ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-02-06 11:10:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add a gui message when hash checks fail in kexec-select-boot

Browse Source
This commit is contained in:
Kyle Rankin 2018-03-01 11:10:41 -08:00
parent 149635ef95
commit 21c46ceb95
No known key found for this signature in database
GPG Key ID: 555577116BFA74B9
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
initrd/bin/gui-init
View File

@ -109,7 +109,7 @@ while true; do
mount_boot mount_boot
DEFAULT_FILE=`find /boot/kexec_default.*.txt 2>/dev/null | head -1` DEFAULT_FILE=`find /boot/kexec_default.*.txt 2>/dev/null | head -1`
if [ -r "$DEFAULT_FILE" ]; then if [ -r "$DEFAULT_FILE" ]; then
kexec-select-boot -b /boot -c "grub.cfg" \ kexec-select-boot -b /boot -c "grub.cfg" -g \
|| recovery "Failed default boot" || recovery "Failed default boot"
else else
if (whiptail --title 'No Default Boot Option Configured' \ if (whiptail --title 'No Default Boot Option Configured' \

14
initrd/bin/kexec-select-boot
View File

@ -48,11 +48,16 @@ verify_global_hashes()
{ {
echo "+++ Checking verified boot hash file " echo "+++ Checking verified boot hash file "
# Check the hashes of all the files # Check the hashes of all the files
if cd $bootdir && sha256sum -c "$TMP_HASH_FILE" ; then if cd $bootdir && sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output ; then
echo "+++ Verified boot hashes " echo "+++ Verified boot hashes "
valid_hash='y' valid_hash='y'
valid_global_hash='y' valid_global_hash='y'
else else
if [ "$gui_menu" = "y" ]; then
CHANGED_FILES=$(grep -v 'OK$' /tmp/hash_output | cut -f1 -d ':')
whiptail --title 'ERROR: Boot Hash Mismatch' \
--msgbox "The following files failed the verification process:\n${CHANGED_FILES}\nExiting to a recovery shell" 16 60
fi
die "$TMP_HASH_FILE: boot hash mismatch" die "$TMP_HASH_FILE: boot hash mismatch"
fi fi
} }
@ -210,10 +215,15 @@ default_select() {
# Enforce that default option hashes are valid # Enforce that default option hashes are valid
echo "+++ Checking verified default boot hash file " echo "+++ Checking verified default boot hash file "
# Check the hashes of all the files # Check the hashes of all the files
if cd $bootdir && sha256sum -c "$TMP_DEFAULT_HASH_FILE" ; then if cd $bootdir && sha256sum -c "$TMP_DEFAULT_HASH_FILE" > /tmp/hash_output ; then
echo "+++ Verified default boot hashes " echo "+++ Verified default boot hashes "
valid_hash='y' valid_hash='y'
else else
if [ "$gui_menu" = "y" ]; then
CHANGED_FILES=$(grep -v 'OK$' /tmp/hash_output | cut -f1 -d ':')
whiptail --title 'ERROR: Default Boot Hash Mismatch' \
--msgbox "The following files failed the verification process:\n${CHANGED_FILES}\nExiting to a recovery shell" 16 60
fi
die "!!! $TMP_DEFAULT_HASH_FILE: default boot hash mismatch" die "!!! $TMP_DEFAULT_HASH_FILE: default boot hash mismatch"
fi fi