2023-02-08 21:01:48 +00:00
#!/bin/bash
2017-04-12 10:48:38 +00:00
# Shell functions for most initialization scripts
2023-03-07 15:10:32 +00:00
. /etc/ash_functions
2023-02-18 17:58:43 +00:00
2023-03-07 19:00:57 +00:00
# Print <hidden> or <empty> depending on whether $1 is empty. Useful to mask an
# optional password parameter.
mask_param() {
if [ -z "$1" ]; then
echo "<empty>"
else
echo "<hidden>"
fi
}
2024-04-19 13:45:39 +00:00
# Pipe input to this to sink it to the debug log, with a name prefix.
# If the input is empty, no output is produced, so actual output is
# readily visible in logs.
#
# For example:
# ls /boot/vmlinux* | SINK_DEBUG "/boot kernels"
SINK_DEBUG() {
local name="$1"
local line haveblank
# If the input doesn't end with a line break, read won't give us the
# last (unterminated) line. Add a line break with echo to ensure we
# don't lose any input. Buffer up to one blank line so we can avoid
# emitting a final (or only) blank line.
(cat; echo) | while IFS= read -r line; do
[[ -n "$haveblank" ]] && DEBUG "$name: " # Emit buffered blank line
if [[ -z "$line" ]]; then
haveblank=y
else
haveblank=
DEBUG "$name: $line"
fi
done
}
# Trace a command with DEBUG, then execute it. Trace failed exit status, stdout
# and stderr, etc.
#
# DO_WITH_DEBUG is designed so it can be dropped in to most command invocations
# without side effects - it adds visibility without actually affecting the
# execution of the script. Exit statuses, stdout, and stderr are traced, but
# they are still returned/written to the caller.
#
2023-03-07 19:00:57 +00:00
# A password parameter can be masked by passing --mask-position N before the
# command to execute, the debug trace will just indicate whether the password
# was empty or nonempty (which is important when use of a password is optional).
# N=0 is the name of the command to be executed, N=1 is its first parameter,
# etc.
2024-04-19 13:45:39 +00:00
#
# DO_WITH_DEBUG() can be added in most places where a command is executed to
# add visibility in the debug log. For example:
#
# [DO_WITH_DEBUG] mount "$BLOCK" "$MOUNTPOINT"
# ^-- adding DO_WITH_DEBUG will show the block device, mountpoint, and whether
# the mount fails
#
# [DO_WITH_DEBUG --mask-position 7] tpmr seal "$KEY" "$IDX" "$pcrs" "$pcrf" "$size" "$PASSWORD"
# ^-- trace the resulting invocation, but mask the password in the log
#
# if ! [DO_WITH_DEBUG] umount "$MOUNTPOINT"; then [...]
# ^-- it can be used when the exit status is checked, like the condition of `if`
#
# hotp_token_info="$([DO_WITH_DEBUG] hotp_verification info)"
# ^-- output of hotp_verification info becomes visible in debug log while
# still being captured by script
#
# [DO_WITH_DEBUG] umount "$MOUNTPOINT" &>/dev/null || true
# ^-- if the command's stdout/stderr/failure are ignored, this still works the
# same way with DO_WITH_DEBUG
2023-03-07 19:00:57 +00:00
DO_WITH_DEBUG() {
2024-04-19 13:45:39 +00:00
local exit_status=0
2024-04-18 16:21:27 +00:00
local cmd_output
if [[ "$1" == "--mask-position" ]]; then
local mask_position="$2"
2023-03-07 19:00:57 +00:00
shift
shift
2024-04-19 13:45:39 +00:00
local show_args=("$@")
show_args[$mask_position]="$(mask_param "${show_args[$mask_position]}")"
DEBUG "${show_args[@]}"
else
DEBUG "$@"
fi
# Execute the command and capture the exit status. Tee stdout/stderr to
# debug sinks, so they're visible but still can be used by the caller
#
# This is tricky when set -e / set -o pipefail may or may not be in
# effect.
# - Putting the command in an `if` ensures set -e won't terminate us,
# and also does not overwrite $? (like `|| true` would).
# - We capture PIPESTATUS[0] whether the command succeeds or fails,
# since we don't know whether the pipeline status will be that of the
# command or 'tee' (depends on set -o pipefail).
2024-04-19 17:31:29 +00:00
if ! "$@" 2> >(tee /dev/stderr | SINK_DEBUG "$1 stderr") | tee >(SINK_DEBUG "$1 stdout"); then
2024-04-19 13:45:39 +00:00
exit_status="${PIPESTATUS[0]}"
else
exit_status="${PIPESTATUS[0]}"
2024-04-18 16:21:27 +00:00
fi
2024-04-19 13:45:39 +00:00
if [[ "$exit_status" -ne 0 ]]; then
# Trace unsuccessful exit status, but only at DEBUG because this
# may be expected. Include the command name in case the command
# also invoked a DO_WITH_DEBUG (it could be a script).
DEBUG "$1: exited with status $exit_status"
2023-03-07 19:00:57 +00:00
fi
2024-04-19 13:45:39 +00:00
# If the command was (probably) not found, trace PATH in case it
# prevented the command from being found
if [[ "$exit_status" -eq 127 ]]; then
DEBUG "$1: PATH=$PATH"
fi
return "$exit_status"
2023-03-07 19:00:57 +00:00
}
2024-01-10 22:04:21 +00:00
# Trace the current script and function.
TRACE_FUNC() {
# Index [1] for BASH_SOURCE and FUNCNAME give us the caller location.
# FUNCNAME is 'main' if called from a script outside any function.
# BASH_LINENO is offset by 1, it provides the line that the
# corresponding FUNCNAME was _called from_, so BASH_LINENO[0] is the
# location of the caller.
TRACE "${BASH_SOURCE[1]}(${BASH_LINENO[0]}): ${FUNCNAME[1]}"
}
# Show the entire current call stack in debug output - useful if a catastrophic
# error or something very unexpected occurs, like totally invalid parameters.
DEBUG_STACK() {
local FRAMES
FRAMES="${#FUNCNAME[@]}"
DEBUG "call stack: ($((FRAMES-1)) frames)"
# Don't print DEBUG_STACK itself, start from 1
for i in $(seq 1 "$((FRAMES-1))"); do
DEBUG "- $((i-1)) - ${BASH_SOURCE[$i]}(${BASH_LINENO[$((i-1))]}): ${FUNCNAME[$i]}"
done
}
2017-04-12 10:48:38 +00:00
pcrs() {
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized). Some checks were
incorrect and are fixed by this change. Most checks are now unchanged
relative to master.
