1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2 #pragma once
3
4 #include <stdbool.h>
5
6 #include "sd-id128.h"
7
8 #include "architecture.h"
9 #include "list.h"
10 #include "loop-util.h"
11 #include "macro.h"
12
13 typedef struct DissectedImage DissectedImage;
14 typedef struct DissectedPartition DissectedPartition;
15 typedef struct DecryptedImage DecryptedImage;
16 typedef struct MountOptions MountOptions;
17 typedef struct VeritySettings VeritySettings;
18
19 struct DissectedPartition {
20 bool found:1;
21 bool rw:1;
22 bool growfs:1;
23 int partno; /* -1 if there was no partition and the images contains a file system directly */
24 Architecture architecture; /* Intended architecture: either native, secondary or unset ARCHITECTURE_INVALID. */
25 sd_id128_t uuid; /* Partition entry UUID as reported by the GPT */
26 char *fstype;
27 char *node;
28 char *label;
29 char *decrypted_node;
30 char *decrypted_fstype;
31 char *mount_options;
32 uint64_t size;
33 uint64_t offset;
34 };
35
36 typedef enum PartitionDesignator {
37 PARTITION_ROOT,
38 PARTITION_ROOT_SECONDARY, /* Secondary architecture */
39 PARTITION_ROOT_OTHER,
40 PARTITION_USR,
41 PARTITION_USR_SECONDARY,
42 PARTITION_USR_OTHER,
43 PARTITION_HOME,
44 PARTITION_SRV,
45 PARTITION_ESP,
46 PARTITION_XBOOTLDR,
47 PARTITION_SWAP,
48 PARTITION_ROOT_VERITY, /* verity data for the PARTITION_ROOT partition */
49 PARTITION_ROOT_SECONDARY_VERITY, /* verity data for the PARTITION_ROOT_SECONDARY partition */
50 PARTITION_ROOT_OTHER_VERITY,
51 PARTITION_USR_VERITY,
52 PARTITION_USR_SECONDARY_VERITY,
53 PARTITION_USR_OTHER_VERITY,
54 PARTITION_ROOT_VERITY_SIG, /* PKCS#7 signature for root hash for the PARTITION_ROOT partition */
55 PARTITION_ROOT_SECONDARY_VERITY_SIG, /* ditto for the PARTITION_ROOT_SECONDARY partition */
56 PARTITION_ROOT_OTHER_VERITY_SIG,
57 PARTITION_USR_VERITY_SIG,
58 PARTITION_USR_SECONDARY_VERITY_SIG,
59 PARTITION_USR_OTHER_VERITY_SIG,
60 PARTITION_TMP,
61 PARTITION_VAR,
62 _PARTITION_DESIGNATOR_MAX,
63 _PARTITION_DESIGNATOR_INVALID = -EINVAL,
64 } PartitionDesignator;
65
PARTITION_DESIGNATOR_VERSIONED(PartitionDesignator d)66 static inline bool PARTITION_DESIGNATOR_VERSIONED(PartitionDesignator d) {
67 /* Returns true for all designators where we want to support a concept of "versioning", i.e. which
68 * likely contain software binaries (or hashes thereof) that make sense to be versioned as a
69 * whole. We use this check to automatically pick the newest version of these partitions, by version
70 * comparing the partition labels. */
71
72 return IN_SET(d,
73 PARTITION_ROOT,
74 PARTITION_ROOT_SECONDARY,
75 PARTITION_ROOT_OTHER,
76 PARTITION_USR,
77 PARTITION_USR_SECONDARY,
78 PARTITION_USR_OTHER,
79 PARTITION_ROOT_VERITY,
80 PARTITION_ROOT_SECONDARY_VERITY,
81 PARTITION_ROOT_OTHER_VERITY,
82 PARTITION_USR_VERITY,
83 PARTITION_USR_SECONDARY_VERITY,
84 PARTITION_USR_OTHER_VERITY,
85 PARTITION_ROOT_VERITY_SIG,
86 PARTITION_ROOT_SECONDARY_VERITY_SIG,
87 PARTITION_ROOT_OTHER_VERITY_SIG,
88 PARTITION_USR_VERITY_SIG,
89 PARTITION_USR_SECONDARY_VERITY_SIG,
