Uma ukhathazekile ngobuqotho besistimu yakho, I-dm-verity ingenye yezingcezu ezibalulekile ze-Linux ecosystem ukuqalisa ngokuphepha nokubona ukuphazamiseka kwesitoreji. Iqhamuke njengengxenye yemephu yedivayisi ye-kernel futhi manje isiyisisekelo sokuqalwa kabusha okuqinisekisiwe ku-Android, i-OpenWrt, kanye nokusabalalisa okudinga ukuvikeleka okuthuthukisiwe.
Kude nokuba umqondo ongabonakali, I-dm-verity imisiwe futhi isetshenziswa ngamathuluzi angempela afana ne-veritysetup kanye ne-systemd-veritysetupIqinisekisa amabhulokhi endizeni isebenzisa izihlahla ze-hashi futhi ingasabela enkohlakalweni ngezinqubomgomo ezisukela ekulobeni umcimbi kuye ekuqaliseni kabusha noma ukuphahlazeka kwesistimu. Ake sibhekisise, ngaphandle kokushiya iziphetho ezixekethile.
Iyini i-dm-verity nokuthi kungani ungase uyikhathalele
I-dm-verity iyithagethi ye-device-mapper ku-kernel leyo iqinisekisa ubuqotho bedivayisi yokuvimba njengoba idatha ifundwaIsebenza ngokubala nokuqinisekisa ama-hashi ebhulokhi ngayinye (imvamisa engu-4K) ngokumelene nesihlahla se-hashi esenziwe ngekhompuyutha ngaphambili, ngokuvamile sisebenzisa i-SHA-256.
Lo mklamo uvumela Amafayela awakwazi ukuguqulwa buthule phakathi kokuqaliswa kabusha noma phakathi nokusetshenziswaKuwukhiye wokwelula uchungechunge lokuqalisa lokwethemba kusistimu yokusebenza, ukukhawulela ukuphikelela kwe-malware, ukuqinisa izinqubomgomo zokuphepha, kanye nokuqinisekisa ukubethela kanye nezindlela ze-MAC ngesikhathi sokuqalisa.
Ku-Android (kusukela ku-4.4) kanye ne-Linux jikelele, Ukwethenjwa kugxilile empandeni yempande yesihlahla, esisayinwe futhi saqinisekiswa ngokhiye osesidlangalaleni otholakala endaweni evikelekile (isb., engxenyeni yokuqalisa noma ku-UKI Esayinwe Nge-Boot Evikelekile). Ukwephula noma yiliphi ibhulokhi kuzodinga ukwephula i-cryptographic hash eyisisekelo.
Ukuqinisekisa kwenziwa nge-block futhi ngokufunwa: Ukubambezeleka okungeziwe kuncane uma kuqhathaniswa nezindleko ze-I/OUma isheke lihluleka, i-kernel ibuyisela iphutha le-I/O futhi isistimu yefayela ibonakala yonakalisiwe, okulindeleke lapho idatha ingathembeki. Izinhlelo zokusebenza zinganquma ukuthi ziqhubeke noma zingaqhubeki ngokusekelwe ekubekezeleleni kwazo amaphutha.
Isihlahla sokuqinisekisa sisebenza kanjani ngaphakathi
Isihlahla sokuqinisekisa sakhiwe ngezingqimba. Isendlalelo esingu-0 yidatha eluhlaza evela kudivayisi, ehlukaniswe ngamabhulokhi angu-4K; i-SHA-256 (enosawoti) hashi ibalwa kubhulokhi ngayinye. Lawa ma hashi abe esehlanganiswa ukuze akhe ungqimba 1. Ungqimba 1 lube seluhlanganiswa lube amabhulokhi futhi luvuselelwe kabusha ukuze lwakhe ungqimba 2, njalo njalo kuze kube yilapho yonke into ingena ebhulokhini elilodwa: lelobhulokhi, lapho lisheshisiwe, likhiqiza ihashi eliyimpande.
