Skip to content

Commit 30b86ca

Browse files
learmjlearmj
committed
IDP: Two new AB PMAPs, consolidate naming
Add two new PMAPs: - cryptdata : Only the persistent storage partition is encrypted. - cryptslots : Only the system (OS) partition for each slot is encrypted. Rename hybrid -> crypthybrid - this is a development-only PMAP which encrypts B.system. A crypt* PMAP now denotes encryption will be applied on some part of the disk image at provisioning time. Documentation updated.
1 parent a36f483 commit 30b86ca

File tree

5 files changed

+194
-8
lines changed

5 files changed

+194
-8
lines changed

‎docs/layer/image-rota.html‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ <h2>Configuration Variables</h2>
454454

455455
<tr>
456456
<td><code>IGconf_image_data_part_size</code></td>
457-
<td>Writable storage partition retained across
457+
<td>Writable data partition retained across
458458
slot rotations.</td>
459459
<td>
460460

@@ -489,16 +489,18 @@ <h2>Configuration Variables</h2>
489489
<td><code>IGconf_image_pmap</code></td>
490490
<td>Provisioning Map type for this image layout.
491491
clear: All partitions will be provisioned unencrypted.
492-
crypt: All partitions except <slot>:boot will be provisioned encrypted.
493-
hybrid: B:system will be provisioned encrypted (development only).</td>
492+
crypt: All non-boot partitions will be provisioned encrypted.
493+
cryptslots: Only system OS partitions will be provisioned encrypted.
494+
cryptdata: Only the data partition will be provisioned encrypted.
495+
crypthybrid: B:system OS partition will be provisioned encrypted (dev only).</td>
494496
<td>
495497

496498

497499
<code>clear</code>
498500

499501

500502
</td>
501-
<td>Must be one of: clear, crypt, hybrid</td>
503+
<td>Must be one of: clear, crypt, cryptslots, cryptdata, crypthybrid</td>
502504
<td>
503505
<a href="variable-validation.html#set-policies" class="badge policy-immediate" title="Click for policy and validation help">immediate</a>
504506
</td>

‎image/gpt/ab_userdata/device/provisionmap-cryptdata.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
[
2+
{
3+
"attributes": {
4+
"PMAPversion": "1.2.0",
5+
"system_type": "slotted"
6+
}
7+
},
8+
{
9+
"partitions": [
10+
{
11+
"image": "config"
12+
}
13+
]
14+
},
15+
{
16+
"slots": {
17+
"A": {
18+
"partitions": [
19+
{
20+
"image": "boot_a",
21+
"static": {
22+
"uuid": "<BOOT_UUID>",
23+
"role": "boot"
24+
}
25+
}
26+
]
27+
}
28+
}
29+
},
30+
{
31+
"slots": {
32+
"B": {
33+
"partitions": [
34+
{
35+
"image": "boot_b",
36+
"static": {
37+
"uuid": "<BOOT_UUID>",
38+
"role": "boot"
39+
}
40+
}
41+
]
42+
}
43+
}
44+
},
45+
{
46+
"slots": {
47+
"A": {
48+
"partitions": [
49+
{
50+
"image": "system_a",
51+
"static": {
52+
"uuid": "<SYSTEM_UUID>",
53+
"role": "system"
54+
}
55+
}
56+
]
57+
}
58+
}
59+
},
60+
{
61+
"slots": {
62+
"B": {
63+
"partitions": [
64+
{
65+
"image": "system_b",
66+
"static": {
67+
"uuid": "<SYSTEM_UUID>",
68+
"role": "system"
69+
}
70+
}
71+
]
72+
}
73+
}
74+
},
75+
{
76+
"encrypted": {
77+
"luks2": {
78+
"key_size": 512,
79+
"cipher": "aes-xts-plain64",
80+
"hash": "sha256",
81+
"label": "root",
82+
"uuid": "<CRYPT_UUID>",
83+
"mname": "cryptroot",
84+
"etype": "partitioned"
85+
},
86+
"partitions": [
87+
{
88+
"image": "persistent"
89+
}
90+
]
91+
}
92+
}
93+
]

‎image/gpt/ab_userdata/device/provisionmap-hybrid.json‎ renamed to ‎image/gpt/ab_userdata/device/provisionmap-crypthybrid.json‎

File renamed without changes.

