apfs/apfstests
0
0
Fork 0
mirror of https://github.com/linux-apfs/apfstests.git synced 2026-05-01 15:01:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

generic: factor out helpers for fs-verity built-in signatures

Browse Source 
The test for retrieving a verity file's built-in signature using
FS_IOC_READ_VERITY_METADATA will need to set up a file with a built-in
signature, which requires the same commands that generic/577 does.
Factor this out into helper functions in common/verity.

Signed-off-by: Eric Biggers <ebiggers@google.com>
This commit is contained in:
Eric Biggers
2021-02-24 14:35:34 -08:00
committed by Eryu Guan
parent 976ca65307
commit c363e7a1fc
2 changed files with 39 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/verity
+36 -1
View File
@@ -48,12 +48,47 @@ _require_scratch_verity()
FSV_BLOCK_SIZE=$(get_page_size)
}
# Check for CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y.
# Check for CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y, as well as the userspace
# commands needed to generate certificates and add them to the kernel.
_require_fsverity_builtin_signatures()
{
if [ ! -e /proc/sys/fs/verity/require_signatures ]; then
_notrun "kernel doesn't support fs-verity builtin signatures"
fi
_require_command "$OPENSSL_PROG" openssl
_require_command "$KEYCTL_PROG" keyctl
}
# Use the openssl program to generate a private key and a X.509 certificate for
# use with fs-verity built-in signature verification, and convert the
# certificate to DER format.
_fsv_generate_cert()
{
local keyfile=$1
local certfile=$2
local certfileder=$3
if ! $OPENSSL_PROG req -newkey rsa:4096 -nodes -batch -x509 \
-keyout $keyfile -out $certfile &>> $seqres.full; then
_fail "Failed to generate certificate and private key (see $seqres.full)"
fi
$OPENSSL_PROG x509 -in $certfile -out $certfileder -outform der
}
# Clear the .fs-verity keyring.
_fsv_clear_keyring()
{
$KEYCTL_PROG clear %keyring:.fs-verity
}
# Load the given X.509 certificate in DER format into the .fs-verity keyring so
# that the kernel can use it to verify built-in signatures.
_fsv_load_cert()
{
local certfileder=$1
$KEYCTL_PROG padd asymmetric '' %keyring:.fs-verity \
< $certfileder >> $seqres.full
}
# Disable mandatory signatures for fs-verity files, if they are supported.
tests/generic/577
+3 -12
View File
@@ -34,8 +34,6 @@ rm -f $seqres.full
_supported_fs generic
_require_scratch_verity
_require_fsverity_builtin_signatures
_require_command "$OPENSSL_PROG" openssl
_require_command "$KEYCTL_PROG" keyctl
_scratch_mkfs_verity &>> $seqres.full
_scratch_mount
@@ -53,21 +51,14 @@ othersigfile=$tmp.othersig
echo -e "\n# Generating certificates and private keys"
for suffix in '' '.2'; do
if ! $OPENSSL_PROG req -newkey rsa:4096 -nodes -batch -x509 \
-keyout $keyfile$suffix -out $certfile$suffix \
&>> $seqres.full; then
_fail "Failed to generate certificate and private key (see $seqres.full)"
fi
$OPENSSL_PROG x509 -in $certfile$suffix -out $certfileder$suffix \
-outform der
_fsv_generate_cert $keyfile$suffix $certfile$suffix $certfileder$suffix
done
echo -e "\n# Clearing fs-verity keyring"
$KEYCTL_PROG clear %keyring:.fs-verity
_fsv_clear_keyring
echo -e "\n# Loading first certificate into fs-verity keyring"
$KEYCTL_PROG padd asymmetric '' %keyring:.fs-verity \
< $certfileder >> $seqres.full
_fsv_load_cert $certfileder
echo -e "\n# Enabling fs.verity.require_signatures"
_enable_fsverity_signatures