mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-20 05:28:08 +00:00
remove older qubes-specific files, no longer required in generic boot env
This commit is contained in:
Trammell Hudson
parent
22282da905
commit
831dca5124
@ -1,27 +0,0 @@
|
||||
# Configuration for a x230 running Qubes OS
|
||||
BOARD=x230
|
||||
|
||||
CONFIG_CRYPTSETUP=y
|
||||
CONFIG_FLASHROM=y
|
||||
CONFIG_GPG=y
|
||||
CONFIG_KEXEC=y
|
||||
CONFIG_UTIL_LINUX=y
|
||||
CONFIG_LVM2=y
|
||||
CONFIG_MBEDTLS=y
|
||||
CONFIG_PCIUTILS=y
|
||||
CONFIG_POPT=y
|
||||
CONFIG_QRENCODE=y
|
||||
CONFIG_TPMTOTP=y
|
||||
CONFIG_XEN=y
|
||||
CONFIG_DROPBEAR=y
|
||||
|
||||
CONFIG_LINUX_USB=y
|
||||
CONFIG_LINUX_E1000E=y
|
||||
|
||||
CONFIG_BOOTSCRIPT=/bin/qubes-init
|
||||
|
||||
CONFIG_USB_BOOT_DEV="/dev/sdb1"
|
||||
|
||||
# Disks encrypted by the TPM LUKS key
|
||||
CONFIG_QUBES_BOOT_DEV="/dev/sda1"
|
||||
CONFIG_QUBES_VG="qubes_dom0"
|
||||
@ -1,11 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Generate a crypttab file for all the devices that are
|
||||
# present on the system. This is a total hack since the
|
||||
# rd.luks.key=/secret.key should be sufficient.
|
||||
|
||||
keyfile=/secret.key
|
||||
|
||||
for dev in /dev/sd*; do
|
||||
uuid=`cryptsetup luksUUID "$dev" 2>/dev/null` || continue
|
||||
echo "luks-$uuid /dev/disk/by-uuid/$uuid $keyfile luks"
|
||||
done
|
||||
@ -1,38 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Final stage to start qubes given a Xen, dom0 kernel and initrd
|
||||
# get the UUID of the root file system
|
||||
# busybox blkid doesn't have a "just the UUID" option
|
||||
. /etc/functions
|
||||
. /etc/config
|
||||
|
||||
XEN="$1"
|
||||
KERNEL="$2"
|
||||
INITRD="$3"
|
||||
|
||||
if [ -z "$XEN" -o -z "$KERNEL" -o -z "$INITRD" ]; then
|
||||
die "Usage: $0 /boot/xen... /boot/vmlinuz... /boot/initramfs..."
|
||||
fi
|
||||
|
||||
# Activate the dom0 group, if it isn't already active
|
||||
lvm vgchange -a y "$CONFIG_QUBES_VG" \
|
||||
|| die "$CONFIG_QUBES_VG: LVM volume group activate failed"
|
||||
|
||||
ROOT_UUID=`blkid /dev/$CONFIG_QUBES_VG/00 | cut -d\" -f2`
|
||||
if [ -z "$ROOT_UUID" ]; then
|
||||
die "$CONFIG_QUBES_VG/00: No UUID for /"
|
||||
fi
|
||||
|
||||
echo "$CONFIG_QUBES_VG/00: UUID=$ROOT_UUID"
|
||||
|
||||
# command line arguments are include in the signature on this script,
|
||||
echo '+++ Loading kernel and initrd'
|
||||
kexec \
|
||||
-l \
|
||||
--module "$KERNEL root=/dev/mapper/luks-$ROOT_UUID ro rd.qubes.hide_all_usb" \
|
||||
--module "$INITRD" \
|
||||
--command-line "no-real-mode reboot=no" \
|
||||
"${XEN}" \
|
||||
|| die "kexec load failed"
|
||||
|
||||
echo "+++ Starting Qubes..."
|
||||
exec kexec -e
|
||||
@ -1,83 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Boot a Qubes installation that has already been setup.
