mirror of
https://github.com/linuxboot/heads.git
synced 2025-02-20 09:16:21 +00:00
WiP: Staging commit to facilitate review, will squash into previous commits once confirmed good
This commit is contained in:
Thierry Laurion
parent
03d8f93c95
commit
64ad01f333
@ -174,7 +174,7 @@ generate_totp_hotp()
|
||||
printf "\033c"
|
||||
else
|
||||
warn "Unsealing TOTP/HOTP secret from previous sealed measurements failed"
|
||||
warn "Try "Generate new HOTP/TOTP secret" option if you updated firmware content"
|
||||
warn 'Try "Generate new HOTP/TOTP secret" option if you updated firmware content'
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
@ -38,7 +38,6 @@ PRIMHASH_FILE="$paramsdir/kexec_primhdl_hash.txt"
|
||||
KEY_DEVICES="$paramsdir/kexec_key_devices.txt"
|
||||
KEY_LVM="$paramsdir/kexec_key_lvm.txt"
|
||||
|
||||
|
||||
lvm_suggest=$(lvm vgscan | awk -F '"' {'print $1'} | tail -n +2)
|
||||
num_lvm=$(echo "$lvm_suggest" | wc -l)
|
||||
if [ "$num_lvm" -eq 1 ] && [ -n "$lvm_suggest" ]; then
|
||||
@ -50,8 +49,7 @@ DEBUG "LVM num_lvm: $num_lvm, lvm_suggest: $lvm_suggest"
|
||||
|
||||
# get all LUKS container devices
|
||||
devices_suggest=$(blkid | cut -d ':' -f 1 | while read device; do
|
||||
cryptsetup isLuks "$device"
|
||||
if [ $(echo $?) == 0 ]; then echo "$device"; fi
|
||||
if cryptsetup isLuks "$device"; then echo "$device"; fi
|
||||
done | sort)
|
||||
num_devices=$(echo "$devices_suggest" | wc -l)
|
||||
|
||||
@ -79,9 +77,9 @@ fi
|
||||
save_key="n"
|
||||
if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [ "$CONFIG_BASIC" != y ]; then
|
||||
DEBUG "TPM is enabled and TPM_NO_LUKS_DISK_UNLOCK is not set"
|
||||
DEBUG "Checking if a a TPM Disk Unlock Key was previously setuped from $KEY_DEVICES"
|
||||
DEBUG "Checking if a a TPM Disk Unlock Key was previously set up from $KEY_DEVICES"
|
||||
if [ ! -r "$KEY_DEVICES" ]; then
|
||||
DEBUG "No previous TPM Disk Unlock Key was setuped for LUKS devices, confirming to add a disk encryption to the TPM"
|
||||
DEBUG "No previous TPM Disk Unlock Key was set up for LUKS devices, confirming to add a disk encryption to the TPM"
|
||||
read \
|
||||
-n 1 \
|
||||
-p "Do you wish to add a disk encryption to the TPM [y/N]: " \
|
||||
@ -94,7 +92,7 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
|
||||
save_key="y"
|
||||
fi
|
||||
else
|
||||
DEBUG "Previous TPM Disk Unlock Key was setuped for LUKS devices"
|
||||
DEBUG "Previous TPM Disk Unlock Key was set up for LUKS devices"
|
||||
read \
|
||||
-n 1 \
|
||||
-p "Do you want to reseal a disk key to the TPM [y/N]: " \
|
||||
@ -123,7 +121,7 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
|
||||
|
||||
if [ "$save_key" = "y" ]; then
|
||||
if [ -n "$old_key_devices" ] || [ -n "$old_lvm_volume_group" ]; then
|
||||
DEBUG "Previous TPM Disk Unlock Key was setuped for LUKS devices $old_key_devices $old_lvm_volume_group"
|
||||
DEBUG "Previous TPM Disk Unlock Key was set up for LUKS devices $old_key_devices $old_lvm_volume_group"
|
||||
read \
|
||||
-n 1 \
|
||||
-p "Do you want to reuse configured Encrypted LVM groups/Block devices? (Y/n):" \
|
||||
@ -138,10 +136,10 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
|
||||
fi
|
||||
fi
|
||||
else
|
||||
DEBUG "No previous TPM Disk Unlock Key was setuped for LUKS devices, setting up new ones"
|
||||
DEBUG "No previous TPM Disk Unlock Key was set up for LUKS devices, setting up new ones"
|
||||
if [ "$num_lvm" -gt 1 ]; then
|
||||
DEBUG "Multiple LVM groups found"
