Read-Only Rootfs
Güvenli Gömülü Sistem

# Temel kullanım
mksquashfs rootfs/ rootfs.squashfs

# xz sıkıştırması, 1 MB block boyutu (en iyi oran)
mksquashfs rootfs/ rootfs.squashfs \
    -comp xz \
    -b 1M \
    -Xdict-size 100% \
    -noappend

# zstd sıkıştırması (daha hızlı decompress, modern tercih)
mksquashfs rootfs/ rootfs.squashfs \
    -comp zstd \
    -Xcompression-level 15

# Geçici dosyaları hariç tut
mksquashfs rootfs/ rootfs.squashfs \
    -comp xz \
    -e rootfs/tmp rootfs/var/log rootfs/var/cache

# Image içeriğini mount etmeden listele
unsquashfs -l rootfs.squashfs | head -30

# Superblock bilgisi (boyut, sıkıştırma, block size)
unsquashfs -s rootfs.squashfs

# Loop device ile mount
sudo mount -t squashfs -o loop rootfs.squashfs /mnt

# Block device'ten direkt mount
sudo mount -t squashfs -o ro /dev/mmcblk0p2 /mnt

CONFIG_SQUASHFS=y
CONFIG_SQUASHFS_FILE_CACHE=y
CONFIG_SQUASHFS_ZLIB=y
CONFIG_SQUASHFS_LZO=y
CONFIG_SQUASHFS_XZ=y
CONFIG_SQUASHFS_LZ4=y
CONFIG_SQUASHFS_ZSTD=y
CONFIG_OVERLAY_FS=y

# Dizinleri hazırla
mkdir -p /lower /upper/upper /upper/work /merged

# SquashFS'i lower olarak mount et
mount -t squashfs -o loop,ro rootfs.squashfs /lower

# tmpfs'i upper/work için mount et
mount -t tmpfs tmpfs /upper

# OverlayFS mount
mount -t overlay overlay \
    -o lowerdir=/lower,upperdir=/upper/upper,workdir=/upper/work \
    /merged

# Lower'da var olan dosyayı sil
rm /merged/etc/motd

# Upper'da whiteout oluştu (karakter cihazı 0:0)
ls -la /upper/upper/etc/motd
# c--------- 1 root root 0, 0 ... /upper/upper/etc/motd

# /merged/etc/motd artık görünmez
# Reboot → tmpfs temizlendi → /etc/motd yeniden görünür

#!/bin/sh
# initramfs /init — read-only rootfs + overlayfs kurulumu

mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs devtmpfs /dev

ROOTDEV=/dev/mmcblk0p2
DATADEV=/dev/mmcblk0p3

# SquashFS'i /mnt/lower'a mount et
mkdir -p /mnt/lower /mnt/overlay
mount -t squashfs -o ro "$ROOTDEV" /mnt/lower

# Data partition'ı mount et (overlay upper için)
mount -t ext4 -o rw,noatime "$DATADEV" /mnt/data 2>/dev/null

# upper ve work dizinlerini hazırla
if mountpoint -q /mnt/data; then
    # Persistent upper (data partition)
    mkdir -p /mnt/data/overlay/upper /mnt/data/overlay/work
    UPPER=/mnt/data/overlay/upper
    WORK=/mnt/data/overlay/work
else
    # Fallback: tmpfs upper (reboot'ta kaybolur)
    mount -t tmpfs tmpfs /mnt/overlay
    mkdir /mnt/overlay/upper /mnt/overlay/work
    UPPER=/mnt/overlay/upper
    WORK=/mnt/overlay/work
fi

# OverlayFS mount
mount -t overlay overlay \
    -o lowerdir=/mnt/lower,upperdir="$UPPER",workdir="$WORK" \
    /mnt/newroot

# pivot_root: yeni rootfs'e geç
mkdir -p /mnt/newroot/oldroot
pivot_root /mnt/newroot /mnt/newroot/oldroot

# Eski proc/sys/dev'i temizle
mount --move /oldroot/proc /proc
mount --move /oldroot/sys /sys
mount --move /oldroot/dev /dev

umount -l /oldroot

exec /sbin/init

# /etc'yi ayrı overlay ile yönet
# lower: squashfs içindeki /etc
# upper: /data/etc-upper
mkdir -p /data/etc-upper /data/etc-work
mount -t overlay overlay \
    -o lowerdir=/etc,upperdir=/data/etc-upper,workdir=/data/etc-work \
    /etc

