| #! /bin/bash |
| # SPDX-License-Identifier: GPL-2.0 |
| # Copyright 2018 Google LLC |
| # |
| # FS QA Test generic/576 |
| # |
| # Test using fs-verity and fscrypt simultaneously. This primarily verifies |
| # correct ordering of the hooks for each feature: fscrypt needs to be first. |
| # |
| . ./common/preamble |
| _begin_fstest auto quick verity encrypt |
| |
| # Override the default cleanup function. |
| _cleanup() |
| { |
| cd / |
| _restore_fsverity_signatures |
| rm -f $tmp.* |
| } |
| |
| # Import common functions. |
| . ./common/filter |
| . ./common/verity |
| . ./common/encrypt |
| |
| # real QA test starts here |
| _supported_fs generic |
| _require_scratch_verity |
| _require_scratch_encryption |
| _require_command "$KEYCTL_PROG" keyctl |
| _disable_fsverity_signatures |
| |
| _scratch_mkfs_encrypted_verity &>> $seqres.full |
| _scratch_mount |
| |
| fsv_orig_file=$tmp.file |
| edir=$SCRATCH_MNT/edir |
| fsv_file=$edir/file.fsv |
| |
| # Set up an encrypted directory. |
| _init_session_keyring |
| keydesc=$(_generate_session_encryption_key) |
| mkdir $edir |
| _set_encpolicy $edir $keydesc |
| |
| # Create a file within the encrypted directory and enable verity on it. |
| # Then check that it has an encryption policy as well. |
| head -c 100000 /dev/zero > $fsv_orig_file |
| cp $fsv_orig_file $fsv_file |
| _fsv_enable $fsv_file |
| echo |
| $XFS_IO_PROG -r -c "get_encpolicy" $fsv_file | _filter_scratch \ |
| | sed 's/Master key descriptor:.*/Master key descriptor: 0000000000000000/' |
| echo |
| |
| # Verify that the file contents are as expected. This should be going through |
| # both the decryption and verity I/O paths. |
| cmp $fsv_orig_file $fsv_file && echo "Files matched" |
| |
| # Just in case, try again after a mount cycle to empty the page cache. |
| _scratch_cycle_mount |
| cmp $fsv_orig_file $fsv_file && echo "Files matched" |
| |
| # Corrupt some bytes as a sanity check that fs-verity is really working. |
| # This also verifies that the data on-disk is really encrypted, since otherwise |
| # the data being written here would be identical to the old data. |
| head -c 1000 /dev/zero | _fsv_scratch_corrupt_bytes $fsv_file 50000 |
| md5sum $fsv_file |& _filter_scratch |
| |
| # success, all done |
| status=0 |
| exit |