From: "Q. Gylstorff" <Quirin.Gylstorff@siemens.com>
To: cip-dev@lists.cip-project.org, jan.kiszka@siemens.com
Subject: [cip-dev][isar-cip-core][RFC 0/8] Read-only root file system with dm-verity
Date: Fri, 12 Nov 2021 12:50:08 +0100 [thread overview]
Message-ID: <20211112115017.401779-1-Quirin.Gylstorff@siemens.com> (raw)
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
This patch series adds support for a read-only squashfs based root filesystem
wit SWUpdate support and secureboot.
The build is somewhat complex as we need the output of dm-verity to generate
the initramfs. The build is split in the following steps
1. We build the root file system
2. We generate a squashfs image - this can also be replace by another image format(e.g. ext4)
3. We build from the image the dm-verity partition and add it to the end of the image
4. We add the resulting verity environment to the initrd
We build the signed efi tool chain.
This series needs SWUpdate 2021.11. The necessary changes are currently backported.
Quirin Gylstorff (8):
Add new class to create a squashfs based root file system
Add classes for dm-verity based rootfs
linux-cip-common: Add options necessary for dm-verity
Create a initrd with support for dm-verity
Create an read-only rootfs with dm-verity
Create systemd mount units for a etc overlay
Mount writable home partition
swupdate: Backport patches from SWUpdate Master
classes/squashfs-img.bbclass | 42 ++++
classes/verity-img.bbclass | 73 +++++++
classes/wic-verity-img.bbclass | 23 +++
kas/opt/verity.yml | 34 ++++
.../etc-overlay-fs/etc-overlay-fs_0.1.bb | 16 ++
.../etc-overlay-fs/files/etc-hostname.service | 14 ++
.../etc-overlay-fs/files/etc-sysusers.service | 14 ++
recipes-core/etc-overlay-fs/files/etc.mount | 13 ++
.../files/overlay-parse-etc.service | 12 ++
recipes-core/etc-overlay-fs/files/postinst | 6 +
recipes-core/home-fs/files/home.mount | 11 +
recipes-core/home-fs/files/postinst | 3 +
recipes-core/home-fs/home-fs_0.1.bb | 10 +
.../images/cip-core-image-read-only.bb | 26 +++
.../0001-add-patches-for-dm-verity.patch | 188 ++++++++++++++++++
.../swupdate/swupdate_2021.04-1+debian-gbp.bb | 5 +
recipes-core/tmp-fs/files/postinst | 3 +
recipes-core/tmp-fs/files/tmp.mount | 11 +
recipes-core/tmp-fs/tmp-fs_0.1.bb | 9 +
.../cip-core-initramfs/cip-core-initramfs.bb | 16 ++
.../files/verity.conf-hook | 1 +
.../initramfs-verity-hook/files/verity.hook | 23 +++
.../initramfs-verity-hook/files/verity.script | 68 +++++++
.../initramfs-verity-hook_0.1.bb | 39 ++++
recipes-kernel/linux/files/verity.cfg | 5 +
recipes-kernel/linux/linux-cip-common.inc | 6 +
wic/qemu-amd64-read-only.wks.in | 15 ++
27 files changed, 686 insertions(+)
create mode 100644 classes/squashfs-img.bbclass
create mode 100644 classes/verity-img.bbclass
create mode 100644 classes/wic-verity-img.bbclass
create mode 100644 kas/opt/verity.yml
create mode 100644 recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb
create mode 100644 recipes-core/etc-overlay-fs/files/etc-hostname.service
create mode 100644 recipes-core/etc-overlay-fs/files/etc-sysusers.service
create mode 100644 recipes-core/etc-overlay-fs/files/etc.mount
create mode 100644 recipes-core/etc-overlay-fs/files/overlay-parse-etc.service
create mode 100755 recipes-core/etc-overlay-fs/files/postinst
create mode 100644 recipes-core/home-fs/files/home.mount
create mode 100755 recipes-core/home-fs/files/postinst
create mode 100644 recipes-core/home-fs/home-fs_0.1.bb
create mode 100644 recipes-core/images/cip-core-image-read-only.bb
create mode 100644 recipes-core/swupdate/files/0001-add-patches-for-dm-verity.patch
create mode 100755 recipes-core/tmp-fs/files/postinst
create mode 100644 recipes-core/tmp-fs/files/tmp.mount
create mode 100644 recipes-core/tmp-fs/tmp-fs_0.1.bb
create mode 100644 recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.conf-hook
create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.hook
create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.script
create mode 100644 recipes-initramfs/initramfs-verity-hook/initramfs-verity-hook_0.1.bb
create mode 100644 recipes-kernel/linux/files/verity.cfg
create mode 100644 wic/qemu-amd64-read-only.wks.in
--
2.30.2
next reply other threads:[~2021-11-12 11:50 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-12 11:50 Q. Gylstorff [this message]
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 1/8] Add new class to create a squashfs based root file system Q. Gylstorff
2021-11-12 12:41 ` Jan Kiszka
2021-11-12 11:50 ` [PATCH] recipes-core/swupdate: Update the SRC_URI and SWUPDATE_BUILD_PROFILES append for buster Q. Gylstorff
2021-11-12 11:58 ` [cip-dev] " Gylstorff Quirin
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 2/8] Add classes for dm-verity based rootfs Q. Gylstorff
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 3/8] linux-cip-common: Add options necessary for dm-verity Q. Gylstorff
2021-11-12 12:46 ` Jan Kiszka
2021-11-16 10:43 ` Gylstorff Quirin
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 4/8] Create a initrd with support " Q. Gylstorff
2021-11-12 12:47 ` Jan Kiszka
[not found] ` <39f049c6-510a-5ac4-6e73-8a865e95405e@siemens.com>
2021-11-15 18:43 ` Gylstorff Quirin
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 5/8] Create an read-only rootfs with dm-verity Q. Gylstorff
2021-11-12 12:53 ` Jan Kiszka
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 6/8] Create systemd mount units for a etc overlay Q. Gylstorff
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 7/8] Mount writable home partition Q. Gylstorff
2021-11-12 11:50 ` [cip-dev][isar-cip-core][RFC 8/8] swupdate: Backport patches from SWUpdate Master Q. Gylstorff
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211112115017.401779-1-Quirin.Gylstorff@siemens.com \
--to=quirin.gylstorff@siemens.com \
--cc=cip-dev@lists.cip-project.org \
--cc=jan.kiszka@siemens.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.