Implement the runsc verity-prepare command.

Implement a new runsc command to set up a sandbox with verityfs and
run the measure tool. This is loosely forked from the do command, and
currently requires the caller to provide the measure tool binary.

PiperOrigin-RevId: 366553769

7 files changed, 259 insertions, 52 deletions

diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index 67307ab3c..2b20284be 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -66,6 +66,7 @@ go_library(
         "//pkg/sentry/fsimpl/proc",
         "//pkg/sentry/fsimpl/sys",
         "//pkg/sentry/fsimpl/tmpfs",
+        "//pkg/sentry/fsimpl/verity",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel:uncaught_signal_go_proto",
diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go
index 9b3dacf46..5ef8cc039 100644
--- a/runsc/boot/vfs.go
+++ b/runsc/boot/vfs.go
@@ -16,6 +16,7 @@ package boot
 
 import (
 	"fmt"
+	"path"
 	"sort"
 	"strings"
 
@@ -37,6 +38,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/proc"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/sys"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs"
+	"gvisor.dev/gvisor/pkg/sentry/fsimpl/verity"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
@@ -83,6 +85,10 @@ func registerFilesystems(k *kernel.Kernel) error {
 		AllowUserMount: true,
 		AllowUserList:  true,
 	})
+	vfsObj.MustRegisterFilesystemType(verity.Name, &verity.FilesystemType{}, &vfs.RegisterFilesystemTypeOptions{
+		AllowUserList:  true,
+		AllowUserMount: false,
+	})
 
 	// Setup files in devtmpfs.
 	if err := memdev.Register(vfsObj); err != nil {
@@ -472,6 +478,12 @@ func (c *containerMounter) getMountNameAndOptionsVFS2(conf *config.Config, m *mo
 	var data []string
 	var iopts interface{}
 
+	verityOpts, verityRequested, remainingMOpts, err := parseVerityMountOptions(m.Options)
+	if err != nil {
+		return "", nil, false, err
+	}
+	m.Options = remainingMOpts
+
 	// Find filesystem name and FS specific data field.
 	switch m.Type {
 	case devpts.Name, devtmpfs.Name, proc.Name, sys.Name:
@@ -530,9 +542,73 @@ func (c *containerMounter) getMountNameAndOptionsVFS2(conf *config.Config, m *mo
 		}
 	}
 
+	if verityRequested {
+		verityOpts.RootMerkleFileName = path.Base(m.Mount.Destination)
+		verityOpts.LowerName = fsName
+		verityOpts.LowerGetFSOptions = opts.GetFilesystemOptions
+		fsName = verity.Name
+		opts = &vfs.MountOptions{
+			GetFilesystemOptions: vfs.GetFilesystemOptions{
+				Data:         strings.Join(data, ","),
+				InternalData: verityOpts,
+			},
+			InternalMount: true,
+		}
+	}
+
 	return fsName, opts, useOverlay, nil
 }
 
