ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-18 20:47:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

gui-init, tpm-reset: Enforce TPM password maximum length

Browse Source 
TPM password must be 1-32 characters.  Loop if the password is not
valid or the repeated password doesn't match, so the user can try
again.

Move prompt_new_owner_password to functions and use in both gui-init
and tpm-reset.

Fixes #1336

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This commit is contained in:
Jonathon Hall 2023-03-13 13:33:30 -04:00
parent 30963e121f
commit 1f8c88a7eb
No known key found for this signature in database
GPG Key ID: 1E9C3CA91AE25114
3 changed files with 22 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
initrd/bin/gui-init
View File

@ -510,24 +510,6 @@ prompt_totp_mismatch()
fi
}
prompt_new_owner_password() {
read -s -p "New TPM owner password: " key_password
echo
if [ -z "$key_password" ]; then
echo "Empty owner password is not allowed" >&2
return 1
fi
read -s -p "Repeat owner password: " key_password2
echo
if [ "$key_password" != "$key_password2" ]; then
echo "Key passwords do not match" >&2
return 1
fi
}
reset_tpm()
{
TRACE "Under /bin/gui-init:reset_tpm"

15
initrd/bin/tpm-reset
View File

@ -5,19 +5,6 @@ echo '*****'
echo '***** WARNING: This will erase all keys and secrets from the TPM'
echo '*****'
read -s -p "New TPM owner password: " key_password
echo
if [ -z "$key_password" ]; then
die "Empty owner password is not allowed"
fi
read -s -p "Repeat owner password: " key_password2
echo
if [ "$key_password" != "$key_password2" ]; then
die "Key passwords do not match"
fi
prompt_new_owner_password
tpmr reset "$key_password"

21
initrd/etc/functions
View File

@ -221,6 +221,27 @@ prompt_tpm_password() {
echo # new line after password prompt
}
# Prompt for a new owner password when resetting the TPM. Returned in
# key_password. The password must be 1-32 characters and must be entered twice,
# the script will loop until this is met.
prompt_new_owner_password() {
local key_password2
key_password=1
key_password2=2
while [ "$key_password" != "$key_password2" ] || [ "${#key_password}" -gt 32 ] || [ -z "$key_password" ]; do
read -s -p "New TPM owner passphrase (2 words suggested, 1-32 characters max): " key_password
echo
read -s -p "Repeat chosen TPM owner passphrase: " key_password2
echo
if [ "$key_password" != "$key_password2" ]; then
echo "Passphrases entered do not match. Try again!"
echo
fi
done
}
check_tpm_counter()
{
TRACE "Under /etc/functions:check_tpm_counter"