From 5bc2bc88e4618ee0a978bee9329b9597931842bb Mon Sep 17 00:00:00 2001 From: Thierry Laurion Date: Sat, 18 Feb 2023 12:58:43 -0500 Subject: [PATCH] All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config -qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now --- .../qemu-coreboot-fbwhiptail-tpm1-hotp.config | 3 +++ .../qemu-coreboot-fbwhiptail-tpm1.config | 3 +++ .../qemu-coreboot-whiptail-tpm1-hotp.config | 3 +++ .../qemu-coreboot-whiptail-tpm1.config | 3 +++ initrd/bin/cbfs-init | 2 ++ initrd/bin/cbfs.sh | 2 ++ initrd/bin/config-gui.sh | 2 ++ initrd/bin/flash-gui.sh | 2 ++ initrd/bin/flash.sh | 2 ++ initrd/bin/flashrom-kgpe-d16-openbmc.sh | 2 ++ initrd/bin/generic-init | 1 + initrd/bin/gpg-gui.sh | 1 + initrd/bin/gpgv | 3 +++ initrd/bin/gui-init | 22 +++++++++++++++- initrd/bin/kexec-boot | 2 ++ initrd/bin/kexec-insert-key | 2 ++ initrd/bin/kexec-iso-init | 2 ++ initrd/bin/kexec-parse-bls | 3 +++ initrd/bin/kexec-parse-boot | 4 +++ initrd/bin/kexec-save-default | 2 ++ initrd/bin/kexec-seal-key | 1 + initrd/bin/kexec-select-boot | 2 ++ initrd/bin/kexec-sign-config | 2 ++ initrd/bin/kexec-unseal-key | 1 + initrd/bin/key-init | 2 ++ initrd/bin/media-scan | 2 ++ initrd/bin/mount-usb | 2 ++ initrd/bin/network-init-recovery | 2 ++ initrd/bin/oem-factory-reset | 3 +++ initrd/bin/oem-system-info-xx30 | 2 ++ initrd/bin/poweroff | 3 +++ initrd/bin/qubes-measure-luks | 3 +++ initrd/bin/reboot | 3 +++ initrd/bin/seal-hotpkey | 3 +++ initrd/bin/seal-totp | 2 ++ initrd/bin/unseal-hotp | 3 +++ initrd/bin/unseal-totp | 2 ++ initrd/bin/usb-init | 2 ++ initrd/bin/wget-measure.sh | 2 ++ initrd/bin/x230-flash.init | 2 ++ initrd/etc/functions | 25 +++++++++++++++++++ initrd/etc/gui_functions | 3 +++ initrd/init | 2 ++ 43 files changed, 139 insertions(+), 1 deletion(-) diff --git a/boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.config b/boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.config index f2301d88..81f4a768 100644 --- a/boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.config +++ b/boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.config @@ -8,6 +8,9 @@ export CONFIG_COREBOOT=y export CONFIG_COREBOOT_VERSION=4.13 export CONFIG_LINUX_VERSION=5.10.5 +#Enable DEBUG output +export CONFIG_DEBUG_OUTPUT=y + CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_LINUX_CONFIG=config/linux-qemu.config diff --git a/boards/qemu-coreboot-fbwhiptail-tpm1/qemu-coreboot-fbwhiptail-tpm1.config b/boards/qemu-coreboot-fbwhiptail-tpm1/qemu-coreboot-fbwhiptail-tpm1.config index f5793221..68b75b50 100644 --- a/boards/qemu-coreboot-fbwhiptail-tpm1/qemu-coreboot-fbwhiptail-tpm1.config +++ b/boards/qemu-coreboot-fbwhiptail-tpm1/qemu-coreboot-fbwhiptail-tpm1.config @@ -6,6 +6,9 @@ export CONFIG_COREBOOT=y export CONFIG_COREBOOT_VERSION=4.13 export CONFIG_LINUX_VERSION=5.10.5 +#Enable DEBUG output +export CONFIG_DEBUG_OUTPUT=y + CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_LINUX_CONFIG=config/linux-qemu.config diff --git a/boards/qemu-coreboot-whiptail-tpm1-hotp/qemu-coreboot-whiptail-tpm1-hotp.config b/boards/qemu-coreboot-whiptail-tpm1-hotp/qemu-coreboot-whiptail-tpm1-hotp.config index 3a9dbb03..108a9395 100644 --- a/boards/qemu-coreboot-whiptail-tpm1-hotp/qemu-coreboot-whiptail-tpm1-hotp.config +++ b/boards/qemu-coreboot-whiptail-tpm1-hotp/qemu-coreboot-whiptail-tpm1-hotp.config @@ -8,6 +8,9 @@ export CONFIG_COREBOOT=y export CONFIG_COREBOOT_VERSION=4.13 export CONFIG_LINUX_VERSION=5.10.5 +#Enable DEBUG output +export CONFIG_DEBUG_OUTPUT=y + CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_LINUX_CONFIG=config/linux-qemu.config diff --git a/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config b/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config index b15625e5..91cd335f 100644 --- a/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config +++ b/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config @@ -6,6 +6,9 @@ export CONFIG_COREBOOT=y export CONFIG_COREBOOT_VERSION=4.13 export CONFIG_LINUX_VERSION=5.10.5 +#Enable DEBUG output +export CONFIG_DEBUG_OUTPUT=y + CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1.config CONFIG_LINUX_CONFIG=config/linux-qemu.config diff --git a/initrd/bin/cbfs-init b/initrd/bin/cbfs-init index ee6276a8..2aa46d5f 100755 --- a/initrd/bin/cbfs-init +++ b/initrd/bin/cbfs-init @@ -2,6 +2,8 @@ set -e -o pipefail . /etc/functions +DEBUG "Under /bin/cbfs-init" + # Update initrd with CBFS files if [ -z "$CONFIG_PCR" ]; then CONFIG_PCR=7 diff --git a/initrd/bin/cbfs.sh b/initrd/bin/cbfs.sh index cea0f6c8..e5f63c6b 100755 --- a/initrd/bin/cbfs.sh +++ b/initrd/bin/cbfs.sh @@ -3,6 +3,8 @@ set -e -o pipefail . /etc/functions . /tmp/config +DEBUG "Under /bin/cbfs.sh" + if pnor "$2" -r HBI > /tmp/pnor.part 2>/dev/null; then cbfs "$@" -o /tmp/pnor.part && pnor "$2" -w HBI < /tmp/pnor.part else diff --git a/initrd/bin/config-gui.sh b/initrd/bin/config-gui.sh index 23e234a1..0a4fcf7f 100755 --- a/initrd/bin/config-gui.sh +++ b/initrd/bin/config-gui.sh @@ -5,6 +5,8 @@ set -e -o pipefail . /etc/gui_functions . /tmp/config +DEBUG "Under /bin/config-gui.sh" + param=$1 while true; do diff --git a/initrd/bin/flash-gui.sh b/initrd/bin/flash-gui.sh index 3d858c91..15394eca 100755 --- a/initrd/bin/flash-gui.sh +++ b/initrd/bin/flash-gui.sh @@ -5,6 +5,8 @@ set -e -o pipefail . /etc/gui_functions . /tmp/config +DEBUG "Under /bin/flash-gui.sh" + while true; do unset menu_choice whiptail $BG_COLOR_MAIN_MENU --title "Firmware Management Menu" \ diff --git a/initrd/bin/flash.sh b/initrd/bin/flash.sh index 14a99fa5..0f190a6d 100755 --- a/initrd/bin/flash.sh +++ b/initrd/bin/flash.sh @@ -6,6 +6,8 @@ set -e -o pipefail . /etc/functions . /tmp/config +DEBUG "Under /bin/flash.sh" + case "$CONFIG_FLASHROM_OPTIONS" in -* ) echo "Board $CONFIG_BOARD detected, continuing..." diff --git a/initrd/bin/flashrom-kgpe-d16-openbmc.sh b/initrd/bin/flashrom-kgpe-d16-openbmc.sh index 138ce035..39a4ab8a 100755 --- a/initrd/bin/flashrom-kgpe-d16-openbmc.sh +++ b/initrd/bin/flashrom-kgpe-d16-openbmc.sh @@ -1,6 +1,8 @@ #!/bin/sh . /etc/functions +DEBUG "Under /bin/flashrom-kgpe-d16-openbmc.sh" + ROM="$1" if [ -z "$1" ]; then die "Usage: $0 /media/kgpe-d16-openbmc.rom" diff --git a/initrd/bin/generic-init b/initrd/bin/generic-init index b63b0a05..0c3de5e2 100755 --- a/initrd/bin/generic-init +++ b/initrd/bin/generic-init @@ -6,6 +6,7 @@ mount_boot() { + DEBUG "Under /bin/generic-init:mount_boot" # Mount local disk if it is not already mounted if ! grep -q /boot /proc/mounts ; then mount -o ro /boot \ diff --git a/initrd/bin/gpg-gui.sh b/initrd/bin/gpg-gui.sh index 4171733c..a68f5a68 100755 --- a/initrd/bin/gpg-gui.sh +++ b/initrd/bin/gpg-gui.sh @@ -5,6 +5,7 @@ set -e -o pipefail . /etc/gui_functions . /tmp/config +DEBUG "Under /bin/gpg-gui.sh" gpg_flash_rom() { if [ "$1" = "replace" ]; then diff --git a/initrd/bin/gpgv b/initrd/bin/gpgv index 2bb9b246..a2cc0d95 100755 --- a/initrd/bin/gpgv +++ b/initrd/bin/gpgv @@ -1,3 +1,6 @@ #!