# /etc/network/interfaces gibi dosyalar artık /data/etc-upper'da
# Squashfs içindeki orijinal dosyalar dokunulmaz kalır

#!/bin/bash
# Buildroot post-build: tmpfs için sembolik linkler hazırla

TARGET_DIR="$1"

# /var/log → tmpfs symlink
rm -rf "$TARGET_DIR/var/log"
ln -sf /run/log "$TARGET_DIR/var/log"

# /var/tmp → tmpfs
rm -rf "$TARGET_DIR/var/tmp"
ln -sf /tmp "$TARGET_DIR/var/tmp"

# /var/run → /run (zaten var ama kontrol edelim)
rm -rf "$TARGET_DIR/var/run"
ln -sf /run "$TARGET_DIR/var/run"

# initramfs /init script'ini kopyala
install -m 755 board/myboard/initramfs-init \
    "$TARGET_DIR/../images/initramfs-init"

# Tüm /var'ı tmpfs'te tut (volatile mode)
root=/dev/mmcblk0p2 rootfstype=squashfs ro systemd.volatile=yes

# Sadece /var volatile, rootfs'in geri kalanı ro
root=/dev/mmcblk0p2 rootfstype=squashfs ro systemd.volatile=state

# rootfs: read-only squashfs
/dev/mmcblk0p2   /        squashfs  ro,noatime              0  0

# /var: yazılabilir ext4 (power-safe journaling)
/dev/mmcblk0p3   /var     ext4      rw,noatime,data=journal 0  2

# /data: kullanıcı verileri
/dev/mmcblk0p4   /data    ext4      rw,noatime              0  2

# /tmp: RAM
tmpfs            /tmp     tmpfs     rw,nosuid,nodev,size=64m 0 0

# d = dizin oluştur (yoksa), Mode UID GID Age
d  /var/log/myapp   0755  root  root  -
d  /var/lib/myapp   0755  myapp myapp -
d  /run/myapp       0755  myapp myapp -
d  /tmp/myapp       0755  myapp myapp 7d

# L = symlink oluştur
L  /var/lock        -     -     -     -  /run/lock

# f = dosya oluştur (yoksa)
f  /var/lib/myapp/config.json  0640  myapp  myapp  -  {}

[Unit]
Description=My Embedded Application
After=network.target var.mount

[Service]
Type=simple
User=myapp
ExecStart=/usr/bin/myapp

# Service özel namespace: sadece bu servis yazabilir
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes

# Yazma iznine ihtiyaç duyulan dizinler
ReadWritePaths=/var/lib/myapp
ReadWritePaths=/data/myapp

[Install]
WantedBy=multi-user.target

# /var/log/journal dizini oluştur (persistent journal için)
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald

# journald.conf
# [Journal]
# Storage=persistent
# SystemMaxUse=32M
# SystemKeepFree=10M

#!/bin/sh
# Factory reset: data partition'ı sıfırla

echo "UYARI: Tüm kullanıcı verileri silinecek!"
read -r answer
[ "$answer" != "EVET" ] && exit 1

DATADEV=/dev/mmcblk0p4

# /data'yı umount et
umount /data

# Sıfırdan ext4 formatla
mkfs.ext4 -L data -F "$DATADEV"

# Yeniden mount et
mount /data

# Temel dizin yapısını oluştur
mkdir -p /data/overlay/upper /data/overlay/work
mkdir -p /data/etc-upper /data/etc-work
mkdir -p /data/app /data/logs

echo "Factory reset tamamlandı. Yeniden başlatılıyor..."
reboot

# Hash device oluştur (rootfs block device + ayrı hash device)
# p2 = rootfs (ro squashfs), p4 = hash partition
veritysetup format /dev/mmcblk0p2 /dev/mmcblk0p4
# VERITY header information for /dev/mmcblk0p2
# UUID:                  ...
# Hash type:             1
# Data blocks:           131072
# Data block size:       4096
# Hash block size:       4096
# Hash algorithm:        sha256
# Salt:                  abcdef1234...
# Root hash:             7f3a2b9c...  ← bunu kaydet!

