2019-01-07 20:28:53 +00:00
|
|
|
#!/bin/bash
|
2021-11-16 21:51:42 +00:00
|
|
|
#########################################################################################
|
|
|
|
# Script to setup the TPM 2.0 Provisioner Docker Image for System Tests
|
|
|
|
#
|
|
|
|
#########################################################################################
|
2019-01-07 20:28:53 +00:00
|
|
|
set -e
|
2022-01-26 15:04:07 +00:00
|
|
|
pushd / > /dev/null
|
2021-11-16 21:51:42 +00:00
|
|
|
echo "Setting up TPM emulator for the TPM2 Provisioner"
|
2019-01-07 20:28:53 +00:00
|
|
|
|
2021-11-16 21:51:42 +00:00
|
|
|
# Function to make and install TPM 2.0 Provisioner packages
|
2022-01-26 15:24:29 +00:00
|
|
|
function installProvisioner {
|
2019-12-23 10:28:26 +00:00
|
|
|
echo "===========Installing TPM 2.0 Provisioner Packages...==========="
|
2022-01-26 15:04:07 +00:00
|
|
|
pushd /HIRS > /dev/null
|
2021-11-16 21:51:42 +00:00
|
|
|
echo "Building the HIRS Provisioner ..."
|
|
|
|
mkdir -p /HIRS/logs/provisioner/
|
|
|
|
sh package/package.centos.sh &> /HIRS/logs/provisioner/provisioner_build.log
|
|
|
|
echo "Installing the HIRS Provisioner ..."
|
2019-12-23 10:28:26 +00:00
|
|
|
yum install -y package/rpm/RPMS/x86_64/HIRS_Provisioner_TPM_2_0*.el7.x86_64.rpm
|
2022-01-26 15:04:07 +00:00
|
|
|
popd > /dev/null
|
2019-01-15 17:46:06 +00:00
|
|
|
}
|
|
|
|
|
2022-01-25 15:54:54 +00:00
|
|
|
# use ibm tss to properly clear tpm pcr values
|
|
|
|
function setTpmPcrValues {
|
|
|
|
mkdir /ibmtss
|
2022-01-26 15:04:07 +00:00
|
|
|
pushd /ibmtss > /dev/null
|
2022-01-25 15:54:54 +00:00
|
|
|
echo "Installing IBM TSS to set the TPM simulator intial values correctly..."
|
|
|
|
wget --no-check-certificate https://downloads.sourceforge.net/project/ibmtpm20tss/ibmtss1.5.0.tar.gz > /dev/null
|
|
|
|
tar -zxvf ibmtss1.5.0.tar.gz > /dev/null
|
|
|
|
cd utils
|
|
|
|
make -f makefiletpmc > /dev/null
|
|
|
|
cd ../utils
|
2022-01-26 15:04:07 +00:00
|
|
|
./startup
|
|
|
|
popd > /dev/null
|
|
|
|
}
|
|
|
|
|
|
|
|
# Set default values tcg_boot_properties
|
|
|
|
function setTcgProperties {
|
|
|
|
propFile="/etc/hirs/tcg_boot.properties";
|
|
|
|
|
|
|
|
echo "tcg.rim.dir=/boot/tcg/manifest/rim/" > $propFile;
|
|
|
|
echo "tcg.swidtag.dir=/boot/tcg/manifest/swidtag/" >> $propFile;
|
|
|
|
echo "tcg.cert.dir=/boot/tcg/cert/platform/" >> $propFile;
|
|
|
|
echo "tcg.event.file=/sys/kernel/security/tpm0/binary_bios_measurements" >> $propFile;
|
2022-01-25 15:54:54 +00:00
|
|
|
}
|
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
# Function to initialize the TPM 2.0 Emulator
|
2022-01-26 15:24:29 +00:00
|
|
|
function initTpm2Emulator {
|
2019-12-23 10:28:26 +00:00
|
|
|
echo "===========Initializing TPM 2.0 Emulator...==========="
|
|
|
|
|
|
|
|
mkdir -p /var/run/dbus
|
|
|
|
if [ -e /var/run/dbus/pid ]; then
|
|
|
|
rm /var/run/dbus/pid
|
|
|
|
fi
|
|
|
|
|
|
|
|