There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2. Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.
Previously, CONFIG_TPM could be variously 'y', 'n', or empty. Now it
is always 'y' or 'n', and 'y' means "any TPM". Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.
There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n'). This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-22 21:30:07 +00:00
if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
2022-08-25 18:43:31 +00:00
tpm2 pcrread sha256
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized). Some checks were
incorrect and are fixed by this change. Most checks are now unchanged
relative to master.
There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2. Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.
Previously, CONFIG_TPM could be variously 'y', 'n', or empty. Now it
is always 'y' or 'n', and 'y' means "any TPM". Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.
There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n'). This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-22 21:30:07 +00:00
elif [ "$CONFIG_TPM" = "y" ]; then
head -8 /sys/class/tpm/tpm0/pcrs
2022-08-25 18:43:31 +00:00
fi
2017-04-12 10:48:38 +00:00
}
2017-04-29 17:40:34 +00:00
2023-08-31 16:07:39 +00:00
confirm_totp() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2017-07-18 17:44:02 +00:00
prompt="$1"
2017-04-29 17:40:34 +00:00
last_half=X
2017-07-18 17:44:02 +00:00
unset totp_confirm
2017-04-29 17:40:34 +00:00
while true; do
# update the TOTP code every thirty seconds
2023-08-31 16:07:39 +00:00
date=$(date "+%Y-%m-%d %H:%M:%S")
seconds=$(date "+%s")
half=$(expr \( $seconds % 60 \) / 30)
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized). Some checks were
incorrect and are fixed by this change. Most checks are now unchanged
relative to master.
There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2. Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.
Previously, CONFIG_TPM could be variously 'y', 'n', or empty. Now it
is always 'y' or 'n', and 'y' means "any TPM". Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.
There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n'). This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-02-22 21:30:07 +00:00
if [ "$CONFIG_TPM" != "y" ]; then
2017-07-18 17:44:02 +00:00
TOTP="NO TPM"
elif [ "$half" != "$last_half" ]; then
2023-08-31 16:07:39 +00:00
last_half=$half
TOTP=$(unseal-totp) ||
recovery "TOTP code generation failed"
2017-04-29 17:40:34 +00:00
fi
echo -n "$date $TOTP: "
# read the first character, non-blocking
read \
-t 1 \
-n 1 \
-s \
2017-07-18 17:44:02 +00:00
-p "$prompt" \
2023-08-31 16:07:39 +00:00
totp_confirm &&
break
2017-04-29 17:40:34 +00:00
# nothing typed, redraw the line
echo -ne '\r'
done
# clean up with a newline
echo
}
2023-08-22 18:34:29 +00:00
2023-08-31 16:07:39 +00:00
reseal_tpm_disk_decryption_key() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
Uniformize vocabulary: LUKS TPM Disk Unlock Key & LUKS Disk Recovery Key
When playing with long fbwhiptail/whiptail messages, this commit played around the long string using fold.
'''
echo -e "This will replace the encrypted container content and its LUKS Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user under the following conditions:\n 1-Every boot if no Disk Unlock Key was added to the TPM\n 2-If the TPM fails (hardware failure)\n 3-If the firmware has been tampered with/modified by the user\n\nThis process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to the LUKS device container.\n\nHit Enter to continue." | fold -w 70 -s
'''
Which gave the exact output of what will be inside of the fbwhiptail prompt, fixed to 70 chars width:
'''
This will replace the encrypted container content and its LUKS Disk
Recovery Key.
The passphrase associated with this key will be asked from the user
under the following conditions:
1-Every boot if no Disk Unlock Key was added to the TPM
2-If the TPM fails (hardware failure)
3-If the firmware has been tampered with/modified by the user
This process requires you to type the current LUKS Disk Recovery Key
passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set
up, by setting a default boot LUKS key slot (1) if present.
At the next prompt, you may be asked to select which file corresponds
to the LUKS device container.
Hit Enter to continue.
'''
Therefore, for long prompts in the future, one can just deal with "\n 1-" alignments to be respected in prompts and have fold deal with cutting the length of strings properly.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-19 17:32:04 +00:00
#For robustness, exit early if LUKS TPM Disk Unlock Key is prohibited in board configs
2023-09-01 19:18:36 +00:00
if [ "$CONFIG_TPM_DISK_UNLOCK_KEY" == "n" ]; then
Uniformize vocabulary: LUKS TPM Disk Unlock Key & LUKS Disk Recovery Key
When playing with long fbwhiptail/whiptail messages, this commit played around the long string using fold.
'''
echo -e "This will replace the encrypted container content and its LUKS Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user under the following conditions:\n 1-Every boot if no Disk Unlock Key was added to the TPM\n 2-If the TPM fails (hardware failure)\n 3-If the firmware has been tampered with/modified by the user\n\nThis process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to the LUKS device container.\n\nHit Enter to continue." | fold -w 70 -s
'''
Which gave the exact output of what will be inside of the fbwhiptail prompt, fixed to 70 chars width:
'''
This will replace the encrypted container content and its LUKS Disk
Recovery Key.
The passphrase associated with this key will be asked from the user
under the following conditions:
1-Every boot if no Disk Unlock Key was added to the TPM
2-If the TPM fails (hardware failure)
3-If the firmware has been tampered with/modified by the user
This process requires you to type the current LUKS Disk Recovery Key
passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set
up, by setting a default boot LUKS key slot (1) if present.
At the next prompt, you may be asked to select which file corresponds
to the LUKS device container.
Hit Enter to continue.
'''
Therefore, for long prompts in the future, one can just deal with "\n 1-" alignments to be respected in prompts and have fold deal with cutting the length of strings properly.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-19 17:32:04 +00:00
DEBUG "LUKS TPM Disk Unlock Key is prohibited in board configs"
2023-08-31 16:07:39 +00:00
return
else
Uniformize vocabulary: LUKS TPM Disk Unlock Key & LUKS Disk Recovery Key
When playing with long fbwhiptail/whiptail messages, this commit played around the long string using fold.