+func parseKeyValue(s string) (string, string, bool) {
+	tokens := strings.SplitN(s, "=", 2)
+	if len(tokens) < 2 {
+		return "", "", false
+	}
+	return strings.TrimSpace(tokens[0]), strings.TrimSpace(tokens[1]), true
+}
+
+// parseAndFilterOptions scans the provided mount options for verity-related
+// mount options. It returns the parsed set of verity mount options, as well as
+// the filtered set of mount options unrelated to verity.
+func parseVerityMountOptions(mopts []string) (verity.InternalFilesystemOptions, bool, []string, error) {
+	nonVerity := []string{}
+	found := false
+	verityOpts := verity.InternalFilesystemOptions{
+		Action: verity.PanicOnViolation,
+	}
+	for _, o := range mopts {
+		if !strings.HasPrefix(o, "verity.") {
+			nonVerity = append(nonVerity, o)
+			continue
+		}
+
+		k, v, ok := parseKeyValue(o)
+		if !ok {
+			return verityOpts, found, nonVerity, fmt.Errorf("invalid verity mount option with no value: %q", o)
+		}
+
+		found = true
+		switch k {
+		case "verity.roothash":
+			verityOpts.RootHash = []byte(v)
+		case "verity.action":
+			switch v {
+			case "error":
+				verityOpts.Action = verity.ErrorOnViolation
+			case "panic":
+				verityOpts.Action = verity.PanicOnViolation
+			default:
+				log.Warningf("Invalid verity action %q", v)
+				verityOpts.Action = verity.PanicOnViolation
+			}
+		default:
+			return verityOpts, found, nonVerity, fmt.Errorf("unknown verity mount option: %q", k)
+		}
+	}
+	verityOpts.AllowRuntimeEnable = len(verityOpts.RootHash) == 0
+	return verityOpts, found, nonVerity, nil
+}
+
 // mountTmpVFS2 mounts an internal tmpfs at '/tmp' if it's safe to do so.
 // Technically we don't have to mount tmpfs at /tmp, as we could just rely on
 // the host /tmp, but this is a nice optimization, and fixes some apps that call
diff --git a/runsc/cli/main.go b/runsc/cli/main.go
index a3c515f4b..6db6614cc 100644
--- a/runsc/cli/main.go
+++ b/runsc/cli/main.go
@@ -86,6 +86,7 @@ func Main(version string) {
 	subcommands.Register(new(cmd.Symbolize), "")
 	subcommands.Register(new(cmd.Wait), "")
 	subcommands.Register(new(cmd.Mitigate), "")
+	subcommands.Register(new(cmd.VerityPrepare), "")
 
 	// Register internal commands with the internal group name. This causes
 	// them to be sorted below the user-facing commands with empty group.
diff --git a/runsc/cmd/BUILD b/runsc/cmd/BUILD
index 2c3b4058b..4b9987cf6 100644
--- a/runsc/cmd/BUILD
+++ b/runsc/cmd/BUILD
@@ -35,6 +35,7 @@ go_library(
         "statefile.go",
         "symbolize.go",
         "syscalls.go",
+        "verity_prepare.go",
         "wait.go",
     ],
     visibility = [
diff --git a/runsc/cmd/do.go b/runsc/cmd/do.go
index 455c57692..5485db149 100644
--- a/runsc/cmd/do.go
+++ b/runsc/cmd/do.go
@@ -126,9 +126,8 @@ func (c *Do) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) su
 		Hostname: hostname,
 	}
 
-	specutils.LogSpec(spec)
-
 	cid := fmt.Sprintf("runsc-%06d", rand.Int31n(1000000))
+
 	if conf.Network == config.NetworkNone {
 		addNamespace(spec, specs.LinuxNamespace{Type: specs.NetworkNamespace})
 
@@ -154,55 +153,7 @@ func (c *Do) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) su
 		}
 	}
 
-	out, err := json.Marshal(spec)
-	if err != nil {
-		return Errorf("Error to marshal spec: %v", err)
-	}
-	tmpDir, err := ioutil.TempDir("", "runsc-do")
-	if err != nil {
-		return Errorf("Error to create tmp dir: %v", err)
-	}
-	defer os.RemoveAll(tmpDir)
-
-	log.Infof("Changing configuration RootDir to %q", tmpDir)
-	conf.RootDir = tmpDir
-
-	cfgPath := filepath.Join(tmpDir, "config.json")
-	if err := ioutil.WriteFile(cfgPath, out, 0755); err != nil {
-		return Errorf("Error write spec: %v", err)
-	}
-
-	containerArgs := container.Args{
-		ID:        cid,
-		Spec:      spec,
-		BundleDir: tmpDir,
-		Attached:  true,
-	}
-	ct, err := container.New(conf, containerArgs)
-	if err != nil {
-		return Errorf("creating container: %v", err)
-	}
-	defer ct.Destroy()
-
-	if err := ct.Start(conf); err != nil {
-		return Errorf("starting container: %v", err)
-	}
-
-	// Forward signals to init in the container. Thus if we get SIGINT from
-	// ^C, the container gracefully exit, and we can clean up.
-	//
-	// N.B. There is a still a window before this where a signal may kill
-	// this process, skipping cleanup.
-	stopForwarding := ct.ForwardSignals(0 /* pid */, false /* fgProcess */)
-	defer stopForwarding()
-
-	ws, err := ct.Wait()
-	if err != nil {
-		return Errorf("waiting for container: %v", err)
-	}
-
-	*waitStatus = ws
-	return subcommands.ExitSuccess
+	return startContainerAndWait(spec, conf, cid, waitStatus)
 }
 