Uma noma yisiphi isendlalelo singaqedi ncamashi ibhulokhi, Ihlanganiswe ngoziro ize ifike ku-4K ukugwema ukungaqondakali. Ubukhulu obuphelele bomuthi buncike kusayizi wokuhlukanisa okuhlolwayo; empeleni, ivamise ukuba ngaphansi kuka-30 MB kuma-partitions wesistimu ajwayelekile.
Inqubo evamile yile: khetha usawoti ongahleliwe, hashi ukuya ku-4K, bala i-SHA-256 ngosawoti webhulokhi ngayinye, ihlanganisa ukwenza amaleveli, iphedisha umngcele webhulokhi ngoziro, futhi iphinda ngeleveli yangaphambilini kuze kushiywe impande eyodwa. Leyo hashi yempande, kanye nosawoti osetshenzisiwe, iphakela ithebula le-dm-verity kanye nesiginesha.
Izinguqulo zefomethi yediski kanye ne-algorithm
Ifomethi yama-hash blocks kudiski inenguqulo. Inguqulo engu-0 kwakuyinguqulo yoqobo esetshenziswe ku-Chromium OS: Usawoti wengezwa ekupheleni kwenqubo ye-hashing, ukugaya kugcinwa ngokuqhubekayo, futhi yonke ingxenye ye-block ihlanganiswe nama-zero.
La Inguqulo 1 inconywa kumadivayisi amasha: Usawoti unqunyelwe ku-hashi, futhi inhlabamkhosi ngayinye ihlanganiswe ngoziro kuze kufike emandleni amabili, okuthuthukisa ukuqondana nokuqina. Ithebula le-dm-verity liphinde licacise i-algorithm (isb., sha1 noma sha256), nakuba ngokuvikeleka kwamanje, i-sha256 iyasetshenziswa.
Ithebula le-dm-verity kanye nemingcele ebalulekile
Ithebula eliqondiwe elithi dm-verity liyachaza lapho idatha ikuphi, lapho isihlahla se-hashi sikhona, nendlela yokuqinisekisaIzinkambu zethebula ezijwayelekile:
- dev: idivayisi enedatha ezoqinisekiswa (uhlobo lwendlela /dev/sdXN noma enkulu: encane).
- hash_dev: idivayisi enesihlahla se-hashi (ingafana; uma kunjalo, i-hash_start kumelwe ibe ngaphandle kwebanga elihloliwe).
- Data_block_size: usayizi webhulokhi yedatha ngamabhayithi (isb. 4096).
- hash_block_size: usayizi we-hash block ngamabhayithi.
- inani_lokuvimba_kwedatha: inombolo yamabhulokhi edatha angaqinisekiswa.
- hash_start_block: i-offset (kumabhulokhi we-hash_block_size) kuya emvinini yesihlahla.
- algorithm: i-algorithm ye-hash (isb. sha256).
- gaya: umbhalo we-hexadecimal we-root block hashi (kuhlanganise nosawoti ngokuya ngenguqulo yefomethi); leli nani yilo okumele ulithembe.
- usawoti: usawoti we-hexadecimal.
Ngaphezu kwalokho, kukhona imingcele ozikhethela kuwusizo kakhulu ukulungisa ukuziphatha:
- indiva_inkohlakalo: Irekhoda amabhlogo akhohlakele, kodwa ivumela ukufunda ukuthi kuqhubeke.
- qala kabusha_ekonakaleni: qala kabusha ekutholweni kwenkohlakalo (ayihambisani ne-ignorry_corruption futhi idinga usekelo lwendawo yomsebenzisi ukuze ugweme amalophu).
- ukwethuka_ngenkohlakalo: : ibangela ukwethuka lapho ithola inkohlakalo (ayihambisani nezinguqulo zangaphambilini).
