130 lines · bash
1#!/bin/bash2# SPDX-License-Identifier: GPL-2.03 4set -e5set -u6set -o pipefail7 8VERBOSE="${SELFTESTS_VERBOSE:=0}"9LOG_FILE="$(mktemp /tmp/verify_sig_setup.log.XXXXXX)"10 11x509_genkey_content="\12[ req ]13default_bits = 204814distinguished_name = req_distinguished_name15prompt = no16string_mask = utf8only17x509_extensions = myexts18 19[ req_distinguished_name ]20CN = eBPF Signature Verification Testing Key21 22[ myexts ]23basicConstraints=critical,CA:FALSE24keyUsage=digitalSignature25subjectKeyIdentifier=hash26authorityKeyIdentifier=keyid27"28 29usage()30{31 echo "Usage: $0 <setup|cleanup <existing_tmp_dir>"32 exit 133}34 35setup()36{37 local tmp_dir="$1"38 39 echo "${x509_genkey_content}" > ${tmp_dir}/x509.genkey40 41 openssl req -new -nodes -utf8 -sha256 -days 36500 \42 -batch -x509 -config ${tmp_dir}/x509.genkey \43 -outform PEM -out ${tmp_dir}/signing_key.pem \44 -keyout ${tmp_dir}/signing_key.pem 2>&145 46 openssl x509 -in ${tmp_dir}/signing_key.pem -out \47 ${tmp_dir}/signing_key.der -outform der48 49 key_id=$(cat ${tmp_dir}/signing_key.der | keyctl padd asymmetric ebpf_testing_key @s)50 51 keyring_id=$(keyctl newring ebpf_testing_keyring @s)52 keyctl link $key_id $keyring_id53}54 55cleanup() {56 local tmp_dir="$1"57 58 keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s59 keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s60 rm -rf ${tmp_dir}61}62 63fsverity_create_sign_file() {64 local tmp_dir="$1"65 66 data_file=${tmp_dir}/data-file67 sig_file=${tmp_dir}/sig-file68 dd if=/dev/urandom of=$data_file bs=1 count=12345 2> /dev/null69 fsverity sign --key ${tmp_dir}/signing_key.pem $data_file $sig_file70 71 # We do not want to enable fsverity on $data_file yet. Try whether72 # the file system support fsverity on a different file.73 touch ${tmp_dir}/tmp-file74 fsverity enable ${tmp_dir}/tmp-file75}76 77fsverity_enable_file() {78 local tmp_dir="$1"79 80 data_file=${tmp_dir}/data-file81 fsverity enable $data_file82}83 84catch()85{86 local exit_code="$1"87 local log_file="$2"88 89 if [[ "${exit_code}" -ne 0 ]]; then90 cat "${log_file}" >&391 fi92 93 rm -f "${log_file}"94 exit ${exit_code}95}96 97main()98{99 [[ $# -ne 2 ]] && usage100 101 local action="$1"102 local tmp_dir="$2"103 104 [[ ! -d "${tmp_dir}" ]] && echo "Directory ${tmp_dir} doesn't exist" && exit 1105 106 if [[ "${action}" == "setup" ]]; then107 setup "${tmp_dir}"108 elif [[ "${action}" == "cleanup" ]]; then109 cleanup "${tmp_dir}"110 elif [[ "${action}" == "fsverity-create-sign" ]]; then111 fsverity_create_sign_file "${tmp_dir}"112 elif [[ "${action}" == "fsverity-enable" ]]; then113 fsverity_enable_file "${tmp_dir}"114 else115 echo "Unknown action: ${action}"116 exit 1117 fi118}119 120trap 'catch "$?" "${LOG_FILE}"' EXIT121 122if [[ "${VERBOSE}" -eq 0 ]]; then123 # Save the stderr to 3 so that we can output back to124 # it incase of an error.125 exec 3>&2 1>"${LOG_FILE}" 2>&1126fi127 128main "$@"129rm -f "${LOG_FILE}"130