90 PARTITION_USR_OTHER_VERITY_SIG);
91 }
92
PARTITION_VERITY_OF(PartitionDesignator p)93 static inline PartitionDesignator PARTITION_VERITY_OF(PartitionDesignator p) {
94 switch (p) {
95
96 case PARTITION_ROOT:
97 return PARTITION_ROOT_VERITY;
98
99 case PARTITION_ROOT_SECONDARY:
100 return PARTITION_ROOT_SECONDARY_VERITY;
101
102 case PARTITION_ROOT_OTHER:
103 return PARTITION_ROOT_OTHER_VERITY;
104
105 case PARTITION_USR:
106 return PARTITION_USR_VERITY;
107
108 case PARTITION_USR_SECONDARY:
109 return PARTITION_USR_SECONDARY_VERITY;
110
111 case PARTITION_USR_OTHER:
112 return PARTITION_USR_OTHER_VERITY;
113
114 default:
115 return _PARTITION_DESIGNATOR_INVALID;
116 }
117 }
118
PARTITION_VERITY_SIG_OF(PartitionDesignator p)119 static inline PartitionDesignator PARTITION_VERITY_SIG_OF(PartitionDesignator p) {
120 switch (p) {
121
122 case PARTITION_ROOT:
123 return PARTITION_ROOT_VERITY_SIG;
124
125 case PARTITION_ROOT_SECONDARY:
126 return PARTITION_ROOT_SECONDARY_VERITY_SIG;
127
128 case PARTITION_ROOT_OTHER:
129 return PARTITION_ROOT_OTHER_VERITY_SIG;
130
131 case PARTITION_USR:
132 return PARTITION_USR_VERITY_SIG;
133
134 case PARTITION_USR_SECONDARY:
135 return PARTITION_USR_SECONDARY_VERITY_SIG;
136
137 case PARTITION_USR_OTHER:
138 return PARTITION_USR_OTHER_VERITY_SIG;
139
140 default:
141 return _PARTITION_DESIGNATOR_INVALID;
142 }
143 }
144
PARTITION_ROOT_OF_ARCH(Architecture arch)145 static inline PartitionDesignator PARTITION_ROOT_OF_ARCH(Architecture arch) {
146 switch (arch) {
147
148 case native_architecture():
149 return PARTITION_ROOT;
150
151 #ifdef ARCHITECTURE_SECONDARY
152 case ARCHITECTURE_SECONDARY:
153 return PARTITION_ROOT_SECONDARY;
154 #endif
155
156 default:
157 return PARTITION_ROOT_OTHER;
158 }
159 }
160
PARTITION_USR_OF_ARCH(Architecture arch)161 static inline PartitionDesignator PARTITION_USR_OF_ARCH(Architecture arch) {
162 switch (arch) {
163
164 case native_architecture():
165 return PARTITION_USR;
166
167 #ifdef ARCHITECTURE_SECONDARY
168 case ARCHITECTURE_SECONDARY:
169 return PARTITION_USR_SECONDARY;
170 #endif
171
172 default:
173 return PARTITION_USR_OTHER;
174 }
175 }
176
177 typedef enum DissectImageFlags {
178 DISSECT_IMAGE_DEVICE_READ_ONLY = 1 << 0, /* Make device read-only */
179 DISSECT_IMAGE_DISCARD_ON_LOOP = 1 << 1, /* Turn on "discard" if on a loop device and file system supports it */
180 DISSECT_IMAGE_DISCARD = 1 << 2, /* Turn on "discard" if file system supports it, on all block devices */
181 DISSECT_IMAGE_DISCARD_ON_CRYPTO = 1 << 3, /* Turn on "discard" also on crypto devices */
182 DISSECT_IMAGE_DISCARD_ANY = DISSECT_IMAGE_DISCARD_ON_LOOP |
183 DISSECT_IMAGE_DISCARD |
184 DISSECT_IMAGE_DISCARD_ON_CRYPTO,
185 DISSECT_IMAGE_GPT_ONLY = 1 << 4, /* Only recognize images with GPT partition tables */
186 DISSECT_IMAGE_GENERIC_ROOT = 1 << 5, /* If no partition table or only single generic partition, assume it's the root fs */
187 DISSECT_IMAGE_MOUNT_ROOT_ONLY = 1 << 6, /* Mount only the root and /usr partitions */