'''
echo -e "This will replace the encrypted container content and its LUKS Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user under the following conditions:\n 1-Every boot if no Disk Unlock Key was added to the TPM\n 2-If the TPM fails (hardware failure)\n 3-If the firmware has been tampered with/modified by the user\n\nThis process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to the LUKS device container.\n\nHit Enter to continue." | fold -w 70 -s
'''
Which gave the exact output of what will be inside of the fbwhiptail prompt, fixed to 70 chars width:
'''
This will replace the encrypted container content and its LUKS Disk
Recovery Key.
The passphrase associated with this key will be asked from the user
under the following conditions:
1-Every boot if no Disk Unlock Key was added to the TPM
2-If the TPM fails (hardware failure)
3-If the firmware has been tampered with/modified by the user
This process requires you to type the current LUKS Disk Recovery Key
passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set
up, by setting a default boot LUKS key slot (1) if present.
At the next prompt, you may be asked to select which file corresponds
to the LUKS device container.
Hit Enter to continue.
'''
Therefore, for long prompts in the future, one can just deal with "\n 1-" alignments to be respected in prompts and have fold deal with cutting the length of strings properly.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-19 17:32:04 +00:00
DEBUG "LUKS TPM Disk Unlock Key is allowed in board configs. Continuing"
2023-08-31 16:07:39 +00:00
fi
if ! grep -q /boot /proc/mounts; then
mount -o ro /boot ||
recovery "Unable to mount /boot"
2023-08-22 18:34:29 +00:00
fi
if [ -s /boot/kexec_key_devices.txt ] || [ -s /boot/kexec_key_lvm.txt ]; then
Uniformize vocabulary: LUKS TPM Disk Unlock Key & LUKS Disk Recovery Key
When playing with long fbwhiptail/whiptail messages, this commit played around the long string using fold.
'''
echo -e "This will replace the encrypted container content and its LUKS Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user under the following conditions:\n 1-Every boot if no Disk Unlock Key was added to the TPM\n 2-If the TPM fails (hardware failure)\n 3-If the firmware has been tampered with/modified by the user\n\nThis process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to the LUKS device container.\n\nHit Enter to continue." | fold -w 70 -s
'''
Which gave the exact output of what will be inside of the fbwhiptail prompt, fixed to 70 chars width:
'''
This will replace the encrypted container content and its LUKS Disk
Recovery Key.
The passphrase associated with this key will be asked from the user
under the following conditions:
1-Every boot if no Disk Unlock Key was added to the TPM
2-If the TPM fails (hardware failure)
3-If the firmware has been tampered with/modified by the user
This process requires you to type the current LUKS Disk Recovery Key
passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set
up, by setting a default boot LUKS key slot (1) if present.
At the next prompt, you may be asked to select which file corresponds
to the LUKS device container.
Hit Enter to continue.
'''
Therefore, for long prompts in the future, one can just deal with "\n 1-" alignments to be respected in prompts and have fold deal with cutting the length of strings properly.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-19 17:32:04 +00:00
warn "LUKS TPM sealed Disk Unlock Key secret needs to be resealed alongside TOTP/HOTP secret"
echo "Resealing LUKS TPM Disk Unlock Key to be unsealed by LUKS TPM Disk Unlock Key passphrase"
2023-08-22 18:34:29 +00:00
while ! kexec-seal-key /boot; do
2023-10-23 19:18:28 +00:00
warn "Recovery Disk Encryption key passphrase/TPM Owner Password may be invalid. Please try again"
2023-08-22 18:34:29 +00:00
done
2023-08-31 16:07:39 +00:00
warn "LUKS header hash changed under /boot/kexec_luks_hdr_hash.txt"
echo "Updating checksums and signing all files under /boot/kexec.sig"
2023-08-22 18:34:29 +00:00
while ! update_checksums; do
2023-10-20 18:12:16 +00:00
warn "Checksums were not signed. Preceding errors should explain possible causes"
2023-08-22 18:34:29 +00:00
done
warn "Rebooting in 3 seconds to enable booting default boot option"
sleep 3
reboot
else
DEBUG "No TPM disk decryption key to reseal"
fi
}
2017-07-04 23:49:14 +00:00
2022-11-09 19:02:03 +00:00
# Enable USB storage (if not already enabled), and wait for storage devices to
# be detected. If USB storage was already enabled, no wait occurs, this would
# have happened already when USB storage was enabled.
2023-08-31 16:07:39 +00:00
enable_usb_storage() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2022-11-09 19:02:03 +00:00
if ! lsmod | grep -q usb_storage; then
timeout=0
echo "Scanning for USB storage devices..."
2023-08-31 16:07:39 +00:00
insmod /lib/modules/usb-storage.ko >/dev/null 2>&1 ||
die "usb_storage: module load failed"
while [[ $(list_usb_storage | wc -l) -eq 0 ]]; do
2022-11-09 19:02:03 +00:00
[[ $timeout -ge 8 ]] && break
sleep 1
2023-08-31 16:07:39 +00:00
timeout=$(($timeout + 1))
2022-11-09 19:02:03 +00:00
done
fi
}
2024-02-02 21:42:33 +00:00
device_has_partitions() {
local DEVICE="$1"
