heads/initrd/bin/kexec-unseal-key

#!/bin/bash
# This will unseal and unecncrypt the drive encryption key from the TPM
# The TOTP secret will be shown to the user on each encryption attempt.
# It will then need to be bundled into initrd that is booted with Qubes.
set -e -o pipefail
. /etc/functions

TPM_INDEX=3
TPM_SIZE=312

. /etc/functions

TRACE_FUNC

mkdir -p /tmp/secret

key_file="$1"

if [ -z "$key_file" ]; then
	key_file="/tmp/secret/secret.key"
fi

DEBUG "CONFIG_TPM: $CONFIG_TPM"
DEBUG "CONFIG_TPM2_TOOLS: $CONFIG_TPM2_TOOLS"
DEBUG "Show PCRs"
DEBUG "$(pcrs)"

for tries in 1 2 3; do
	read -s -p "Enter LUKS TPM Disk Unlock Key passphrase (blank to abort): " tpm_password
	echo
	if [ -z "$tpm_password" ]; then
		die "Aborting unseal disk encryption key"
	fi

	if DO_WITH_DEBUG --mask-position 6 \
		tpmr unseal "$TPM_INDEX" "0,1,2,3,4,5,6,7" "$TPM_SIZE" \
		"$key_file" "$tpm_password"; then
		exit 0
	fi

	DEBUG $(pcrs)
	warn "Unable to unseal disk encryption key"
	if [ -e /boot/kexec_lukshdr_hash.txt -a -e /tmp/luksDump.txt ]; then
		if ! diff /boot/kexec_lukshdr_hash.txt /tmp/luksDump.txt > /dev/null 2>&1; then
			warn "Encrypted LUKS(es) container(s) headers changed since they were measured and sealed in TPM for Disk Unlock key. You might want to investigate."
		fi
	else
		warn "No encrypted LUKS container(s) headers were found/comparable under /boot/kexec_lukshdr_hash.txt"
		warn "You might need to setup a new boot default and Disk Unlock Key from Options->Boot Options->Show OS boot menu."
	fi
done

die "Retry count exceeded..."