188 DISSECT_IMAGE_MOUNT_NON_ROOT_ONLY = 1 << 7, /* Mount only the non-root and non-/usr partitions */
189 DISSECT_IMAGE_VALIDATE_OS = 1 << 8, /* Refuse mounting images that aren't identifiable as OS images */
190 DISSECT_IMAGE_VALIDATE_OS_EXT = 1 << 9, /* Refuse mounting images that aren't identifiable as OS extension images */
191 DISSECT_IMAGE_RELAX_VAR_CHECK = 1 << 10, /* Don't insist that the UUID of /var is hashed from /etc/machine-id */
192 DISSECT_IMAGE_FSCK = 1 << 11, /* File system check the partition before mounting (no effect when combined with DISSECT_IMAGE_READ_ONLY) */
193 DISSECT_IMAGE_NO_PARTITION_TABLE = 1 << 12, /* Only recognize single file system images */
194 DISSECT_IMAGE_VERITY_SHARE = 1 << 13, /* When activating a verity device, reuse existing one if already open */
195 DISSECT_IMAGE_MKDIR = 1 << 14, /* Make top-level directory to mount right before mounting, if missing */
196 DISSECT_IMAGE_USR_NO_ROOT = 1 << 15, /* If no root fs is in the image, but /usr is, then allow this (so that we can mount the rootfs as tmpfs or so */
197 DISSECT_IMAGE_REQUIRE_ROOT = 1 << 16, /* Don't accept disks without root partition (or at least /usr partition if DISSECT_IMAGE_USR_NO_ROOT is set) */
198 DISSECT_IMAGE_MOUNT_READ_ONLY = 1 << 17, /* Make mounts read-only */
199 DISSECT_IMAGE_READ_ONLY = DISSECT_IMAGE_DEVICE_READ_ONLY |
200 DISSECT_IMAGE_MOUNT_READ_ONLY,
201 DISSECT_IMAGE_GROWFS = 1 << 18, /* Grow file systems in partitions marked for that to the size of the partitions after mount */
202 DISSECT_IMAGE_MOUNT_IDMAPPED = 1 << 19, /* Mount mounts with kernel 5.12-style userns ID mapping, if file system type doesn't support uid=/gid= */
203 } DissectImageFlags;
204
205 struct DissectedImage {
206 bool encrypted:1;
207 bool has_verity:1; /* verity available in image, but not necessarily used */
208 bool has_verity_sig:1; /* pkcs#7 signature embedded in image */
209 bool verity_ready:1; /* verity available, fully specified and usable */
210 bool verity_sig_ready:1; /* verity signature logic, fully specified and usable */
211 bool single_file_system:1; /* MBR/GPT or single file system */
212
213 DissectedPartition partitions[_PARTITION_DESIGNATOR_MAX];
214
215 /* Meta information extracted from /etc/os-release and similar */
216 char *image_name;
217 char *hostname;
218 sd_id128_t machine_id;
219 char **machine_info;
220 char **os_release;
221 char **extension_release;
222 int has_init_system;
223 };
224
225 struct MountOptions {
226 PartitionDesignator partition_designator;
227 char *options;
228 LIST_FIELDS(MountOptions, mount_options);
229 };
230
231 struct VeritySettings {
232 /* Binary root hash for the Verity Merkle tree */
233 void *root_hash;
234 size_t root_hash_size;
235
236 /* PKCS#7 signature of the above */
237 void *root_hash_sig;
238 size_t root_hash_sig_size;
239
240 /* Path to the verity data file, if stored externally */
241 char *data_path;
242
243 /* PARTITION_ROOT or PARTITION_USR, depending on what these Verity settings are for */
244 PartitionDesignator designator;
245 };
246
247 #define VERITY_SETTINGS_DEFAULT { \