# fdisk normally says "doesn't contain a valid partition table" for
# devices that lack a partition table - except for FAT32.
#
# FAT32 devices have a volume boot record that looks enough like an MBR
# to satisfy fdisk. In that case, fdisk prints a partition table header
# but no partitions.
#
# This check covers that: [ $(fdisk -l "$b" | wc -l) -eq 5 ]
# In both cases the output is 5 lines: 3 about device info, 1 empty line
# and the 5th will be the table header or the invalid message.
local DISK_DATA=$(fdisk -l "$DEVICE")
if echo "$DISK_DATA" | grep -q "doesn't contain a valid partition table" || \
[ "$(echo "$DISK_DATA" | wc -l)" -eq 5 ]; then
# No partition table
return 1
fi
# There is a partition table
return 0
}
2023-08-31 16:07:39 +00:00
list_usb_storage() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-07-19 22:48:03 +00:00
# List all USB storage devices, including partitions unless we received argument stating we want drives only
# The output is a list of device names, one per line.
if [ "$1" = "disks" ]; then
DEBUG "Listing USB storage devices (disks only) since list_usb_storage was called with 'disks' argument"
else
DEBUG "Listing USB storage devices (including partitions)"
fi
2022-11-02 15:03:30 +00:00
stat -c %N /sys/block/sd* 2>/dev/null | grep usb |
cut -f1 -d ' ' |
sed "s/[']//g" |
while read b; do
# Ignore devices of size 0, such as empty SD card
# readers on laptops attached via USB.
if [ "$(cat "$b/size")" -gt 0 ]; then
2023-07-19 22:48:03 +00:00
DEBUG "USB storage device of size greater then 0: $b"
2022-11-02 15:03:30 +00:00
echo "$b"
fi
done |
sed "s|/sys/block|/dev|" |
while read b; do
# If the device has a partition table, ignore it and
# include the partitions instead - even if the kernel
# hasn't detected the partitions yet. Such a device is
# never usable directly, and this allows the "wait for
# disks" loop in mount-usb to correctly wait for the
# partitions.
2024-02-02 21:42:33 +00:00
if ! device_has_partitions "$b"; then
2022-11-02 15:03:30 +00:00
# No partition table, include this device
2023-07-19 22:48:03 +00:00
DEBUG "USB storage device without partition table: $b"
echo "$b"
#Bypass the check for partitions if we want only disks
elif [ "$1" = "disks" ]; then
# disks only were requested, so we don't list partitions
DEBUG "USB storage device with partition table: $b"
DEBUG "We asked for disks only, so we don't want to list partitions"
2022-11-02 15:03:30 +00:00
echo "$b"
else
# Has a partition table, include partitions
2023-07-19 22:48:03 +00:00
DEBUG "USB storage device with partition table: $b"
2022-11-02 15:03:30 +00:00
ls -1 "$b"* | awk 'NR!=1 {print $0}'
fi
done
}
2023-11-03 17:53:47 +00:00
# Prompt for a TPM Owner Password if it is not already cached in /tmp/secret/tpm_owner_password.
# Sets tpm_owner_password variable reused in flow, and cache file used until recovery shell is accessed.
# Tools should optionally accept a TPM password on the command line, since some flows need
# it multiple times and only one prompt is ideal.
2023-10-24 15:19:49 +00:00
prompt_tpm_owner_password() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-11-03 14:10:05 +00:00
2023-11-02 15:38:50 +00:00
if [ -s /tmp/secret/tpm_owner_password ]; then
2023-10-24 15:19:49 +00:00
DEBUG "/tmp/secret/tpm_owner_password already cached in file. Reusing"
tpm_owner_password=$(cat /tmp/secret/tpm_owner_password)
2023-08-31 16:07:39 +00:00
return 0
2023-03-10 20:36:24 +00:00
fi
2023-10-24 15:19:49 +00:00
read -s -p "TPM Owner Password: " tpm_owner_password
2023-03-10 20:36:24 +00:00
echo # new line after password prompt
2023-10-23 19:18:28 +00:00
# Cache the password externally to be reused by who needs it
2023-10-24 15:19:49 +00:00
DEBUG "Caching TPM Owner Password to /tmp/secret/tpm_owner_password"
2023-10-23 19:18:28 +00:00
mkdir -p /tmp/secret || die "Unable to create /tmp/secret"
2023-10-24 15:19:49 +00:00
echo -n "$tpm_owner_password" >/tmp/secret/tpm_owner_password || die "Unable to cache TPM owner_password under /tmp/secret/tpm_owner_password"
2023-03-10 20:36:24 +00:00
}
2017-07-08 20:59:37 +00:00
2023-11-03 17:53:47 +00:00
# Prompt for a new TPM Owner Password when resetting the TPM.
# Returned in tpm_owner_passpword and cached under /tpm/secret/tpm_owner_password
# The password must be 1-32 characters and must be entered twice,
2023-03-13 17:33:30 +00:00
# the script will loop until this is met.
prompt_new_owner_password() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-10-24 15:19:49 +00:00
local tpm_owner_password2
tpm_owner_password=1
tpm_owner_password2=2
while [ "$tpm_owner_password" != "$tpm_owner_password2" ] || [ "${#tpm_owner_password}" -gt 32 ] || [ -z "$tpm_owner_password" ]; do
read -s -p "New TPM Owner Password (2 words suggested, 1-32 characters max): " tpm_owner_password
2023-03-13 17:33:30 +00:00
echo
2023-10-24 15:19:49 +00:00
read -s -p "Repeat chosen TPM Owner Password: " tpm_owner_password2
2023-03-13 17:33:30 +00:00
echo
2023-10-24 15:19:49 +00:00
if [ "$tpm_owner_password" != "$tpm_owner_password2" ]; then
2023-03-13 17:33:30 +00:00
echo "Passphrases entered do not match. Try again!"
echo
fi
done
2023-10-23 17:13:39 +00:00
# Cache the password externally to be reused by who needs it
2023-10-24 15:19:49 +00:00
DEBUG "Caching TPM Owner Password to /tmp/secret/tpm_owner_password"
2023-10-23 17:13:39 +00:00
mkdir -p /tmp/secret || die "Unable to create /tmp/secret"
2023-10-24 15:19:49 +00:00
echo -n "$tpm_owner_password" >/tmp/secret/tpm_owner_password || die "Unable to cache TPM password under /tmp/secret"
2023-03-13 17:33:30 +00:00
}
2023-08-31 16:07:39 +00:00
check_tpm_counter() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-11-03 14:54:16 +00:00
2023-08-31 16:07:39 +00:00
LABEL=${2:-3135106223}
tpm_password="$3"
2017-07-08 20:59:37 +00:00
# if the /boot.hashes file already exists, read the TPM counter ID
# from it.
if [ -r "$1" ]; then
2023-08-31 16:07:39 +00:00
TPM_COUNTER=$(grep counter- "$1" | cut -d- -f2)
2017-07-08 20:59:37 +00:00
else
2018-06-19 19:27:27 +00:00
warn "$1 does not exist; creating new TPM counter"
2022-08-25 18:43:31 +00:00
tpmr counter_create \
2017-07-08 20:59:37 +00:00
-pwdc '' \
2023-08-31 16:07:39 +00:00
-la $LABEL |
2023-11-03 17:53:47 +00:00
tee /tmp/counter ||
die "Unable to create TPM counter"
2023-08-31 16:07:39 +00:00
TPM_COUNTER=$(cut -d: -f1 </tmp/counter)
2017-07-08 20:59:37 +00:00
fi
if [ -z "$TPM_COUNTER" ]; then
die "$1: TPM Counter not found?"
