generic: factor out helpers for fs-verity built-in signatures

The test for retrieving a verity file's built-in signature using
FS_IOC_READ_VERITY_METADATA will need to set up a file with a built-in
signature, which requires the same commands that generic/577 does.
Factor this out into helper functions in common/verity.

Signed-off-by: Eric Biggers <ebiggers@google.com>

diff --git a/common/verity b/common/verity
index a8d3de06b3c7e52bc4a11298bb96951bbd9bf3c4..9a18224082cd23256ec00d19236d851d8f9bfa97 100644 (file)
--- a/common/verity
+++ b/common/verity
@@ -48,12 +48,47 @@ _require_scratch_verity()
        FSV_BLOCK_SIZE=$(get_page_size)
 }
 
        FSV_BLOCK_SIZE=$(get_page_size)
 }
 

-# Check for CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y.
+# Check for CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y, as well as the userspace
+# commands needed to generate certificates and add them to the kernel.

 _require_fsverity_builtin_signatures()
 {
        if [ ! -e /proc/sys/fs/verity/require_signatures ]; then
                _notrun "kernel doesn't support fs-verity builtin signatures"
        fi
 _require_fsverity_builtin_signatures()
 {
        if [ ! -e /proc/sys/fs/verity/require_signatures ]; then
                _notrun "kernel doesn't support fs-verity builtin signatures"
        fi

+       _require_command "$OPENSSL_PROG" openssl
+       _require_command "$KEYCTL_PROG" keyctl
+}
+
+# Use the openssl program to generate a private key and a X.509 certificate for
+# use with fs-verity built-in signature verification, and convert the
+# certificate to DER format.
+_fsv_generate_cert()
+{
+       local keyfile=$1
+       local certfile=$2
+       local certfileder=$3
+
+       if ! $OPENSSL_PROG req -newkey rsa:4096 -nodes -batch -x509 \
+                       -keyout $keyfile -out $certfile &>> $seqres.full; then
+               _fail "Failed to generate certificate and private key (see $seqres.full)"
+       fi
+       $OPENSSL_PROG x509 -in $certfile -out $certfileder -outform der
+}
+
+# Clear the .fs-verity keyring.
+_fsv_clear_keyring()
+{
+       $KEYCTL_PROG clear %keyring:.fs-verity
+}
+
+# Load the given X.509 certificate in DER format into the .fs-verity keyring so
+# that the kernel can use it to verify built-in signatures.
+_fsv_load_cert()
+{
+       local certfileder=$1
+
+       $KEYCTL_PROG padd asymmetric '' %keyring:.fs-verity \
+               < $certfileder >> $seqres.full

 }
 
 # Disable mandatory signatures for fs-verity files, if they are supported.
 }
 
 # Disable mandatory signatures for fs-verity files, if they are supported.

diff --git a/tests/generic/577 b/tests/generic/577
index 0e9459428be006b60609e15c7e769ad05e5f7710..114463be864cdeb280d5c501056ce70e8eacbb22 100755 (executable)
--- a/tests/generic/577
+++ b/tests/generic/577
@@ -34,8 +34,6 @@ rm -f $seqres.full
 _supported_fs generic
 _require_scratch_verity
 _require_fsverity_builtin_signatures
 _supported_fs generic
 _require_scratch_verity
 _require_fsverity_builtin_signatures

-_require_command "$OPENSSL_PROG" openssl
-_require_command "$KEYCTL_PROG" keyctl

 
 _scratch_mkfs_verity &>> $seqres.full
 _scratch_mount
 
 _scratch_mkfs_verity &>> $seqres.full
 _scratch_mount


@@ -53,21 +51,14 @@ othersigfile=$tmp.othersig
 
 echo -e "\n# Generating certificates and private keys"
 for suffix in '' '.2'; do
 
 echo -e "\n# Generating certificates and private keys"
 for suffix in '' '.2'; do

-       if ! $OPENSSL_PROG req -newkey rsa:4096 -nodes -batch -x509 \
-                       -keyout $keyfile$suffix -out $certfile$suffix \
-                       &>> $seqres.full; then
-               _fail "Failed to generate certificate and private key (see $seqres.full)"
-       fi
-       $OPENSSL_PROG x509 -in $certfile$suffix -out $certfileder$suffix \
-               -outform der
+       _fsv_generate_cert $keyfile$suffix $certfile$suffix $certfileder$suffix

 done
 
 echo -e "\n# Clearing fs-verity keyring"
 done
 
 echo -e "\n# Clearing fs-verity keyring"

-$KEYCTL_PROG clear %keyring:.fs-verity
+_fsv_clear_keyring

 
 echo -e "\n# Loading first certificate into fs-verity keyring"
 
 echo -e "\n# Loading first certificate into fs-verity keyring"

-$KEYCTL_PROG padd asymmetric '' %keyring:.fs-verity \
-       < $certfileder >> $seqres.full
+_fsv_load_cert $certfileder

 
 echo -e "\n# Enabling fs.verity.require_signatures"
 _enable_fsverity_signatures
 
 echo -e "\n# Enabling fs.verity.require_signatures"
 _enable_fsverity_signatures