# Root hash'i kaydet
ROOT_HASH=$(veritysetup format /dev/mmcblk0p2 /dev/mmcblk0p4 2>&1 \
    | grep "Root hash" | awk '{print $3}')

# Bütünlüğü doğrula
veritysetup verify /dev/mmcblk0p2 /dev/mmcblk0p4 "$ROOT_HASH"
# Başarı: exit code 0 (çıktı yok)

# dm-verity device map'le
veritysetup open /dev/mmcblk0p2 vroot /dev/mmcblk0p4 "$ROOT_HASH"
# /dev/mapper/vroot oluşur

# Doğrulanmış rootfs'i mount et
mount -t squashfs -o ro /dev/mapper/vroot /mnt

# dm-verity ile boot — root hash bootargs içinde
root=/dev/dm-0
dm-mod.create="vroot,,0,ro,0 262144 verity 1 /dev/mmcblk0p2 /dev/mmcblk0p4 4096 4096 131072 131072 sha256 <root_hash> <salt>"
rootfstype=squashfs ro

CONFIG_BLK_DEV_DM=y
CONFIG_DM_VERITY=y
CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y   # root hash imzası doğrulama
CONFIG_CRYPTO_SHA256=y

# Filesystem Images → SquashFS root filesystem
BR2_TARGET_ROOTFS_SQUASHFS=y
BR2_TARGET_ROOTFS_SQUASHFS_LZMA=n
BR2_TARGET_ROOTFS_SQUASHFS_XZ=y

# ext4 image de üretelim (data partition için)
BR2_TARGET_ROOTFS_EXT2=y
BR2_TARGET_ROOTFS_EXT2_4=y
BR2_TARGET_ROOTFS_EXT2_SIZE="256M"

# Overlay directory: içeriği rootfs üzerine kopyalanır
BR2_ROOTFS_OVERLAY="board/myboard/rootfs-overlay"

# Post-build ve post-image script'ler
BR2_ROOTFS_POST_BUILD_SCRIPT="board/myboard/post-build.sh"
BR2_ROOTFS_POST_IMAGE_SCRIPT="board/myboard/post-image.sh"

#!/bin/bash
TARGET_DIR="$1"

# /var/log → tmpfs, log'lar RAM'de
rm -rf  "$TARGET_DIR/var/log"
ln -sf  /run/log  "$TARGET_DIR/var/log"

# /var/tmp → /tmp
rm -rf  "$TARGET_DIR/var/tmp"
ln -sf  /tmp  "$TARGET_DIR/var/tmp"

# /var/run → /run
rm -rf  "$TARGET_DIR/var/run"
ln -sf  /run  "$TARGET_DIR/var/run"

# fstab oluştur
cat > "$TARGET_DIR/etc/fstab" <<'EOF'
/dev/mmcblk0p2  /      squashfs  ro,noatime              0  0
/dev/mmcblk0p3  /data  ext4      rw,noatime,errors=remount-ro  0  2
tmpfs           /tmp   tmpfs     rw,nosuid,nodev,size=32m 0  0
tmpfs           /run   tmpfs     rw,nosuid,nodev,size=32m 0  0
EOF

#!/bin/bash
BINARIES_DIR="${BINARIES_DIR}"
BOARD_DIR="$(dirname $0)"

# genimage ile tam eMMC image üret
genimage \
    --config  "$BOARD_DIR/genimage.cfg" \
    --rootpath "$TARGET_DIR" \
    --tmppath  "$BUILD_DIR/genimage.tmp" \
    --inputpath "$BINARIES_DIR" \
    --outputpath "$BINARIES_DIR"

image sdcard.img {
  hdimage {}

  partition boot {
    partition-type = 0xC
    bootable = true
    image = "boot.vfat"
    size = 64M
  }

  partition rootfsA {
    partition-type = 0x83
    image = "rootfs.squashfs"
    size = 256M
  }

  partition rootfsB {
    partition-type = 0x83
    image = "rootfs.squashfs"
    size = 256M
  }

  partition data {
    partition-type = 0x83
    image = "rootfs.ext2"
    size = 512M
  }
}

# squashfs'i mmc'den kernel'a yükle
setenv bootcmd 'mmc dev 0; sqfsload mmc 0:2 ${loadaddr} /boot/Image; \
    sqfsload mmc 0:2 ${fdt_addr} /boot/myboard.dtb; \
    setenv bootargs root=/dev/mmcblk0p2 rootfstype=squashfs ro \
    systemd.volatile=state; \
    booti ${loadaddr} - ${fdt_addr}'

# Read-only rootfs aktif et
IMAGE_FEATURES += "read-only-rootfs"

# Debug sembolleri içeren paketler (geliştirme için)
IMAGE_FEATURES += "dbg-pkgs"

# SquashFS image üretimi
IMAGE_FSTYPES += "squashfs-xz"

# ext4 data partition
IMAGE_FSTYPES += "ext4"

# /etc/volatile.conf — tmpfs üzerine bind mount tanımları
VOLATILE_LOG_DIR ?= "volatile"

# Formatı: "type mode uid gid path [link]"
VOLATILE_BINDS += "/var/volatile/log 0755 root root /var/log"
VOLATILE_BINDS += "/var/volatile/tmp 1777 root root /var/tmp"
VOLATILE_BINDS += "/var/volatile/lib/systemd 0755 root root /var/lib/systemd"