fi
}
2023-08-31 16:07:39 +00:00
read_tpm_counter() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-08-31 16:07:39 +00:00
tpmr counter_read -ix "$1" | tee "/tmp/counter-$1" ||
die "Counter read failed"
2017-07-08 20:59:37 +00:00
}
2023-08-31 16:07:39 +00:00
increment_tpm_counter() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-08-31 16:07:39 +00:00
tpmr counter_increment -ix "$1" -pwdc '' |
tee /tmp/counter-$1 ||
2023-11-02 16:58:19 +00:00
die "TPM counter increment failed for rollback prevention. Please reset the TPM"
2017-07-08 20:59:37 +00:00
}
check_config() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2017-07-08 20:59:37 +00:00
if [ ! -d /tmp/kexec ]; then
2023-08-31 16:07:39 +00:00
mkdir /tmp/kexec ||
die 'Failed to make kexec tmp dir'
2017-07-08 20:59:37 +00:00
else
2023-08-31 16:07:39 +00:00
rm -rf /tmp/kexec/* ||
die 'Failed to empty kexec tmp dir'
2017-07-08 20:59:37 +00:00
fi
2023-06-21 18:36:28 +00:00
if [ ! -r $1/kexec.sig -a "$CONFIG_BASIC" != "y" ]; then
2017-07-08 20:59:37 +00:00
return
fi
2023-08-31 16:07:39 +00:00
if [ $(find $1/kexec*.txt | wc -l) -eq 0 ]; then
2017-07-08 20:59:37 +00:00
return
fi
2018-03-14 17:24:14 +00:00
if [ "$2" != "force" ]; then
2023-08-31 16:07:39 +00:00
if ! sha256sum $(find $1/kexec*.txt) | gpgv $1/kexec.sig -; then
2018-03-14 17:24:14 +00:00
die 'Invalid signature on kexec boot params'
fi
2017-07-08 20:59:37 +00:00
fi
echo "+++ Found verified kexec boot params"
2023-08-31 16:07:39 +00:00
cp $1/kexec*.txt /tmp/kexec ||
die "Failed to copy kexec boot params to tmp"
2017-07-08 20:59:37 +00:00
}
2018-04-22 00:21:37 +00:00
2022-11-03 18:13:16 +00:00
# Replace a file in a ROM (add it if the file does not exist)
replace_rom_file() {
ROM="$1"
ROM_FILE="$2"
NEW_FILE="$3"
2023-08-31 16:07:39 +00:00
if (cbfs.sh -o "$ROM" -l | grep -q "$ROM_FILE"); then
2022-11-03 18:13:16 +00:00
cbfs.sh -o "$ROM" -d "$ROM_FILE"
fi
cbfs.sh -o "$ROM" -a "$ROM_FILE" -f "$NEW_FILE"
}
2018-12-06 23:24:28 +00:00
replace_config() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2018-12-06 23:41:20 +00:00
CONFIG_FILE=$1
CONFIG_OPTION=$2
NEW_SETTING=$3
2018-12-06 23:24:28 +00:00
2018-12-06 23:41:20 +00:00
touch $CONFIG_FILE
2023-08-31 16:07:39 +00:00
# first pull out the existing option from the global config and place in a tmp file
awk "gsub(\"^export ${CONFIG_OPTION}=.*\",\"export ${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config >${CONFIG_FILE}.tmp
awk "gsub(\"^${CONFIG_OPTION}=.*\",\"${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config >>${CONFIG_FILE}.tmp
2018-12-06 23:24:28 +00:00
2023-08-31 16:07:39 +00:00
# then copy any remaining settings from the existing config file, minus the option you changed
grep -v "^export ${CONFIG_OPTION}=" ${CONFIG_FILE} | grep -v "^${CONFIG_OPTION}=" >>${CONFIG_FILE}.tmp || true
