"
+
+# Special-case handling of the dm= param:
+if [ "$dmparams" != "$required_dmparams" ]; then
+    echo "Kernel dm= parameter does not match expected value!"
+    echo "Expected: $required_dmparams"
+    echo "Actual:   $dmparams"
+    testpass=false
+fi
+
+# Ensure all other required params are present
+for param in ${required_kparams[@]}; do :

[gauravsh, 2011/01/26 22:55:57]

probably not a very big deal - but how will this handle changes in the order of
individual params, or repetitions. I am not sure is there are kernel options
like that - where order matters. 

+    if [[ "$kparams_nodm" != *$param* ]]; then
+        echo "Kernel parameters missing required value: $param"
+        testpass=false
+    else
+        # Remove matched params as we go. If all goes well, kparams_nodm
+        # will be nothing left but whitespace by the end.
+        kparams_nodm=${kparams_nodm/$param/}
+    fi
+done
+
+# Check-off each of the allowed-but-optional params that were present
+for param in ${optional_kparams[@]}; do :
+    kparams_nodm=${kparams_nodm/$param/}
+done
+
+# This section enforces the default-deny for any unexpected params
+# not already processed by one of the above loops.
+if [ ! -z ${kparams_nodm// /} ]; then
+    echo "Unexpected kernel parameters found: $kparams_nodm"
+    testpass=false
+fi
+
+if $testpass; then

[gauravsh, 2011/01/26 22:55:57]

instead of testpass, you could just use testfail=0 in the beginning, and set it
to 1 when a failure occurs.

then here, simply exit $testfail

+    exit 0
+else
+    exit 1
+fi