|
||||
//untested
|
||||
# TODO: untested codepath. What uses lvm+LUKS on top nowadays?!?
|
||||
selected_lvmdev_not_existing=1
|
||||
while [ $selected_lvmdev_not_existing -ne 0 ]; do
|
||||
{
|
||||
@ -172,7 +170,8 @@ if [ "$CONFIG_TPM" = "y" ] && [ "$CONFIG_TPM_NO_LUKS_DISK_UNLOCK" != "y" ] && [
|
||||
key_devices
|
||||
|
||||
result=$(echo "$devices_suggest" | grep -q "$key_devices") || selected_luksdev_not_existing=1
|
||||
if [ $? == 0 ]; then
|
||||
#if result is not empty, then the device exists
|
||||
if [ -n "$result" ]; then
|
||||
selected_luksdev_not_existing=0
|
||||
fi
|
||||
}
|
||||
|
||||
@ -53,7 +53,7 @@ echo
|
||||
|
||||
read -s -p "New TPM Disk Unlock Key passphrase for booting: " key_password
|
||||
echo
|
||||
read -s -p "Repeat TPM Disk Unlock key passphrase for booting: " key_password2
|
||||
read -s -p "Repeat TPM Disk Unlock Key passphrase for booting: " key_password2
|
||||
echo
|
||||
|
||||
if [ "$key_password" != "$key_password2" ]; then
|
||||
|
||||
@ -56,12 +56,12 @@ if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
|
||||
sha256sum -c "$PRIMHASH_FILE" \
|
||||
|| {
|
||||
echo "FATAL: Hash of TPM2 primary key handle mismatch!";
|
||||
echo "If you have not intentionally regenerated TPM2 primary key,";
|
||||
warn "If you have not intentionally regenerated TPM2 primary key,";
|
||||
warn "your system may have been compromised";
|
||||
}
|
||||
else
|
||||
echo "WARNING: Hash of TPM2 primary key handle does not exist!"
|
||||
echo "Please rebuild the boot hash tree."
|
||||
warn "Hash of TPM2 primary key handle does not exist"
|
||||
warn "Please rebuild the boot hash tree"
|
||||
default_failed="y"
|
||||
fi
|
||||
fi
|
||||
|
||||
@ -41,8 +41,7 @@ pcrs() {
|
||||
fi
|
||||
}
|
||||
|
||||
confirm_totp()
|
||||
{
|
||||
confirm_totp() {
|
||||
TRACE "Under /etc/functions:confirm_totp"
|
||||
prompt="$1"
|
||||
last_half=X
|
||||
@ -51,15 +50,15 @@ confirm_totp()
|
||||
while true; do
|
||||
|
||||
# update the TOTP code every thirty seconds
|
||||
date=`date "+%Y-%m-%d %H:%M:%S"`
|
||||
seconds=`date "+%s"`
|
||||
half=`expr \( $seconds % 60 \) / 30`
|
||||
date=$(date "+%Y-%m-%d %H:%M:%S")
|
||||
seconds=$(date "+%s")
|
||||
half=$(expr \( $seconds % 60 \) / 30)
|
||||
if [ "$CONFIG_TPM" != "y" ]; then
|
||||
TOTP="NO TPM"
|
||||
elif [ "$half" != "$last_half" ]; then
|
||||
last_half=$half;
|
||||
TOTP=`unseal-totp` \
|
||||
|| recovery "TOTP code generation failed"
|
||||
last_half=$half
|
||||
TOTP=$(unseal-totp) ||
|
||||
recovery "TOTP code generation failed"
|
||||
fi
|
||||
|
||||
echo -n "$date $TOTP: "
|
||||
@ -70,8 +69,8 @@ confirm_totp()
|
||||
-n 1 \
|
||||
-s \
|
||||
-p "$prompt" \
|
||||
totp_confirm \
|
||||
&& break
|
||||
totp_confirm &&
|
||||
break
|
||||
|
||||
# nothing typed, redraw the line
|
||||
echo -ne '\r'
|
||||
@ -81,27 +80,32 @@ confirm_totp()
|
||||
echo
|
||||
}
|
||||
|
||||
reseal_tpm_disk_decryption_key()
|
||||
{
|
||||
reseal_tpm_disk_decryption_key() {
|
||||
TRACE "Under /etc/functions:reseal_tpm_disk_decryption_key"
|
||||
#Can be called only on resealing, not on tpm reset:
|
||||
#otherise primary handle and rollback would change.
|
||||
if ! grep -q /boot /proc/mounts ; then
|
||||
mount -o ro /boot \
|
||||
|| recovery "Unable to mount /boot"
|
||||
#For robustness, exit early if TPM Disk Unlock Key is prohibited in board configs
|
||||
if [ "$CONFIG_TPM_DISK_UNLOCK_KEY" != "y" ]; then
|
||||
DEBUG "TPM Disk Unlock Key is prohibited in board configs"
|
||||
return
|
||||
else
|
||||
DEBUG "TPM Disk Unlock Key is allowed in board configs. Continuing"
|
||||
fi
|
||||
|
||||
if ! grep -q /boot /proc/mounts; then
|
||||
mount -o ro /boot ||
|
||||
recovery "Unable to mount /boot"
|
||||
fi
|
||||
|
||||
if [ -s /boot/kexec_key_devices.txt ] || [ -s /boot/kexec_key_lvm.txt ]; then
|
||||
warn "A TPM disk decryption key previoulsy sealed is now invalid since firmware measurements cannot be unsealed"
|
||||
warn "Renewing LUKS Disk Unlock Key to be unsealed by TPM Disk Unlock Key passphrase"
|
||||
warn "A TPM Disk Unlock Key previously sealed is now invalid since firmware measurements cannot be unsealed"
|
||||
echo "Renewing LUKS Disk Unlock Key to be unsealed by TPM Disk Unlock Key passphrase"
|
||||
while ! kexec-seal-key /boot; do
|
||||
warn "Recovery disk encryption key passphrase invalid. Try again!"
