heads/initrd/bin/usb-init

#!/bin/sh
# Boot a USB installation

. /etc/functions
. /etc/config

# Confirm we have a good TOTP unseal
if ! confirm_totp ; then
	recovery 'Failed to unseal TOTP'
fi

# Extend PCR4 as soon as possible
tpm extend -ix 4 -ic usb

if [ ! "$totp_confirm" = "y" ]; then
	recovery "Failed to confirm validity of TOTP"
fi

usb-scan
recovery "Something failed during USB boot"
adds a USB boot option with basic parsing to kexec Supports booting from USB media using either the root device or a signed ISO as the boot device. Boot options are parsed with quick/dirty shell scripts to infer kexec params. Closes #195 and begins to address #196 2017-04-29 13:40:34 -04:00			`#!/bin/sh`
Added a generic boot config and persistent params Refactored boot parsing code and applied that in local-init to scan /boot for grub options and allow the user to unsafely boot anything. This goes a long way to addressing #196. Optionally the user can customize those boot parameters or enforce arbitrary hashes on the boot device by creating and signing config files in /boot/ or /media/ or /media/kexec_iso/ISO_FILENAME/. 2017-07-02 23:01:04 -04:00			`# Boot a USB installation`
adds a USB boot option with basic parsing to kexec Supports booting from USB media using either the root device or a signed ISO as the boot device. Boot options are parsed with quick/dirty shell scripts to infer kexec params. Closes #195 and begins to address #196 2017-04-29 13:40:34 -04:00
			`. /etc/functions`
			`. /etc/config`

			`# Confirm we have a good TOTP unseal`
			`if ! confirm_totp ; then`
			`recovery 'Failed to unseal TOTP'`
			`fi`

			`# Extend PCR4 as soon as possible`
			`tpm extend -ix 4 -ic usb`

			`if [ ! "$totp_confirm" = "y" ]; then`
			`recovery "Failed to confirm validity of TOTP"`
			`fi`

Minor tweaks to signing params and boot options Also split out usb-scan to allow manual initiation of scan from the recovery shell 2017-07-03 13:07:03 -04:00			`usb-scan`
Added rollback protection to generic boot Changed the checking of required hashes or required rollback state to be right before boot, allowing the user to sign/set defaults in interactive mode. Also cleaned up usages of recovery and fixed iso parameter regression. 2017-07-08 16:59:37 -04:00			`recovery "Something failed during USB boot"`