if [ -e /var/run/dbus/system_bus_socket ]; then
|
|
|
|
rm /var/run/dbus/system_bus_socket
|
|
|
|
fi
|
|
|
|
|
|
|
|
# Start the DBus
|
|
|
|
dbus-daemon --fork --system
|
|
|
|
echo "DBus started"
|
|
|
|
|
|
|
|
# Give DBus time to start up
|
|
|
|
sleep 5
|
|
|
|
|
|
|
|
/ibmtpm/src/./tpm_server &
|
|
|
|
echo "TPM Emulator started"
|
|
|
|
|
2022-01-25 15:54:54 +00:00
|
|
|
sleep 1
|
|
|
|
# Use the ibmtss to clear the PCR values (tpm2-abrmd will currupt PCR0)
|
|
|
|
setTpmPcrValues
|
2019-12-23 10:28:26 +00:00
|
|
|
# Give tpm_server time to start and register on the DBus
|
2022-01-25 15:54:54 +00:00
|
|
|
sleep 1
|
2019-12-23 10:28:26 +00:00
|
|
|
|
|
|
|
tpm2-abrmd -t socket &
|
|
|
|
echo "TPM2-Abrmd started"
|
|
|
|
|
|
|
|
# Give ABRMD time to start and register on the DBus
|
2021-11-16 21:51:42 +00:00
|
|
|
sleep 2
|
2019-12-23 10:28:26 +00:00
|
|
|
|
|
|
|
# Certificates
|
|
|
|
ek_cert="/HIRS/.ci/setup/certs/ek_cert.der"
|
|
|
|
ca_key="/HIRS/.ci/setup/certs/ca.key"
|
|
|
|
ca_cert="/HIRS/.ci/setup/certs/ca.crt"
|
|
|
|
platform_cert="platformAttributeCertificate.der"
|
|
|
|
|
|
|
|
if tpm2_nvlist | grep -q 0x1c00002; then
|
|
|
|
echo "Released NVRAM for EK."
|
|
|
|
tpm2_nvrelease -x 0x1c00002 -a 0x40000001
|
|
|
|
fi
|
|
|
|
|
|
|
|
# Define nvram space to enable loading of EK cert (-x NV Index, -a handle to
|
|
|
|
# authorize [0x40000001 = ownerAuth handle], -s size [defaults to 2048], -t
|
|
|
|
# specifies attribute value in publicInfo struct
|
|
|
|
# [0x2000A = ownerread|ownerwrite|policywrite])
|
|
|
|
size=$(cat $ek_cert | wc -c)
|
|
|
|
echo "Define NVRAM location for EK cert of size $size."
|
|
|
|
tpm2_nvdefine -x 0x1c00002 -a 0x40000001 -t 0x2000A -s $size
|
|
|
|
|
|
|
|
# Load key into TPM nvram
|
|
|
|
echo "Loading EK cert $ek_cert into NVRAM."
|
|
|
|
tpm2_nvwrite -x 0x1c00002 -a 0x40000001 $ek_cert
|
|
|
|
|
|
|
|
if tpm2_nvlist | grep -q 0x1c90000; then
|
|
|
|
echo "Released NVRAM for PC."
|
|
|
|
tpm2_nvrelease -x 0x1c90000 -a 0x40000001
|
|
|
|
fi
|
|
|
|
|
|
|
|
echo "===========TPM 2.0 Emulator Initialization Complete!==========="
|
|
|
|
|
|
|
|
# Set Logging to INFO Level
|
|
|
|
sed -i "s/WARN/INFO/" /etc/hirs/TPM2_Provisioner/log4cplus_config.ini
|
2019-01-15 17:46:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
# Function to update the hirs-site.config file
|
2022-01-26 15:24:29 +00:00
|
|
|
function updateHirsSiteConfigFile {
|
2019-12-23 10:28:26 +00:00
|
|
|
HIRS_SITE_CONFIG="/etc/hirs/hirs-site.config"
|
2019-02-04 19:26:54 +00:00
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
echo ""
|
|
|
|
echo "===========Updating ${HIRS_SITE_CONFIG}, using values from /HIRS/.ci/docker/.env file...==========="
|
|
|
|
cat /HIRS/.ci/docker/.env
|
2019-02-04 19:26:54 +00:00
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
cat <<DEFAULT_SITE_CONFIG_FILE > $HIRS_SITE_CONFIG
|
2019-01-15 17:46:06 +00:00
|
|
|