|
||||
warn "Recovery Disk Encryption key passphrase invalid. Try again!"
|
||||
done
|
||||
warn "LUKS header hash changed under of /boot/kexec_luks_hdr_hash.txt"
|
||||
warn "Updating checksums and signing all files under /boot/kexec.sig"
|
||||
warn "LUKS header hash changed under /boot/kexec_luks_hdr_hash.txt"
|
||||
echo "Updating checksums and signing all files under /boot/kexec.sig"
|
||||
while ! update_checksums; do
|
||||
warn "Checksums were not signed. Bad GPG PIN provided?"
|
||||
warn "Please update checksums and provide a valid GPG PIN"
|
||||
warn "Checksums were not signed. Bad GPG PIN provided?"
|
||||
warn "Please update checksums and provide a valid GPG PIN"
|
||||
done
|
||||
warn "Rebooting in 3 seconds to enable booting default boot option"
|
||||
sleep 3
|
||||
@ -114,23 +118,21 @@ reseal_tpm_disk_decryption_key()
|
||||
# Enable USB storage (if not already enabled), and wait for storage devices to
|
||||
# be detected. If USB storage was already enabled, no wait occurs, this would
|
||||
# have happened already when USB storage was enabled.
|
||||
enable_usb_storage()
|
||||
{
|
||||
enable_usb_storage() {
|
||||
if ! lsmod | grep -q usb_storage; then
|
||||
timeout=0
|
||||
echo "Scanning for USB storage devices..."
|
||||
insmod /lib/modules/usb-storage.ko >/dev/null 2>&1 \
|
||||
|| die "usb_storage: module load failed"
|
||||
while [[ $(list_usb_storage | wc -l) -eq 0 ]]; do
|
||||
insmod /lib/modules/usb-storage.ko >/dev/null 2>&1 ||
|
||||
die "usb_storage: module load failed"
|
||||
while [[ $(list_usb_storage | wc -l) -eq 0 ]]; do
|
||||
[[ $timeout -ge 8 ]] && break
|
||||
sleep 1
|
||||
timeout=$(($timeout+1))
|
||||
timeout=$(($timeout + 1))
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
list_usb_storage()
|
||||
{
|
||||
list_usb_storage() {
|
||||
TRACE "Under /etc/functions:list_usb_storage"
|
||||
# List all USB storage devices, including partitions unless we received argument stating we want drives only
|
||||
# The output is a list of device names, one per line.
|
||||
@ -187,8 +189,7 @@ list_usb_storage()
|
||||
done
|
||||
}
|
||||
|
||||
confirm_gpg_card()
|
||||
{
|
||||
confirm_gpg_card() {
|
||||
TRACE "Under /etc/functions:confirm_gpg_card"
|
||||
read \
|
||||
-n 1 \
|
||||
@ -199,7 +200,7 @@ confirm_gpg_card()
|
||||
if [ "$card_confirm" != "y" \
|
||||
-a "$card_confirm" != "Y" \
|
||||
-a -n "$card_confirm" ] \
|
||||
; then
|
||||
; then
|
||||
die "gpg card not confirmed"
|
||||
fi
|
||||
|
||||
@ -210,23 +211,23 @@ confirm_gpg_card()
|
||||
# ensure we don't exit without retrying
|
||||
errexit=$(set -o | grep errexit | awk '{print $2}')
|
||||
set +e
|
||||
gpg --card-status > /dev/null
|
||||
gpg --card-status >/dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
# prompt for reinsertion and try a second time
|
||||
read -n1 -r -p \
|
||||
"Can't access GPG key; remove and reinsert, then press Enter to retry. " \
|
||||
ignored
|
||||
# restore prev errexit state
|
||||
if [ "$errexit" = "on" ]; then
|
||||
set -e
|
||||
fi
|
||||
# retry card status
|
||||
gpg --card-status > /dev/null \
|
||||
|| die "gpg card read failed"
|
||||
# prompt for reinsertion and try a second time
|
||||
read -n1 -r -p \
|
||||
"Can't access GPG key; remove and reinsert, then press Enter to retry. " \
|
||||
ignored
|
||||
# restore prev errexit state
|
||||
if [ "$errexit" = "on" ]; then
|
||||
set -e
|
||||
fi
|
||||
# retry card status
|
||||
gpg --card-status >/dev/null ||
|
||||
die "gpg card read failed"
|
||||
fi
|
||||
# restore prev errexit state
|
||||
if [ "$errexit" = "on" ]; then
|
||||
set -e
|
||||
set -e
|
||||
fi
|
||||
}
|
||||
|
||||
@ -235,7 +236,7 @@ confirm_gpg_card()
