Re: [meta-security][PATCH 0/6] Some small dm-verity improvements

Armin Kuster

On 9/7/20 10:17 AM, Niko Mauno wrote:
This set of patches addresses some small issues in dm-verity rootfs
facility, which were observed while making use of dm-verity-img.bbclass
to generate dm-verity rootfs images for real arm-based hardware. For
purposes of establishing this changeset, the default 'qemux86-64'
machine was used as a reference.

During testing/development the following additional settings were
defined in local.conf:

DM_VERITY_IMAGE = "core-image-minimal"
IMAGE_CLASSES += "dm-verity-img"
INITRAMFS_IMAGE = "dm-verity-image-initramfs"
I have used the above and added it to the gitlab-ci.

And the following command line was used to test the changes with qemu:

KERNEL=.../build/tmp/deploy/images/qemux86-64/bzImage-initramfs-qemux86-64.bin \
QB_NET=none \
runqemu \
nographic \
qemuparams="-nic none" \
qemux86-64 \
Thanks for the example. I should help in creating a selfttest.

series merged.


Niko Mauno (6):
dm-verity-img.bbclass: Fix bashisms
dm-verity-img.bbclass: Reorder parse-time check
dm-verity-image-initramfs: Fix do_rootfs dependency
dm-verity-image-initramfs: Ensure verity hash sync
dm-verity-image-initramfs: Bind at do_image instead
linux-yocto(-dev): Add dm-verity fragment as needed

classes/dm-verity-img.bbclass | 12 ++++++------
recipes-core/images/ | 7 +++++--
recipes-kernel/linux/linux-yocto-dev.bbappend | 1 +
recipes-kernel/linux/linux-yocto_5.%.bbappend | 1 +
4 files changed, 13 insertions(+), 8 deletions(-)

Join to automatically receive all group messages.