1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
// Copyright 2021 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// This binary can be used to run a measurement of the verity file system,
// generate the corresponding Merkle tree files, and return the root hash.
package main
import (
"flag"
"io/ioutil"
"log"
"os"
"syscall"
"gvisor.dev/gvisor/pkg/abi/linux"
)
var path = flag.String("path", "", "path to the verity file system.")
const maxDigestSize = 64
type digest struct {
metadata linux.DigestMetadata
digest [maxDigestSize]byte
}
func main() {
flag.Parse()
if *path == "" {
log.Fatalf("no path provided")
}
if err := enableDir(*path); err != nil {
log.Fatalf("Failed to enable file system %s: %v", *path, err)
}
// Print the root hash of the file system to stdout.
if err := measure(*path); err != nil {
log.Fatalf("Failed to measure file system %s: %v", *path, err)
}
}
// enableDir enables verity features on all the files and sub-directories within
// path.
func enableDir(path string) error {
files, err := ioutil.ReadDir(path)
if err != nil {
return err
}
for _, file := range files {
if file.IsDir() {
// For directories, first enable its children.
if err := enableDir(path + "/" + file.Name()); err != nil {
return err
}
} else if file.Mode().IsRegular() {
// For regular files, open and enable verity feature.
f, err := os.Open(path + "/" + file.Name())
if err != nil {
return err
}
var p uintptr
if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, uintptr(f.Fd()), uintptr(linux.FS_IOC_ENABLE_VERITY), p); err != 0 {
return err
}
}
}
// Once all children are enabled, enable the parent directory.
f, err := os.Open(path)
if err != nil {
return err
}
var p uintptr
if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, uintptr(f.Fd()), uintptr(linux.FS_IOC_ENABLE_VERITY), p); err != 0 {
return err
}
return nil
}
|