|
||||
# line, since some flows need it multiple times and only one prompt is ideal.
|
||||
prompt_tpm_password() {
|
||||
if [ -n "$tpm_password" ]; then
|
||||
return 0;
|
||||
return 0
|
||||
fi
|
||||
|
||||
read -s -p "TPM Owner password: " tpm_password
|
||||
@ -263,25 +264,24 @@ prompt_new_owner_password() {
|
||||
done
|
||||
}
|
||||
|
||||
check_tpm_counter()
|
||||
{
|
||||
TRACE "Under /etc/functions:check_tpm_counter"
|
||||
LABEL=${2:-3135106223}
|
||||
tpm_password="$3"
|
||||
check_tpm_counter() {
|
||||
TRACE "Under /etc/functions:check_tpm_counter"
|
||||
LABEL=${2:-3135106223}
|
||||
tpm_password="$3"
|
||||
# if the /boot.hashes file already exists, read the TPM counter ID
|
||||
# from it.
|
||||
if [ -r "$1" ]; then
|
||||
TPM_COUNTER=`grep counter- "$1" | cut -d- -f2`
|
||||
TPM_COUNTER=$(grep counter- "$1" | cut -d- -f2)
|
||||
else
|
||||
warn "$1 does not exist; creating new TPM counter"
|
||||
prompt_tpm_password
|
||||
tpmr counter_create \
|
||||
-pwdo "$tpm_password" \
|
||||
-pwdc '' \
|
||||
-la $LABEL \
|
||||
| tee /tmp/counter \
|
||||
|| die "Unable to create TPM counter"
|
||||
TPM_COUNTER=`cut -d: -f1 < /tmp/counter`
|
||||
-la $LABEL |
|
||||
tee /tmp/counter ||
|
||||
die "Unable to create TPM counter"
|
||||
TPM_COUNTER=$(cut -d: -f1 </tmp/counter)
|
||||
fi
|
||||
|
||||
if [ -z "$TPM_COUNTER" ]; then
|
||||
@ -289,48 +289,46 @@ check_tpm_counter()
|
||||
fi
|
||||
}
|
||||
|
||||
read_tpm_counter()
|
||||
{
|
||||
read_tpm_counter() {
|
||||
TRACE "Under /etc/functions:read_tpm_counter"
|
||||
tpmr counter_read -ix "$1" | tee "/tmp/counter-$1" \
|
||||
|| die "Counter read failed"
|
||||
tpmr counter_read -ix "$1" | tee "/tmp/counter-$1" ||
|
||||
die "Counter read failed"
|
||||
}
|
||||
|
||||
increment_tpm_counter()
|
||||
{
|
||||
increment_tpm_counter() {
|
||||
TRACE "Under /etc/functions:increment_tpm_counter"
|
||||
tpmr counter_increment -ix "$1" -pwdc '' \
|
||||
| tee /tmp/counter-$1 \
|
||||
|| die "Counter increment failed"
|
||||
tpmr counter_increment -ix "$1" -pwdc '' |
|
||||
tee /tmp/counter-$1 ||
|
||||
die "Counter increment failed"
|
||||
}
|
||||
|
||||
check_config() {
|
||||
TRACE "Under /etc/functions:check_config"
|
||||
if [ ! -d /tmp/kexec ]; then
|
||||
mkdir /tmp/kexec \
|
||||
|| die 'Failed to make kexec tmp dir'
|
||||
mkdir /tmp/kexec ||
|
||||
die 'Failed to make kexec tmp dir'
|
||||
else
|
||||
rm -rf /tmp/kexec/* \
|
||||
|| die 'Failed to empty kexec tmp dir'
|
||||
rm -rf /tmp/kexec/* ||
|
||||
die 'Failed to empty kexec tmp dir'
|
||||
fi
|
||||
|
||||
if [ ! -r $1/kexec.sig -a "$CONFIG_BASIC" != "y" ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if [ `find $1/kexec*.txt | wc -l` -eq 0 ]; then
|
||||
if [ $(find $1/kexec*.txt | wc -l) -eq 0 ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if [ "$2" != "force" ]; then
|
||||
if ! sha256sum `find $1/kexec*.txt` | gpgv $1/kexec.sig - ; then
|
||||
if ! sha256sum $(find $1/kexec*.txt) | gpgv $1/kexec.sig -; then
|
||||
die 'Invalid signature on kexec boot params'
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "+++ Found verified kexec boot params"
|
||||
cp $1/kexec*.txt /tmp/kexec \
|
||||
|| die "Failed to copy kexec boot params to tmp"
|
||||
cp $1/kexec*.txt /tmp/kexec ||
|
||||
die "Failed to copy kexec boot params to tmp"
|
||||
}
|
||||
|
||||
# Replace a file in a ROM (add it if the file does not exist)
|
||||