sort ${CONFIG_FILE}.tmp | uniq >${CONFIG_FILE}
2019-02-22 01:17:16 +00:00
rm -f ${CONFIG_FILE}.tmp
2018-12-06 23:24:28 +00:00
}
2019-07-05 22:04:00 +00:00
2023-07-05 14:18:06 +00:00
# Generate a secret for TPM-less HOTP by reading the ROM. Output is the
# sha256sum of the ROM (binary, not printable), which can be truncated to the
# supported secret length.
2019-11-25 18:25:11 +00:00
secret_from_rom_hash() {
local ROM_IMAGE="/tmp/coreboot-notpm.rom"
echo -e "\nTPM not detected; measuring ROM directly\n" 1>&2
2023-07-03 20:59:23 +00:00
# Read the ROM if we haven't read it yet
if [ ! -f "${ROM_IMAGE}" ]; then
flash.sh -r "${ROM_IMAGE}" >/dev/null 2>&1 || return 1
2019-11-25 18:25:11 +00:00
fi
2023-07-03 20:59:23 +00:00
2023-07-05 14:18:06 +00:00
sha256sum "${ROM_IMAGE}" | cut -f1 -d ' ' | fromhex_plain
2019-11-25 18:25:11 +00:00
}
2023-08-31 16:07:39 +00:00
update_checksums() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2019-07-05 22:04:00 +00:00
# ensure /boot mounted
2023-08-31 16:07:39 +00:00
if ! grep -q /boot /proc/mounts; then
mount -o ro /boot ||
recovery "Unable to mount /boot"
2019-07-05 22:04:00 +00:00
fi
2020-10-08 13:16:08 +00:00
2019-07-05 22:04:00 +00:00
# remount RW
2020-07-13 22:22:40 +00:00
mount -o rw,remount /boot
2019-07-05 22:04:00 +00:00
# sign and auto-roll config counter
extparam=
2023-08-31 16:07:39 +00:00
if [ "$CONFIG_TPM" = "y" ]; then
2022-08-25 18:43:31 +00:00
if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
extparam=-r
fi
2019-07-05 22:04:00 +00:00
fi
2023-08-31 16:07:39 +00:00
if ! kexec-sign-config -p /boot -u $extparam; then
2021-09-24 20:05:14 +00:00
rv=1
else
rv=0
2019-11-13 23:28:12 +00:00
fi
2019-07-05 22:04:00 +00:00
# switch back to ro mode
mount -o ro,remount /boot
2021-09-24 20:05:14 +00:00
return $rv
2019-07-05 22:04:00 +00:00
}
2019-08-19 22:07:22 +00:00
2022-12-31 17:41:24 +00:00
print_tree() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-01-08 13:02:13 +00:00
find ./ ! -path './kexec*' -print0 | sort -z
}
2023-01-14 12:14:09 +00:00
# Escape zero-delimited standard input to safely display it to the user in e.g.
# `whiptail`, `less`, `echo`, `cat`. Doesn't produce shell-escaped output.
# Most printable characters are passed verbatim (exception: \).
# These escapes are used to replace their corresponding characters: #n#r#t#v#b
# Other characters are rendered as hexadecimal escapes.
2023-01-08 13:02:13 +00:00
# escape_zero [prefix] [escape character]
# prefix: \0 in the input will result in \n[prefix]
# escape character: character to use for escapes (default: #); \ may be interpreted by `whiptail`
escape_zero() {
local prefix="$1"
local echar="${2:-#}"
local todo=""
2023-01-14 12:14:09 +00:00
local echar_hex="$(echo -n "$echar" | xxd -p -c1)"
[ ${#echar_hex} -eq 2 ] || die "Invalid escape character $echar passed to escape_zero(). Programming error?!"
2023-01-08 13:02:13 +00:00
echo -e -n "$prefix"
2023-01-14 12:14:09 +00:00
xxd -p -c1 | tr -d '\n' |
2023-08-31 16:07:39 +00:00
{
while IFS= read -r -n2 -d ''; do
if [ -n "$todo" ]; then
#REPLY == " " is EOF
[[ "$REPLY" == " " ]] && echo '' || echo -e -n "$todo"
todo=""
fi
case "$REPLY" in
2023-01-08 13:02:13 +00:00
00)
todo="\n$prefix"
;;
08)
echo -n "${echar}b"
;;
09)
echo -n "${echar}t"
;;
0a)
echo -n "${echar}n"
;;
0b)
echo -n "${echar}v"
;;
0d)
echo -n "${echar}r"
;;
2023-01-14 12:14:09 +00:00
"$echar_hex")
echo -n "$echar$echar"
2023-01-08 13:02:13 +00:00
;;
2023-01-14 12:14:09 +00:00
#interpreted characters:
2023-08-31 16:07:39 +00:00
2[0-9a-f] | 3[0-9a-f] | 4[0-9a-f] | 5[0-9abd-f] | 6[0-9a-f] | 7[0-9a-e])
2023-01-08 13:02:13 +00:00
echo -e -n '\x'"$REPLY"
;;
# All others are escaped
2023-01-14 12:14:09 +00:00
*)
2023-01-08 13:02:13 +00:00
echo -n "${echar}x$REPLY"
;;
2023-08-31 16:07:39 +00:00
esac
done
}
2022-12-31 17:41:24 +00:00
}
2023-01-12 16:31:31 +00:00
# Currently heads doesn't support signing file names with certain characters
# due to https://bugs.busybox.net/show_bug.cgi?id=14226. Also, certain characters
# may be intepreted by `whiptail`, `less` et al (e.g. \n, \b, ...).
assert_signable() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2023-01-12 16:31:31 +00:00
# ensure /boot mounted
2023-08-31 16:07:39 +00:00
if ! grep -q /boot /proc/mounts; then
2023-01-12 16:31:31 +00:00
mount -o ro /boot || die "Unable to mount /boot"
fi
2023-08-31 16:07:39 +00:00
find /boot -print0 >/tmp/signable.ref
2023-01-12 16:31:31 +00:00
local del='\001-\037\134\177-\377'
2023-08-31 16:07:39 +00:00
LC_ALL=C tr -d "$del" </tmp/signable.ref >/tmp/signable.del || die "Failed to execute tr."
if ! cmp -s "/tmp/signable.ref" "/tmp/signable.del" &>/dev/null; then
2023-01-14 09:27:42 +00:00
local user_out="/tmp/hash_output_mismatches"
local add="Please investigate!"
[ -f "$user_out" ] && add="Please investigate the following relative paths to /boot (where # are sanitized invalid characters):"$'\n'"$(cat "$user_out")"
recovery "Some /boot file names contain characters that are currently not supported by heads: $del"$'\n'"$add"
2023-01-12 16:31:31 +00:00
fi
rm -f /tmp/signable.*
}
2023-08-31 16:07:39 +00:00
verify_checksums() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2022-12-31 17:41:24 +00:00
local boot_dir="$1"
2023-01-12 16:18:52 +00:00
local gui="${2:-y}"
2022-12-31 17:41:24 +00:00
(
set +e -o pipefail
local ret=0
cd "$boot_dir" || ret=1
2023-08-31 16:07:39 +00:00
sha256sum -c "$TMP_HASH_FILE" >/tmp/hash_output || ret=1
2022-12-31 17:41:24 +00:00
# also make sure that the file & directory structure didn't change
# (sha256sum won't detect added files)
2023-08-31 16:07:39 +00:00
print_tree >/tmp/tree_output || ret=1
if ! cmp -s "$TMP_TREE_FILE" /tmp/tree_output &>/dev/null; then
2023-01-08 13:02:13 +00:00
ret=1
2023-01-12 16:18:52 +00:00
[[ "$gui" != "y" ]] && exit "$ret"
2023-01-08 13:02:13 +00:00
# produce a diff that can safely be presented to the user
# this is relatively hard as file names may e.g. contain backslashes etc.,
# which are interpreted by whiptail, less, ...
2023-08-31 16:07:39 +00:00
escape_zero "(new) " <"$TMP_TREE_FILE" >"${TMP_TREE_FILE}.user"
escape_zero "(new) " </tmp/tree_output >/tmp/tree_output.user
diff "${TMP_TREE_FILE}.user" /tmp/tree_output.user | grep -E '^\+\(new\).*$' | sed -r 's/^\+\(new\)/(new)/g' >>/tmp/hash_output
2023-01-08 13:02:13 +00:00
rm -f "${TMP_TREE_FILE}.user"
rm -f /tmp/tree_output.user
fi
2022-12-31 17:41:24 +00:00
exit $ret
)
return $?