|
||||
# This depends on the PCR 4 being "normal-boot":
|
||||
# f8fa3b6e32e7c6fe04c366e74636e505b28f3b0d
|
||||
# which is only set if the top level /init script has started
|
||||
# without user intervention or dropping into a recovery shell.
|
||||
|
||||
. /etc/functions
|
||||
. /etc/config
|
||||
|
||||
if [ "$1" = "recovery" ]; then
|
||||
warn "Recovery mode boot; ignoring key failures"
|
||||
RECOVERY=1
|
||||
fi
|
||||
|
||||
# TODO: Allow /boot to be encrypted?
|
||||
# This would require a different TPM key, a user passphrase to decrypt it,
|
||||
# or loading the USB modules to talk to a Yubikey to get the thing.
|
||||
if ! grep -q /boot /proc/mounts ; then
|
||||
mount -o ro "$CONFIG_QUBES_BOOT_DEV" /boot \
|
||||
|| recovery '$CONFIG_BOOT_DEV: Unable to mount /boot'
|
||||
fi
|
||||
|
||||
BOOT_HASHES=/boot/boot.hashes
|
||||
if [ ! -r "$BOOT_HASHES" ]; then
|
||||
recovery "$BOOT_HASHES does not exist; re-run qubes-update"
|
||||
fi
|
||||
|
||||
# Verify the signature on the hashes
|
||||
gpgv "$BOOT_HASHES.asc" "$BOOT_HASHES" \
|
||||
|| recovery 'boot hashes signature failed'
|
||||
|
||||
# Retrieve the TPM counter ID and generate its current value
|
||||
TPM_COUNTER=`grep counter $BOOT_HASHES | cut -d- -f2`
|
||||
if [ -z "$TPM_COUNTER" ]; then
|
||||
recovery "$BOOT_HASHES: TPM counter not found?"
|
||||
fi
|
||||
|
||||
read_tpm_counter $TPM_COUNTER
|
||||
|
||||
# Check the hashes of all the files
|
||||
sha256sum -c "$BOOT_HASHES" \
|
||||
|| recovery "$BOOT_HASHES: hash mismatch"
|
||||
|
||||
XEN=`grep /boot/xen $BOOT_HASHES | cut -d\ -f3 | tail -1`
|
||||
KERNEL=`grep /boot/vmlin $BOOT_HASHES | cut -d\ -f3 | tail -1`
|
||||
INITRD=`grep /boot/initram $BOOT_HASHES | cut -d\ -f3 | tail -1`
|
||||
|
||||
# Activate the dom0 group
|
||||
lvm vgchange -a y "$CONFIG_QUBES_VG" \
|
||||
|| recovery "$CONFIG_QUBES_VG: LVM volume group activate failed"
|
||||
|
||||
# Measure the LUKS headers before we unseal the disk key
|
||||
qubes-measure-luks /dev/$CONFIG_QUBES_VG/* \
|
||||
|| recovery "LUKS measure failed"
|
||||
|
||||
# Unpack the initrd and fixup the /etc/crypttab
|
||||
# this is a hack to split it into two parts since
|
||||
# we know that the first 0x3400 bytes are the microcode
|
||||
INITRD_DIR=/tmp/secret/initrd
|
||||
SECRET_CPIO=/tmp/secret/initrd.cpio
|
||||
mkdir -p "$INITRD_DIR/etc"
|
||||
|
||||
# Attempt to unseal the disk key from the TPM
|
||||
# should we give this some number of tries?
|
||||
if ! unseal-key "$INITRD_DIR/secret.key" ; then
|
||||
warn 'Unseal disk key failed'
|
||||
if [ -z "$RECOVERY" ]; then
|
||||
recovery 'Starting recovery shell'
|
||||
fi
|
||||
fi
|
||||
|
||||
# Override PCR 4 so that user can't read the key
|
||||
tpm extend -ix 4 -ic qubes \
|
||||
|| recovery 'Unable to scramble PCR'
|
||||
|
||||
echo '+++ Building initrd'
|
||||
( cd "$INITRD_DIR" ; find . | cpio -H newc -o ) > "$SECRET_CPIO"
|
||||
cat "$INITRD" >> "$SECRET_CPIO"
|
||||
|
||||
/bin/qubes-boot "$XEN" "$KERNEL" "$SECRET_CPIO"
|
||||
|
||||
recovery "Something failed..."
|
||||
@ -1,29 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Attempt to install qubes using the recovery shell and the pre-built
|
||||
# version of Xen
|
||||
|
||||
. /etc/functions
|
||||
|
||||
DEV="$1"
|
||||
if [ -z "$DEV" ]; then
|
||||
DEV="/dev/sdb2"
|
||||
fi
|
||||
|
||||
mount-usb "$DEV" \
|
||||
|| die "$DEV: Unable to mount?"
|
||||
|
||||
cd /media/efi/boot \
|
||||
|| die "$DEV: cd to /media/efi/boot failed?"