@ -338,8 +336,8 @@ replace_rom_file() {
|
||||
ROM="$1"
|
||||
ROM_FILE="$2"
|
||||
NEW_FILE="$3"
|
||||
|
||||
if (cbfs.sh -o "$ROM" -l | grep -q "$ROM_FILE") then
|
||||
|
||||
if (cbfs.sh -o "$ROM" -l | grep -q "$ROM_FILE"); then
|
||||
cbfs.sh -o "$ROM" -d "$ROM_FILE"
|
||||
fi
|
||||
cbfs.sh -o "$ROM" -a "$ROM_FILE" -f "$NEW_FILE"
|
||||
@ -352,13 +350,13 @@ replace_config() {
|
||||
NEW_SETTING=$3
|
||||
|
||||
touch $CONFIG_FILE
|
||||
# first pull out the existing option from the global config and place in a tmp file
|
||||
awk "gsub(\"^export ${CONFIG_OPTION}=.*\",\"export ${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config > ${CONFIG_FILE}.tmp
|
||||
awk "gsub(\"^${CONFIG_OPTION}=.*\",\"${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config >> ${CONFIG_FILE}.tmp
|
||||
# first pull out the existing option from the global config and place in a tmp file
|
||||
awk "gsub(\"^export ${CONFIG_OPTION}=.*\",\"export ${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config >${CONFIG_FILE}.tmp
|
||||
awk "gsub(\"^${CONFIG_OPTION}=.*\",\"${CONFIG_OPTION}=\\\"${NEW_SETTING}\\\"\")" /tmp/config >>${CONFIG_FILE}.tmp
|
||||
|
||||
# then copy any remaining settings from the existing config file, minus the option you changed
|
||||
grep -v "^export ${CONFIG_OPTION}=" ${CONFIG_FILE} | grep -v "^${CONFIG_OPTION}=" >> ${CONFIG_FILE}.tmp || true
|
||||
sort ${CONFIG_FILE}.tmp | uniq > ${CONFIG_FILE}
|
||||
# then copy any remaining settings from the existing config file, minus the option you changed
|
||||
grep -v "^export ${CONFIG_OPTION}=" ${CONFIG_FILE} | grep -v "^${CONFIG_OPTION}=" >>${CONFIG_FILE}.tmp || true
|
||||
sort ${CONFIG_FILE}.tmp | uniq >${CONFIG_FILE}
|
||||
rm -f ${CONFIG_FILE}.tmp
|
||||
}
|
||||
|
||||
@ -368,7 +366,7 @@ set_config() {
|
||||
CONFIG_FILE="$1"
|
||||
CONFIG_OPTION="$2"
|
||||
NEW_SETTING="$3"
|
||||
|
||||
|
||||
if grep -q "$CONFIG_OPTION" "$CONFIG_FILE"; then
|
||||
replace_config "$CONFIG_FILE" "$CONFIG_OPTION" "$NEW_SETTING"
|
||||
else
|
||||
@ -389,12 +387,11 @@ set_user_config() {
|
||||
|
||||
# Load a config value to a variable, defaulting to empty. Does not fail if the
|
||||
# config is not set (since it would expand to empty by default).
|
||||
load_config_value()
|
||||
{
|
||||
local config_name="$1"
|
||||
if grep -q "$config_name=" /tmp/config; then
|
||||
grep "$config_name=" /tmp/config | tail -n1 | cut -f2 -d '=' | tr -d '"'
|
||||
fi
|
||||
load_config_value() {
|
||||
local config_name="$1"
|
||||
if grep -q "$config_name=" /tmp/config; then
|
||||
grep "$config_name=" /tmp/config | tail -n1 | cut -f2 -d '=' | tr -d '"'
|
||||
fi
|
||||
}
|
||||
|
||||
# Generate a secret for TPM-less HOTP by reading the ROM. Output is the
|
||||
@ -413,13 +410,12 @@ secret_from_rom_hash() {
|
||||
sha256sum "${ROM_IMAGE}" | cut -f1 -d ' ' | fromhex_plain
|
||||
}
|
||||
|
||||
update_checksums()
|
||||
{
|
||||
update_checksums() {
|
||||
TRACE "Under /etc/functions:update_checksums"
|
||||
# ensure /boot mounted
|
||||
if ! grep -q /boot /proc/mounts ; then
|
||||
mount -o ro /boot \
|
||||
|| recovery "Unable to mount /boot"
|
||||
if ! grep -q /boot /proc/mounts; then
|
||||
mount -o ro /boot ||
|
||||
recovery "Unable to mount /boot"
|
||||
fi
|
||||
|
||||
# remount RW
|
||||
@ -427,12 +423,12 @@ update_checksums()
|
||||
|
||||
# sign and auto-roll config counter
|
||||
extparam=
|
||||
if [ "$CONFIG_TPM" = "y" ];then
|
||||
