| Message ID | 20260825063713.51497-1-a-dubey@ti.com |
|---|---|
| State | Superseded |
| Delegated to: | Ryan Eatmon |
| Headers | show |
| Series | [master,1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity | expand |
meta-ti / na / 20260825063713.51497-1-a-dubey
PRC Results: FAIL
=========================================================
check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
All patches passed
=========================================================
apply-yocto-patch: PASS
=========================================================
master
=====================
Summary:
- Patch Series: [master][PATCH 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity
- Submitter: From: Atharv Dubey <a-dubey@ti.com>
- Date: Date: Tue, 25 Aug 2026 12:07:11 +0530
- Num Patches: 3
- Mailing List (public inbox) Commit SHA: ac4c9e3fbd631c591c104856a1946d2ddf20edf4
Applied to:
- Repository: lcpd-prc-meta-ti
- Base Branch: master-next
- Commit Author: LCPD Automation Script <lcpdbld@list.ti.com>
- Commit Subject: CI/CD Auto-Merger: cicd.master.202608242200
- Commit SHA: 025d1864b5f1b9849379ee0319f466abe3bf27cc
Patches
----------------------------------------
All patches applied
=========================================================
check-yocto-repo: FAIL
=========================================================
master
=====================
FAIL
WARN: .bbappend files might need a guard to make them check-layer compliant. (GUARD-1)
meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend
WARN: .bbappend files might need a guard to make them check-layer compliant. (GUARD-1)
meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend
WARN: .bbappend files might need a guard to make them check-layer compliant. (GUARD-1)
meta-ti-bsp/dynamic-layers/security-layer/recipes-tisdk/tisdk-uenv/tisdk-uenv.bbappend
WARN: Are you missing a PV = "...". (PV-1)
meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb
ERROR: SUMMARY cannot be longer than 72 characters. (SUMMARY-2)
meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
On 25/08/26 12:07, Atharv Dubey wrote: > Add an optional dynamic layer enabling dm-verity block-level integrity > verification of the root filesystem for TI K3 platforms, using > meta-security's stock dm-verity mechanism as-is. > > dm-verity hashes the rootfs at build time; at boot, a dedicated > initramfs loads the root hash and the kernel checks every block read > against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain, > hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way > circular dependency through kernel-fit-image.bbclass. > > DM_VERITY_IMAGE selects which image recipe gets verity-enabled > (default arago-base-image, overridable in local.conf); all effects are > scoped to PN == DM_VERITY_IMAGE, so building any other image type is > unaffected. Only active when the "security" layer and dm-verity-upstream > feature are enabled. > > Signed-off-by: Atharv Dubey <a-dubey@ti.com> > --- > meta-ti-bsp/conf/layer.conf | 3 +++ > meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++ > .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++ > .../udev/files/dm-verity.ignorelist | 1 + > .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++ > meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ > 6 files changed, 50 insertions(+) > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in > > diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf > index 3cc54aa4..aca35cd3 100644 > --- a/meta-ti-bsp/conf/layer.conf > +++ b/meta-ti-bsp/conf/layer.conf > @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ > LAYERRECOMMENDS_meta-ti-bsp = " \ > openembedded-layer \ > tpm-layer \ > + security \ > " > > BBFILES_DYNAMIC += " \ > openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ > tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ > tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ > + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ > + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ > " > > SIGGEN_EXCLUDERECIPES_ABISAFE += " \ > diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc > index 2ebbfb9e..e23e0ead 100644 > --- a/meta-ti-bsp/conf/machine/include/k3.inc > +++ b/meta-ti-bsp/conf/machine/include/k3.inc > @@ -64,3 +64,13 @@ FALCON_INCLUDE = "" > FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" > > require ${FALCON_INCLUDE} > + > +# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass + > +# dm-verity-image-initramfs, used as-is (build-time hashing). Only active > +# when the security layer is present and this feature is explicitly > +# requested -- see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > +DISTRO_FEATURES[validitems] += "dm-verity-upstream" > + > +DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}" > + > +require ${DM_VERITY_UPSTREAM_INCLUDE} > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > new file mode 100644 > index 00000000..4de9e2fb > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > @@ -0,0 +1,17 @@ > +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. > +DM_VERITY_IMAGE ?