1 #!/bin/bash
2 # SPDX-License-Identifier: GPL-2.0
3
4 set -e
5 set -u
6 set -o pipefail
7
8 VERBOSE="${SELFTESTS_VERBOSE:=0}"
9 LOG_FILE="$(mktemp /tmp/verify_sig_setup.log.XXXXXX)"
10
11 x509_genkey_content="\
12 [ req ]
13 default_bits = 2048
14 distinguished_name = req_distinguished_name
15 prompt = no
16 string_mask = utf8only
17 x509_extensions = myexts
18
19 [ req_distinguished_name ]
20 CN = eBPF Signature Verification Testing Key
21
22 [ myexts ]
23 basicConstraints=critical,CA:FALSE
24 keyUsage=digitalSignature
25 subjectKeyIdentifier=hash
26 authorityKeyIdentifier=keyid
27 "
28
29 usage()
30 {
31 echo "Usage: $0 <setup|cleanup <existing_tmp_dir>"
32 exit 1
33 }
34
35 setup()
36 {
37 local tmp_dir="$1"
38
39 echo "${x509_genkey_content}" > ${tmp_dir}/x509.genkey
40
41 openssl req -new -nodes -utf8 -sha256 -days 36500 \
42 -batch -x509 -config ${tmp_dir}/x509.genkey \
43 -outform PEM -out ${tmp_dir}/signing_key.pem \
44 -keyout ${tmp_dir}/signing_key.pem 2>&1
45
46 openssl x509 -in ${tmp_dir}/signing_key.pem -out \
47 ${tmp_dir}/signing_key.der -outform der
48
49 key_id=$(cat ${tmp_dir}/signing_key.der | keyctl padd asymmetric ebpf_testing_key @s)
50
51 keyring_id=$(keyctl newring ebpf_testing_keyring @s)
52 keyctl link $key_id $keyring_id
53 }
54
55 cleanup() {
56 local tmp_dir="$1"
57
58 keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s
59 keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s
60 rm -rf ${tmp_dir}
61 }
62
63 fsverity_create_sign_file() {
64 local tmp_dir="$1"
65
66 data_file=${tmp_dir}/data-file
67 sig_file=${tmp_dir}/sig-file
68 dd if=/dev/urandom of=$data_file bs=1 count=12345 2> /dev/null
69 fsverity sign --key ${tmp_dir}/signing_key.pem $data_file $sig_file
70
71 # We do not want to enable fsverity on $data_file yet. Try whether
72 # the file system support fsverity on a different file.
73 touch ${tmp_dir}/tmp-file
74 fsverity enable ${tmp_dir}/tmp-file
75 }
76
77 fsverity_enable_file() {
78 local tmp_dir="$1"
79
80 data_file=${tmp_dir}/data-file
81 fsverity enable $data_file
82 }
83
84 catch()
85 {
86 local exit_code="$1"
87 local log_file="$2"
88
89 if [[ "${exit_code}" -ne 0 ]]; then
90 cat "${log_file}" >&3
91 fi
92
93 rm -f "${log_file}"
94 exit ${exit_code}
95 }
96
97 main()
98 {
99 [[ $# -ne 2 ]] && usage
100
101 local action="$1"
102 local tmp_dir="$2"
103
104 [[ ! -d "${tmp_dir}" ]] && echo "Directory ${tmp_dir} doesn't exist" && exit 1
105
106 if [[ "${action}" == "setup" ]]; then
107 setup "${tmp_dir}"
108 elif [[ "${action}" == "cleanup" ]]; then
109 cleanup "${tmp_dir}"
110 elif [[ "${action}" == "fsverity-create-sign" ]]; then
111 fsverity_create_sign_file "${tmp_dir}"
112 elif [[ "${action}" == "fsverity-enable" ]]; then
113 fsverity_enable_file "${tmp_dir}"
114 else
115 echo "Unknown action: ${action}"
116 exit 1
117 fi
118 }
119
120 trap 'catch "$?" "${LOG_FILE}"' EXIT
121
122 if [[ "${VERBOSE}" -eq 0 ]]; then
123 # Save the stderr to 3 so that we can output back to
124 # it incase of an error.
125 exec 3>&2 1>"${LOG_FILE}" 2>&1
126 fi
127
128 main "$@"
129 rm -f "${LOG_FILE}"
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.