}
2024-02-02 21:42:33 +00:00
# Check if a device is an LVM2 PV, and if so print the VG name
find_lvm_vg_name() {
TRACE_FUNC
local DEVICE VG
DEVICE="$1"
mkdir -p /tmp/root-hashes-gui
if ! lvm pvs "$DEVICE" >/tmp/root-hashes-gui/lvm_vg 2>/dev/null; then
# It's not an LVM PV
return 1
fi
VG="$(tail -n +2 /tmp/root-hashes-gui/lvm_vg | awk '{print $2}')"
if [ -z "$VG" ]; then
DEBUG "Could not find LVM2 VG from lvm pvs output:"
DEBUG "$(cat /tmp/root-hashes-gui/lvm_vg)"
return 1
fi
echo "$VG"
}
# If a block device is a partition, check if it is a bios-grub partition on a
# GPT-partitioned disk.
is_gpt_bios_grub() {
TRACE_FUNC
local PART_DEV="$1" DEVICE NUMBER
# Figure out the partitioned device containing this device (if there is
# one) from /sys/class/block.
local DEVICE_MATCHES=("/sys/class/block/"*"/$(basename "$PART_DEV")")
DEVICE="$(echo "${DEVICE_MATCHES[0]}" | cut -d/ -f5)"
if [ "${#DEVICE_MATCHES[@]}" -ne 1 ] || [ "$DEVICE" = "*" ]; then
return 0
fi
# Extract the partition number
if ! [[ $(basename "$PART_DEV") =~ ([0-9]+)$ ]]; then
return 0 # Can't figure out the partition number
fi
NUMBER="${BASH_REMATCH[1]}"
# Now we know the device and partition number, get the type. This is
# specific to GPT disks, MBR disks are shown differently by fdisk.
TRACE "$PART_DEV is partition $NUMBER of $DEVICE"
if [ "$(fdisk -l "/dev/$DEVICE" | awk '$1 == '"$NUMBER"' {print $5}')" == grub ]; then
return 0
fi
return 1
}
# Test if a block device could be used as /boot - we can mount it and it
# contains /boot/grub* files. (Here, the block device could be a partition or
# an unpartitioned device.)
#
# If the device is a partition, its type is also checked. Some common types
# that we definitely can't mount this way are excluded to silence spurious exFAT
# errors.
#
# Any existing /boot is unmounted. If the device is a reasonable boot device,
# it's left mounted on /boot.
mount_possible_boot_device() {
TRACE_FUNC
local BOOT_DEV="$1"
local PARTITION_TYPE
# Unmount anything on /boot. Ignore failure since there might not be
# anything. If there is something mounted and we cannot unmount it for
# some reason, mount will fail, which is handled.
umount /boot 2>/dev/null || true
# Skip bios-grub partitions on GPT disks, LUKS partitions, and LVM PVs,
# we can't mount these as /boot.
if is_gpt_bios_grub "$BOOT_DEV" || cryptsetup isLuks "$BOOT_DEV" ||
find_lvm_vg_name "$BOOT_DEV" >/dev/null; then
TRACE "$BOOT_DEV is not a mountable partition for /boot"
return 1
fi
TRACE "Try mounting $BOOT_DEV as /boot"
if mount -o ro "$BOOT_DEV" /boot >/dev/null 2>&1; then
if ls -d /boot/grub* >/dev/null 2>&1; then
# This device is a reasonable boot device
return 0
fi
umount /boot || true
fi
return 1
}
2019-08-19 22:07:22 +00:00
# detect and set /boot device
# mount /boot if successful
2023-08-31 16:07:39 +00:00
detect_boot_device() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2024-02-02 21:42:33 +00:00
local devname
2019-08-19 22:07:22 +00:00
# unmount /boot to be safe
2020-07-13 22:22:40 +00:00
cd / && umount /boot 2>/dev/null
2019-08-19 22:07:22 +00:00
# check $CONFIG_BOOT_DEV if set/valid
2024-02-02 21:42:33 +00:00
if [ -e "$CONFIG_BOOT_DEV" ] && mount_possible_boot_device "$CONFIG_BOOT_DEV"; then
# CONFIG_BOOT_DEV is valid device and contains an installed OS
return 0
2019-08-19 22:07:22 +00:00
fi
# generate list of possible boot devices
2023-08-31 16:07:39 +00:00
fdisk -l | grep "Disk /dev/" | cut -f2 -d " " | cut -f1 -d ":" >/tmp/disklist
2020-10-18 18:46:57 +00:00
2024-02-02 21:42:33 +00:00
# Check each possible boot device
2023-08-31 16:07:39 +00:00
for i in $(cat /tmp/disklist); do
2024-02-02 21:42:33 +00:00
# If the device has partitions, check the partitions instead
if device_has_partitions "$i"; then
devname="$(basename "$i")"
partitions=("/sys/class/block/$devname/$devname"?*)
2019-08-19 22:07:22 +00:00
else
2024-02-02 21:42:33 +00:00
partitions=("$i") # Use the device itself
2019-08-19 22:07:22 +00:00
fi
2024-02-02 21:42:33 +00:00
for partition in "${partitions[@]}"; do
partition_dev=/dev/"$(basename "$partition")"
# No sense trying something we already tried above
if [ "$partition_dev" = "$CONFIG_BOOT_DEV" ]; then
continue
fi
# If this is a reasonable boot device, select it and finish
if mount_possible_boot_device "$partition_dev"; then
CONFIG_BOOT_DEV="$partition_dev"
2019-11-13 23:36:29 +00:00
return 0
fi
2024-02-02 21:42:33 +00:00
done
2019-08-19 22:07:22 +00:00
