Re: [Buildroot] [PATCH next 1/3] fs/common.mk: add optional hook to build a verity hash tree

[Fiona Klute via buildroot <buildroot@buildroot.org>]

Am 01.09.26 um 13:38 schrieb Peter Korsgaard:
>>>>>> "Fiona" == Fiona Klute <fiona.klute@gmx.de> writes:
> 
> Hi,
> 
>   >> Possibly, but should that then be per-fs or global? I wonder if it
>   >> is
>   >> worth the complexity to add this logic versus how fairly simple it is to
>   >> just do it with whatever options you want in a post-image script.
> 
>   > I'd say per-fs. The logic could be shared like the general veritysetup
>   > call, just the option would need to be added for each fs (in
>   > Config.in). I don't think Kconfig has a kind of templating for that?
> 
>   > I agree running veritysetup in a post-image script isn't very
>   > complicated. Where I'm actually trying to do is to have the roothash
>   > of my rootfs before building an initramfs (using
>   > BR2_TARGET_ROOTFS_CPIO_DRACUT), so it can be included (and signed
>   > along with the initramfs, in my case in a FIT image). Of course these
>   > patches don't achieve that, they'd just provide the roothash as a
>   > start.
> 
>   > If you have a better idea how to do that I'm all ears.
> 
> The way I have solved it in the past is to use "late" binding between
> the kernel and rootfs, E.G. only when I build the FIT image by sticking
> the root hash into a u-boot boot script that I generate in my post-image
> script and embed in the FIT.

That's exactly what I'm doing for now, with a config for the script in 
the FIT image running "source $loadaddr#set-roothash" works, but it 
seems kind of convoluted. Especially given Dracut explicitly provides 
the option to embed command line options in the initramfs. :D

>   > script can't do it (rootfs image isn't ready), post-image doesn't have
>   > the fakeroot environment for running Dracut (and other setup [1]).
>   > Maybe we should move building initramfs to a separate stage, after
>   > rootfs (I'd definitely need to order cpio after other fs types), and
>   > add a pre-initramfs script? Is there another non-messy way to use the
>   > fakeroot environment and variables from Buildroot config that I've
>   > missed so far (other than rules in external.mk)?
> 
> Initramfs is indeed annoying because of the circular dependencies. It
> has been quite a while since I last used one. Out of interest, what do
> you need the initramfs for?
Right now for setting up that dm-verity device, in the future probably 
dm-crypt, too. If it was *only* dm-verity I could use dm-mod.create 
(assemble parameters like in the test in post-image) and let the kernel 
handle the rest. Systemd has a bunch of automation for it, which is why 
I've been working on fixing Dracut. ;-)

We don't really need the circular dependency, we just have to order the 
initramfs after the rootfs. Kinda crude, but works (in external.mk):

$(BINARIES_DIR)/rootfs.cpio: $(BINARIES_DIR)/rootfs.squashfs

My general idea so far is to add something similar (but generic) 
conditional on BR2_TARGET_ROOTFS_CPIO_DRACUT=y. We might still need a 
script hook, but maybe a custom Dracut module would be enough (e.g. 
build a veritytab/crypttab and install it in the initramfs). I'm still 
working this out. :-)

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot