ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-02-13 14:15:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

TPM2 primary handle debugging once more. Can't wait we get rid of this...

Browse Source 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This commit is contained in:
Thierry Laurion 2024-12-17 16:10:48 -05:00
parent 71d4260045
commit 1e6079620a
No known key found for this signature in database
GPG Key ID: 9A53E1BB3FF00461
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
initrd/bin/kexec-save-default
View File

@ -223,7 +223,7 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
-n 1 \ -n 1 \
-p "Do you wish to add a disk encryption key to the TPM [y/N]: " \ -p "Do you wish to add a disk encryption key to the TPM [y/N]: " \
add_key_confirm add_key_confirm
#TODO: still not convinced: disk encryption key? decryption key? everywhere TPM Disk Unlock Key. Confusing even more? #TODO: still not convinced: disk encryption key? decryption key? everywhere TPM Disk Unlock Key. Confusing even more?
echo echo
if [ "$add_key_confirm" = "y" \ if [ "$add_key_confirm" = "y" \
@ -277,9 +277,15 @@ if [ ! -d $paramsdir ]; then
fi fi
if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
sha256sum /tmp/secret/primary.handle >"$PRIMHASH_FILE" >/dev/null 2>&1 || if [ -f /tmp/secret/primary.handle ]; then
die "ERROR: Failed to Hash TPM2 primary key handle!" DEBUG "Hashing TPM2 primary key handle..."
DEBUG "TPM2 primary key handle hash saved to $PRIMHASH_FILE" sha256sum /tmp/secret/primary.handle >"$PRIMHASH_FILE" 2>/dev/null ||
die "ERROR: Failed to Hash TPM2 primary key handle!"
DEBUG "TPM2 primary key handle hash saved to $PRIMHASH_FILE"
DEBUG "Hash content: $(cat $PRIMHASH_FILE)"
else
die "ERROR: TPM2 primary key handle file does not exist!"
fi
fi fi
rm $paramsdir/kexec_default.*.txt 2>/dev/null || true rm $paramsdir/kexec_default.*.txt 2>/dev/null || true

2
initrd/bin/kexec-select-boot
View File

@ -67,6 +67,8 @@ if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
warn "If you have not intentionally regenerated TPM2 primary key," warn "If you have not intentionally regenerated TPM2 primary key,"
warn "your system may have been compromised" warn "your system may have been compromised"
DEBUG "Hash of TPM2 primary key handle mismatched for $PRIMHASH_FILE" DEBUG "Hash of TPM2 primary key handle mismatched for $PRIMHASH_FILE"
DEBUG "Contents of $PRIMHASH_FILE:"
DEBUG "$(cat $PRIMHASH_FILE)"
} }
else else
warn "Hash of TPM2 primary key handle does not exist" warn "Hash of TPM2 primary key handle does not exist"