fsverity: Use thiserror for measurement, add a compare API

Change the API to use thiserror instead of anyhow, as we
want in some cases more precise error mappings.

Also by default change the API to return `Option`
for callers that want to not have missing verity be a fatal
error.

Finally, add a high level compare API that most of the callers
really wanted.

Note I didn't try to add a wrapper error enum for the
verity *enablement* part yet.

Signed-off-by: Colin Walters <[email protected]>

Cargo.toml

@@ -24,6 +24,7 @@ rustix = { version = "0.38.37", features = ["fs", "mount", "process"] }
 sha2 = "0.10.8"
 tar = { version = "0.4.42", default-features = false }
 tempfile = "3.13.0"
+thiserror = "2.0.4"
 tokio = "1.41.0"
 zstd = "0.13.2"
 

src/fsverity/ioctl.rs

@@ -1,10 +1,22 @@
 use std::os::fd::AsFd;
 
-use anyhow::Result;
+use rustix::io::Errno;
 use rustix::ioctl;
+use thiserror::Error;
 
 use super::FsVerityHashValue;
 
+/// Measuring fsverity failed.
+#[derive(Error, Debug)]
+pub enum MeasureVerityError {
+    #[error("i/o error")]
+    Io(#[from] std::io::Error),
+    #[error("Expected algorithm {expected}, found {found}")]
+    InvalidDigestAlgorithm { expected: u16, found: u16 },
+    #[error("Expected digest size {expected}")]
+    InvalidDigestSize { expected: u16 },
+}
+
 // See /usr/include/linux/fsverity.h
 #[repr(C)]
 pub struct FsVerityEnableArg {
@@ -22,7 +34,10 @@ pub struct FsVerityEnableArg {
 // #define FS_IOC_ENABLE_VERITY    _IOW('f', 133, struct fsverity_enable_arg)
 type FsIocEnableVerity = ioctl::WriteOpcode<b'f', 133, FsVerityEnableArg>;
 
-pub fn fs_ioc_enable_verity<F: AsFd, H: FsVerityHashValue>(fd: F) -> Result<()> {
+/// Enable fsverity on the target file. This is a thin safe wrapper for the underlying base `ioctl`
+/// and hence all constraints apply such as requiring the file descriptor to already be `O_RDONLY`
+/// etc.
+pub fn fs_ioc_enable_verity<F: AsFd, H: FsVerityHashValue>(fd: F) -> std::io::Result<()> {
     unsafe {
         ioctl::ioctl(
             fd,
@@ -43,6 +58,7 @@ pub fn fs_ioc_enable_verity<F: AsFd, H: FsVerityHashValue>(fd: F) -> Result<()>
     Ok(())
 }
 
+/// Core definition of a fsverity digest.
 #[repr(C)]
 pub struct FsVerityDigest<F> {
     digest_algorithm: u16,
@@ -53,7 +69,10 @@ pub struct FsVerityDigest<F> {
 // #define FS_IOC_MEASURE_VERITY   _IORW('f', 134, struct fsverity_digest)
 type FsIocMeasureVerity = ioctl::ReadWriteOpcode<b'f', 134, FsVerityDigest<()>>;
 
-pub fn fs_ioc_measure_verity<F: AsFd, H: FsVerityHashValue>(fd: F) -> Result<H> {
+/// Measure the fsverity digest of the provided file descriptor.
+pub fn fs_ioc_measure_verity<F: AsFd, H: FsVerityHashValue>(
+    fd: F,
+) -> Result<Option<H>, MeasureVerityError> {
     let digest_size = std::mem::size_of::<H>() as u16;
     let digest_algorithm = H::ALGORITHM as u16;
 
@@ -63,16 +82,48 @@ pub fn fs_ioc_measure_verity<F: AsFd, H: FsVerityHashValue>(fd: F) -> Result<H>
         digest: H::EMPTY,
     };
 
-    unsafe {
+    let r = unsafe {
         ioctl::ioctl(
             fd,
             ioctl::Updater::<FsIocMeasureVerity, FsVerityDigest<H>>::new(&mut digest),
-        )?;
+        )
+    };
+    match r {
+        Ok(()) => {
+            if digest.digest_algorithm != digest_algorithm {
+                return Err(MeasureVerityError::InvalidDigestAlgorithm {
+                    expected: digest.digest_algorithm,
+                    found: digest_algorithm,
+                });
+            }
+            if digest.digest_size != digest_size {
+                return Err(MeasureVerityError::InvalidDigestSize {
+                    expected: digest.digest_size,
+                });
+            }
+            Ok(Some(digest.digest))
+        }
+        // This function returns Ok(None) if there's no verity digest found.
+        Err(Errno::NODATA | Errno::NOTTY | Errno::OPNOTSUPP) => Ok(None),
+        Err(Errno::OVERFLOW) => Err(MeasureVerityError::InvalidDigestSize {
+            expected: digest.digest_size,
+        }),
+        Err(e) => Err(std::io::Error::from(e).into()),
     }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::fsverity::Sha256HashValue;
 
-    if digest.digest_algorithm != digest_algorithm || digest.digest_size != digest_size {
-        Err(std::io::Error::from(std::io::ErrorKind::InvalidData))?
-    } else {
-        Ok(digest.digest)
+    #[test]
+    fn test_measure_verity_opt() -> anyhow::Result<()> {
+        let tf = tempfile::tempfile()?;
+        assert_eq!(
+            fs_ioc_measure_verity::<_, Sha256HashValue>(&tf).unwrap(),
+            None
+        );
+        Ok(())
     }
 }

src/fsverity/mod.rs

@@ -1,7 +1,13 @@
+use std::os::fd::AsFd;
+
+use anyhow::Result;
+use ioctl::MeasureVerityError;
+use thiserror::Error;
+
 pub mod digest;
 pub mod ioctl;
 
