heads/initrd/bin/unseal-totp

#!/bin/bash
# Retrieve the sealed file from the NVRAM, unseal it and compute the totp

. /etc/functions

TOTP_SECRET="/tmp/secret/totp.key"

TRACE "Under /bin/unseal-totp"

if [ "$CONFIG_TPM" = "y" ]; then
	tpmr unseal 4d47 0,1,2,3,4,7 312 "$TOTP_SECRET" ||
		die "Unable to unseal TOTP secret"
		fi

if ! totp -q <"$TOTP_SECRET"; then
	shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null
	die 'Unable to compute TOTP hash?'
fi

shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null
exit 0
Add dual support for real bash and busybox's bash(ash) - modify bash to have it configured with -Os 2023-02-08 16:01:48 -05:00			`#!/bin/bash`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`# Retrieve the sealed file from the NVRAM, unseal it and compute the totp`

			`. /etc/functions`

			`TOTP_SECRET="/tmp/secret/totp.key"`

Add TRACE function tracing function to output on console when enabled - Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs - Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc) - add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action 2023-02-20 11:01:17 -05:00			`TRACE "Under /bin/unseal-totp"`
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config -qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now 2023-02-18 12:58:43 -05:00
tpmr: Wrap TPM1 and TPM2 unseal actions so scripts can invoke either Provide tpmr unseal to unseal a file with TPM1 or TPM2. For TPM1, it wraps tpm nv_readvalue and tpm unsealfile. For TPM2, it wraps tpm2 unseal. kexec-unseal-key, seal-hotpkey, unseal-hotp, and unseal-totp no longer need to differentiate TPM1/TPM2. Fixes spurious shred errors on TPM2 that only apply to TPM1 (temporary sealed secret file and shred are now internal to tpmr). Fixes TPM1 disk unlock key unsealing due to logic errors relating to exit status of tpmr unseal or tpm unsealfile (now always uses status of tpmr unseal). Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm> 2023-02-28 13:36:11 -05:00			`if [ "$CONFIG_TPM" = "y" ]; then`
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`tpmr unseal 4d47 0,1,2,3,4,7 312 "$TOTP_SECRET" \|\|`
			`die "Unable to unseal TOTP secret"`
			`fi`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`if ! totp -q <"$TOTP_SECRET"; then`
			`shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`die 'Unable to compute TOTP hash?'`
			`fi`

WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`exit 0`