blob: 0666699b6858166227131e17a0da99e5ae22a4c2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/list.h>
#include <linux/kernel.h>
#include <linux/dm-verity-loadpin.h>
#include "dm.h"
#include "dm-core.h"
#include "dm-verity.h"
#define DM_MSG_PREFIX "verity-loadpin"
LIST_HEAD(dm_verity_loadpin_trusted_root_digests);
static bool is_trusted_verity_target(struct dm_target *ti)
{
int verity_mode;
u8 *root_digest;
unsigned int digest_size;
struct dm_verity_loadpin_trusted_root_digest *trd;
bool trusted = false;
if (!dm_is_verity_target(ti))
return false;
verity_mode = dm_verity_get_mode(ti);
if ((verity_mode != DM_VERITY_MODE_EIO) &&
(verity_mode != DM_VERITY_MODE_RESTART) &&
(verity_mode != DM_VERITY_MODE_PANIC))
return false;
if (dm_verity_get_root_digest(ti, &root_digest, &digest_size))
return false;
list_for_each_entry(trd, &dm_verity_loadpin_trusted_root_digests, node) {
if ((trd->len == digest_size) &&
!memcmp(trd->data, root_digest, digest_size)) {
trusted = true;
break;
}
}
kfree(root_digest);
return trusted;
}
/*
* Determines whether the file system of a superblock is located on
* a verity device that is trusted by LoadPin.
*/
bool dm_verity_loadpin_is_bdev_trusted(struct block_device *bdev)
{
struct mapped_device *md;
struct dm_table *table;
struct dm_target *ti;
int srcu_idx;
bool trusted = false;
if (bdev == NULL)
return false;
if (list_empty(&dm_verity_loadpin_trusted_root_digests))
return false;
md = dm_get_md(bdev->bd_dev);
if (!md)
return false;
table = dm_get_live_table(md, &srcu_idx);
if (table->num_targets != 1)
goto out;
ti = dm_table_get_target(table, 0);
if (is_trusted_verity_target(ti))
trusted = true;
out:
dm_put_live_table(md, srcu_idx);
dm_put(md);
return trusted;
}
|