/bin/sh # if we are using the full GPG we need a wrapper for the gpgv executable +. /etc/functions + +DEBUG "Under /bin/gpgv" exec gpg --verify "$@" diff --git a/initrd/bin/gui-init b/initrd/bin/gui-init index 06a0d422..46a3ae03 100755 --- a/initrd/bin/gui-init +++ b/initrd/bin/gui-init @@ -17,7 +17,7 @@ skip_to_menu="false" mount_boot() { - + DEBUG "Under /bin/gui-init:mount_boot" # Mount local disk if it is not already mounted while ! grep -q /boot /proc/mounts ; do # try to mount if CONFIG_BOOT_DEV exists @@ -63,6 +63,7 @@ mount_boot() verify_global_hashes() { + DEBUG "Under /bin/gui-init:verify_global_hashes" # Check the hashes of all the files, ignoring signatures for now check_config /boot force TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt" @@ -137,6 +138,7 @@ verify_global_hashes() prompt_update_checksums() { + DEBUG "Under /bin/gui-init:prompt_update_checksums" if (whiptail $BG_COLOR_WARNING --title 'Update Checksums and sign all files in /boot' \ --yesno "You have chosen to update the checksums and sign all of the files in /boot.\n\nThis means that you trust that these files have not been tampered with.\n\nYou will need your GPG key available, and this change will modify your disk.\n\nDo you want to continue?" 0 80) then if ! update_checksums ; then @@ -148,6 +150,7 @@ prompt_update_checksums() generate_totp_htop() { + DEBUG "Under /bin/gui-init:generate_totp_htop" echo "Scan the QR code to add the new TOTP secret" if /bin/seal-totp "$BOARD_NAME"; then if [ -x /bin/hotp_verification ]; then @@ -167,6 +170,7 @@ generate_totp_htop() update_totp() { + DEBUG "Under /bin/gui-init:update_totp" # update the TOTP code date=`date "+%Y-%m-%d %H:%M:%S %Z"` if [ "$CONFIG_TPM" = n ]; then @@ -217,6 +221,7 @@ update_totp() update_hotp() { + DEBUG "Under /bin/gui-init:update_hotp" if [ -x /bin/hotp_verification ]; then HOTP=`unseal-hotp` if ! hotp_verification info ; then @@ -255,6 +260,7 @@ update_hotp() clean_boot_check() { + DEBUG "Under /bin/gui-init:mount_boot" # assume /boot mounted if ! grep -q /boot /proc/mounts ; then return @@ -283,6 +289,7 @@ clean_boot_check() check_gpg_key() { + DEBUG "Under /bin/gui-init:check_gpg_key" GPG_KEY_COUNT=`gpg -k 2>/dev/null | wc -l` if [ $GPG_KEY_COUNT -eq 0 ]; then BG_COLOR_MAIN_MENU=$BG_COLOR_ERROR @@ -319,6 +326,7 @@ check_gpg_key() prompt_auto_default_boot() { + DEBUG "Under /bin/gui-init:prompt_auto_default_boot" # save IFS before changing, restore after read IFS_DEF=$IFS IFS='' @@ -335,6 +343,7 @@ prompt_auto_default_boot() show_main_menu() { + DEBUG "Under /bin/gui-init:show_main_menu" date=`date "+%Y-%m-%d %H:%M:%S %Z"` whiptail $BG_COLOR_MAIN_MENU --title "$MAIN_MENU_TITLE" \ --menu "$date\nTOTP: $TOTP | HOTP: $HOTP" 0 80 10 \ @@ -368,6 +377,7 @@ show_main_menu() show_options_menu() { + DEBUG "Under /bin/gui-init:show_options_menu" whiptail $BG_COLOR_MAIN_MENU --title "HEADS Options" \ --menu "" 0 80 10 \ 'b' ' Boot Options -->' \ @@ -424,6 +434,7 @@ show_options_menu() show_boot_options_menu() { + DEBUG "Under /bin/gui-init:show_boot_options_menu" whiptail $BG_COLOR_MAIN_MENU --title "Boot Options" \ --menu "Select A Boot Option" 0 80 10 \ 'm' ' Show OS boot menu' \ @@ -451,6 +462,7 @@ show_boot_options_menu() show_tpm_totp_hotp_options_menu() { + DEBUG "Under /bin/gui-init:show_tpm_totp_hotp_options_menu" whiptail $BG_COLOR_MAIN_MENU --title "TPM/TOTP/HOTP Options" \ --menu "Select An Option" 0 80 10 \ 'g' ' Generate new TOTP/HOTP secret' \ @@ -477,6 +489,7 @@ show_tpm_totp_hotp_options_menu() prompt_totp_mismatch() { + DEBUG "Under /bin/gui-init:prompt_totp_mismatch" if (whiptail $BG_COLOR_WARNING --title "TOTP/HOTP code mismatched" \ --yesno "TOTP/HOTP code mismatches could indicate either TPM tampering or clock drift:\n\nTo correct clock drift: 'date -s yyyy-MM-DD hh:mm:ss' in UTC timezone\nand save it to the RTC: 'hwclock -w'\nthen reboot and try again.\n\nWould you like to exit to a recovery console?" 0 80) then echo "" @@ -493,6 +506,7 @@ prompt_totp_mismatch() reset_tpm() { + DEBUG "Under /bin/gui-init:reset_tpm" if [ "$CONFIG_TPM" = "y" ]; then if (whiptail $BG_COLOR_WARNING --title 'Reset the TPM' \ --yesno "This will clear the TPM and TPM password, replace them with new ones!\n\nDo you want to proceed?" 0 80) then @@ -526,6 +540,7 @@ reset_tpm() show_system_info() { + DEBUG "Under /bin/gui-init:show_system_info" battery_charge="$(print_battery_charge)" battery_health="$(print_battery_health)" if [ -n $battery_charge -a -n $battery_health ];then @@ -543,6 +558,7 @@ show_system_info() select_os_boot_option() { + DEBUG "Under /bin/gui-init:select_os_boot_option" mount_boot if verify_global_hashes ; then kexec-select-boot -m -b /boot -c "grub.cfg" -g @@ -551,6 +567,7 @@ select_os_boot_option() attempt_default_boot() { + DEBUG "Under /bin/gui-init:attempt_default_boot" mount_boot if ! verify_global_hashes; then @@ -568,6 +585,7 @@ attempt_default_boot() force_unsafe_boot() { + DEBUG "Under /bin/gui-init:force_unsafe_boot" # Run the menu selection in "force" mode, bypassing hash checks if (whiptail $BG_COLOR_WARNING --title 'Unsafe Forced Boot Selected!' \ --yesno "WARNING: You have chosen to skip all tamper checks and boot anyway.\n\nThis is an unsafe option!\n\nDo you want to proceed?" 0 80) then @@ -576,6 +594,7 @@ force_unsafe_boot() } # gui-init start +DEBUG "Under /bin/gui-init, start" # Use stored HOTP key branding if [ -r /boot/kexec_hotp_key ]; then @@ -609,6 +628,7 @@ if [[ "$HOTP" = "Success" && $CONFIG_AUTO_BOOT_TIMEOUT ]]; then fi while true; do + DEBUG "Under gui-init:while true loop" skip_to_menu="false" show_main_menu done diff --git a/initrd/bin/kexec-boot b/initrd/bin/kexec-boot index 50f806f3..feb5e622 100755 --- a/initrd/bin/kexec-boot +++ b/initrd/bin/kexec-boot @@ -4,6 +4,8 @@ set -e -o pipefail . /tmp/config . /etc/functions +DEBUG "Under /bin/kexec-boot" + dryrun="n" printfiles="n" printinitrd="n" diff --git a/initrd/bin/kexec-insert-key b/initrd/bin/kexec-insert-key index 8894da12..42984dbb 100755 --- a/initrd/bin/kexec-insert-key +++ b/initrd/bin/kexec-insert-key @@ -3,6 +3,8 @@ set -e -o pipefail . /etc/functions +DEBUG "Under /bin/kexec-insert-key" + TMP_KEY_DEVICES="/tmp/kexec/kexec_key_devices.txt" TMP_KEY_LVM="/tmp/kexec/kexec_key_lvm.txt" diff --git a/initrd/bin/kexec-iso-init b/initrd/bin/kexec-iso-init index b623dbff..41a83882 100755 --- a/initrd/bin/kexec-iso-init +++ b/initrd/bin/kexec-iso-init @@ -4,6 +4,8 @@ set -e -o pipefail . /etc/functions . /tmp/config +DEBUG "Under /bin/kexec-iso-init" + MOUNTED_ISO_PATH="$1" ISO_PATH="$2" DEV="$3" diff --git a/initrd/bin/kexec-parse-bls b/initrd/bin/kexec-parse-bls index ee2e0881..c28db3a1 100755 --- a/initrd/bin/kexec-parse-bls +++ b/initrd/bin/kexec-parse-bls @@ -1,5 +1,8 @@ #!/bin/sh set -e -o pipefail +. /etc/functions +DEBUG "Under /bin/kexec-parse-bls" + bootdir="$1" file="$2" blsdir="$3" diff --git a/initrd/bin/kexec-parse-boot b/initrd/bin/kexec-parse-boot index 7bba7d26..5f964561 100755 --- a/initrd/bin/kexec-parse-boot +++ b/initrd/bin/kexec-parse-boot @@ -1,5 +1,9 @@ #!/bin/sh set -e -o pipefail +. /etc/functions + +DEBUG "Under /bin/kexec-parse-boot" + bootdir="$1" file="$2" diff --git a/initrd/bin/kexec-save-default b/initrd/bin/kexec-save-default index 23ddd46b..479f191c 100755 --- a/initrd/bin/kexec-save-default +++ b/initrd/bin/kexec-save-default @@ -4,6 +4,8 @@ set -e -o pipefail . /tmp/config . /etc/functions +DEBUG "Under /bin/kexec-save-default" + while getopts "b:d:p:i:" arg; do case $arg in b) bootdir="$OPTARG" ;; diff --git a/initrd/bin/kexec-seal-key b/initrd/bin/kexec-seal-key index 7000070b..96f4d1ce 100755 --- a/initrd/bin/kexec-seal-key +++ b/initrd/bin/kexec-seal-key @@ -3,6 +3,7 @@ # with the current PCRs and then store it in the TPM NVRAM. # It will then need to be bundled into initrd that is booted. set -e -o pipefail +. /etc/functions TPM_INDEX=3 TPM_SIZE=312 diff --git a/initrd/bin/kexec-select-boot b/initrd/bin/kexec-select-boot index 44fee308..126d695d 100755 --- a/initrd/bin/kexec-select-boot +++ b/initrd/bin/kexec-select-boot @@ -4,6 +4,8 @@ set -e -o pipefail . /tmp/config . /etc/functions +DEBUG "Under /bin/kexec-select-boot" + add="" remove="" config="*.cfg" diff --git a/initrd/bin/kexec-sign-config b/initrd/bin/kexec-sign-config index 88a74c14..4d4e2855 100755 --- a/initrd/bin/kexec-sign-config +++ b/initrd/bin/kexec-sign-config @@ -4,6 +4,8 @@ set -e -o pipefail . /tmp/config . /etc/functions +DEBUG "Under /bin/kexec-sign-config" + rollback="n" update="n" while getopts "p:c:ur" arg; do diff --git a/initrd/bin/kexec-unseal-key b/initrd/bin/kexec-unseal-key index e016f5bd..d35e8b78 100755 --- a/initrd/bin/kexec-unseal-key +++ b/initrd/bin/kexec-unseal-key @@ -3,6 +3,7 @@ # The TOTP secret will be shown to the user on each encryption attempt. # It will then need to be bundled into initrd that is booted with Qubes. set -e -o pipefail +. /etc/functions TPM_INDEX=3 TPM_SIZE=312 diff --git a/initrd/bin/key-init b/initrd/bin/key-init index bb4c1b5c..bbc3f47b 100755 --- a/initrd/bin/key-init +++ b/initrd/bin/key-init @@ -2,6 +2,8 @@ set -e -o pipefail . /etc/functions +DEBUG "Under /bin/key-init" + # Post processing of keys # Import user's keys diff --git a/initrd/bin/media-scan b/initrd/bin/media-scan index 9cea4fea..d49f7791 100755 --- a/initrd/bin/media-scan +++ b/initrd/bin/media-scan @@ -5,6 +5,8 @@ set -e -o pipefail . /etc/gui_functions . /tmp/config +DEBUG "Under /bin/media-scan" + # Unmount any previous boot device if grep -q /boot /proc/mounts ; then umount /boot \ diff --git a/initrd/bin/mount-usb b/initrd/bin/mount-usb index 570336a9..d6fb7938 100755 --- a/initrd/bin/mount-usb +++ b/initrd/bin/mount-usb @@ -2,6 +2,8 @@ # Mount a USB device . /etc/functions +DEBUG "Under /bin/mount-usb" + enable_usb if ! lsmod | grep -q usb_storage; then diff --git a/initrd/bin/network-init-recovery b/initrd/bin/network-init-recovery index a0fdba2d..0f97d7a0 100755 --- a/initrd/bin/network-init-recovery +++ b/initrd/bin/network-init-recovery @@ -2,6 +2,8 @@ . /etc/functions +DEBUG "Under /bin/network-init-recovery" + # bring up the ethernet; maybe should do DHCP? ifconfig lo 127.0.0.1 diff --git a/initrd/bin/oem-factory-reset b/initrd/bin/oem-factory-reset index 5d18b207..afab3c94 100755 --- a/initrd/bin/oem-factory-reset +++ b/initrd/bin/oem-factory-reset @@ -1,7 +1,10 @@ #!/bin/sh # Automated setup of TPM, GPG keys, and disk +DEBUG "Under /bin/oem-factory-reset" + set -o pipefail +. /etc/functions # use TERM to exit on error trap "exit 1" TERM diff --git a/initrd/bin/oem-system-info-xx30 b/initrd/bin/oem-system-info-xx30 index 158df9ff..ab735da4 100755 --- a/initrd/bin/oem-system-info-xx30 +++ b/initrd/bin/oem-system-info-xx30 @@ -9,6 +9,8 @@ export BG_COLOR_MAIN_MENU="" . /etc/luks-functions . /tmp/config +DEBUG "Under /bin/oem-system-info-xx30" + battery_charge="$(print_battery_charge)" battery_health="$(print_battery_health)" if [ -n $battery_charge -a -n $battery_health ];then diff --git a/initrd/bin/poweroff b/initrd/bin/poweroff index f7a0b123..78af30c9 100755 --- a/initrd/bin/poweroff +++ b/initrd/bin/poweroff @@ -1,4 +1,7 @@ #!/bin/sh +. /etc/functions + +DEBUG "Under /bin/poweroff" # Sync all mounted filesystems echo s > /proc/sysrq-trigger diff --git a/initrd/bin/qubes-measure-luks b/initrd/bin/qubes-measure-luks index ddf39ef3..c5be1037 100755 --- a/initrd/bin/qubes-measure-luks +++ b/initrd/bin/qubes-measure-luks @@ -1,6 +1,9 @@ #!/bin/sh # Measure all of the luks disk encryption headers into # a PCR so that we can detect disk swap attacks. +. /etc/functions + +DEBUG "Under /bin/qubes-measure-luks" die() { echo >&2 "$@"; exit 1; } diff --git a/initrd/bin/reboot b/initrd/bin/reboot index aab0fd7d..0e11b921 100755 --- a/initrd/bin/reboot +++ b/initrd/bin/reboot @@ -1,4 +1,7 @@ #!/bin/sh +. /etc/functions + +DEBUG "Under /bin/reboot" # Sync all mounted filesystems echo s > /proc/sysrq-trigger diff --git a/initrd/bin/seal-hotpkey b/initrd/bin/seal-hotpkey index 70b0e933..f0a654fd 100755 --- a/initrd/bin/seal-hotpkey +++ b/initrd/bin/seal-hotpkey @@ -10,6 +10,7 @@ HOTP_KEY="/boot/kexec_hotp_key" mount_boot() { + DEBUG "Under /bin/seal-htopkey:mount_boot" # Mount local disk if it is not already mounted if ! grep -q /boot /proc/mounts ; then mount -o ro /boot \ @@ -17,6 +18,8 @@ mount_boot() fi } +DEBUG "Under /bin/seal-hotpkey" + # Use stored HOTP key branding (this might be useful after OEM reset) if [ -r /boot/kexec_hotp_key ]; then HOTPKEY_BRANDING="$(cat /boot/kexec_hotp_key)" diff --git a/initrd/bin/seal-totp b/initrd/bin/seal-totp index 22005c89..49875896 