|
||||
|
||||
kexec -l \
|
||||
--module "./vmlinuz inst.stage2=hd:LABEL=Qubes-R3.2-x86_64" \
|
||||
--module "./initrd.img" \
|
||||
--command-line "no-real-mode reboot=no" \
|
||||
/bin/xen.gz \
|
||||
|| die "$DEV: kexec -l failed?"
|
||||
|
||||
warn "Starting installer..."
|
||||
sleep 1
|
||||
kexec -e
|
||||
|
||||
die "$DEV: kexec -e failed?"
|
||||
@ -1,45 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Update the /boot partition signatures
|
||||
set -o pipefail
|
||||
. /etc/functions
|
||||
|
||||
XEN="$1"
|
||||
KERNEL="$2"
|
||||
INITRD="$3"
|
||||
BOOT_HASHES="/boot/boot.hashes"
|
||||
|
||||
if [ -z "$XEN" -o -z "$KERNEL" -o -z "$INITRD" ]; then
|
||||
die "Usage: $0 /boot/xen... /boot/vmlinuz... /boot/initramfs..."
|
||||
fi
|
||||
|
||||
confirm_gpg_card
|
||||
|
||||
check_tpm_counter $BOOT_HASHES
|
||||
|
||||
mount -o rw,remount /boot \
|
||||
|| die "Could not remount /boot"
|
||||
|
||||
increment_tpm_counter $TPM_COUNTER
|
||||
|
||||
sha256sum \
|
||||
"$XEN" \
|
||||
"$KERNEL" \
|
||||
"$INITRD" \
|
||||
"/tmp/counter-$TPM_COUNTER" \
|
||||
| tee "$BOOT_HASHES"
|
||||
|
||||
for tries in 1 2 3; do
|
||||
if gpg \
|
||||
--digest-algo SHA256 \
|
||||
--detach-sign \
|
||||
-a \
|
||||
"$BOOT_HASHES" \
|
||||
; then
|
||||
mount -o ro,remount /boot
|
||||
exit 0
|
||||
fi
|
||||
done
|
||||
|
||||
warn "$BOOT_HASHES: Unable to sign boot hashes"
|
||||
mount -o ro,remount /boot
|
||||
exit 1
|
||||
@ -1,126 +0,0 @@
|
||||
#!/bin/sh
|
||||
# This will generate a disk encryption key and seal / ecncrypt
|
||||
# with the current PCRs and then store it in the TPM NVRAM.
|
||||
# It will then need to be bundled into initrd that is booted with Qubes.
|
||||
|
||||
TPM_INDEX=3
|
||||
TPM_SIZE=312
|
||||
KEY_FILE="/tmp/secret/secret.key"
|
||||
TPM_SEALED="/tmp/secret/secret.sealed"
|
||||
RECOVERY_KEY="/tmp/secret/recovery.key"
|
||||
|
||||
. /etc/functions
|
||||
. /etc/config
|
||||
|
||||
# Activate the LVM volume group
|
||||
VOLUME_GROUP=qubes_dom0
|
||||
lvm vgchange -a y $VOLUME_GROUP \
|
||||
|| die "$VOLUME_GROUP: unable to activate volume group"
|
||||
|
||||
# Key slot 0 is the manual recovery pass phrase
|
||||
# that they user entered when they installed Qubes,
|
||||
# key slot 1 is the one that we've generated.
|
||||
read -s -p "Enter disk recovery key: " disk_password
|
||||
echo -n "$disk_password" > "$RECOVERY_KEY"
|
||||
echo
|
||||
|
||||
# Remove all the old keys from slot 1
|
||||
for dev in /dev/$VOLUME_GROUP/*; do
|
||||
echo "++++++ $dev: Removing old key slot"
|
||||
cryptsetup luksKillSlot \
|
||||
--key-file "$RECOVERY_KEY" \
|
||||
$dev 1 \
|
||||
|| warn "$dev: ignoring problem"
|
||||
done
|
||||
|
||||
read -s -p "New disk unlock password for booting: " key_password
|
||||
echo
|
||||
read -s -p "Repeat unlock code: " key_password2
|
||||
echo
|
||||
|
||||
if [ "$key_password" != "$key_password2" ]; then
|
||||
die "Key passwords do not match"
|
||||
fi
|
||||
|
||||
dd \
|
||||
if=/dev/urandom \
|
||||
of="$KEY_FILE" \
|
||||
bs=1 \
|
||||
count=128 \
|
||||
2>/dev/null \
|
||||
|| die "Unable to generate 128 random bytes"
|
||||
|
||||
for dev in /dev/$VOLUME_GROUP/*; do
|
||||
echo "+++++ $dev: Adding key"
|
||||
cryptsetup luksAddKey \
|
||||
--key-file "$RECOVERY_KEY" \
|
||||
--key-slot 1 \
|
||||
$dev "$KEY_FILE" \
|
||||
|| die "$dev: Unable to add key"
|
||||
done
|
||||
|
||||
# Now that we have setup the new keys, measure the PCRs
|
||||
# We don't care what ends up in PCR 6; we just want
|
||||
# to get the /tmp/luksDump.txt file. We use PCR16
|
||||
# since it should still be zero
|
||||
/bin/qubes-measure-luks /dev/$VOLUME_GROUP/* \
|
||||
|| die "Unable to measure the LUKS headers"