-pub trait FsVerityHashValue {
+pub trait FsVerityHashValue: Eq + AsRef<[u8]> {
     const ALGORITHM: u8;
     const EMPTY: Self;
 }
@@ -19,3 +25,61 @@ impl FsVerityHashValue for Sha512HashValue {
     const ALGORITHM: u8 = 2;
     const EMPTY: Self = [0; 64];
 }
+
+/// A verity comparison failed.
+#[derive(Error, Debug)]
+pub enum CompareVerityError {
+    #[error("failed to read verity")]
+    Measure(#[from] MeasureVerityError),
+    #[error("fsverity is not enabled on target file")]
+    VerityMissing,
+    #[error("Expected digest {expected} but found {found}")]
+    DigestMismatch { expected: String, found: String },
+}
+
+/// Require the fsverity digest to be present.
+pub fn measure_verity_digest<F: AsFd, H: FsVerityHashValue>(
+    fd: F,
+) -> Result<H, CompareVerityError> {
+    match ioctl::fs_ioc_measure_verity::<_, H>(fd)? {
+        Some(found) => Ok(found),
+        None => Err(CompareVerityError::VerityMissing),
+    }
+}
+
+/// Compare the fsverity digest of the file versus the expected digest.
+pub fn ensure_verity<F: AsFd, H: FsVerityHashValue>(
+    fd: F,
+    expected: &H,
+) -> Result<(), CompareVerityError> {
+    let found = measure_verity_digest::<_, H>(fd)?;
+    if expected == &found {
+        Ok(())
+    } else {
+        Err(CompareVerityError::DigestMismatch {
+            expected: hex::encode(expected),
+            found: hex::encode(found.as_ref()),
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::fsverity::Sha256HashValue;
+
+    #[test]
+    fn test_verity_missing() -> anyhow::Result<()> {
+        let tf = tempfile::tempfile()?;
+        match measure_verity_digest::<_, Sha256HashValue>(&tf) {
+            Err(CompareVerityError::VerityMissing) => {}
+            o => panic!("Unexpected {o:?}"),
+        }
+        let h = Sha256HashValue::default();
+        match ensure_verity(&tf, &h) {
+            Err(CompareVerityError::VerityMissing) => {}
+            o => panic!("Unexpected {o:?}"),
+        }
+        Ok(())
+    }
+}

src/mount.rs

@@ -14,7 +14,7 @@ use rustix::{
     },
 };
 
-use crate::fsverity;
+use crate::{fsverity, util};
 
 struct FsHandle {
     pub fd: OwnedFd,
@@ -192,11 +192,8 @@ impl<'a> MountOptions<'a> {
         let image = std::fs::File::open(self.image)?;
 
         if let Some(expected) = self.digest {
-            let measured: fsverity::Sha256HashValue =
-                fsverity::ioctl::fs_ioc_measure_verity(&image)?;
-            if expected != hex::encode(measured) {
-                panic!("expected {:?} measured {:?}", expected, measured);
-            }
+            let expected = util::parse_sha256(expected)?;
+            fsverity::ensure_verity(&image, &expected)?;
         }
 
         mount_fd(image, self.basedir, mountpoint)

src/repository.rs

@@ -20,9 +20,8 @@ use sha2::{Digest, Sha256};
 
 use crate::{
     fsverity::{
-        digest::FsVerityHasher,
-        ioctl::{fs_ioc_enable_verity, fs_ioc_measure_verity},
-        FsVerityHashValue, Sha256HashValue,
+        self, digest::FsVerityHasher, ioctl::fs_ioc_enable_verity, FsVerityHashValue,
+        Sha256HashValue,
     },
     mount::{mount_fd, pivot_sysroot},
     splitstream::{DigestMap, SplitStreamReader, SplitStreamWriter},
@@ -95,11 +94,11 @@ impl Repository {
         let ro_fd = open(proc_self_fd(&fd), OFlags::RDONLY, Mode::empty())?;
         drop(fd);
 
-        fs_ioc_enable_verity::<&OwnedFd, Sha256HashValue>(&ro_fd)?;
+        fs_ioc_enable_verity::<&OwnedFd, Sha256HashValue>(&ro_fd)
+            .context("Re-validating verity digest")?;
 
         // double-check
-        let measured_digest: Sha256HashValue = fs_ioc_measure_verity(&ro_fd)?;
-        assert!(measured_digest == digest);
+        fsverity::ensure_verity(&ro_fd, &digest)?;
 
         if let Err(err) = linkat(
             CWD,
@@ -123,12 +122,8 @@ impl Repository {
         expected_verity: &Sha256HashValue,
     ) -> Result<OwnedFd> {
         let fd = self.openat(filename, OFlags::RDONLY)?;
-        let measured_verity: Sha256HashValue = fs_ioc_measure_verity(&fd)?;
-        if measured_verity != *expected_verity {
-            bail!("bad verity!")
-        } else {
-            Ok(fd)
-        }
+        fsverity::ensure_verity(&fd, expected_verity)?;
+        Ok(fd)
     }
 
     /// Creates a SplitStreamWriter for writing a split stream.
@@ -194,7 +189,7 @@ impl Repository {
     pub fn check_stream(&self, sha256: &Sha256HashValue) -> Result<Option<Sha256HashValue>> {
         match self.openat(&format!("streams/{}", hex::encode(sha256)), OFlags::RDONLY) {
             Ok(stream) => {
-                let measured_verity: Sha256HashValue = fs_ioc_measure_verity(&stream)?;
+                let measured_verity: Sha256HashValue = fsverity::measure_verity_digest(&stream)?;
                 let mut context = Sha256::new();
                 let mut split_stream = SplitStreamReader::new(File::from(stream))?;