ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-20 05:28:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

kexec-seal/save-key /etc/functions : some more uniformisation of TPM DUK verbiage

Browse Source
This commit is contained in:
Thierry Laurion 2023-09-02 04:17:50 -04:00
parent 51b1ad39c3
commit 8b0fc0f129
No known key found for this signature in database
GPG Key ID: E7B4A71658E36A93
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
initrd/bin/kexec-save-key
View File

@ -73,7 +73,7 @@ for dev in $key_devices; do
done done
kexec-seal-key $paramsdir || kexec-seal-key $paramsdir ||
die "Failed to save and generate key in TPM" die "Failed to save and generate TPM Disk Unlock Key"
if [ "$skip_sign" != "y" ]; then if [ "$skip_sign" != "y" ]; then
extparam= extparam=

4
initrd/bin/kexec-seal-key
View File

@ -61,7 +61,7 @@ if [ "$key_password" != "$key_password2" ]; then
fi fi
# Generate key file # Generate key file
echo "++++++ Generating new randomized 128 bytes key file that will be unsealed by TPM Disk Unlock Key passphrase" echo "++++++ Generating new randomized 128 bytes key file that will be sealed/unsealed by TPM Disk Unlock Key passphrase"
dd \ dd \
if=/dev/urandom \ if=/dev/urandom \
of="$KEY_FILE" \ of="$KEY_FILE" \
@ -85,7 +85,7 @@ for dev in $(cat "$KEY_DEVICES" | cut -d\ -f1); do
fi fi
else else
DEBUG "Slot 1 is not the only existing slot on $dev" DEBUG "Slot 1 is not the only existing slot on $dev"
DEBUG "$dev Slot 1 will be used to store LUKS Disk Unlock Key that will be sealed into TPM next" DEBUG "$dev Slot 1 will be used to store LUKS Disk Unlock Key that TPM will seal/unseal with TPM Disk Unlock Key passphrase"
fi fi
done done

2
initrd/etc/functions
View File

@ -96,7 +96,7 @@ reseal_tpm_disk_decryption_key() {
fi fi
if [ -s /boot/kexec_key_devices.txt ] || [ -s /boot/kexec_key_lvm.txt ]; then if [ -s /boot/kexec_key_devices.txt ] || [ -s /boot/kexec_key_lvm.txt ]; then
warn "A TPM Disk Unlock Key previously sealed is now invalid since firmware measurements cannot be unsealed" warn "A TPM Disk Unlock Key previously sealed is now invalid since firmware measurements could not unseal TOTP"
echo "Renewing LUKS Disk Unlock Key to be unsealed by TPM Disk Unlock Key passphrase" echo "Renewing LUKS Disk Unlock Key to be unsealed by TPM Disk Unlock Key passphrase"
while ! kexec-seal-key /boot; do while ! kexec-seal-key /boot; do
warn "Recovery Disk Encryption key passphrase invalid. Try again!" warn "Recovery Disk Encryption key passphrase invalid. Try again!"