|
||||
luks_pcr=`tpm calcfuturepcr -ix 16 -if /tmp/luksDump.txt`
|
||||
|
||||
# Note that PCR 4 needs to be set with the "normal-boot"
|
||||
# path value, which we do not have right now since we are
|
||||
# in a recovery shell.
|
||||
# used to be -ix 4 f8fa3b6e32e7c6fe04c366e74636e505b28f3b0d \
|
||||
# now just all zeros in a normal boot
|
||||
# PCR 5 must be all zero since no kernel modules should have
|
||||
# been loaded during a normal boot, but might have been
|
||||
# loaded in the recovery shell.
|
||||
# Otherwise use the current values of the PCRs, which will be read
|
||||
# from the TPM as part of the sealing ("X").
|
||||
tpm sealfile2 \
|
||||
-if "$KEY_FILE" \
|
||||
-of "$TPM_SEALED" \
|
||||
-pwdd "$key_password" \
|
||||
-hk 40000000 \
|
||||
-ix 0 X \
|
||||
-ix 1 X \
|
||||
-ix 2 X \
|
||||
-ix 3 X \
|
||||
-ix 4 0000000000000000000000000000000000000000 \
|
||||
-ix 5 0000000000000000000000000000000000000000 \
|
||||
-ix 6 $luks_pcr \
|
||||
|| die "Unable to seal secret"
|
||||
|
||||
rm -f "$KEY_FILE"
|
||||
|
||||
# try it without the owner password first
|
||||
if ! tpm nv_writevalue \
|
||||
-in $TPM_INDEX \
|
||||
-if "$TPM_SEALED" \
|
||||
; then
|
||||
# to create an nvram space we need the TPM owner password
|
||||
# and the TPM physical presence must be asserted.
|
||||
#
|
||||
# The permissions are 0 since there is nothing special
|
||||
# about the sealed file
|
||||
tpm physicalpresence -s \
|
||||
|| warn "Warning: Unable to assert physical presence"
|
||||
|
||||
read -s -p "TPM Owner password: " tpm_password
|
||||
echo
|
||||
|
||||
tpm nv_definespace \
|
||||
-in $TPM_INDEX \
|
||||
-sz $TPM_SIZE \
|
||||
-pwdo "$tpm_password" \
|
||||
-per 0 \
|
||||
|| warn "Warning: Unable to define NVRAM space; trying anyway"
|
||||
|
||||
|
||||
tpm nv_writevalue \
|
||||
-in $TPM_INDEX \
|
||||
-if "$TPM_SEALED" \
|
||||
|| die "Unable to write sealed secret to NVRAM"
|
||||
fi
|
||||
|
||||
rm "$TPM_SEALED" \
|
||||
@ -1,30 +0,0 @@
|
||||
#!/bin/sh
|
||||
mount -o ro -t ext4 /dev/sda1 /boot
|
||||
|
||||
die() { echo >&2 "$*"; exit 1; }
|
||||
|
||||
XEN=/boot/xen-4.6.3.gz
|
||||
INITRD=/boot/initramfs-4.4.14-11.pvops.qubes.x86_64.img
|
||||
KERNEL=/boot/vmlinuz-4.4.14-11.pvops.qubes.x86_64
|
||||
|
||||
echo "+++ Checking $XEN"
|
||||
gpgv "${XEN}.asc" "${XEN}" || die "Xen signature failed"
|
||||
|
||||
echo "+++ Checking $INITRD"
|
||||
gpgv "${INITRD}.asc" "${INITRD}" || die "Initrd signature failed"
|
||||
|
||||
echo "+++ Checking $KERNEL"
|
||||
gpgv "${KERNEL}.asc" "${KERNEL}" || die "Kernel signature failed"
