heads/initrd/bin/unseal-totp

#!/bin/bash
# Retrieve the sealed file from the NVRAM, unseal it and compute the totp

. /etc/functions

TOTP_SECRET="/tmp/secret/totp.key"

TRACE_FUNC

if [ "$CONFIG_TPM" = "y" ]; then
	tpmr unseal 4d47 0,1,2,3,4,7 312 "$TOTP_SECRET" ||
		die "Unable to unseal TOTP secret"
fi

if ! totp -q <"$TOTP_SECRET"; then
	shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null
	die 'Unable to compute TOTP hash?'
fi

shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null
exit 0
Add dual support for real bash and busybox's bash(ash) - modify bash to have it configured with -Os 2023-02-08 16:01:48 -05:00			`#!/bin/bash`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`# Retrieve the sealed file from the NVRAM, unseal it and compute the totp`

			`. /etc/functions`

			`TOTP_SECRET="/tmp/secret/totp.key"`

all scripts: replace TRACE manual strings with dynamic tracing by bash debug Exception: scripts sourcing/calls within etc/ash_functions continues to use old TRACE functions until we switch to bash completely getting rid of ash. This would mean getting rid of legacy boards (flash + legacy boards which do not have enough space for bash in flash boards) once and for all. Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2024-02-01 14:30:31 -05:00			`TRACE_FUNC`
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config -qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now 2023-02-18 12:58:43 -05:00
tpmr: Wrap TPM1 and TPM2 unseal actions so scripts can invoke either Provide tpmr unseal to unseal a file with TPM1 or TPM2. For TPM1, it wraps tpm nv_readvalue and tpm unsealfile. For TPM2, it wraps tpm2 unseal. kexec-unseal-key, seal-hotpkey, unseal-hotp, and unseal-totp no longer need to differentiate TPM1/TPM2. Fixes spurious shred errors on TPM2 that only apply to TPM1 (temporary sealed secret file and shred are now internal to tpmr). Fixes TPM1 disk unlock key unsealing due to logic errors relating to exit status of tpmr unseal or tpm unsealfile (now always uses status of tpmr unseal). Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm> 2023-02-28 13:36:11 -05:00			`if [ "$CONFIG_TPM" = "y" ]; then`
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`tpmr unseal 4d47 0,1,2,3,4,7 312 "$TOTP_SECRET" \|\|`
			`die "Unable to unseal TOTP secret"`
unseal-totp: fix indentation Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-11-03 09:31:44 -04:00			`fi`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`if ! totp -q <"$TOTP_SECRET"; then`
			`shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`die 'Unable to compute TOTP hash?'`
			`fi`

WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password Signed-off-by: Thierry Laurion <insurgo@riseup.net> 2023-10-23 15:18:28 -04:00			`shred -n 10 -z -u "$TOTP_SECRET" 2>/dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 06:49:39 -04:00			`exit 0`