 func addNamespace(spec *specs.Spec, ns specs.LinuxNamespace) {
@@ -397,3 +348,58 @@ func calculatePeerIP(ip string) (string, error) {
 	}
 	return fmt.Sprintf("%s.%s.%s.%d", parts[0], parts[1], parts[2], n), nil
 }
+
+func startContainerAndWait(spec *specs.Spec, conf *config.Config, cid string, waitStatus *unix.WaitStatus) subcommands.ExitStatus {
+	specutils.LogSpec(spec)
+
+	out, err := json.Marshal(spec)
+	if err != nil {
+		return Errorf("Error to marshal spec: %v", err)
+	}
+	tmpDir, err := ioutil.TempDir("", "runsc-do")
+	if err != nil {
+		return Errorf("Error to create tmp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	log.Infof("Changing configuration RootDir to %q", tmpDir)
+	conf.RootDir = tmpDir
+
+	cfgPath := filepath.Join(tmpDir, "config.json")
+	if err := ioutil.WriteFile(cfgPath, out, 0755); err != nil {
+		return Errorf("Error write spec: %v", err)
+	}
+
+	containerArgs := container.Args{
+		ID:        cid,
+		Spec:      spec,
+		BundleDir: tmpDir,
+		Attached:  true,
+	}
+
+	ct, err := container.New(conf, containerArgs)
+	if err != nil {
+		return Errorf("creating container: %v", err)
+	}
+	defer ct.Destroy()
+
+	if err := ct.Start(conf); err != nil {
+		return Errorf("starting container: %v", err)
+	}
+
+	// Forward signals to init in the container. Thus if we get SIGINT from
+	// ^C, the container gracefully exit, and we can clean up.
+	//
+	// N.B. There is a still a window before this where a signal may kill
+	// this process, skipping cleanup.
+	stopForwarding := ct.ForwardSignals(0 /* pid */, false /* fgProcess */)
+	defer stopForwarding()
+
+	ws, err := ct.Wait()
+	if err != nil {
+		return Errorf("waiting for container: %v", err)
+	}
+
+	*waitStatus = ws
+	return subcommands.ExitSuccess
+}
diff --git a/runsc/cmd/verity_prepare.go b/runsc/cmd/verity_prepare.go
new file mode 100644
index 000000000..2197cd3f8
--- /dev/null
+++ b/runsc/cmd/verity_prepare.go
@@ -0,0 +1,106 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"os"
+
+	"github.com/google/subcommands"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/runsc/config"
+	"gvisor.dev/gvisor/runsc/flag"
+	"gvisor.dev/gvisor/runsc/specutils"
+)
+
+// VerityPrepare implements subcommands.Commands for the "verity-prepare"
+// command. It sets up a sandbox with a writable verity mount mapped to "--dir",
+// and executes the verity measure tool specified by "--tool" in the sandbox. It
+// is intended to prepare --dir to be mounted as a verity filesystem.
+type VerityPrepare struct {
+	root string
+	tool string
+	dir  string
+}
+
+// Name implements subcommands.Command.Name.
+func (*VerityPrepare) Name() string {
+	return "verity-prepare"
+}
+
+// Synopsis implements subcommands.Command.Synopsis.
+func (*VerityPrepare) Synopsis() string {
+	return "Generates the data structures necessary to enable verityfs on a filesystem."
+}
+
+// Usage implements subcommands.Command.Usage.
+func (*VerityPrepare) Usage() string {
+	return "verity-prepare --tool=<measure_tool> --dir=<path>"
+}
+
+// SetFlags implements subcommands.Command.SetFlags.
+func (c *VerityPrepare) SetFlags(f *flag.FlagSet) {
+	f.StringVar(&c.root, "root", "/", `path to the root directory, defaults to "/"`)
+	f.StringVar(&c.tool, "tool", "", "path to the verity measure_tool")
+	f.StringVar(&c.dir, "dir", "", "path to the directory to be hashed")
+}
+
+// Execute implements subcommands.Command.Execute.
+func (c *VerityPrepare) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) subcommands.ExitStatus {
+	conf := args[0].(*config.Config)
+	waitStatus := args[1].(*unix.WaitStatus)
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		return Errorf("Error to retrieve hostname: %v", err)
+	}
+
+	// Map the entire host file system.
+	absRoot, err := resolvePath(c.root)
+	if err != nil {
+		return Errorf("Error resolving root: %v", err)
+	}
+
+	spec := &specs.Spec{
+		Root: &specs.Root{
+			Path: absRoot,
+		},
+		Process: &specs.Process{
+			Cwd:          absRoot,
+			Args:         []string{c.tool, "--path", "/verityroot"},
+			Env:          os.Environ(),
+			Capabilities: specutils.AllCapabilities(),
+		},
+		Hostname: hostname,
+		Mounts: []specs.Mount{
+			specs.Mount{
+				Source:      c.dir,
+				Destination: "/verityroot",
+				Type:        "bind",
+				Options:     []string{"verity.roothash="},
+			},
+		},
+	}
+
+	cid := fmt.Sprintf("runsc-%06d", rand.Int31n(1000000))
+
+	// Force no networking, it is not necessary to run the verity measure tool.
+	conf.Network = config.NetworkNone
+
+	return startContainerAndWait(spec, conf, cid, waitStatus)
+}
diff --git a/runsc/specutils/fs.go b/runsc/specutils/fs.go
index b62504a8c..9ecd0fde6 100644
--- a/runsc/specutils/fs.go
+++ b/runsc/specutils/fs.go
@@ -18,6 +18,7 @@ import (
 	"fmt"
 	"math/bits"
 	"path"
+	"strings"
 