= "arago-base-image" > +DM_VERITY_IMAGE_TYPE = "ext4" > +IMAGE_CLASSES += "dm-verity-img" > + > +DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs" > + > +python () { > + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): > + return > + > + d.setVar('WKS_FILE', 'k3-verity.wks.in') > + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') > + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR') > + d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' % d.getVar('DM_VERITY_INITRAMFS_IMAGE')) > + d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' % (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE'))) > +} > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > new file mode 100644 > index 00000000..5af878c9 > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > @@ -0,0 +1 @@ > +/dev/mmcblk1p2 > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > new file mode 100644 > index 00000000..3940a24d > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > @@ -0,0 +1,14 @@ > +# Under dm-verity, the raw root partition looks unmounted to udev's > +# auto-mount check, so it tries to mount it a second time on its own, > +# outside of dm-verity's protection. This tells it to skip that partition. > +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" > + > +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'file://dm-verity.ignorelist', '', d)}" > + > +do_install:append() { > + if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true', 'false', d)}; then > + install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity > + fi > +} > + > +FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d" > diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in > new file mode 100644 > index 00000000..6ef2c57f > --- /dev/null > +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in > @@ -0,0 +1,5 @@ > +# Disk layout for a board that boots with dm-verity enabled. > + > +bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2 ${TI_WKS_BOOTLOADER_APPEND}" > +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M > +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 Hi All, A Gentle Reminder for a review on the patches. Regards, Atharv
On 12:07-20260825, Atharv Dubey via lists.yoctoproject.org wrote: > Add an optional dynamic layer enabling dm-verity block-level integrity > verification of the root filesystem for TI K3 platforms, using > meta-security's stock dm-verity mechanism as-is. > > dm-verity hashes the rootfs at build time; at boot, a dedicated > initramfs loads the root hash and the kernel checks every block read > against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain, > hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way > circular dependency through kernel-fit-image.bbclass. > > DM_VERITY_IMAGE selects which image recipe gets verity-enabled > (default arago-base-image, overridable in local.conf); all effects are > scoped to PN == DM_VERITY_IMAGE, so building any other image type is > unaffected. Only active when the "security" layer and dm-verity-upstream > feature are enabled. > > Signed-off-by: Atharv Dubey <a-dubey@ti.com> Hi Athrav, Thanks for the patch > --- > meta-ti-bsp/conf/layer.conf | 3 +++ > meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++ > .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++ > .../udev/files/dm-verity.ignorelist | 1 + > .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++ > meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ > 6 files changed, 50 insertions(+) > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in > > diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf > index 3cc54aa4..aca35cd3 100644 > --- a/meta-ti-bsp/conf/layer.conf > +++ b/meta-ti-bsp/conf/layer.conf > @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ > LAYERRECOMMENDS_meta-ti-bsp = " \ > openembedded-layer \ > tpm-layer \ > + security \ > " > > BBFILES_DYNAMIC += " \ > openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ > tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ > tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ > + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ > + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ > " > > SIGGEN_EXCLUDERECIPES_ABISAFE += " \ > diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc > index 2ebbfb9e..e23e0ead 100644 > --- a/meta-ti-bsp/conf/machine/include/k3.inc > +++ b/meta-ti-bsp/conf/machine/include/k3.inc > @@ -64,3 +64,13 @@ FALCON_INCLUDE = "" > FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" > > require ${FALCON_INCLUDE} > + > +# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass + > +# dm-verity-image-initramfs, used as-is (build-time hashing). Only active > +# when the security layer is present and this feature is explicitly > +# requested -- see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > +DISTRO_FEATURES[validitems] += "dm-verity-upstream" > + > +DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}" > + > +require ${DM_VERITY_UPSTREAM_INCLUDE} > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > new file mode 100644 > index 00000000..4de9e2fb > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc > @@ -0,0 +1,17 @@ > +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. > +DM_VERITY_IMAGE ?= "arago-base-image" > +DM_VERITY_IMAGE_TYPE = "ext4" > +IMAGE_CLASSES += "dm-verity-img" > + > +DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs" > + > +python () { > + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): > + return > + > + d.setVar('WKS_FILE', 'k3-verity.wks.in') > + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') > + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR') > + d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' % d.getVar('DM_VERITY_INITRAMFS_IMAGE')) > + d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' % (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE'))) > +} > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > new file mode 100644 > index 00000000..5af878c9 > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist > @@ -0,0 +1 @@ > +/dev/mmcblk1p2 > diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > new file mode 100644 > index 00000000..3940a24d > --- /dev/null > +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend > @@ -0,0 +1,14 @@ > +# Under dm-verity, the raw root partition looks unmounted to udev's > +# auto-mount check, so it tries to mount it a second time on its own, > +# outside of dm-verity's protection. This tells it to skip that partition. > +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" > + > +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'file://dm-verity.ignorelist', '', d)}" > + > +do_install:append() { > + if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true', 