if [ "$CONFIG_TPM" = "y" ]; then
|
||||
if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
|
||||
extparam=-r
|
||||
fi
|
||||
fi
|
||||
if ! kexec-sign-config -p /boot -u $extparam ; then
|
||||
if ! kexec-sign-config -p /boot -u $extparam; then
|
||||
rv=1
|
||||
else
|
||||
rv=0
|
||||
@ -466,15 +462,15 @@ escape_zero() {
|
||||
|
||||
echo -e -n "$prefix"
|
||||
xxd -p -c1 | tr -d '\n' |
|
||||
{
|
||||
while IFS= read -r -n2 -d '' ; do
|
||||
if [ -n "$todo" ] ; then
|
||||
#REPLY == " " is EOF
|
||||
[[ "$REPLY" == " " ]] && echo '' || echo -e -n "$todo"
|
||||
todo=""
|
||||
fi
|
||||
{
|
||||
while IFS= read -r -n2 -d ''; do
|
||||
if [ -n "$todo" ]; then
|
||||
#REPLY == " " is EOF
|
||||
[[ "$REPLY" == " " ]] && echo '' || echo -e -n "$todo"
|
||||
todo=""
|
||||
fi
|
||||
|
||||
case "$REPLY" in
|
||||
case "$REPLY" in
|
||||
00)
|
||||
todo="\n$prefix"
|
||||
;;
|
||||
@ -497,16 +493,16 @@ escape_zero() {
|
||||
echo -n "$echar$echar"
|
||||
;;
|
||||
#interpreted characters:
|
||||
2[0-9a-f]|3[0-9a-f]|4[0-9a-f]|5[0-9abd-f]|6[0-9a-f]|7[0-9a-e])
|
||||
2[0-9a-f] | 3[0-9a-f] | 4[0-9a-f] | 5[0-9abd-f] | 6[0-9a-f] | 7[0-9a-e])
|
||||
echo -e -n '\x'"$REPLY"
|
||||
;;
|
||||
# All others are escaped
|
||||
*)
|
||||
echo -n "${echar}x$REPLY"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
esac
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
# Currently heads doesn't support signing file names with certain characters
|
||||
@ -515,14 +511,14 @@ escape_zero() {
|
||||
assert_signable() {
|
||||
TRACE "Under /etc/functions:assert_signable"
|
||||
# ensure /boot mounted
|
||||
if ! grep -q /boot /proc/mounts ; then
|
||||
if ! grep -q /boot /proc/mounts; then
|
||||
mount -o ro /boot || die "Unable to mount /boot"
|
||||
fi
|
||||
|
||||
find /boot -print0 > /tmp/signable.ref
|
||||
find /boot -print0 >/tmp/signable.ref
|
||||
local del='\001-\037\134\177-\377'
|
||||
LC_ALL=C tr -d "$del" < /tmp/signable.ref > /tmp/signable.del || die "Failed to execute tr."
|
||||
if ! cmp -s "/tmp/signable.ref" "/tmp/signable.del" &> /dev/null ; then
|
||||
LC_ALL=C tr -d "$del" </tmp/signable.ref >/tmp/signable.del || die "Failed to execute tr."
|
||||
if ! cmp -s "/tmp/signable.ref" "/tmp/signable.del" &>/dev/null; then
|
||||
local user_out="/tmp/hash_output_mismatches"
|
||||
local add="Please investigate!"
|
||||
[ -f "$user_out" ] && add="Please investigate the following relative paths to /boot (where # are sanitized invalid characters):"$'\n'"$(cat "$user_out")"
|
||||
@ -531,8 +527,7 @@ assert_signable() {
|
||||
rm -f /tmp/signable.*
|
||||
}
|
||||
|
||||
verify_checksums()
|
||||
{
|
||||
verify_checksums() {
|
||||
TRACE "Under /etc/functions:verify_checksums"
|
||||
local boot_dir="$1"
|
||||
local gui="${2:-y}"
|
||||
@ -541,20 +536,20 @@ verify_checksums()
|
||||
set +e -o pipefail
|
||||
local ret=0
|
||||
cd "$boot_dir" || ret=1
|
||||
sha256sum -c "$TMP_HASH_FILE" > /tmp/hash_output || ret=1
|
||||
sha256sum -c "$TMP_HASH_FILE" >/tmp/hash_output || ret=1
|
||||
|
||||
# also make sure that the file & directory structure didn't change
|
||||
# (sha256sum won't detect added files)
|
||||
print_tree > /tmp/tree_output || ret=1
|
||||
if ! cmp -s "$TMP_TREE_FILE" /tmp/tree_output &> /dev/null ; then
|
||||
print_tree >/tmp/tree_output || ret=1
|
||||
if ! cmp -s "$TMP_TREE_FILE" /tmp/tree_output &>/dev/null; then
|
||||
ret=1
|
||||
[[ "$gui" != "y" ]] && exit "$ret"
