[isar-cip-core,RFC,0/8] Read-only root file system with dm-verity

Message

Quirin Gylstorff Nov. 12, 2021, 11:50 a.m. UTC

From: Quirin Gylstorff <[e-mail]>

This patch series adds support for a read-only squashfs based root filesystem
wit SWUpdate support and secureboot.

The build is somewhat complex as we need the output of dm-verity to generate
the initramfs. The build is split in the following steps
1. We build the root file system
2. We generate a squashfs image - this can also be replace by another image format(e.g. ext4)
3. We build from the image the dm-verity partition and add it to the end of the image
4. We add the resulting verity environment to the initrd

We build the signed efi tool chain.

This series needs SWUpdate 2021.11. The necessary changes are currently backported.

Quirin Gylstorff (8):
  Add new class to create a squashfs based root file system
  Add classes for dm-verity based rootfs
  linux-cip-common: Add options necessary for dm-verity
  Create a initrd with support for dm-verity
  Create an read-only rootfs with dm-verity
  Create systemd mount units for a etc overlay
  Mount writable home partition
  swupdate: Backport patches from SWUpdate Master

 classes/squashfs-img.bbclass                  |  42 ++++
 classes/verity-img.bbclass                    |  73 +++++++
 classes/wic-verity-img.bbclass                |  23 +++
 kas/opt/verity.yml                            |  34 ++++
 .../etc-overlay-fs/etc-overlay-fs_0.1.bb      |  16 ++
 .../etc-overlay-fs/files/etc-hostname.service |  14 ++
 .../etc-overlay-fs/files/etc-sysusers.service |  14 ++
 recipes-core/etc-overlay-fs/files/etc.mount   |  13 ++
 .../files/overlay-parse-etc.service           |  12 ++
 recipes-core/etc-overlay-fs/files/postinst    |   6 +
 recipes-core/home-fs/files/home.mount         |  11 +
 recipes-core/home-fs/files/postinst           |   3 +
 recipes-core/home-fs/home-fs_0.1.bb           |  10 +
 .../images/cip-core-image-read-only.bb        |  26 +++
 .../0001-add-patches-for-dm-verity.patch      | 188 ++++++++++++++++++
 .../swupdate/swupdate_2021.04-1+debian-gbp.bb |   5 +
 recipes-core/tmp-fs/files/postinst            |   3 +
 recipes-core/tmp-fs/files/tmp.mount           |  11 +
 recipes-core/tmp-fs/tmp-fs_0.1.bb             |   9 +
 .../cip-core-initramfs/cip-core-initramfs.bb  |  16 ++
 .../files/verity.conf-hook                    |   1 +
 .../initramfs-verity-hook/files/verity.hook   |  23 +++
 .../initramfs-verity-hook/files/verity.script |  68 +++++++
 .../initramfs-verity-hook_0.1.bb              |  39 ++++
 recipes-kernel/linux/files/verity.cfg         |   5 +
 recipes-kernel/linux/linux-cip-common.inc     |   6 +
 wic/qemu-amd64-read-only.wks.in               |  15 ++
 27 files changed, 686 insertions(+)
 create mode 100644 classes/squashfs-img.bbclass
 create mode 100644 classes/verity-img.bbclass
 create mode 100644 classes/wic-verity-img.bbclass
 create mode 100644 kas/opt/verity.yml
 create mode 100644 recipes-core/etc-overlay-fs/etc-overlay-fs_0.1.bb
 create mode 100644 recipes-core/etc-overlay-fs/files/etc-hostname.service
 create mode 100644 recipes-core/etc-overlay-fs/files/etc-sysusers.service
 create mode 100644 recipes-core/etc-overlay-fs/files/etc.mount
 create mode 100644 recipes-core/etc-overlay-fs/files/overlay-parse-etc.service
 create mode 100755 recipes-core/etc-overlay-fs/files/postinst
 create mode 100644 recipes-core/home-fs/files/home.mount
 create mode 100755 recipes-core/home-fs/files/postinst
 create mode 100644 recipes-core/home-fs/home-fs_0.1.bb
 create mode 100644 recipes-core/images/cip-core-image-read-only.bb
 create mode 100644 recipes-core/swupdate/files/0001-add-patches-for-dm-verity.patch
 create mode 100755 recipes-core/tmp-fs/files/postinst
 create mode 100644 recipes-core/tmp-fs/files/tmp.mount
 create mode 100644 recipes-core/tmp-fs/tmp-fs_0.1.bb
 create mode 100644 recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
 create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.conf-hook
 create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.hook
 create mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.script
 create mode 100644 recipes-initramfs/initramfs-verity-hook/initramfs-verity-hook_0.1.bb
 create mode 100644 recipes-kernel/linux/files/verity.cfg
 create mode 100644 wic/qemu-amd64-read-only.wks.in