pvmfw: avb: Add API tests for tampered initrd
Add tests specifically covering a tampered initrd of unmodified size.
Add comment explaining why pvmfw::avb::Ops::verify_partition() works on
initrd, so that I don't have to go back and read libavb code again next
time I come across this code and have inevitably forgotten why it works.
Test: TH
Change-Id: I1597037f3d28d927a591eefc6570cfbedba9ad94
diff --git a/guest/pvmfw/avb/src/ops.rs b/guest/pvmfw/avb/src/ops.rs
index 62bf239..780e23b 100644
--- a/guest/pvmfw/avb/src/ops.rs
+++ b/guest/pvmfw/avb/src/ops.rs
@@ -60,6 +60,14 @@
&mut self,
partition_name: &CStr,
) -> SlotVerifyResult<SlotVerifyData<'a>> {
+ // Note that this call manages to verify the initrd images using hashes contained in the
+ // (unique) VBMeta from the end of self.kernel because if
+ //
+ // - read_from_partition("vbmeta") returns AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION and
+ // - we do NOT pass AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION to slot_verify()
+ //
+ // then libavb (specifically, avb_slot_verify()) falls back to retrieving VBMeta from the
+ // footer of the "boot" partition i.e. self.kernel (see PartitionName::Kernel).
slot_verify(
self,
&[partition_name],
diff --git a/guest/pvmfw/avb/tests/api_test.rs b/guest/pvmfw/avb/tests/api_test.rs
index 29a6277..df33830 100644
--- a/guest/pvmfw/avb/tests/api_test.rs
+++ b/guest/pvmfw/avb/tests/api_test.rs
@@ -356,6 +356,32 @@
}
#[test]
+fn tampered_normal_initrd_fails_verification() -> Result<()> {
+ let mut initrd = load_latest_initrd_normal()?;
+ initrd[1] = !initrd[1]; // Flip the bits
+
+ assert_payload_verification_with_initrd_fails(
+ &load_latest_signed_kernel()?,
+ &initrd,
+ &load_trusted_public_key()?,
+ SlotVerifyError::Verification(None).into(),
+ )
+}
+
+#[test]
+fn tampered_debug_initrd_fails_verification() -> Result<()> {
+ let mut initrd = load_latest_initrd_debug()?;
+ initrd[1] = !initrd[1]; // Flip the bits
+
+ assert_payload_verification_with_initrd_fails(
+ &load_latest_signed_kernel()?,
+ &initrd,
+ &load_trusted_public_key()?,
+ SlotVerifyError::Verification(None).into(),
+ )
+}
+
+#[test]
fn tampered_vbmeta_fails_verification() -> Result<()> {
let mut kernel = load_latest_signed_kernel()?;
let footer = extract_avb_footer(&kernel)?;