ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-02-10 12:51:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

initrd/bin/tmpr: silence tpm reset console output, LOG instead

Browse Source 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This commit is contained in:
Thierry Laurion 2024-12-03 12:20:21 -05:00
parent 48807de222
commit 3726e9083f
No known key found for this signature in database
GPG Key ID: 9A53E1BB3FF00461
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
initrd/bin/tpmr
View File

@ -650,15 +650,15 @@ tpm2_reset() {
# output TPM Owner Password to a file to be reused in this boot session until recovery shell/reboot # output TPM Owner Password to a file to be reused in this boot session until recovery shell/reboot
DEBUG "Caching TPM Owner Password to $SECRET_DIR/tpm_owner_password" DEBUG "Caching TPM Owner Password to $SECRET_DIR/tpm_owner_password"
echo -n "$tpm_owner_password" >"$SECRET_DIR/tpm_owner_password" echo -n "$tpm_owner_password" >"$SECRET_DIR/tpm_owner_password"
tpm2 clear -c platform || warn "Unable to clear TPM on platform hierarchy" tpm2 clear -c platform > /dev/null 2>&1 || LOG "Unable to clear TPM on platform hierarchy"
tpm2 changeauth -c owner "$(tpm2_password_hex "$tpm_owner_password")" tpm2 changeauth -c owner "$(tpm2_password_hex "$tpm_owner_password")" > /dev/null 2>&1 || LOG "Unable to change owner password"
tpm2 changeauth -c endorsement "$(tpm2_password_hex "$tpm_owner_password")" tpm2 changeauth -c endorsement "$(tpm2_password_hex "$tpm_owner_password")" > /dev/null 2>&1 || LOG "Unable to change endorsement password"
tpm2 createprimary -C owner -g sha256 -G "${CONFIG_PRIMARY_KEY_TYPE:-rsa}" \ tpm2 createprimary -C owner -g sha256 -G "${CONFIG_PRIMARY_KEY_TYPE:-rsa}" \
-c "$SECRET_DIR/primary.ctx" -P "$(tpm2_password_hex "$tpm_owner_password")" -c "$SECRET_DIR/primary.ctx" -P "$(tpm2_password_hex "$tpm_owner_password")" > /dev/null 2>&1 || LOG "Unable to create primary key"
tpm2 evictcontrol -C owner -c "$SECRET_DIR/primary.ctx" "$PRIMARY_HANDLE" \ tpm2 evictcontrol -C owner -c "$SECRET_DIR/primary.ctx" "$PRIMARY_HANDLE" \
-P "$(tpm2_password_hex "$tpm_owner_password")" -P "$(tpm2_password_hex "$tpm_owner_password")" > /dev/null 2>&1 || LOG "Unable to evict primary key"
shred -u "$SECRET_DIR/primary.ctx" shred -u "$SECRET_DIR/primary.ctx" > /dev/null 2>&1
tpm2_startsession tpm2_startsession > /dev/null 2>&1 || LOG "Unable to start session"
# Set the dictionary attack parameters. TPM2 defaults vary widely, we # Set the dictionary attack parameters. TPM2 defaults vary widely, we
# want consistent behavior on any TPM. # want consistent behavior on any TPM.
@ -681,7 +681,7 @@ tpm2_reset() {
--max-tries=10 \ --max-tries=10 \
--recovery-time=3600 \ --recovery-time=3600 \
--lockout-recovery-time=0 \ --lockout-recovery-time=0 \
--auth="session:$ENC_SESSION_FILE" --auth="session:$ENC_SESSION_FILE" > /dev/null 2>&1 || LOG "Unable to set dictionary lockout parameters"
# Set a random DA lockout password, so the DA lockout can't be cleared # Set a random DA lockout password, so the DA lockout can't be cleared
# with a password. Heads doesn't offer dictionary attach reset, instead # with a password. Heads doesn't offer dictionary attach reset, instead
@ -690,7 +690,7 @@ tpm2_reset() {
# The default lockout password is empty, so we must set this, and we # The default lockout password is empty, so we must set this, and we
# don't need to provide any auth (use the default empty password). # don't need to provide any auth (use the default empty password).
tpm2 changeauth -Q -c lockout \ tpm2 changeauth -Q -c lockout \
"hex:$(dd if=/dev/urandom bs=32 count=1 status=none 2>/dev/null | xxd -p | tr -d ' \n')" "hex:$(dd if=/dev/urandom bs=32 count=1 status=none 2>/dev/null | xxd -p | tr -d ' \n')" > /dev/null 2>&1 || LOG "Unable to set lockout password"
} }
tpm1_reset() { tpm1_reset() {
TRACE_FUNC TRACE_FUNC
@ -700,17 +700,17 @@ tpm1_reset() {
DEBUG "Caching TPM Owner Password to $SECRET_DIR/tpm_owner_password" DEBUG "Caching TPM Owner Password to $SECRET_DIR/tpm_owner_password"
echo -n "$tpm_owner_password" >"$SECRET_DIR/tpm_owner_password" echo -n "$tpm_owner_password" >"$SECRET_DIR/tpm_owner_password"
# Make sure the TPM is ready to be reset # Make sure the TPM is ready to be reset
tpm physicalpresence -s tpm physicalpresence -s > /dev/null 2>&1 || LOG "Unable to assert physical presence"
tpm physicalenable tpm physicalenable > /dev/null 2>&1 || >LOG "Unable to enable TPM"
tpm physicalsetdeactivated -c tpm physicalsetdeactivated -c > /dev/null 2>&1 || LOG "Unable to deactivate TPM"
tpm forceclear tpm forceclear -pwdo "$tpm_owner_password" > /dev/null 2>&1 || LOG "Unable to clear TPM"
tpm physicalenable tpm physicalenable > /dev/null 2>&1 || LOG "Unable to enable TPM"
tpm takeown -pwdo "$tpm_owner_password" tpm takeown -pwdo "$tpm_owner_password" > /dev/null 2>&1 || LOG "Unable to take ownership of TPM"
# And now turn it all back on # And now turn it all back on
tpm physicalpresence -s tpm physicalpresence -s > /dev/null 2>&1 || LOG "Unable to assert physical presence"
tpm physicalenable tpm physicalenable > /dev/null 2>&1 || LOG "Unable to enable TPM"
tpm physicalsetdeactivated -c tpm physicalsetdeactivated -c > /dev/null 2>&1 || LOG "Unable to deactivate TPM"
} }
# Perform final cleanup before boot and lock the platform heirarchy. # Perform final cleanup before boot and lock the platform heirarchy.