scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2026-01-09 00:51:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add sanity check for dev_boot_signed_only

Browse Source 
Removing rootfs verification or resigning kernels can lead to an
unusable system if the dev_boot_signed_only flag is set.  Add a sanity
check to print out an error when this happens.

BRANCH=none
BUG=none
TEST=manual
Run /usr/share/vboot/bin/make_dev_ssd.sh with the dev_boot_signed_only
flag set to 1 and observe that an error message is printed.

Change-Id: If116538152ee3122e3b742918bf1676982754fdd
Reviewed-on: https://chromium-review.googlesource.com/260970
Trybot-Ready: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
This commit is contained in:
Chirantan Ekbote
2015-03-18 14:45:45 -07:00
committed by ChromeOS Commit Bot
parent d75eb7f77a
commit eee1b3d227
1 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
scripts/image_signing/make_dev_ssd.sh
View File

@@ -293,6 +293,32 @@ resign_ssd_kernel() {
return $resigned_kernels
}
sanity_check_crossystem_flags() {
debug_msg "crossystem sanity check"
if [ -n "${FLAGS_save_config}" ]; then
debug_msg "not resigning kernel."
return
fi
if [ "$(crossystem dev_boot_signed_only)" = "0" ]; then
debug_msg "dev_boot_signed_only not set - safe."
return
fi
echo "
ERROR: YOUR FIRMWARE WILL ONLY BOOT SIGNED IMAGES.
Modifying the kernel or root filesystem will result in an unusable system. If
you really want to make this change, allow the firmware to boot self-signed
images by running:
sudo crossystem dev_boot_signed_only=0
before re-executing this command.
"
return $FLAGS_FALSE
}
sanity_check_live_partitions() {
debug_msg "Partition sanity check"
if [ "$FLAGS_partitions" = "$ROOTDEV_KERNEL" ]; then
@@ -418,7 +444,8 @@ main() {
done
echo ""
elif ! sanity_check_live_firmware ||
! sanity_check_live_partitions; then
! sanity_check_live_partitions ||
! sanity_check_crossystem_flags; then
err_die "IMAGE $FLAGS_image IS NOT MODIFIED."
fi
fi