- qala kabusha_on_iphutha y ukwethuka_ngephutha: ukusabela okufanayo kodwa ngamaphutha e-I/O.
- indiva_iziro_blocks: ayihloli amabhulokhi alindelwe njengoziro futhi ibuyisela oziro.
- use_fec_from_device + fec_roots + ama-fec_blocks + fec_start: Nika amandla i-Reed–Solomon (FEC) ukuze ibuyisele idatha lapho ukuqinisekiswa kwehluleka; idatha, i-hashi, nezindawo ze-FEC akumele zidlulelane, futhi osayizi bebhulokhi kufanele bafane.
- hlola_kakhulu_kanye: Ihlola ibhulokhi ngayinye yedatha kuphela lapho ifundwa okokuqala (yehlisa phezulu ngezindleko zokuphepha ekuhlaselweni okubukhoma).
- impande_hash_sig_key_desc: Ireferensi kukhiye ekufakweni kokhiye ukuze kuqinisekiswe isiginesha ye-PKCS7 ye-hashi yempande lapho udala ukuqoshwa kwemephu (idinga ukucushwa kwe-kernel okufanelekile nama-keyrings athenjwayo).
- try_verify_in_tasklet: Uma ama-hashes egcinwe futhi usayizi we-I/O uvumela, hlola ingxenye engezansi ukuze unciphise ukubambezeleka; kulungiswe nge-/sys/module/dm_verity/parameters/use_bh_bytes ngekilasi le-I/O ngalinye.
Isiginesha, imethadatha kanye ne-trust anchoring
Ukuze i-dm-verity ithembeke, Ihashi lempande kufanele lithenjwe futhi ngokuvamile lisayinweKu-Android yakudala, ukhiye osesidlangalaleni ufakiwe ekuhlukaniseni ukuqalisa, okuqinisekiswa ngaphandle komkhiqizi; iqinisekisa isiginesha ye-hashi yezimpande futhi iqinisekisa ukuthi ukuhlukaniswa kwesistimu akushintshiwe.
Imethadatha ye-Verity ingeza isakhiwo nokulawula inguqulo. Ibhulokhi yemethadatha ihlanganisa inombolo yomlingo 0xb001b001 (amabhayithi b0 01 b0 01), inguqulo (okwamanje 0), isiginesha yetafula ku-PKCS1.5 (imvamisa engamabhayithi angu-256 ku-RSA-2048), ubude betafula, ithebula ngokwalo kanye neziro zokupheqa kufika ku-32K.
Ekusetshenzisweni kwe-Android, ukuqinisekiswa kuncike fs_mgr futhi fstab: Ukwengeza umaki wokuhlola kokufakiwe okuhambisanayo nokubeka ukhiye ku-/boot/verity_key. Uma inombolo yomlingo ingekho lapho kufanele ibe khona, ukuqinisekiswa kuyama ukuze kugwenywe ukuhlola into engalungile.
Ukusebenza kokuqala kuqinisekisiwe
Ukuvikelwa kuhlala ku-kernel: Uma konakele ngaphambi kwe-kernel boots, umhlaseli ugcina ukulawulaYingakho abakhiqizi ngokuvamile beqinisekisa ngokuqinile isigaba ngasinye: ukhiye oshiswe kudivayisi uqinisekisa i-bootloader yokuqala, eqinisekisa okulandelayo, i-bootloader yohlelo lokusebenza, futhi ekugcineni, i-kernel.
Nge-kernel eqinisekisiwe, I-dm-verity inikwe amandla uma ukhweza idivayisi evinjiwe eqinisekisiweEsikhundleni sokusheshisa yonke idivayisi (ezohamba kancane futhi imoshe amandla), iqinisekiswa ngokuvimba njengoba ifinyelelwa. Ukwehluleka kubangela iphutha le-I/O, futhi amasevisi nezinhlelo zokusebenza zisabela ngokuvumelana nokubekezelela kwazo: ukuqhubeka ngaphandle kwaleyo datha noma ukuphahlazeka ngokuphelele.
