Mender + dm-verity integration

Globulo
Tue, 09 Jan 2024 20:47:38 +0000
General Discussions

Hi,

We are improving the security of a system based on a Toradex Verdin iMX8M Mini module.

We have been successfully using mender in this system for a long time previously. But now, as part of the security hardening we have integrated dm-verity to avoid modifications of the rootfs.

Our problem is the device-mapper used by dm-verity, regardless of the physical device being used, mounts the rootfs from device /dev/dm-0 and this confuses the mender-client, as expected.

This is the result of mount:

/dev/dm-0 on / type ext4 (ro,relatime)

And this is the result of the command “stat /”

stat /
File: /
Size: 4096      	Blocks: 8          IO Block: 4096   directory
Device: 253,0	Inode: 2           Links: 21
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2024-01-06 00:21:16.000000000 +0100
Modify: 2024-01-06 00:21:16.000000000 +0100
Change: 2024-01-06 00:21:16.000000000 +0100
 Birth: 2024-01-06 00:21:16.000000000 +0100

This is the log output from mender when I try to install the artifact:

root@XXXX-00005003:~# mender install /tmp/usb/XXXX-dev-01.00-20240107215702.mender
INFO[0000] Loaded configuration file: /var/lib/mender/mender.conf
INFO[0000] Loaded configuration file: /etc/mender/mender.conf
INFO[0000] 'UpdateControlMapExpirationTimeSeconds' is not set in the Mender configuration file. Falling back to the default of 2*UpdatePollIntervalSeconds
INFO[0000] 'UpdateControlMapBootExpirationTimeSeconds' is not set in the Mender configuration file. Falling back to the default of 600 seconds
INFO[0000] Mender running on partition: /dev/dm-0
INFO[0001] Mender running on partition: /dev/dm-0
INFO[0001] Start updating from local image file: [/tmp/usb/XXXX-dev-01.00-20240107215702.mender]
Installing Artifact of size 394884608...
INFO[0001] No public key was provided for authenticating the artifact
ERRO[0001] Download failed: Payload: can not install Payload: XXXX-dev-01.00-verdin-imx8mm.ext4: Active root partition matches neither RootfsPartA nor RootfsPartB.
ERRO[0001] Payload: can not install Payload: XXXX-dev-01.00-verdin-imx8mm.ext4: Active root partition matches neither RootfsPartA nor RootfsPartB.

As you can see, it detects /dev/dm-0 and obviously it doesn’t match RootfsPartA neither RootfsPartB that are defined as /dev/mmcblk0p2 and /dev/mmcblk0p3.

Using commands like dmsetup is possible to figure out the physical physical device attached to the dm device:

root@XXXX-00005003:~# dmsetup deps -o devname
verity: 1 dependencies  : (mmcblk0p2)

My question is: What would you consider the best approach to update the mender client so it notices the device is provided by device-mapper and tries to look “deeper” to find the real device? Is there a standard way that we could use? or we have to simply patch mender-client?

We would be more than happy to contribute the patch to the community so this is why I ask for “best approach”.

11 posts - 3 participants