ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-02-13 06:05:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

TPM2 primary handle debugging once more. Can't wait we get rid of this...

Browse Source 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This commit is contained in:
Thierry Laurion 2024-12-17 16:10:48 -05:00
parent 71d4260045
commit 1e6079620a
No known key found for this signature in database
GPG Key ID: 9A53E1BB3FF00461
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
initrd/bin/kexec-save-default
View File

@ -223,7 +223,7 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
-n 1 \
-p "Do you wish to add a disk encryption key to the TPM [y/N]: " \
add_key_confirm
#TODO: still not convinced: disk encryption key? decryption key? everywhere TPM Disk Unlock Key. Confusing even more?
#TODO: still not convinced: disk encryption key? decryption key? everywhere TPM Disk Unlock Key. Confusing even more?
echo
if [ "$add_key_confirm" = "y" \
@ -277,9 +277,15 @@ if [ ! -d $paramsdir ]; then
fi
if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
sha256sum /tmp/secret/primary.handle >"$PRIMHASH_FILE" >/dev/null 2>&1 ||
die "ERROR: Failed to Hash TPM2 primary key handle!"
DEBUG "TPM2 primary key handle hash saved to $PRIMHASH_FILE"
if [ -f /tmp/secret/primary.handle ]; then
DEBUG "Hashing TPM2 primary key handle..."
sha256sum /tmp/secret/primary.handle >"$PRIMHASH_FILE" 2>/dev/null ||
die "ERROR: Failed to Hash TPM2 primary key handle!"
DEBUG "TPM2 primary key handle hash saved to $PRIMHASH_FILE"
DEBUG "Hash content: $(cat $PRIMHASH_FILE)"
else
die "ERROR: TPM2 primary key handle file does not exist!"
fi
fi
rm $paramsdir/kexec_default.*.txt 2>/dev/null || true

2
initrd/bin/kexec-select-boot
View File

@ -67,6 +67,8 @@ if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
warn "If you have not intentionally regenerated TPM2 primary key,"
warn "your system may have been compromised"
DEBUG "Hash of TPM2 primary key handle mismatched for $PRIMHASH_FILE"
DEBUG "Contents of $PRIMHASH_FILE:"
DEBUG "$(cat $PRIMHASH_FILE)"
}
else
warn "Hash of TPM2 primary key handle does not exist"