Ukulungiswa Kwephutha Langaphambili (FEC)
Kusukela ku-Android 7.0, I-FEC (Reed–Solomon) ihlanganiswe nezindlela zokuxhumanisa ukunciphisa isikhala nokwandisa amandla okubuyisela amabhlogo alimele. Lokhu kusebenza ngokuhambisana ne-dm-verity: uma isheke lihluleka, uhlelo olungaphansi lungazama ukulilungisa ngaphambi kokuthi limemezele ukuthi ngeke litholakale.
Ukusebenza nokwenza kahle
Ukunciphisa umthelela: Nika amandla ukusheshisa kwe-SHA-2 nge-NEON ku-ARMv7 nezandiso ze-SHA-2 ku-ARMv8 kusuka ku-kernel. Lungisa amapharamitha okufunda phambili kanye ne-prefetch_cluster yehadiwe yakho; ukuqinisekiswa kwebhulokhi ngayinye ngokuvamile kwengeza okuncane ezindlekweni ze-I/O, kodwa lezi zilungiselelo zenza umehluko.
Ukuqalisa ku-Linux (systemd, veritysetup) ne-Android
Ku-Linux yesimanje ene-systemd, dm-verity ivumela impande eqinisekisiwe yokufunda kuphela usebenzisa i-veritysetup (ingxenye ye-cryptsetup), systemd-veritysetup.generator, kanye ne-systemd-veritysetup@.service. Kunconywa ukuthi ufake i-Secure Boot kanye ne-UKI esayiniwe (isithombe se-kernel esihlanganisiwe), nakuba kungadingeki ngokuqinile.
Ukulungiselela nokuhlukaniswa okunconyiwe
Ingxenye yesistimu esebenzayo nelungisiwe. Gcina ivolumu yesihlahla se-hashi (I-8–10% yosayizi wezimpande ngokuvamile yanele) futhi ucabange ukuhlukanisa / ikhaya kanye / var uma udinga ukubhala. Isikimu esivamile sihlanganisa: I-ESP (ye-bootloader), i-XBOOTLDR (yama-UKI), impande (enokubethela noma ngaphandle kwayo), ukwahlukanisa kwe-VERITY, kanye nokuzikhethela /ikhaya kanye /var.
Njengempande, I-EROFS iyindlela ethakazelisa kakhulu ye-ext4 noma i-squashfs: Ifundwa kuphela ngedizayini, isebenza kahle kakhulu ku-flash/SSD, ukucindezela kwe-lz4 ngokuzenzakalelayo, futhi isetshenziswa kabanzi kumafoni e-Android ane-dm-verity.
Amafayela okufanele abhaleke
Nge-root ro, ezinye izinhlelo zilindele ukubhalela / njll noma ngesikhathi se-initUngayihambisa ku-/var/etc futhi uvumelanise noma yini edinga ukuguqulwa (isb., ukuxhumana kwe-NetworkManager ku-/etc/NetworkManager/system-connections). Qaphela ukuthi i-systemd-journald idinga ukuthi /etc/machine-id ibe khona kumkhombandlela wezimpande (hhayi i-symlink) ukugwema ukuphula ukuqalisa kwangaphambi kwesikhathi.
Ukuze uthole ukuthi yiziphi izinguquko ekusebenzeni, sebenzisa i-dracut-overlayroot: imboza i-tmpfs phezu kwempande, futhi yonke into ebhaliwe ivela ku-/run/overlayroot/u. Engeza imojuli ku-/usr/lib/dracut/modules.d/, faka i-overlayroot ku-dracut, bese usetha i-overlayroot=1 emugqeni we-kernel; ngale ndlela uzobona ukuthi yini okufanele uthuthele kuyo /var.
