From: Eric Biggers <ebiggers@xxxxxxxxxx>
Even though the kernel currently only supports PAGE_SIZE == Merkle tree
block size, PAGE_SIZE isn't a good default Merkle tree block size for
fsverity-utils, since it means that if someone doesn't explicitly
specify the block size, then the results of 'fsverity sign' and
'fsverity enable' will differ between different architectures.
So change the default Merkle tree block size to 4096, which is the most
common PAGE_SIZE. This will break anyone using the fsverity program
without the --block-size option on an architecture with a non-4K page
size. But I don't think anyone is actually doing that yet anyway.
Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
---
programs/cmd_digest.c | 2 +-
programs/cmd_enable.c | 2 +-
programs/cmd_sign.c | 2 +-
programs/fsverity.c | 14 --------------
programs/fsverity.h | 1 -
5 files changed, 3 insertions(+), 18 deletions(-)
diff --git a/programs/cmd_digest.c b/programs/cmd_digest.c
index 180f438..7899b04 100644
--- a/programs/cmd_digest.c
+++ b/programs/cmd_digest.c
@@ -90,7 +90,7 @@ int fsverity_cmd_digest(const struct fsverity_command *cmd,
tree_params.hash_algorithm = FS_VERITY_HASH_ALG_DEFAULT;
if (tree_params.block_size == 0)
- tree_params.block_size = get_default_block_size();
+ tree_params.block_size = 4096;
for (int i = 0; i < argc; i++) {
struct fsverity_signed_digest *d = NULL;
diff --git a/programs/cmd_enable.c b/programs/cmd_enable.c
index d90d208..ba5b088 100644
--- a/programs/cmd_enable.c
+++ b/programs/cmd_enable.c
@@ -114,7 +114,7 @@ int fsverity_cmd_enable(const struct fsverity_command *cmd,
arg.hash_algorithm = FS_VERITY_HASH_ALG_DEFAULT;
if (arg.block_size == 0)
- arg.block_size = get_default_block_size();
+ arg.block_size = 4096;
if (!open_file(&file, argv[0], O_RDONLY, 0))
goto out_err;
diff --git a/programs/cmd_sign.c b/programs/cmd_sign.c
index 580e4df..9cb7507 100644
--- a/programs/cmd_sign.c
+++ b/programs/cmd_sign.c
@@ -105,7 +105,7 @@ int fsverity_cmd_sign(const struct fsverity_command *cmd,
tree_params.hash_algorithm = FS_VERITY_HASH_ALG_DEFAULT;
if (tree_params.block_size == 0)
- tree_params.block_size = get_default_block_size();
+ tree_params.block_size = 4096;
if (sig_params.keyfile == NULL) {
error_msg("Missing --key argument");
diff --git a/programs/fsverity.c b/programs/fsverity.c
index 4a2f8df..33d0a3f 100644
--- a/programs/fsverity.c
+++ b/programs/fsverity.c
@@ -12,7 +12,6 @@
#include "fsverity.h"
#include <limits.h>
-#include <unistd.h>
static const struct fsverity_command {
const char *name;
@@ -192,19 +191,6 @@ bool parse_salt_option(const char *arg, u8 **salt_ptr, u32 *salt_size_ptr)
return true;
}
-u32 get_default_block_size(void)
-{
- long n = sysconf(_SC_PAGESIZE);
-
- if (n <= 0 || n >= INT_MAX || !is_power_of_2(n)) {
- fprintf(stderr,
- "Warning: invalid _SC_PAGESIZE (%ld). Assuming 4K blocks.\n",
- n);
- return 4096;
- }
- return n;
-}
-
int main(int argc, char *argv[])
{
const struct fsverity_command *cmd;
diff --git a/programs/fsverity.h b/programs/fsverity.h
index 669fef2..2af5527 100644
--- a/programs/fsverity.h
+++ b/programs/fsverity.h
@@ -46,6 +46,5 @@ void usage(const struct fsverity_command *cmd, FILE *fp);
bool parse_hash_alg_option(const char *arg, u32 *alg_ptr);
bool parse_block_size_option(const char *arg, u32 *size_ptr);
bool parse_salt_option(const char *arg, u8 **salt_ptr, u32 *salt_size_ptr);
-u32 get_default_block_size(void);
#endif /* PROGRAMS_FSVERITY_H */
--
2.29.2
|