100755 --- a/initrd/bin/seal-totp +++ b/initrd/bin/seal-totp @@ -7,6 +7,8 @@ . /etc/functions +DEBUG "Under /bin/seal-totp" + TPM_NVRAM_SPACE=4d47 HOST="$1" diff --git a/initrd/bin/unseal-hotp b/initrd/bin/unseal-hotp index 0fc3fb28..d38c9162 100755 --- a/initrd/bin/unseal-hotp +++ b/initrd/bin/unseal-hotp @@ -9,6 +9,7 @@ HOTP_COUNTER="/boot/kexec_hotp_counter" mount_boot_or_die() { + DEBUG "Under /bin/unseal-hotp:mount_boot_or_die" # Mount local disk if it is not already mounted if ! grep -q /boot /proc/mounts ; then mount -o ro /boot \ @@ -16,6 +17,8 @@ mount_boot_or_die() fi } +DEBUG "Under /bin/unseal-hotp" + # Store counter in file instead of TPM for now, as it conflicts with Heads # config TPM counter as TPM 1.2 can only increment one counter between reboots # get current value of HOTP counter in TPM, create if absent diff --git a/initrd/bin/unseal-totp b/initrd/bin/unseal-totp index c9c339b1..47fdeef7 100755 --- a/initrd/bin/unseal-totp +++ b/initrd/bin/unseal-totp @@ -6,6 +6,8 @@ TOTP_SEALED="/tmp/secret/totp.sealed" TOTP_SECRET="/tmp/secret/totp.key" +DEBUG "Under /bin/unseal-totp" + tpm nv_readvalue \ -in 4d47 \ -sz 312 \ diff --git a/initrd/bin/usb-init b/initrd/bin/usb-init index bc0abaf4..6cb78338 100755 --- a/initrd/bin/usb-init +++ b/initrd/bin/usb-init @@ -4,6 +4,8 @@ . /etc/functions . /tmp/config +DEBUG "Under /bin/usb-init" + if [ "$CONFIG_TPM" = "y" ]; then # Extend PCR4 as soon as possible tpm extend -ix 4 -ic usb diff --git a/initrd/bin/wget-measure.sh b/initrd/bin/wget-measure.sh index a18b28e7..dbf0c7ee 100755 --- a/initrd/bin/wget-measure.sh +++ b/initrd/bin/wget-measure.sh @@ -1,7 +1,9 @@ #!/bin/sh # get a file and extend a TPM PCR +. /etc/functions die() { + DEBUG "Under /bin/wget-measure.sh:die" echo >&2 "$@" exit 1 } diff --git a/initrd/bin/x230-flash.init b/initrd/bin/x230-flash.init index 0ba456f7..4d8ed84c 100755 --- a/initrd/bin/x230-flash.init +++ b/initrd/bin/x230-flash.init @@ -5,6 +5,8 @@ . /etc/functions . /tmp/config +DEBUG "Under /bin/x230-flash.init" + insmod /lib/modules/ehci-hcd.ko insmod /lib/modules/ehci-pci.ko insmod /lib/modules/xhci-hcd.ko diff --git a/initrd/etc/functions b/initrd/etc/functions index 7d8cedc7..ce4746a1 100755 --- a/initrd/etc/functions +++ b/initrd/etc/functions @@ -12,7 +12,15 @@ warn() { sleep 1; } +DEBUG() { + if [ "$CONFIG_DEBUG_OUTPUT" = "y" ];then + echo >&2 "DEBUG: $*"; + fi +} + + recovery() { + DEBUG "Under /etc/functions:recovery" echo >&2 "!!!!! $*" # Remove any temporary secret files that might be hanging around @@ -44,6 +52,7 @@ recovery() { } pause_recovery() { + DEBUG "Under /etc/functions:pause_recovery" read -p 'Hit enter to proceed to recovery shell:' recovery $* } @@ -54,6 +63,7 @@ pcrs() { confirm_totp() { + DEBUG "Under /etc/functions:confirm_totp" prompt="$1" last_half=X unset totp_confirm @@ -93,6 +103,7 @@ confirm_totp() enable_usb() { + DEBUG "Under /etc/functions:enable_usb" #insmod ehci_hcd prior of uhdc_hcd and ohci_hcd to suppress dmesg warning if ! lsmod | grep -q ehci_hcd; then insmod /lib/modules/ehci-hcd.ko \ @@ -137,6 +148,7 @@ enable_usb() list_usb_storage() { + DEBUG "Under /etc/functions:list_usb_storage" stat -c %N /sys/block/sd* 2>/dev/null | grep usb | cut -f1 -d ' ' | sed "s/[']//g" | @@ -176,6 +188,7 @@ list_usb_storage() confirm_gpg_card() { + DEBUG "Under /etc/functions:confirm_gpg_card" read \ -n 1 \ -p "Please confirm that your GPG card is inserted [Y/n]: " \ @@ -219,6 +232,7 @@ confirm_gpg_card() check_tpm_counter() { + DEBUG "Under /etc/functions:check_tpm_counter" LABEL=${2:-3135106223} # if the /boot.hashes file already exists, read the TPM counter ID # from it. @@ -244,18 +258,21 @@ check_tpm_counter() read_tpm_counter() { + DEBUG "Under /etc/functions:read_tpm_counter" tpm counter_read -ix "$1" | tee "/tmp/counter-$1" \ || die "Counter read failed" } increment_tpm_counter() { + DEBUG "Under /etc/functions:increment_tpm_counter" tpm counter_increment -ix "$1" -pwdc '' \ | tee /tmp/counter-$1 \ || die "Counter increment failed" } check_config() { + DEBUG "Under /etc/functions:check_config" if [ ! -d /tmp/kexec ]; then mkdir /tmp/kexec \ || die 'Failed to make kexec tmp dir' @@ -284,6 +301,7 @@ check_config() { } preserve_rom() { + DEBUG "Under /etc/functions:preserve_rom" new_rom="$1" old_files=`cbfs -t 50 -l 2>/dev/null | grep "^heads/"` @@ -299,6 +317,7 @@ preserve_rom() { done } replace_config() { + DEBUG "Under /etc/functions:replace_config" CONFIG_FILE=$1 CONFIG_OPTION=$2 NEW_SETTING=$3 @@ -314,11 +333,13 @@ replace_config() { rm -f ${CONFIG_FILE}.tmp } combine_configs() { + DEBUG "Under /etc/functions:combine_configs" cat /etc/config* > /tmp/config } update_checksums() { + DEBUG "Under /etc/functions:update_checksums" # ensure /boot mounted if ! grep -q /boot /proc/mounts ; then mount -o ro /boot \ @@ -346,6 +367,7 @@ update_checksums() } print_tree() { + DEBUG "Under /etc/functions:print_tree" find ./ ! -path './kexec*' -print0 | sort -z } @@ -413,6 +435,7 @@ escape_zero() { # due to https://bugs.busybox.net/show_bug.cgi?id=14226. Also, certain characters # may be intepreted by `whiptail`, `less` et al (e.g. \n, \b, ...). assert_signable() { + DEBUG "Under /etc/functions:assert_signable" # ensure /boot mounted if ! grep -q /boot /proc/mounts ; then mount -o ro /boot || die "Unable to mount /boot" @@ -432,6 +455,7 @@ assert_signable() { verify_checksums() { + DEBUG "Under /etc/functions:verify_checksums" local boot_dir="$1" local gui="${2:-y}" @@ -465,6 +489,7 @@ verify_checksums() # mount /boot if successful detect_boot_device() { + DEBUG "Under /etc/functions:detect_boot_device" # unmount /boot to be safe cd / && umount /boot 2>/dev/null diff --git a/initrd/etc/gui_functions b/initrd/etc/gui_functions index 7405f2fa..a2d1f218 100755 --- a/initrd/etc/gui_functions +++ b/initrd/etc/gui_functions @@ -1,8 +1,10 @@ #!/bin/sh # Shell functions for common operations using fbwhiptail +. /etc/functions mount_usb() { + DEBUG "under gui_functions:mount_usb" # Unmount any previous USB device if grep -q /media /proc/mounts ; then umount /media || die "Unable to unmount /media" @@ -23,6 +25,7 @@ mount_usb() file_selector() { + DEBUG "under gui_functions:file_selector" FILE="" FILE_LIST=$1 MENU_MSG=${2:-"Choose the file"} diff --git a/initrd/init b/initrd/init index 41534487..5aeffdeb 100755 --- a/initrd/init +++ b/initrd/init @@ -43,6 +43,8 @@ hwclock -l -s . /etc/functions . /etc/config +DEBUG "Under init" + # set CONFIG_TPM dynamically before init if [ -e /dev/tpm0 ]; then CONFIG_TPM='y'