Izibonelo eziwusizo: i-pacman ne-NetworkManager
Ku-Arch, kulula Hambisa isizindalwazi se-Pacman siye ku-/usr/lib/pacman ukuze i-rootfs ihlale izibuko amaphakheji afakiwe. Bese, uqondise kabusha inqolobane ku/var/lib/pacman kanye nesixhumanisi. Ukushintsha uhlu lwesibuko ngaphandle kokuthinta impande, luhambise ku-/var/etc bese uluxhuma noma kunjalo.
Nge-NetworkManager, hambisa ukuxhumana kwesistimu ku-/var/etc/NetworkManager kanye nesixhumanisi kusuka ku-/etc/NetworkManager/system-connections. Lokhu kugcina impande ingaguquleki futhi nokucushwa bukhoma lapho kufanele kubhaleke khona.
Ukwakhiwa kobuqiniso nokuhlola
Kusuka kokubukhoma futhi enayo yonke into ephelele futhi efakwe ku-ro, dala isihlahla kanye ne-roothash nge ifomethi ye-veritysetup: Uma isebenza, iphrinta umugqa we-Root Hash, ongawulondoloza ku-roothash.txt. Iqalise ukuze ihlolwe nge-veritysetup evulekile impande yedivayisi yedivayisi $(cat roothash.txt) bese ukhweza /dev/mapper/root.
Uma uthanda, kuqala ikhiqiza isihlahla efayeleni (verity.bin) bese uyibhala ku-VERITY partition. Isethi ewumphumela ithi: isithombe sempande, isihlahla se-verity, kanye ne-root hashi ozoyiphina ekuqaleni.
Lungiselela umugqa we-kernel
Engeza lezi zinhlaka: systemd.verity=1, roothash=contents_of_roothash.txt, systemd.verity_root_data=ROOT-PATH (isb. LABEL=OS), kanye ne-systemd.verity_root_hash=VERITY-PATH (isb. LABEL=VERITY). Setha izinketho ze-systemd.verity_root_options ukuze uqale kabusha ekukhohlakaleni noma ukwethuka-on-inkohlakalo ngezinqubomgomo eziqinile.
Ezinye izinketho ezinconyiwe: ro (uma ungasebenzisi i-EROFS/squashfs), rd.emergency=reboot y rd.igobolondo=0 (vimbela amagobolondo angagunyaziwe uma ibhuthi ihluleka), futhi lockdown=imfihlo ukuvikela inkumbulo ye-kernel ekufinyeleleni.
Izingxenye ezengeziwe ezinokwethenjelwa
Hhayi nje impande: Ungachaza okunye ukuhlela ku/etc/veritytab futhi i-systemd-veritysetup@.service izowahlanganisa ekuqaleni. Khumbula: kulula u-RW ukukhweza i-partition engeyona impande, futhi umsebenzisi wempande angakhubaza i-Verity kulezo zihlukanisi, ngakho-ke inani lokuvikeleka lapho liphansi.
Ukuphepha: Secure Boot, UKI namamojula asayiniwe
I-dm-verity ayiyona inhlamvu yesiliva. Sayina i-UKI bese uvula i-Secure Boot ngokhiye bakho ukuvimbela noma ubani ekukhipheni i-kernel/initramfs/cmdline (okuhlanganisa impande ye-hashi). Amathuluzi afana ne-sbupdate-git noma i-sbctl asiza ukugcina izithombe zisayiniwe kanye neketango lokuqalisa liqinile.
Uma unika amandla ukuvala i-kernel noma ukuqinisekiswa kwesiginesha yemojuli, I-DKMS noma amamojula angaphandle kwesihlahla kufanele asayinwe noma ngeke balayishe. Cabangela i-kernel yangokwezifiso enokwesekwa kokusayina kwepayipi lakho (bona amamojula e-kernel esayiniwe).
