OLD | NEW |
1 #!/bin/bash | 1 #!/bin/bash |
2 # | 2 # |
3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
6 | 6 |
7 # Script to verify integrity of root file system for a GPT-based image | 7 # Script to verify integrity of root file system for a GPT-based image |
8 | 8 |
9 # --- BEGIN COMMON.SH BOILERPLATE --- | 9 # --- BEGIN COMMON.SH BOILERPLATE --- |
10 # Load common CrOS utilities. Inside the chroot this file is installed in | 10 # Load common CrOS utilities. Inside the chroot this file is installed in |
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
91 } | 91 } |
92 | 92 |
93 get_partitions | 93 get_partitions |
94 | 94 |
95 # Logic below extracted from src/platform/installer/chromeos-setimage | 95 # Logic below extracted from src/platform/installer/chromeos-setimage |
96 DUMP_KERNEL_CONFIG=/usr/bin/dump_kernel_config | 96 DUMP_KERNEL_CONFIG=/usr/bin/dump_kernel_config |
97 KERNEL_CONFIG=$(sudo "${DUMP_KERNEL_CONFIG}" "${KERNEL_IMG}") | 97 KERNEL_CONFIG=$(sudo "${DUMP_KERNEL_CONFIG}" "${KERNEL_IMG}") |
98 kernel_cfg="$(echo "${KERNEL_CONFIG}" | sed -e 's/.*dm="\([^"]*\)".*/\1/g' | | 98 kernel_cfg="$(echo "${KERNEL_CONFIG}" | sed -e 's/.*dm="\([^"]*\)".*/\1/g' | |
99 cut -f2- -d,)" | 99 cut -f2- -d,)" |
100 rootfs_sectors=$(echo ${kernel_cfg} | cut -f2 -d' ') | 100 rootfs_sectors=$(echo ${kernel_cfg} | cut -f2 -d' ') |
101 verity_depth=$(echo ${kernel_cfg} | cut -f7 -d' ') | |
102 verity_algorithm=$(echo ${kernel_cfg} | cut -f8 -d' ') | 101 verity_algorithm=$(echo ${kernel_cfg} | cut -f8 -d' ') |
103 | 102 |
104 # Compute the rootfs hash tree | 103 # Compute the rootfs hash tree |
105 VERITY=/bin/verity | 104 VERITY=/bin/verity |
106 table="vroot none ro,"$(sudo "${VERITY}" create \ | 105 # First argument to verity is reserved/unused and MUST be 0 |
107 ${verity_depth} \ | 106 table="vroot none ro,"$(sudo "${VERITY}" create 0 \ |
108 "${verity_algorithm}" \ | 107 "${verity_algorithm}" \ |
109 "${ROOTFS_IMG}" \ | 108 "${ROOTFS_IMG}" \ |
110 $((rootfs_sectors / 8)) \ | 109 $((rootfs_sectors / 8)) \ |
111 /dev/null) | 110 /dev/null) |
112 | 111 |
113 expected_hash=$(echo ${kernel_cfg} | cut -f9 -d' ') | 112 expected_hash=$(echo ${kernel_cfg} | cut -f9 -d' ') |
114 generated_hash=$(echo ${table} | cut -f2- -d, | cut -f9 -d' ') | 113 generated_hash=$(echo ${table} | cut -f2- -d, | cut -f9 -d' ') |
115 | 114 |
116 cleanup | 115 cleanup |
117 | 116 |
118 if [ "${expected_hash}" != "${generated_hash}" ]; then | 117 if [ "${expected_hash}" != "${generated_hash}" ]; then |
119 warn "expected hash = ${expected_hash}" | 118 warn "expected hash = ${expected_hash}" |
120 warn "actual hash = ${generated_hash}" | 119 warn "actual hash = ${generated_hash}" |
121 die "Root filesystem has been modified unexpectedly!" | 120 die "Root filesystem has been modified unexpectedly!" |
122 else | 121 else |
123 info "Root filesystem checksum match!" | 122 info "Root filesystem checksum match!" |
124 fi | 123 fi |
OLD | NEW |