'false', d)}; then Add `install -d ${D}${sysconfdir}/udev/mount.ignorelist.d` before installing the file. > + install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity > + fi > +} > + > +FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d" FILES variable just adds the folder here (misses the dm-verity file) it should be `FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d/dm-verity"` > diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in > new file mode 100644 > index 00000000..6ef2c57f > --- /dev/null > +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in > @@ -0,0 +1,5 @@ > +# Disk layout for a board that boots with dm-verity enabled. > + > +bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2 ${TI_WKS_BOOTLOADER_APPEND}" root variable should not be hardcoded to `/dev/mmcblk1p2`, not all machines will use the same partition numbering. Better to use uuid. > +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M > +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 -- Yogesh
Hi Yogesh, On 03/09/26 14:07, Yogesh Hegde wrote: > On 12:07-20260825, Atharv Dubey via lists.yoctoproject.org wrote: >> Add an optional dynamic layer enabling dm-verity block-level integrity >> verification of the root filesystem for TI K3 platforms, using >> meta-security's stock dm-verity mechanism as-is. >> >> dm-verity hashes the rootfs at build time; at boot, a dedicated >> initramfs loads the root hash and the kernel checks every block read >> against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain, >> hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way >> circular dependency through kernel-fit-image.bbclass. >> >> DM_VERITY_IMAGE selects which image recipe gets verity-enabled >> (default arago-base-image, overridable in local.conf); all effects are >> scoped to PN == DM_VERITY_IMAGE, so building any other image type is >> unaffected. Only active when the "security" layer and dm-verity-upstream >> feature are enabled. >> >> Signed-off-by: Atharv Dubey <a-dubey@ti.com> > Hi Athrav, Thanks for the patch > >> --- >> meta-ti-bsp/conf/layer.conf | 3 +++ >> meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++ >> .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++ >> .../udev/files/dm-verity.ignorelist | 1 + >> .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++ >> meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ >> 6 files changed, 50 insertions(+) >> create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc >> create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist >> create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend >> create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in >> >> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf >> index 3cc54aa4..aca35cd3 100644 >> --- a/meta-ti-bsp/conf/layer.conf >> +++ b/meta-ti-bsp/conf/layer.conf >> @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ >> LAYERRECOMMENDS_meta-ti-bsp = " \ >> openembedded-layer \ >> tpm-layer \ >> + security \ >> " >> >> BBFILES_DYNAMIC += " \ >> openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ >> tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ >> tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ >> + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ >> + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ >> " >> >> SIGGEN_EXCLUDERECIPES_ABISAFE += " \ >> diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc >> index 2ebbfb9e..e23e0ead 100644 >> --- a/meta-ti-bsp/conf/machine/include/k3.inc >> +++ b/meta-ti-bsp/conf/machine/include/k3.inc >> @@ -64,3 +64,13 @@ FALCON_INCLUDE = "" >> FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" >> >> require ${FALCON_INCLUDE} >> + >> +# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass + >> +# dm-verity-image-initramfs, used as-is (build-time hashing). Only active >> +# when the security layer is present and this feature is explicitly >> +# requested -- see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc >> +DISTRO_FEATURES[validitems] += "dm-verity-upstream" >> + >> +DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}" >> + >> +require ${DM_VERITY_UPSTREAM_INCLUDE} >> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc >> new file mode 100644 >> index 00000000..4de9e2fb >> --- /dev/null >> +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc >> @@ -0,0 +1,17 @@ >> +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. >> +DM_VERITY_IMAGE ?= "arago-base-image" >> +DM_VERITY_IMAGE_TYPE = "ext4" >> +IMAGE_CLASSES += "dm-verity-img" >> + >> +DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs" >> + >> +python () { >> + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): >> + return >> + >> + d.setVar('WKS_FILE', 'k3-verity.wks.in') >> + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') >> + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR') >> + d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' % d.getVar('DM_VERITY_INITRAMFS_IMAGE')) >> + d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' % (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE'))) >> +} >> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist >> new file mode 100644 >> index 00000000..5af878c9 >> --- /dev/null >> +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist >> @@ -0,0 +1 @@ >> +/dev/mmcblk1p2 >> diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend >> new file mode 100644 >> index 00000000..3940a24d >> --- /dev/null >> +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend >> @@ -0,0 +1,14 @@ >> +# Under dm-verity, the raw root partition looks unmounted to udev's >> +# auto-mount check, so it tries to mount it a second time on its own, >> +# outside of dm-verity's protection. This tells it to skip that