Ukubethela, TPM kanye metering
I-dm-verity ivikela ubuqotho, ukungabi yimfihloUngashiya impande ingabhaliwe uma ingenayo izimfihlo futhi iketango lokuqalisa livikelekile. Uma usebenzisa amafayela angukhiye asuka empandeni ukuze uvule amanye amavolumu, khona-ke kuwumqondo omuhle ukuwabhala ngemfihlo.
Nge-TPM 2.0, i-systemd-cryptenroll ivumela okhiye bokubopha kuma-PCRs 0,1,5,7 (i-firmware, izinketho, i-GPT, isimo sokuqalisa esivikelekile). Engeza rd.luks.options=LUKS_UUID=tpm2-device=auto futhi uqiniseke ukuthi uhlanganisa ukusekela kwe-TPM2 kuma-initramfs. i-systemd-boot ikala i-kernel.efi ku-PCR4, iwusizo kokhiye abangavumelekile uma i-UKI noma i-cmdline yayo ishintsha.
Izibuyekezo namamodeli wokusabalalisa
Umsuka oqinisekisiwe wokufunda kuphela Ayibuyekezwa nomphathi wephakheji ngendlela evamile. Okuhle wukwakha izithombe ezintsha ngamathuluzi afana iphrojekthi ye-Yocto futhi uzishicilele. I-systemd ine-systemd-sysupdate kanye ne-systemd-repart yokulanda isithombe esiqinile kanye nokukhanyisa.
Elinye isu lithi Uhlelo lwe-A/B: Ugcina izimpande ezimbili kanye namaqiniso amabili. Kopisha impande esebenzayo empandeni engasebenzi, sebenzisa izinguquko, futhi wenze kabusha ukuqinisekiswa. Buyela ebhuthini elandelayo. Uma usebenzisa i-UKI, khumbula ukubuyekeza i-hashi yempande kulayini we-cmd noma wakhe kabusha i-UKI esayiniwe.
Ngokuphikelela kokuzikhethela, sebenzisa i-OverlayFS kumpande oqinisekisiwe nephezulu ku-tmpfs noma idiski. Ungaphinda udlule i-systemd.volatile=overlay ngokuphikelela kwesikhashana. I-Flatpak yenza kube lula ukufaka izinhlelo zokusebenza ku-/var kanye/nekhaya ngaphandle kokuthinta /.
Kunamaphakheji azenzakalelayo (isb. i-verity-squash-root ku-AUR) akha impande ye-squashfs futhi sayina i-roothash nge-kernel kanye ne-initramfs, okukuvumela ukuthi ukhethe phakathi kwemodi eqhubekayo noma ye-ephemeral nokugcina ama-rootfs akamuva njengesipele. Qaphela: ukwengeza ukuphikelela kumpande oqinisekisiwe kunamacala okusebenzisa amancane; zama ukuphikelela idatha yohlelo lokusebenza kuma-partitions ahlukene.
I-Android: i-system-as-root, i-AVB nembondela yomthengisi
Kusukela ku-Android 10, I-RootFS iyeka ukusebenza kudiski ye-RAM futhi ihlanganisa ne-system.img. (isistimu-njenge-root). Amadivayisi ethulwa nge-Android 10 ahlala esebenzisa lolu hlelo futhi adinga i-ramdisk ye-dm-linear. I-BOARD_BUILD_SYSTEM_ROOT_IMAGE isethelwe kumanga kulesi sakhiwo ukuze ihlukanise phakathi kokusebenzisa i-ramdisk kanye nokwenza kusebenze ngokuqondile i-system.img.
I-Android 10 ihlanganisa ama-partitions ashukumisayo kanye ne-init yesigaba sokuqala okwenza kusebenze ukuhlukaniswa kwesistimu enengqondo; i-kernel ayisayikhwezi ngokuqondile. Ama-OTA esistimu kuphela adinga ukwakheka kwesistimu njengezimpande, okuyisibopho kumadivayisi e-Android 10.
