ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-01-30 16:14:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

WiP to be squashed: we need to refactor prompt_tpm_password which is used both for TPM Owner Password prompt and caching reused for TPM disk unlock key passphrase which of course fails

Browse Source 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This commit is contained in:
Thierry Laurion 2023-10-23 17:23:38 -04:00
parent 15f1d0b77a
commit 729f2b17b8
No known key found for this signature in database
GPG Key ID: E7B4A71658E36A93
3 changed files with 25 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
initrd/bin/kexec-seal-key
View File

@ -135,6 +135,10 @@ tpmr calcfuturepcr 6 "/tmp/luksDump.txt" >>"$pcrf"
# We take into consideration user files in cbfs # We take into consideration user files in cbfs
tpmr pcrread -a 7 "$pcrf" tpmr pcrread -a 7 "$pcrf"
DEBUG "TODO: REMOVE THIS: key_password=$key_password here"
DEBUG "TODO: REMOVE THIS: content of /tmp/secret/tpm_password: $(cat /tmp/secret/tpm_password) here"
DO_WITH_DEBUG --mask-position 7 \ DO_WITH_DEBUG --mask-position 7 \
tpmr seal "$KEY_FILE" "$TPM_INDEX" 0,1,2,3,4,5,6,7 "$pcrf" \ tpmr seal "$KEY_FILE" "$TPM_INDEX" 0,1,2,3,4,5,6,7 "$pcrf" \
"$TPM_SIZE" "$key_password" || { "$TPM_SIZE" "$key_password" || {

33
initrd/bin/kexec-select-boot
View File

@ -50,21 +50,24 @@ bootdir="${bootdir%%/}"
paramsdev="${paramsdev%%/}" paramsdev="${paramsdev%%/}"
paramsdir="${paramsdir%%/}" paramsdir="${paramsdir%%/}"
PRIMHASH_FILE="$paramsdir/kexec_primhdl_hash.txt"
if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then #PRIMHASH_FILE="$paramsdir/kexec_primhdl_hash.txt"
if [ -r "$PRIMHASH_FILE" ]; then #if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
sha256sum -c "$PRIMHASH_FILE" \ # if [ -r "$PRIMHASH_FILE" ]; then
|| { # sha256sum -c "$PRIMHASH_FILE" \
echo "FATAL: Hash of TPM2 primary key handle mismatch!"; # || {
warn "If you have not intentionally regenerated TPM2 primary key,"; # echo "FATAL: Hash of TPM2 primary key handle mismatch!";
warn "your system may have been compromised"; # warn "If you have not intentionally regenerated TPM2 primary key,";
} # warn "your system may have been compromised";
else # }
warn "Hash of TPM2 primary key handle does not exist" # else
warn "Please rebuild the boot hash tree" # warn "Hash of TPM2 primary key handle does not exist"
default_failed="y" # warn "Please rebuild the boot hash tree"
fi # default_failed="y"
fi # fi
#fi
#TODO: Readd when this can work successfully by simply resealing TOTP/HOTP without having to reset TPM2, this is a major pain point for users
#And acutally don't work as intended, even more with TPM DUK
verify_global_hashes() verify_global_hashes()
{ {

3
initrd/etc/functions
View File

@ -197,14 +197,17 @@ prompt_tpm_password() {
#Caller might already have cached the password in tpm_password. If not, prompt for it and cache it externally #Caller might already have cached the password in tpm_password. If not, prompt for it and cache it externally
if [ -n "$tpm_password" ]; then if [ -n "$tpm_password" ]; then
DEBUG "tpm_password variable already set by caller. Reusing" DEBUG "tpm_password variable already set by caller. Reusing"
DEBUG "TODO REMOVE THIS! tpm_password is $tpm_password here."
return 0 return 0
elif [ -s /tmp/secret/tpm_password ]; then elif [ -s /tmp/secret/tpm_password ]; then
DEBUG "/tmp/secret/tpm_password already cached in file. Reusing" DEBUG "/tmp/secret/tpm_password already cached in file. Reusing"
tpm_password=$(cat /tmp/secret/tpm_password) tpm_password=$(cat /tmp/secret/tpm_password)
DEBUG "TODO REMOVE THIS! tpm_password is $tpm_password here."
return 0 return 0
fi fi
read -s -p "TPM Owner Password: " tpm_password read -s -p "TPM Owner Password: " tpm_password
#TODO: This function is called for both owner and TPM sealing calls. We should probably have a different prompt for each
echo # new line after password prompt echo # new line after password prompt
# Cache the password externally to be reused by who needs it # Cache the password externally to be reused by who needs it