heads/initrd/bin/kexec-unseal-key

#!/bin/sh
# This will unseal and unecncrypt the drive encryption key from the TPM
# The TOTP secret will be shown to the user on each encryption attempt.
# It will then need to be bundled into initrd that is booted with Qubes.
set -e -o pipefail
. /etc/functions

TPM_INDEX=3
TPM_SIZE=312

. /etc/functions
mkdir -p /tmp/secret

sealed_file="/tmp/secret/sealed.key"
key_file="$1"

if [ -z "$key_file" ]; then
	key_file="/tmp/secret/secret.key"
fi

echo "DEBUG: CONFIG_TPM: $CONFIG_TPM"
echo "DEBUG: CONFIG_TPM2_TOOLS: $CONFIG_TPM2_TOOLS"
echo "DEBUG: Show PCRs"
pcrs

if [ "$CONFIG_TPM" = "y" ];then
	tpm nv_readvalue \
	    -in "$TPM_INDEX" \
	    -sz "$TPM_SIZE" \
	    -of "$sealed_file" \
		|| die "Unable to read key from TPM NVRAM"

	for tries in 1 2 3; do
		if [ "$CONFIG_AUTO_UNLOCK" != y ]; then
			read -s -p "Enter unlock password (blank to abort): " tpm_password
			echo
			if [ -z "$tpm_password" ]; then
				die "Aborting unseal disk encryption key"
			fi

			tpm unsealfile \
			    -if "$sealed_file" \
			    -of "$key_file" \
			    -pwdd "$tpm_password" \
			    -hk 40000000
		else
			tpm unsealfile \
			    -if "$sealed_file" \
			    -of "$key_file" \
			    -hk 40000000
		fi

		if [ $? -eq 0 ]; then
			# should be okay if this fails
			shred -n 10 -z -u /tmp/secret/sealed 2> /dev/null || true
			exit 0
		fi

		pcrs
		warn "Unable to unseal disk encryption key"
	done
elif [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
	if [ "$CONFIG_ATTEST_TOOLS" = "y" ]; then
		echo "Bring up network for remote attestation"
		network-init-recovery
	fi
	for tries in 1 2 3; do
	if [ "$CONFIG_AUTO_UNLOCK" = "y" ]; then
		tpmr unseal "0x8100000$TPM_INDEX" "sha256:0,1,2,3,4,5,6,7" > "$key_file"
	else
		tpmr unseal "0x8100000$TPM_INDEX" "sha256:0,1,2,3,4,5,6,7" "file:-" > "$key_file"
	fi

	if [ $? -eq 0 ]; then
		# should be okay if this fails
		shred -n 10 -z -u /tmp/secret/sealed 2> /dev/null || true
		exit 0
	fi

	pcrs
	warn "Unable to unseal disk encryption key"
done
fi

die "Retry count exceeded..."