Inombolo A/B, gcina ukutakula kuhlukene ne-bootNgokungafani ne-A/B, asikho isipele se-boot_a/boot_b, ngakho-ke ukususa ukutakula kokungeyona i-A/B kungakushiya ungenayo imodi yokutakula uma isibuyekezo sokuqalisa sihluleka.
I-kernel ifaka i-system.img ku-/converity ngezindlela ezimbili: i-vboot 1.0 (iziqephu zokuthi i-kernel ihlukanise imethadatha ye-Android kusistimu futhi ithole amapharamitha we-dm-verity; i-cmdline ihlanganisa impande=/dev/dm-0, skip_initramfs kanye ne-init=/init nge-dm=…) noma i-vboot 2.0/AVB, lapho i-bootloader ihlanganisa i-libavb, ifunda i-hashtree descriptor (ku-vbmeta noma isistimu), yakha imingcele futhi idlulisele ku-kernel ku-cmdline, ngokusekelwa kwe-FEC namafulegi afana ne-restart_on_corruption.
Ngesistimu-njenge-root, ungasebenzisi i-BOARD_ROOT_EXTRA_FOLDERS kumafolda empande eqondene nedivayisi: lezi zizonyamalala lapho kukhanyisa i-GSI. Chaza izikhwezi ezithile ngaphansi kwe/mnt/vendor/ , okuyinto fs_mgr edala ngokuzenzakalelayo, futhi ibhekisela kubo ku-fstab yesihlahla sedivayisi.
I-Android ivumela i-a imbondela yomthengisi kusuka ku-/product/vendor_overlay/: i-init izokwengeza ngaphakathi / idayise iziqondiso ezingaphansi ezihlangabezana nezidingo zomongo we-SELinux kanye nokuba khona kwe / umthengisi/ . Idinga CONFIG_OVERLAY_FS=yy, kuma-kernels amadala, i-override_creds=off patch.
Ukuqaliswa okujwayelekile: ifaka amafayela ahlanganiswe ngaphambilini kudivayisi/ / /imbondela_yomthengisi/, zingeze ku-PRODUCT_COPY_FILES ezinamafayili e-find-copy-subdir ku-$(TARGET_COPY_OUT_PRODUCT)/vendor_overlay, chaza okuqukethwe ku-file_contexts nokunye nohlelo lokusebenza (isb. i-vendor_configs_file ne-vendor_app_file) futhi uvumele i-mounton kulezo zingqikithi ze-init. Hlola nge-test vfs_mgr_vendor_overlay_test ku-userdebug.
Ukuxazulula inkinga: umlayezo wenkohlakalo we-dm-verity ku-Android
Kumadivayisi anezikhala ze-A/B, shintsha izikhala noma I-vbmeta ekhanyayo/i-boot ngaphandle kokuvumelana kwe-roothash Lokhu kungase kuqalise isixwayiso: inkohlakalo ye-dm-verity, idivayisi yakho ayithenjwa. Imiyalo efana ne-fastboot flash -disable-verity -disable-verification vbmeta vbmeta.img khubaza ukuqinisekiswa, kodwa shiya uhlelo ngaphandle kweziqinisekiso zobuqotho.
Amanye ama-bootloaders asekela fastboot oem khubaza_dm_verity futhi okuphambene nayo, enable_dm_verity. Isebenza kwamanye amamodeli, kodwa hhayi kwamanye; futhi ingadinga i-kernel/magisk enamafulegi alungisiwe. Sebenzisa ngokuzifaka engozini yakho: inkambo ehlakaniphile yokwenza qondanisa i-boot, i-vbmeta, nesistimu, sayina noma ukhiqize kabusha isihlahla futhi uqinisekise ukuthi i-hashi yempande elindelekile ifana naleyo emisiwe.