done
# no valid boot device found
echo "Unable to locate /boot files on any mounted disk"
return 1
}
2021-10-19 18:48:03 +00:00
2023-08-31 16:07:39 +00:00
scan_boot_options() {
2024-02-01 19:30:31 +00:00
TRACE_FUNC
2022-11-16 19:24:28 +00:00
local bootdir config option_file
bootdir="$1"
config="$2"
option_file="$3"
if [ -r $option_file ]; then rm $option_file; fi
2023-08-31 16:07:39 +00:00
for i in $(find $bootdir -name "$config"); do
2024-04-19 17:35:17 +00:00
DO_WITH_DEBUG kexec-parse-boot "$bootdir" "$i" >>$option_file
2022-11-16 19:24:28 +00:00
done
# FC29/30+ may use BLS format grub config files
# https://fedoraproject.org/wiki/Changes/BootLoaderSpecByDefault
# only parse these if $option_file is still empty
if [ ! -s $option_file ] && [ -d "$bootdir/loader/entries" ]; then
2023-08-31 16:07:39 +00:00
for i in $(find $bootdir -name "$config"); do
kexec-parse-bls "$bootdir" "$i" "$bootdir/loader/entries" >>$option_file
2022-11-16 19:24:28 +00:00
done
fi
}
2023-08-31 16:07:39 +00:00
calc() {
awk "BEGIN { print "$*" }"
2021-10-19 18:48:03 +00:00
}
2023-07-05 14:18:06 +00:00
# truncate a file to a size only if it is longer (busybox truncate lacks '<' and
# always sets the file size)
truncate_max_bytes() {
local bytes="$1"
local file="$2"
if [ "$(stat -c %s "$file")" -gt "$bytes" ]; then
truncate -s "$bytes" "$file"
fi
}
# Busybox xxd -p pads the last line with spaces to 60 columns, which not only
# trips up many scripts, it's very difficult to diagnose by looking at the
# output. Delete line breaks and spaces to really get plain hex output.
tohex_plain() {
xxd -p | tr -d '\n '
}
# Busybox xxd -p -r silently truncates lines longer than 60 hex chars.
# Shorter lines are OK, spaces are OK, and even splitting a byte across lines is
# allowed, so just fold the text to maximum 60 column lines.
# Note that also unlike GNU xxd, non-hex chars in input corrupt the output (GNU
# xxd ignores them).
fromhex_plain() {
fold -w 60 | xxd -p -r
}
2023-08-31 16:07:39 +00:00
print_battery_health() {
2021-10-26 20:26:11 +00:00
if [ -d /sys/class/power_supply/BAT* ]; then
2023-08-31 16:07:39 +00:00
battery_health=$(calc $(cat /sys/class/power_supply/BAT*/charge_full)/$(cat /sys/class/power_supply/BAT*/charge_full_design)*100 | awk -F "." {'print $1'})
2021-10-19 18:48:03 +00:00
echo "$battery_health"
fi
}
2023-08-31 16:07:39 +00:00
print_battery_charge() {
2021-10-26 20:26:11 +00:00
if [ -d /sys/class/power_supply/BAT* ]; then
2023-08-31 16:07:39 +00:00
battery_charge=$(calc $(cat /sys/class/power_supply/BAT*/charge_now)/$(cat /sys/class/power_supply/BAT*/charge_full)*100 | awk -F "." {'print $1'})
echo "$battery_charge"
fi
2021-10-19 18:48:03 +00:00
}
2022-04-29 14:24:02 +00:00
2023-08-31 16:07:39 +00:00
generate_random_mac_address() {
2022-04-29 14:24:02 +00:00
#Borrowed from https://stackoverflow.com/questions/42660218/bash-generate-random-mac-address-unicast
hexdump -n 6 -ve '1/1 "%.2x "' /dev/urandom | awk -v a="2,6,a,e" -v r="$RANDOM" 'BEGIN{srand(r);}NR==1{split(a,b,",");r=int(rand()*4+1);printf "%s%s:%s:%s:%s:%s:%s\n",substr($1,0,1),b[r],$2,$3,$4,$5,$6}'
}
2023-03-10 22:50:43 +00:00
# Add a command to be invoked at exit. (Note that trap EXIT replaces any
# existing handler.) Commands are invoked in reverse order, so they can be used
# to clean up resources, etc.
# The parameters are all executed as-is and do _not_ require additional quoting
# (unlike trap). E.g.:
# at_exit shred "$file" #<-- file is expanded when calling at_exit, no extra quoting needed
at_exit() {
AT_EXIT_HANDLERS+=("$@") # Command and args
AT_EXIT_HANDLERS+=("$#") # Number of elements in this command
}
# Array of all exit handler command arguments with lengths of each command at
# the end. For example:
# at_exit echo hello
# at_exit echo a b c
# results in:
# AT_EXIT_HANDLERS=(echo hello 2 echo a b c 4)
AT_EXIT_HANDLERS=()
# Each handler is an array AT_EXIT_HANDLER_{i}
run_at_exit_handlers() {
local cmd_pos cmd_len
cmd_pos="${#AT_EXIT_HANDLERS[@]}"
# Silence trace if there are no handlers, this is common and occurs a lot
[ "$cmd_pos" -gt 0 ] && DEBUG "Running at_exit handlers"
while [ "$cmd_pos" -gt 0 ]; do
2023-08-31 16:07:39 +00:00
cmd_pos="$((cmd_pos - 1))"
2023-03-10 22:50:43 +00:00
cmd_len="${AT_EXIT_HANDLERS[$cmd_pos]}"
2023-08-31 16:07:39 +00:00
cmd_pos="$((cmd_pos - cmd_len))"
2023-03-10 22:50:43 +00:00
"${AT_EXIT_HANDLERS[@]:$cmd_pos:$cmd_len}"
done
}
trap run_at_exit_handlers EXIT