‎image/gpt/ab_userdata/device/provisionmap-cryptslots.json‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
[
2+
{
3+
"attributes": {
4+
"PMAPversion": "1.3.0",
5+
"system_type": "slotted"
6+
}
7+
},
8+
{
9+
"partitions": [
10+
{
11+
"image": "config"
12+
}
13+
]
14+
},
15+
{
16+
"slots": {
17+
"A": {
18+
"partitions": [
19+
{
20+
"image": "boot_a",
21+
"static": {
22+
"uuid": "<BOOT_UUID>",
23+
"role": "boot"
24+
}
25+
}
26+
]
27+
}
28+
}
29+
},
30+
{
31+
"slots": {
32+
"B": {
33+
"partitions": [
34+
{
35+
"image": "boot_b",
36+
"static": {
37+
"uuid": "<BOOT_UUID>",
38+
"role": "boot"
39+
}
40+
}
41+
]
42+
}
43+
}
44+
},
45+
{
46+
"encrypted": {
47+
"luks2": {
48+
"key_size": 512,
49+
"cipher": "aes-xts-plain64",
50+
"hash": "sha256",
51+
"label": "root",
52+
"uuid": "<CRYPT_UUID>",
53+
"mname": "cryptroot",
54+
"etype": "partitioned"
55+
},
56+
"slots": {
57+
"A": {
58+
"partitions": [
59+
{
60+
"image": "system_a",
61+
"static": {
62+
"uuid": "<SYSTEM_UUID>",
63+
"role": "system"
64+
}
65+
}
66+
]
67+
},
68+
"B": {
69+
"partitions": [
70+
{
71+
"image": "system_b",
72+
"static": {
73+
"uuid": "<SYSTEM_UUID>",
74+
"role": "system"
75+
}
76+
}
77+
]
78+
}
79+
}
80+
}
81+
},
82+
{
83+
"partitions": [
84+
{
85+
"image": "persistent"
86+
}
87+
]
88+
}
89+
]

‎image/gpt/ab_userdata/image.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
# X-Env-Var-system_part_size-Set: y
2525
#
2626
# X-Env-Var-data_part_size: 1G
27-
# X-Env-Var-data_part_size-Desc: Writable storage partition retained across
27+
# X-Env-Var-data_part_size-Desc: Writable data partition retained across
2828
# slot rotations.
2929
# X-Env-Var-data_part_size-Required: n
3030
# X-Env-Var-data_part_size-Valid: size
@@ -39,10 +39,12 @@
3939
# X-Env-Var-pmap: clear
4040
# X-Env-Var-pmap-Desc: Provisioning Map type for this image layout.
4141
# clear: All partitions will be provisioned unencrypted.
42-
# crypt: All partitions except <slot>:boot will be provisioned encrypted.
43-
# hybrid: B:system will be provisioned encrypted (development only).
42+
# crypt: All non-boot partitions will be provisioned encrypted.
43+
# cryptslots: Only system OS partitions will be provisioned encrypted.
44+
# cryptdata: Only the data partition will be provisioned encrypted.
45+
# crypthybrid: B:system OS partition will be provisioned encrypted (dev only).
4446
# X-Env-Var-pmap-Required: n
45-
# X-Env-Var-pmap-Valid: clear,crypt,hybrid
47+
# X-Env-Var-pmap-Valid: clear,crypt,cryptslots,cryptdata,crypthybrid
4648
# X-Env-Var-pmap-Set: y
4749
#
4850
# X-Env-Var-ptable_protect: $( [ "${IGconf_device_storage_type:-}" = "emmc" ] && echo y || echo n )

0 commit comments

Comments
 (0)