Uma ngemuva kwesixwayiso ungaqhubeka nokucindezela amandla, uhlelo luqala, kodwa awusenalo iketango eliqinile lokuthembanaUkuze ususe umlayezo ngaphandle kokudela ukuvikeleka, buyisela izithombe zokuqala ezisayiniwe noma yakha kabusha/qinisekisa i-vbmeta nge-hashtree elungile, esikhundleni sokukhubaza ukuqinisekiswa.
i.MX kanye nezinkundla ze-OpenWrt
Ku-i.MX6 (isb. sabresd), lungisa i-kernel nge-DM_VERITY nosekelo lwe-FEC, khiqiza isihlahla nge-veritysetup, gcina i-hashi yempande ngokuvikelekile, futhi udlule imingcele efanelekile kulayini we-cmd noma uhlanganise nge-initramfs nge-systemd-veritysetup. Uma ungasebenzisi i-dm-crypt, awudingi i-CAAM ukuze uqiniseke; kugxilwe kubuqotho.
Ku-OpenWrt nangaphakathi amasistimu e-Linux ashumekiwe ane-OpenEmbedded, Kunemizamo yokuhlanganisa i-dm-verity ne-SELinux (Imisebenzi ye-Bootlin ebuyekeziwe ngenhloso yokuhlanganisa ukwesekwa). Ilingana ngokwemvelo: amarutha nempahla yenethiwekhi iyazuza kumpande engaguquleki, eqinisekisiwe, neqiniswe yi-MAC.
Ukwakhiwa kwesihlahla ngesandla kanye nemethadatha (ukubuka okuningiliziwe)
I-cryptsetup ingakwakhela isihlahla, kodwa uma ukhetha ukuqonda ifomethi, incazelo yomugqa wethebula elihlangene ihlanganisa: igama lemephu, idivayisi yedatha, ibhulokhi yedatha namasayizi we-hashi, usayizi wesithombe kumabhulokhi, hash_start position (block image +8 uma ihlangene), i-root hashi, nosawoti. Ngemuva kokukhiqiza izendlalelo ezihlanganisiwe (kusuka phezulu kuye phansi, ngaphandle kohlaka 0), ubhala isihlahla kudiski.
Ukupakisha konke, bhala ithebula le-dm-verity, lisayine (i-RSA-2048 evamile) kanye netafula lesiginesha+yeqembu kumethadatha ngesihloko esinguqulo kanye nenombolo yomlingo. Bese, ihlanganisa isithombe sohlelo, imethadatha yokuqinisekisa, kanye nesihlahla se-hashi. Ku-fstab, imaka okuthi fs_mgr njengokuqinisekisa futhi ibeka ukhiye wasesidlangalaleni kokuthi /boot/verity_key ukuze kuqinisekiswe isiginesha.
Lungiselela nge I-SHA-2 isheshisa i-CPU yakho futhi ulungise i-read-ahead/prefetch_cluster. Kuzingxenyekazi zekhompuyutha ze-ARM, i-NEON SHA-2 (ARMv7) nezandiso ze-SHA-2 (ARMv8) zehlisa kakhulu i-overhead yokuqinisekisa.
Kunoma yikuphi ukuthunyelwa, khumbula lokho inani le-hashi lempande kufanele livikelwe: kungakhathaliseki ukuthi ihlanganiswe yaba yi-UKI esayiniwe, engxenyeni yebhuthi esayiniwe, noma yaqinisekiswa i-bootloader isebenzisa i-AVB. Yonke into ngemva kwalelo phuzu izuza lokho kuthembana.
Njengoba konke lokhu okungenhla sekusendaweni, i-dm-verity iba isisekelo esiqinile sezinhlelo ezingaguquki, ezihambayo nezishumekiwe, isekela izibuyekezo zokwenziwayo, izimbondela zokulungiselela, kanye nemodeli yesimanje yokuvikela enciphisa indawo yokuhlasela futhi ivimbele ukuphikelela ngaphandle kokudela ukusebenza.
