github.com/SagerNet/gvisor@v0.0.0-20210707092255-7731c139d75c/tools/verity/measure_tool.go (about)

     1  // Copyright 2021 The gVisor Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  // This binary can be used to run a measurement of the verity file system,
    16  // generate the corresponding Merkle tree files, and return the root hash.
    17  package main
    18  
    19  import (
    20  	"flag"
    21  	"io/ioutil"
    22  	"log"
    23  	"os"
    24  	"syscall"
    25  
    26  	"github.com/SagerNet/gvisor/pkg/abi/linux"
    27  )
    28  
    29  var path = flag.String("path", "", "path to the verity file system.")
    30  
    31  const maxDigestSize = 64
    32  
    33  type digest struct {
    34  	metadata linux.DigestMetadata
    35  	digest   [maxDigestSize]byte
    36  }
    37  
    38  func main() {
    39  	flag.Parse()
    40  	if *path == "" {
    41  		log.Fatalf("no path provided")
    42  	}
    43  	if err := enableDir(*path); err != nil {
    44  		log.Fatalf("Failed to enable file system %s: %v", *path, err)
    45  	}
    46  	// Print the root hash of the file system to stdout.
    47  	if err := measure(*path); err != nil {
    48  		log.Fatalf("Failed to measure file system %s: %v", *path, err)
    49  	}
    50  }
    51  
    52  // enableDir enables verity features on all the files and sub-directories within
    53  // path.
    54  func enableDir(path string) error {
    55  	files, err := ioutil.ReadDir(path)
    56  	if err != nil {
    57  		return err
    58  	}
    59  	for _, file := range files {
    60  		if file.IsDir() {
    61  			// For directories, first enable its children.
    62  			if err := enableDir(path + "/" + file.Name()); err != nil {
    63  				return err
    64  			}
    65  		} else if file.Mode().IsRegular() {
    66  			// For regular files, open and enable verity feature.
    67  			f, err := os.Open(path + "/" + file.Name())
    68  			if err != nil {
    69  				return err
    70  			}
    71  			var p uintptr
    72  			if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, uintptr(f.Fd()), uintptr(linux.FS_IOC_ENABLE_VERITY), p); err != 0 {
    73  				return err
    74  			}
    75  		}
    76  	}
    77  	// Once all children are enabled, enable the parent directory.
    78  	f, err := os.Open(path)
    79  	if err != nil {
    80  		return err
    81  	}
    82  	var p uintptr
    83  	if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, uintptr(f.Fd()), uintptr(linux.FS_IOC_ENABLE_VERITY), p); err != 0 {
    84  		return err
    85  	}
    86  	return nil
    87  }