|
||||
# produce a diff that can safely be presented to the user
|
||||
# this is relatively hard as file names may e.g. contain backslashes etc.,
|
||||
# which are interpreted by whiptail, less, ...
|
||||
escape_zero "(new) " < "$TMP_TREE_FILE" > "${TMP_TREE_FILE}.user"
|
||||
escape_zero "(new) " < /tmp/tree_output > /tmp/tree_output.user
|
||||
diff "${TMP_TREE_FILE}.user" /tmp/tree_output.user | grep -E '^\+\(new\).*$' | sed -r 's/^\+\(new\)/(new)/g' >> /tmp/hash_output
|
||||
escape_zero "(new) " <"$TMP_TREE_FILE" >"${TMP_TREE_FILE}.user"
|
||||
escape_zero "(new) " </tmp/tree_output >/tmp/tree_output.user
|
||||
diff "${TMP_TREE_FILE}.user" /tmp/tree_output.user | grep -E '^\+\(new\).*$' | sed -r 's/^\+\(new\)/(new)/g' >>/tmp/hash_output
|
||||
rm -f "${TMP_TREE_FILE}.user"
|
||||
rm -f /tmp/tree_output.user
|
||||
fi
|
||||
@ -565,8 +560,7 @@ verify_checksums()
|
||||
|
||||
# detect and set /boot device
|
||||
# mount /boot if successful
|
||||
detect_boot_device()
|
||||
{
|
||||
detect_boot_device() {
|
||||
TRACE "Under /etc/functions:detect_boot_device"
|
||||
# unmount /boot to be safe
|
||||
cd / && umount /boot 2>/dev/null
|
||||
@ -582,22 +576,22 @@ detect_boot_device()
|
||||
fi
|
||||
|
||||
# generate list of possible boot devices
|
||||
fdisk -l | grep "Disk /dev/" | cut -f2 -d " " | cut -f1 -d ":" > /tmp/disklist
|
||||
fdisk -l | grep "Disk /dev/" | cut -f2 -d " " | cut -f1 -d ":" >/tmp/disklist
|
||||
|
||||
# filter out extraneous options
|
||||
> /tmp/boot_device_list
|
||||
for i in `cat /tmp/disklist`; do
|
||||
>/tmp/boot_device_list
|
||||
for i in $(cat /tmp/disklist); do
|
||||
# remove block device from list if numeric partitions exist, since not bootable
|
||||
DEV_NUM_PARTITIONS=$((`ls -1 $i* | wc -l`-1))
|
||||
DEV_NUM_PARTITIONS=$(($(ls -1 $i* | wc -l) - 1))
|
||||
if [ ${DEV_NUM_PARTITIONS} -eq 0 ]; then
|
||||
echo $i >> /tmp/boot_device_list
|
||||
echo $i >>/tmp/boot_device_list
|
||||
else
|
||||
ls $i* | tail -${DEV_NUM_PARTITIONS} >> /tmp/boot_device_list
|
||||
ls $i* | tail -${DEV_NUM_PARTITIONS} >>/tmp/boot_device_list
|
||||
fi
|
||||
done
|
||||
|
||||
# iterate thru possible options and check for grub dir
|
||||
for i in `cat /tmp/boot_device_list`; do
|
||||
for i in $(cat /tmp/boot_device_list); do
|
||||
umount /boot 2>/dev/null
|
||||
if mount -o ro $i /boot >/dev/null 2>&1; then
|
||||
if ls -d /boot/grub* >/dev/null 2>&1; then
|
||||
@ -613,30 +607,28 @@ detect_boot_device()
|
||||
return 1
|
||||
}
|
||||
|
||||
scan_boot_options()
|
||||
{
|
||||
scan_boot_options() {
|
||||
local bootdir config option_file
|
||||
bootdir="$1"
|
||||
config="$2"
|
||||
option_file="$3"
|
||||
|
||||
if [ -r $option_file ]; then rm $option_file; fi
|
||||
for i in `find $bootdir -name "$config"`; do
|
||||
DO_WITH_DEBUG kexec-parse-boot "$bootdir" "$i" >> $option_file
|
||||
for i in $(find $bootdir -name "$config"); do
|
||||
DO_WITH_DEBUG kexec-parse-boot "$bootdir" "$i" >>$option_file
|
||||
done
|
||||
# FC29/30+ may use BLS format grub config files
|
||||
# https://fedoraproject.org/wiki/Changes/BootLoaderSpecByDefault
|
||||
# only parse these if $option_file is still empty
|
||||
if [ ! -s $option_file ] && [ -d "$bootdir/loader/entries" ]; then
|
||||
for i in `find $bootdir -name "$config"`; do
|
||||
kexec-parse-bls "$bootdir" "$i" "$bootdir/loader/entries" >> $option_file
|
||||
for i in $(find $bootdir -name "$config"); do
|
||||
kexec-parse-bls "$bootdir" "$i" "$bootdir/loader/entries" >>$option_file
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
calc()
|
||||
{
|
||||
awk "BEGIN { print "$*" }";
|
||||
calc() {
|
||||
awk "BEGIN { print "$*" }"
|
||||
}
|
||||
|
||||
# truncate a file to a size only if it is longer (busybox truncate lacks '<' and
|
||||
@ -665,24 +657,21 @@ fromhex_plain() {
|
||||