248 .designator = _PARTITION_DESIGNATOR_INVALID \
249 }
250
251 MountOptions* mount_options_free_all(MountOptions *options);
252 DEFINE_TRIVIAL_CLEANUP_FUNC(MountOptions*, mount_options_free_all);
253 const char* mount_options_from_designator(const MountOptions *options, PartitionDesignator designator);
254
255 int probe_filesystem(const char *node, char **ret_fstype);
256 int dissect_image(int fd, const VeritySettings *verity, const MountOptions *mount_options, uint64_t diskseq, uint64_t uevent_seqnum_not_before, usec_t timestamp_not_before, DissectImageFlags flags, DissectedImage **ret);
257 int dissect_image_and_warn(int fd, const char *name, const VeritySettings *verity, const MountOptions *mount_options, uint64_t diskseq, uint64_t uevent_seqnum_not_before, usec_t timestamp_not_before, DissectImageFlags flags, DissectedImage **ret);
258
259 DissectedImage* dissected_image_unref(DissectedImage *m);
260 DEFINE_TRIVIAL_CLEANUP_FUNC(DissectedImage*, dissected_image_unref);
261
262 int dissected_image_decrypt(DissectedImage *m, const char *passphrase, const VeritySettings *verity, DissectImageFlags flags, DecryptedImage **ret);
263 int dissected_image_decrypt_interactively(DissectedImage *m, const char *passphrase, const VeritySettings *verity, DissectImageFlags flags, DecryptedImage **ret);
264 int dissected_image_mount(DissectedImage *m, const char *dest, uid_t uid_shift, uid_t uid_range, DissectImageFlags flags);
265 int dissected_image_mount_and_warn(DissectedImage *m, const char *where, uid_t uid_shift, uid_t uid_range, DissectImageFlags flags);
266
267 int dissected_image_acquire_metadata(DissectedImage *m, DissectImageFlags extra_flags);
268
269 DecryptedImage* decrypted_image_unref(DecryptedImage *p);
270 DEFINE_TRIVIAL_CLEANUP_FUNC(DecryptedImage*, decrypted_image_unref);
271 int decrypted_image_relinquish(DecryptedImage *d);
272
273 const char* partition_designator_to_string(PartitionDesignator d) _const_;
274 PartitionDesignator partition_designator_from_string(const char *name) _pure_;
275
276 int verity_settings_load(VeritySettings *verity, const char *image, const char *root_hash_path, const char *root_hash_sig_path);
277 void verity_settings_done(VeritySettings *verity);
278
279 int dissected_image_load_verity_sig_partition(DissectedImage *m, int fd, VeritySettings *verity);
280
281 bool dissected_image_verity_candidate(const DissectedImage *image, PartitionDesignator d);
282 bool dissected_image_verity_ready(const DissectedImage *image, PartitionDesignator d);
283 bool dissected_image_verity_sig_ready(const DissectedImage *image, PartitionDesignator d);
284
285 int mount_image_privately_interactively(const char *path, DissectImageFlags flags, char **ret_directory, LoopDevice **ret_loop_device, DecryptedImage **ret_decrypted_image);
286
287 int verity_dissect_and_mount(int src_fd, const char *src, const char *dest, const MountOptions *options, const char *required_host_os_release_id, const char *required_host_os_release_version_id, const char *required_host_os_release_sysext_level, const char *required_sysext_scope);
288