|
||||
|
||||
# should also check xen command line arguments!
|
||||
# should also check kernel command line arguments!
|
||||
|
||||
kexec \
|
||||
-l \
|
||||
--module "${KERNEL} root=LABEL=root rhgb" \
|
||||
--module "${INITRD}" \
|
||||
--command-line "no-real-mode reboot=no console=vga dom0_mem=min:1024M dom0_mem=max:4096M" \
|
||||
"${XEN}"
|
||||
|
||||
|
||||
echo "Ready to start Xen: run 'kexec -e' to execute it"
|
||||
@ -1,92 +0,0 @@
|
||||
#!/bin/sh
|
||||
# This will unseal and unecncrypt the drive encryption key from the TPM
|
||||
# The TOTP secret will be shown to the user on each encryption attempt.
|
||||
# It will then need to be bundled into initrd that is booted with Qubes.
|
||||
|
||||
TPM_INDEX=3
|
||||
TPM_SIZE=312
|
||||
|
||||
. /etc/functions
|
||||
mkdir -p /tmp/secret
|
||||
|
||||
sealed_file="/tmp/secret/sealed.key"
|
||||
key_file="$1"
|
||||
|
||||
if [ -z "$key_file" ]; then
|
||||
key_file="/tmp/secret/secret.key"
|
||||
fi
|
||||
|
||||
tpm nv_readvalue \
|
||||
-in "$TPM_INDEX" \
|
||||
-sz "$TPM_SIZE" \
|
||||
-of "$sealed_file" \
|
||||
|| die "Unable to read key from TPM NVRAM"
|
||||
|
||||
|
||||
get_password()
|
||||
{
|
||||
last_half=X
|
||||
|
||||
while true; do
|
||||
|
||||
# update the TOTP code every thirty seconds
|
||||
date=`date "+%Y-%m-%d %H:%M:%S"`
|
||||
seconds=`date "+%s"`
|
||||
half=`expr \( $seconds % 60 \) / 30`
|
||||
if [ "$half" != "$last_half" ]; then
|
||||
last_half=$half;
|
||||
TOTP=`unseal-totp` \
|
||||
|| die "TOTP code generation failed"
|
||||
fi
|
||||
|
||||
echo -n "$date $TOTP: "
|
||||
|
||||
# read the first character, non-blocking
|
||||
read \
|
||||
-t 1 \
|
||||
-n 1 \
|
||||
-s \
|
||||
-p "Enter unlock password: " \
|
||||
tpm_password_1 \
|
||||
&& break
|
||||
|
||||
# nothing typed, redraw the line
|
||||
echo -ne '\r'
|
||||
done
|
||||
|
||||
# they have started typing, read the rest, blocking
|
||||
if [ -z "$tpm_password_1" ]; then
|
||||
# they hit enter; we should exit gracefully
|
||||
tpm_password=""
|
||||
else
|
||||
# they hit something else, read the rest of the line
|
||||
read \
|
||||
-s \
|
||||
-p '' \
|
||||
tpm_password_2
|
||||
tpm_password="$tpm_password_1$tpm_password_2"
|
||||
fi
|
||||
|
||||
# clean up with a newline
|
||||
echo
|
||||
|
||||
}
|
||||
|
||||
for tries in 1 2 3; do
|
||||
get_password
|
||||
|
||||
if tpm unsealfile \
|
||||
-if "$sealed_file" \
|
||||
-of "$key_file" \
|
||||
-pwdd "$tpm_password" \
|
||||
-hk 40000000 \
|
||||
; then
|
||||
rm -f /tmp/secret/sealed
|
||||
exit 0
|
||||
fi
|
||||
|
||||
pcrs
|
||||
warn "Unable to unseal disk encryption key"
|
||||
done
|
||||
|
||||
die "Retry count exceeded..."
|
||||
@ -1,21 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Add additional files to the initrd cpio so that we can pass
|
||||
# new keys to the Qubes startup routines.
|
||||
# Usage:
|
||||
# wrap-cpio /boot/initrd.blah /tmp/root/ > /tmp/new.cpio
|
||||
|
||||
die() { echo >&2 "$@"; exit 1; }
|
||||
warn() { echo >&2 "$@"; }
|
||||
|
||||
cpio_file="$1"
|
||||
if [ -z "$cpio_file" ]; then
|
||||
die "Initial cpio must be specified"
|
||||
fi
|
||||
|
||||
new_dir="$2"
|
||||
if [ -z "$new_dir" ]; then
|
||||
die "Additional directory must be specified"
|
||||
fi
|
||||
|
||||
( cd "$new_dir" ; find . | cpio -H newc -ov )
|
||||
cat "$cpio_file"
|
||||
Loading…
Reference in New Issue
Block a user