fold -w 60 | xxd -p -r
|
||||
}
|
||||
|
||||
print_battery_health()
|
||||
{
|
||||
print_battery_health() {
|
||||
if [ -d /sys/class/power_supply/BAT* ]; then
|
||||
battery_health=$(calc $(cat /sys/class/power_supply/BAT*/charge_full)/$(cat /sys/class/power_supply/BAT*/charge_full_design)*100 | awk -F "." {'print $1'})
|
||||
battery_health=$(calc $(cat /sys/class/power_supply/BAT*/charge_full)/$(cat /sys/class/power_supply/BAT*/charge_full_design)*100 | awk -F "." {'print $1'})
|
||||
echo "$battery_health"
|
||||
fi
|
||||
}
|
||||
|
||||
print_battery_charge()
|
||||
{
|
||||
print_battery_charge() {
|
||||
if [ -d /sys/class/power_supply/BAT* ]; then
|
||||
battery_charge=$(calc $(cat /sys/class/power_supply/BAT*/charge_now)/$(cat /sys/class/power_supply/BAT*/charge_full)*100 | awk -F "." {'print $1'})
|
||||
echo "$battery_charge"
|
||||
fi
|
||||
battery_charge=$(calc $(cat /sys/class/power_supply/BAT*/charge_now)/$(cat /sys/class/power_supply/BAT*/charge_full)*100 | awk -F "." {'print $1'})
|
||||
echo "$battery_charge"
|
||||
fi
|
||||
}
|
||||
|
||||
generate_random_mac_address()
|
||||
{
|
||||
generate_random_mac_address() {
|
||||
#Borrowed from https://stackoverflow.com/questions/42660218/bash-generate-random-mac-address-unicast
|
||||
hexdump -n 6 -ve '1/1 "%.2x "' /dev/urandom | awk -v a="2,6,a,e" -v r="$RANDOM" 'BEGIN{srand(r);}NR==1{split(a,b,",");r=int(rand()*4+1);printf "%s%s:%s:%s:%s:%s:%s\n",substr($1,0,1),b[r],$2,$3,$4,$5,$6}'
|
||||
}
|
||||
@ -713,9 +702,9 @@ run_at_exit_handlers() {
|
||||
# Silence trace if there are no handlers, this is common and occurs a lot
|
||||
[ "$cmd_pos" -gt 0 ] && DEBUG "Running at_exit handlers"
|
||||
while [ "$cmd_pos" -gt 0 ]; do
|
||||
cmd_pos="$((cmd_pos-1))"
|
||||
cmd_pos="$((cmd_pos - 1))"
|
||||
cmd_len="${AT_EXIT_HANDLERS[$cmd_pos]}"
|
||||
cmd_pos="$((cmd_pos-cmd_len))"
|
||||
cmd_pos="$((cmd_pos - cmd_len))"
|
||||
"${AT_EXIT_HANDLERS[@]:$cmd_pos:$cmd_len}"
|
||||
done
|
||||
}
|
||||
|
||||
@ -301,7 +301,7 @@ while : ; do
|
||||
if [ -z "$luks_current_Disk_Recovery_Key_passphrase" ]; then
|
||||
#if no external provisioning provides current Disk Recovery Key passphrase
|
||||
whiptail --title 'Reencrypt LUKS disk encrypted container ?' \
|
||||
--msgbox "This will replace the encrypted container content and its Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user in the\nfollowing conditions:\n 1-Every boot if no Disk unlock key was added to the TPM\n 2-If the TPM fails (Hardware failure)\n 3-If the firmware has been tampered with/upgraded/modified by the user\n\nThis process requires you to type the current Disk Recovery Key passphrase\nand will delete TPM Disk unlock key slot if setuped by setting a default boot\n LUKS header (slot 1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to\nthe LUKS device container.\n\nHit Enter to continue." 0 80
|
||||
--msgbox "This will replace the encrypted container content and its Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user in the\nfollowing conditions:\n 1-Every boot if no Disk unlock key was added to the TPM\n 2-If the TPM fails (Hardware failure)\n 3-If the firmware has been tampered with/upgraded/modified by the user\n\nThis process requires you to type the current Disk Recovery Key passphrase\nand will delete TPM Disk unlock key slot if set up by setting a default boot\n LUKS header (slot 1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to\nthe LUKS device container.\n\nHit Enter to continue." 0 80
|
||||
echo -e "\nEnter current Disk Recovery Key passphrase (Provisioned at OS installation or by OEM):"
|
||||
read -r luks_current_Disk_Recovery_Key_passphrase
|
||||
echo -n "$luks_current_Disk_Recovery_Key_passphrase" > /tmp/luks_current_Disk_Recovery_Key_passphrase
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user