Add script to validate kernel params before we sign images

scripts/image_signing/ensure_secure_kernelparams.sh

Index: scripts/image_signing/ensure_secure_kernelparams.sh
diff --git a/scripts/image_signing/ensure_secure_kernelparams.sh b/scripts/image_signing/ensure_secure_kernelparams.sh
new file mode 100755
index 0000000000000000000000000000000000000000..72534ac550fe0adce044dfbf4129cd5f7109d440
--- /dev/null
+++ b/scripts/image_signing/ensure_secure_kernelparams.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# abort on error
+set -e
+
+# Load common constants and variables.
+. "$(dirname "$0")/common.sh"
+
+# Given a kernel boot param string which includes ...dm="dmstuff"...
+# this returns the dmstuff by itself.
+get_dmparams() {
+    echo "$1" | sed 's/^.*\ dm="\([^"]*\)".*/\1/'
+}
+
+# Given a kernel boot param string which includes ...dm="stuff"...
+# this returns the param string with the dm="..." section removed.
+# Useful in conjunction with get_dmparams to divide and process
+# the two sections of parameters in seperate passes
+kparams_remove_dm() {
+    echo "$1" | sed 's/dm="[^"]*"//'
+}
+
+# Given a dm param string which includes a long and unpredictable
+# sha1 hash, return the same string with the sha1 hash replaced
+# with a magic placeholder. This same magic placeholder is used
+# in the config file, for comparison purposes.
+dmparams_mangle_sha1() {
+    echo "$1" | sed 's/sha1 [0-9a-fA-F]*/sha1 MAGIC_HASH/'
+}
+
+usage() {
+    echo "Usage $PROG image [config]"
+}
+
+main() {
+    if [ $# -ne 1 ] && [ $# -ne 2 ]; then
+        usage
+        exit 1
+    fi
+
+    image="$1"
+
+    # Default config location: same name/directory as this script,
+    # with a .config file extension, ie ensure_secure_kernelparams.config
+    configfile="$(dirname "$0")/${0/%.sh/.config}"
+    # Or, maybe a config was provided on the command line
+    if [ $# -eq 2 ]; then
+        configfile="$2"
+    fi
+    # Either way, load test-expectations data from config
+    . "$configfile"
+
+    testfail=0

[gauravsh, 2011/01/27 22:25:59]

define this at the beginning of the function (and add a comment). 

Also, for vars that have function scope, it is a good idea to mark them clearly
as such by defining them as local. 

+    kernelblob=$(make_temp_file)
+    extract_image_partition "$image" 2 "$kernelblob"
+    rootfs=$(make_temp_dir)
+    mount_image_partition_ro "$image" 3 "$rootfs"
+
+    # Pick the right set of test-expectation data to use. This substitution
+    # turns e.g. x86-foo as a well as x86-foo-pvtkeys into "x86_foo" by
+    # grabbing the first two runs of non-hyphen characters found after '='
+    board=$(grep CHROMEOS_RELEASE_BOARD= "$rootfs/etc/lsb-release" | \
+            sed 's/.*=\([^-]*\)-\([^-]*\).*/\1_\2/')

[gauravsh, 2011/01/27 22:25:59]

cut -f 1-2 -d '-' | sed -e s/-/_/ maybe a tad bit easier to to read than the sed
command. your call. :)

+    eval "required_kparams=(\${required_kparams_$board[@]})"
+    eval "optional_kparams=(\${optional_kparams_$board[@]})"
+    eval "required_dmparams=\"\$required_dmparams_$board\""
+
+    # Divide the dm params from the rest and process seperately
+    kparams=$(dump_kernel_config "$kernelblob")
+    dmparams=$(dmparams_mangle_sha1 "$(get_dmparams "$kparams")")
+    kparams_nodm=$(kparams_remove_dm "$kparams")
+
+    # Special-case handling of the dm= param:
+    if [ "$dmparams" != "$required_dmparams" ]; then
+        echo "Kernel dm= parameter does not match expected value!"
+        echo "Expected: $required_dmparams"
+        echo "Actual:   $dmparams"
+        testfail=1
+    fi
+
+    # Ensure all other required params are present

[gauravsh, 2011/01/27 22:25:59]

nit: general comment about comments - typically all comment sentences must end
in a period.

+    for param in ${required_kparams[@]}; do :
+        if [[ "$kparams_nodm" != *$param* ]]; then

[gauravsh, 2011/01/27 22:25:59]

nit: use one of either [ ] or [[ ]]. recommended is to just use [ ]

+            echo "Kernel parameters missing required value: $param"
+            testfail=1
+        else
+            # Remove matched params as we go. If all goes well, kparams_nodm
+            # will be nothing left but whitespace by the end.
+            kparams_nodm=${kparams_nodm/$param/}
+        fi
+    done
+
+    # Check-off each of the allowed-but-optional params that were present
+    for param in ${optional_kparams[@]}; do :
+        kparams_nodm=${kparams_nodm/$param/}
+    done
+
+    # This section enforces the default-deny for any unexpected params
+    # not already processed by one of the above loops.
+    if [ ! -z ${kparams_nodm// /} ]; then
+        echo "Unexpected kernel parameters found: $kparams_nodm"
+        testfail=1
+    fi
+
+    exit $testfail
+}
+
+main $@