partition. >> +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" >> + >> +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'file://dm-verity.ignorelist', '', d)}" >> + >> +do_install:append() { >> + if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true', 'false', d)}; then > Add `install -d ${D}${sysconfdir}/udev/mount.ignorelist.d` before > installing the file. Sure will make the change in the next revision. > >> + install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity >> + fi >> +} >> + >> +FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d" > FILES variable just adds the folder here (misses the dm-verity file) it should be > `FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d/dm-verity"` Yeah, good catch will update this in next version. > >> diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in >> new file mode 100644 >> index 00000000..6ef2c57f >> --- /dev/null >> +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in >> @@ -0,0 +1,5 @@ >> +# Disk layout for a board that boots with dm-verity enabled. >> + >> +bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2 ${TI_WKS_BOOTLOADER_APPEND}" > root variable should not be hardcoded to `/dev/mmcblk1p2`, not all > machines will use the same partition numbering. Better to use uuid. Sure will do this in the next version . > >> +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M >> +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 > -- Yogesh > Thanks, Atharv
diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf index 3cc54aa4..aca35cd3 100644 --- a/meta-ti-bsp/conf/layer.conf +++ b/meta-ti-bsp/conf/layer.conf @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ LAYERRECOMMENDS_meta-ti-bsp = " \ openembedded-layer \ tpm-layer \ + security \ " BBFILES_DYNAMIC += " \ openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ " SIGGEN_EXCLUDERECIPES_ABISAFE += " \ diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc index 2ebbfb9e..e23e0ead 100644 --- a/meta-ti-bsp/conf/machine/include/k3.inc +++ b/meta-ti-bsp/conf/machine/include/k3.inc @@ -64,3 +64,13 @@ FALCON_INCLUDE = "" FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" require ${FALCON_INCLUDE} + +# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass + +# dm-verity-image-initramfs, used as-is (build-time hashing). Only active +# when the security layer is present and this feature is explicitly +# requested -- see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc +DISTRO_FEATURES[validitems] += "dm-verity-upstream" + +DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}" + +require ${DM_VERITY_UPSTREAM_INCLUDE} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc new file mode 100644 index 00000000..4de9e2fb --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc @@ -0,0 +1,17 @@ +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. +DM_VERITY_IMAGE ?= "arago-base-image" +DM_VERITY_IMAGE_TYPE = "ext4" +IMAGE_CLASSES += "dm-verity-img" + +DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs" + +python () { + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): + return + + d.setVar('WKS_FILE', 'k3-verity.wks.in') + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR') + d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' % d.getVar('DM_VERITY_INITRAMFS_IMAGE')) + d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' % (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE'))) +} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist new file mode 100644 index 00000000..5af878c9 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist @@ -0,0 +1 @@ +/dev/mmcblk1p2 diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend new file mode 100644 index 00000000..3940a24d --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend @@ -0,0 +1,14 @@ +# Under dm-verity, the raw root partition looks unmounted to udev's +# auto-mount check, so it tries to mount it a second time on its own, +# outside of dm-verity's protection. This tells it to skip that partition. +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" + +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'file://dm-verity.ignorelist', '', d)}" + +do_install:append() { + if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true', 'false', d)}; then + install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity + fi +} + +FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d" diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in new file mode 100644 index 00000000..6ef2c57f --- /dev/null +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in @@ -0,0 +1,5 @@ +# Disk layout for a board that boots with dm-verity enabled. + +bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2 ${TI_WKS_BOOTLOADER_APPEND}" +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024
Add an optional dynamic layer enabling dm-verity block-level integrity verification of the root filesystem for TI K3 platforms, using meta-security's stock dm-verity mechanism as-is. dm-verity hashes the rootfs at build time; at boot, a dedicated initramfs loads the root hash and the kernel checks every block read against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain, hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way circular dependency through kernel-fit-image.bbclass. DM_VERITY_IMAGE selects which image recipe gets verity-enabled (default arago-base-image, overridable in local.conf); all effects are scoped to PN == DM_VERITY_IMAGE, so building any other image type is unaffected. Only active when the "security" layer and dm-verity-upstream feature are enabled. Signed-off-by: Atharv Dubey <a-dubey@ti.com> --- meta-ti-bsp/conf/layer.conf | 3 +++ meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++ .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++ .../udev/files/dm-verity.ignorelist | 1 + .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++ meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ 6 files changed, 50 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in