#*******************************************
|
|
|
|
#* HIRS site configuration properties file
|
|
|
|
#*******************************************
|
2019-02-04 19:26:54 +00:00
|
|
|
CLIENT_HOSTNAME=${HIRS_ACA_PROVISIONER_TPM2_IP}
|
2019-01-15 17:46:06 +00:00
|
|
|
TPM_ENABLED=${TPM_ENABLED}
|
|
|
|
IMA_ENABLED=${IMA_ENABLED}
|
2019-02-04 19:26:54 +00:00
|
|
|
|
2019-01-15 17:46:06 +00:00
|
|
|
# Site-specific configuration
|
2019-02-04 19:26:54 +00:00
|
|
|
ATTESTATION_CA_FQDN=${HIRS_ACA_HOSTNAME}
|
2019-01-15 17:46:06 +00:00
|
|
|
ATTESTATION_CA_PORT=${HIRS_ACA_PORTAL_PORT}
|
|
|
|
BROKER_FQDN=${HIRS_ACA_PORTAL_IP}
|
|
|
|
BROKER_PORT=${HIRS_BROKER_PORT}
|
|
|
|
PORTAL_FQDN=${HIRS_ACA_PORTAL_IP}
|
|
|
|
PORTAL_PORT=${HIRS_ACA_PORTAL_PORT}
|
2019-02-04 19:26:54 +00:00
|
|
|
|
2019-01-15 17:46:06 +00:00
|
|
|
DEFAULT_SITE_CONFIG_FILE
|
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
echo "===========New HIRS Config File==========="
|
|
|
|
cat /etc/hirs/hirs-site.config
|
2019-01-15 17:46:06 +00:00
|
|
|
}
|
|
|
|
|
2022-01-26 15:24:29 +00:00
|
|
|
function waitForAca {
|
2021-11-16 21:51:42 +00:00
|
|
|
# Wait for ACA to boot
|
|
|
|
echo "Waiting for ACA to spin up at address ${HIRS_ACA_PORTAL_IP} on port ${HIRS_ACA_PORTAL_PORT} ..."
|
|
|
|
until [ "`curl --silent --connect-timeout 1 -I -k https://${HIRS_ACA_PORTAL_IP}:${HIRS_ACA_PORTAL_PORT}/HIRS_AttestationCAPortal | grep '302 Found'`" != "" ]; do
|
2022-01-26 15:04:07 +00:00
|
|
|
sleep 1;
|
2021-11-16 21:51:42 +00:00
|
|
|
#echo "Checking on the ACA..."
|
|
|
|
done
|
|
|
|
echo "ACA is up!"
|
|
|
|
}
|
|
|
|
|
|
|
|
#Wait for the ACA to spin up, if it hasnt already
|
2022-01-26 15:24:29 +00:00
|
|
|
waitForAca
|
2021-11-16 21:51:42 +00:00
|
|
|
|
2019-01-15 17:46:06 +00:00
|
|
|
# Install packages
|
2022-01-26 15:24:29 +00:00
|
|
|
installProvisioner
|
2019-01-15 17:46:06 +00:00
|
|
|
|
2022-01-25 15:54:54 +00:00
|
|
|
# Test to see if provisioner config were set up
|
|
|
|
echo "TPM2 Provisioner container running:"
|
|
|
|
echo "Contents of /etc/hirs is $(ls -al /etc/hirs)";
|
|
|
|
|
2022-01-26 15:04:07 +00:00
|
|
|
setTcgProperties
|
|
|
|
|
|
|
|
echo "TPM2 Provisioner container running:"
|
|
|
|
echo "Contents of /etc/hirs is $(ls -al /etc/hirs)";
|
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
# Install TPM 2.0 Emulator
|
2022-01-26 15:24:29 +00:00
|
|
|
initTpm2Emulator
|
2019-01-15 17:46:06 +00:00
|
|
|
|
2019-02-04 19:26:54 +00:00
|
|
|
# Update the hirs-site.config file
|
2022-01-26 15:24:29 +00:00
|
|
|
updateHirsSiteConfigFile
|
2019-01-15 17:46:06 +00:00
|
|
|
|
2019-12-23 10:28:26 +00:00
|
|
|
echo "TPM 2.0 Emulator NV RAM list"
|
2019-07-19 09:50:26 +00:00
|
|
|
tpm2_nvlist
|
|
|
|
|
2019-01-15 17:46:06 +00:00
|
|
|
echo ""
|
2019-12-23 10:28:26 +00:00
|
|
|
echo "===========HIRS ACA TPM 2.0 Provisioner Setup Complete!==========="
|
2021-11-16 21:51:42 +00:00
|
|
|
|
|
|
|
popd
|