ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-29 17:28:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
429d8bbead
heads/initrd/bin/seal-totp

54 lines
1.5 KiB
Plaintext
Raw Normal View History

Add dual support for real bash and busybox's bash(ash) - modify bash to have it configured with -Os
2023-02-08 21:01:48 +00:00
#!/bin/bash
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151)
2017-04-12 10:49:39 +00:00
# Generate a random secret, seal it with the PCRs
# and write it to the TPM NVRAM.
#
# Pass in a hostname if you want to change it from the default string
#
. /etc/functions
Add TRACE function tracing function to output on console when enabled - Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs - Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc) - add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
2023-02-20 16:01:17 +00:00
TRACE "Under /bin/seal-totp"
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config -qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now
2023-02-18 17:58:43 +00:00
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151)
2017-04-12 10:49:39 +00:00
TPM_NVRAM_SPACE=4d47
HOST="$1"
if [ -z "$HOST" ]; then
HOST="TPMTOTP"
fi
gui-init: Eliminate extra TPM owner password prompts in TPM reset We just set the TPM owner password, so there's no need to make the user enter it again. Eliminates some failure modes if the user mistypes it or enters the wrong password. Allow optionally passing in the TPM owner password in tpmr seal, check_tpm_counter(), seal-totp, and generate_totp_htop(). The user is still prompted if the password is needed but was not provided, so existing uses in other contexts continue to work unchanged. Prompt for the password in reset_tpm() and pass it down to each of the above. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 20:36:24 +00:00
TPM_PASSWORD="$2"
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151)
2017-04-12 10:49:39 +00:00
TOTP_SECRET="/tmp/secret/totp.key"
TOTP_SEALED="/tmp/secret/totp.sealed"
dd \
if=/dev/urandom \
of="$TOTP_SECRET" \
count=1 \
bs=20 \
2>/dev/null \
|| die "Unable to generate 20 random bytes"
secret="`base32 < $TOTP_SECRET`"
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2 Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for both TPM1 and TPM2. Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is essentially the TPM2 logic now that tpmr provides the same wrapped commands for both TPM1 and TPM2. Remove algorithm prefix from PCR list in tpmr unseal for consistency with tpmr seal. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:39:06 +00:00
pcrf="/tmp/secret/pcrf.bin"
tpmr pcrread 0 "$pcrf"
tpmr pcrread -a 1 "$pcrf"
tpmr pcrread -a 2 "$pcrf"
tpmr pcrread -a 3 "$pcrf"
# pcr 4 is expected to be zero (boot mode: init)
kexec-seal-key, seal-totp: Silence dd status when setting up PCRs Add status=none to dd invocations building PCR data. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 21:42:19 +00:00
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 status=none >> "$pcrf"
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2 Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for both TPM1 and TPM2. Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is essentially the TPM2 logic now that tpmr provides the same wrapped commands for both TPM1 and TPM2. Remove algorithm prefix from PCR list in tpmr unseal for consistency with tpmr seal. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:39:06 +00:00
# pcr 5 (kernel modules loaded) is not measured at sealing/unsealing of totp
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout) kexec-seal-key: Add DEBUG statement for PCR precalc seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1 tpmr: add DO_WITH_DEBUG calls for calcfuturepcr functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL Not so related but part of output review and corrections: kexec-insert-key: cosmetic changes prepending "+++" to disk related changes kexec-save-default: cosmetic changes prepending "+++" to disk related changes config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-09 18:28:04 +00:00
DEBUG "Sealing TOTP neglecting PCR5 involvement (Dynamically loaded kernel modules are not firmware integrity attestation related)"
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2 Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for both TPM1 and TPM2. Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is essentially the TPM2 logic now that tpmr provides the same wrapped commands for both TPM1 and TPM2. Remove algorithm prefix from PCR list in tpmr unseal for consistency with tpmr seal. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:39:06 +00:00
# pcr 6 (drive luks header) is not measured at sealing/unsealing of totp
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout) kexec-seal-key: Add DEBUG statement for PCR precalc seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1 tpmr: add DO_WITH_DEBUG calls for calcfuturepcr functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL Not so related but part of output review and corrections: kexec-insert-key: cosmetic changes prepending "+++" to disk related changes kexec-save-default: cosmetic changes prepending "+++" to disk related changes config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-09 18:28:04 +00:00
DEBUG "Sealing TOTP without PCR6 involvement (LUKS header consistency is not firmware integrity attestation related)"
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2 Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for both TPM1 and TPM2. Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is essentially the TPM2 logic now that tpmr provides the same wrapped commands for both TPM1 and TPM2. Remove algorithm prefix from PCR list in tpmr unseal for consistency with tpmr seal. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:39:06 +00:00
# pcr 7 is containing measurements of user injected stuff in cbfs
tpmr pcrread -a 7 "$pcrf"
gui-init: Eliminate extra TPM owner password prompts in TPM reset We just set the TPM owner password, so there's no need to make the user enter it again. Eliminates some failure modes if the user mistypes it or enters the wrong password. Allow optionally passing in the TPM owner password in tpmr seal, check_tpm_counter(), seal-totp, and generate_totp_htop(). The user is still prompted if the password is needed but was not provided, so existing uses in other contexts continue to work unchanged. Prompt for the password in reset_tpm() and pass it down to each of the above. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 20:36:24 +00:00
tpmr seal "$TOTP_SECRET" "$TPM_NVRAM_SPACE" 0,1,2,3,4,7 "$pcrf" 312 "" "$TPM_PASSWORD" \
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2 Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for both TPM1 and TPM2. Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is essentially the TPM2 logic now that tpmr provides the same wrapped commands for both TPM1 and TPM2. Remove algorithm prefix from PCR list in tpmr unseal for consistency with tpmr seal. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:39:06 +00:00
|| die "Unable to write sealed secret to NVRAM"
supress errors on console when files don't exist (equivalent of rm -f)
2019-02-22 01:16:02 +00:00
shred -n 10 -z -u "$TOTP_SEALED" 2> /dev/null
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151)
2017-04-12 10:49:39 +00:00
url="otpauth://totp/$HOST?secret=$secret"
secret=""
qrenc "$url"
Display TOTP secret as text Enable use of TOTP devices without a camera
2021-08-07 17:40:13 +00:00
echo "$url"
Reference in New Issue Copy Permalink