nspawn/dissect: automatically discover dm-verity verity partitions

This adds support for discovering and making use of properly tagged dm-verity
data integrity partitions. This extends both systemd-nspawn and systemd-dissect
with a new --root-hash= switch that takes the root hash to use for the root
partition, and is otherwise fully automatic.

Verity partitions are discovered automatically by GPT table type UUIDs, as
listed in
https://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/
(which I updated prior to this change, to include new UUIDs for this purpose.

mkosi with https://github.com/systemd/mkosi/pull/39 applied may generate images
that carry the necessary integrity data. With that PR and this commit, the
following simply lines suffice to boot up an integrity-protected container image:

```
 # mkdir test
 # cd test
 # mkosi --verity
 # systemd-nspawn -i ./image.raw -bn
```

Note that mkosi writes the image file to "image.raw" next to a a file
"image.roothash" that contains the root hash. systemd-nspawn will look for that
file and use it if it exists, in case --root-hash= is not specified explicitly.

1 files changed, 39 insertions, 4 deletions

diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index 5e6848acb4..e3c96b7407 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -23,6 +23,7 @@
 
 #include "architecture.h"
 #include "dissect-image.h"
+#include "hexdecoct.h"
 #include "log.h"
 #include "loop-util.h"
 #include "string-util.h"
@@ -35,6 +36,8 @@ static enum {
 static const char *arg_image = NULL;
 static const char *arg_path = NULL;
 static DissectImageFlags arg_flags = DISSECT_IMAGE_DISCARD_ON_LOOP;
+static void *arg_root_hash = NULL;
+static size_t arg_root_hash_size = 0;
 
 static void help(void) {
         printf("%s [OPTIONS...] IMAGE\n"
@@ -44,7 +47,8 @@ static void help(void) {
                "     --version         Show package version\n"
                "  -m --mount           Mount the image to the specified directory\n"
                "  -r --read-only       Mount read-only\n"
-               "     --discard=MODE    Choose 'discard' mode (disabled, loop, all, crypto)\n",
+               "     --discard=MODE    Choose 'discard' mode (disabled, loop, all, crypto)\n"
+               "     --root-hash=HASH  Specify root hash for verity\n",
                program_invocation_short_name,
                program_invocation_short_name);
 }
@@ -54,6 +58,7 @@ static int parse_argv(int argc, char *argv[]) {
         enum {
                 ARG_VERSION = 0x100,
                 ARG_DISCARD,
+                ARG_ROOT_HASH,
         };
 
         static const struct option options[] = {
@@ -62,10 +67,11 @@ static int parse_argv(int argc, char *argv[]) {
                 { "mount",     no_argument,       NULL, 'm'           },
                 { "read-only", no_argument,       NULL, 'r'           },
                 { "discard",   required_argument, NULL, ARG_DISCARD   },
+                { "root-hash", required_argument, NULL, ARG_ROOT_HASH },
                 {}
         };
 
-        int c;
+        int c, r;
 
         assert(argc >= 0);
         assert(argv);
@@ -105,6 +111,25 @@ static int parse_argv(int argc, char *argv[]) {
 
                         break;
 
+                case ARG_ROOT_HASH: {
+                        void *p;
+                        size_t l;
+
+                        r = unhexmem(optarg, strlen(optarg), &p, &l);
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to parse root hash: %s", optarg);
+                        if (l < sizeof(sd_id128_t)) {
+                                log_error("Root hash must be at least 128bit long: %s", optarg);
+                                free(p);
+                                return -EINVAL;
+                        }
+
+                        free(arg_root_hash);
+                        arg_root_hash = p;
+                        arg_root_hash_size = l;
+                        break;
+                }
+
                 case '?':
                         return -EINVAL;
 
@@ -162,11 +187,15 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        r = dissect_image(d->fd, &m);
+        r = dissect_image(d->fd, arg_root_hash, arg_root_hash_size, &m);
         if (r == -ENOPKG) {
                 log_error_errno(r, "Couldn't identify a suitable partition table or file system in %s.", arg_image);
                 goto finish;
         }
+        if (r == -EADDRNOTAVAIL) {
+                log_error_errno(r, "No root partition for specified root hash found in %s.", arg_image);
+                goto finish;
+        }
         if (r < 0) {
                 log_error_errno(r, "Failed to dissect image: %m");
                 goto finish;
@@ -179,6 +208,7 @@ int main(int argc, char *argv[]) {
 
                 for (i = 0; i < _PARTITION_DESIGNATOR_MAX; i++) {
                         DissectedPartition *p = m->partitions + i;
+                        int k;
 
                         if (!p->found)
                                 continue;
@@ -193,6 +223,10 @@ int main(int argc, char *argv[]) {
                         if (p->architecture != _ARCHITECTURE_INVALID)
                                 printf(" for %s", architecture_to_string(p->architecture));
 
+                        k = PARTITION_VERITY_OF(i);
+                        if (k >= 0)
+                                printf(" %s verity", m->partitions[k].found ? "with" : "without");
+
                         if (p->partno >= 0)
                                 printf(" on partition #%i", p->partno);
 
@@ -206,7 +240,7 @@ int main(int argc, char *argv[]) {
         }
 
         case ACTION_MOUNT:
-                r = dissected_image_decrypt_interactively(m, NULL, arg_flags, &di);
+                r = dissected_image_decrypt_interactively(m, NULL, arg_root_hash, arg_root_hash_size, arg_flags, &di);
                 if (r < 0)
                         goto finish;
 
@@ -232,5 +266,6 @@ int main(int argc, char *argv[]) {
         }
 
 finish:
+        free(arg_root_hash);
         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 }