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/sys/unix"
@@ -64,6 +65,12 @@ var optionsMap = map[string]mapping{
 	"sync":          {set: true, val: unix.MS_SYNCHRONOUS},
 }
 
+// verityMountOptions is the set of valid verity mount option keys.
+var verityMountOptions = map[string]struct{}{
+	"verity.roothash": struct{}{},
+	"verity.action":   struct{}{},
+}
+
 // propOptionsMap is similar to optionsMap, but it lists propagation options
 // that cannot be used together with other flags.
 var propOptionsMap = map[string]mapping{
@@ -117,6 +124,14 @@ func validateMount(mnt *specs.Mount) error {
 	return nil
 }
 
+func moptKey(opt string) string {
+	if len(opt) == 0 {
+		return opt
+	}
+	// Guaranteed to have at least one token, since opt is not empty.
+	return strings.SplitN(opt, "=", 2)[0]
+}
+
 // ValidateMountOptions validates that mount options are correct.
 func ValidateMountOptions(opts []string) error {
 	for _, o := range opts {
@@ -125,7 +140,8 @@ func ValidateMountOptions(opts []string) error {
 		}
 		_, ok1 := optionsMap[o]
 		_, ok2 := propOptionsMap[o]
-		if !ok1 && !ok2 {
+		_, ok3 := verityMountOptions[moptKey(o)]
+		if !ok1 && !ok2 && !ok3 {
 			return fmt.Errorf("unknown mount option %q", o)
 		}
 		if err := validatePropagation(o); err != nil {