# d = dizin oluştur, f = dosya oluştur
# Format: type  mode  uid  gid  path
d  0755  root  root  /var/volatile/log
d  0755  root  root  /var/volatile/run
d  1777  root  root  /var/volatile/tmp
d  0755  root  root  /var/volatile/lib
d  0755  root  root  /var/volatile/lib/systemd
d  0755  root  root  /var/volatile/lib/NetworkManager

SUMMARY = "MyBoard Read-Only Production Image"
LICENSE = "MIT"

inherit core-image

IMAGE_FEATURES += " \
    read-only-rootfs \
    ssh-server-openssh \
"

IMAGE_INSTALL += " \
    packagegroup-core-boot \
    kernel-modules \
    myapp \
    volatile-binds \
"

IMAGE_FSTYPES = "squashfs-xz ext4"

# /var'ı tmpfs'e bağlamak için systemd-volatile-root
DISTRO_FEATURES:append = " systemd"
VIRTUAL-RUNTIME_init_manager = "systemd"

# Image'ı build et
bitbake myboard-image

# Üretilen dosyaları kontrol et
ls -lh tmp/deploy/images/myboard/
# myboard-image-myboard.squashfs-xz
# myboard-image-myboard.ext4

# SquashFS içeriğini doğrula
unsquashfs -l myboard-image-myboard.squashfs-xz | grep var/log
# squashfs-root/var/log -> /run/log (symlink olmalı)

# U-Boot boot.cmd
if test "${upgrade_available}" = "1"; then
    setexpr bootcount ${bootcount} + 1
    if test ${bootcount} > 3; then
        echo "Rollback: boot_slot A"
        setenv boot_slot A
        setenv upgrade_available 0
        setenv bootcount 0
        saveenv
    fi
fi

if test "${boot_slot}" = "B"; then
    setenv rootpart 3   # mmcblk0p3 = rootfsB
else
    setenv rootpart 2   # mmcblk0p2 = rootfsA
fi

setenv bootargs root=/dev/mmcblk0p${rootpart} rootfstype=squashfs ro \
    systemd.volatile=state
sqfsload mmc 0:${rootpart} ${loadaddr} /boot/Image
booti ${loadaddr} - ${fdt_addr_r}

[Unit]
Description=OTA Update Health Check
After=network-online.target myapp.service
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/health-check.sh
RemainAfterExit=no

#!/bin/sh
# Güncelleme sağlık kontrolü

UPGRADE_AVAILABLE=$(fw_printenv upgrade_available 2>/dev/null | cut -d= -f2)

[ "$UPGRADE_AVAILABLE" != "1" ] && exit 0

# Kritik servislerin çalışıp çalışmadığını kontrol et
check_service() {
    systemctl is-active --quiet "$1" && return 0
    echo "HATA: $1 çalışmıyor — rollback başlatılıyor"
    fw_setenv upgrade_available 0
    fw_setenv boot_slot A
    reboot
}

check_service myapp.service
check_service NetworkManager.service

# Tüm kontroller geçti: güncellemeyi onayla
fw_setenv upgrade_available 0
fw_setenv bootcount 0
echo "Güncelleme onaylandı."

#!/bin/sh
# Aktif slot'u oku
ACTIVE_SLOT=$(fw_printenv boot_slot 2>/dev/null | cut -d= -f2)
ACTIVE_SLOT=${ACTIVE_SLOT:-A}

if [ "$ACTIVE_SLOT" = "A" ]; then
    TARGET_DEV=/dev/mmcblk0p3
    TARGET_SLOT=B
else
    TARGET_DEV=/dev/mmcblk0p2
    TARGET_SLOT=A
fi

echo "Güncelleniyor: Slot ${TARGET_SLOT} (${TARGET_DEV})"

# Yeni squashfs'i hedef partition'a yaz
dd if=/tmp/rootfs-new.squashfs of="$TARGET_DEV" bs=4M status=progress
sync

# Yeni slot'u aktif yap
fw_setenv boot_slot "$TARGET_SLOT"
fw_setenv upgrade_available 1
fw_setenv bootcount 0

echo "Güncelleme yazıldı. Yeniden başlatılıyor..."
reboot