Re: [meta-security][PATCH] dm-verity-img.bbclass: Expose --data-block-size for configuration

Armin Kuster



On 9/1/21 7:18 AM, Paulo Neves wrote:
From: Christer Fletcher <christer.fletcher@...>

Add DM_VERITY_IMAGE_DATA_BLOCK_SIZE to be able to set the
--data-block-size used in veritysetup. Tuning this value effects the
performance and size of the resulting image.

Signed-off-by: Christer Fletcher <christer.fletcher@...>
Signed-off-by: Paulo Neves <paulo.neves1@...>
classes/dm-verity-img.bbclass | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/classes/dm-verity-img.bbclass b/classes/dm-verity-img.bbclass
index 16d395b..b311fc5 100644
--- a/classes/dm-verity-img.bbclass
+++ b/classes/dm-verity-img.bbclass
@@ -22,6 +22,9 @@
# is stored where it can be installed into associated initramfs rootfs.
STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity"

+# Define the data block size to use in veritysetup.
# Process the output from veritysetup and generate the corresponding .env
# file. The output from veritysetup is not very machine-friendly so we need to
# convert it to some better format. Let's drop the first line (doesn't contain
@@ -57,7 +60,7 @@ verity_setup() {

# Let's drop the first line of output (doesn't contain any useful info)
# and feed the rest to another function.
- veritysetup --data-block-size=1024 --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
+ veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity

VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity"

Join to automatically receive all group messages.