ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-01-18 10:46:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

check PGP signatures on xen, kernel and initrd (partial fix for #43)

Browse Source
This commit is contained in:
Trammell Hudson 2016-11-03 16:45:50 -04:00
parent b818986cb2
commit 9fb998bef0
Failed to extract signature
1 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
initrd/start-xen
View File

@ -1,9 +1,30 @@
#!/bin/sh
mount -o ro -t ext4 /dev/sda1 /boot
exec kexec \
die() { echo >&2 "$*"; exit 1; }
XEN=/boot/xen-4.6.3.gz
INITRD=/boot/initramfs-4.4.14-11.pvops.qubes.x86_64.img
KERNEL=/boot/vmlinuz-4.4.14-11.pvops.qubes.x86_64
echo "+++ Checking $XEN"
gpgv "${XEN}.asc" "${XEN}" || die "Xen signature failed"
echo "+++ Checking $INITRD"
gpgv "${INITRD}.asc" "${INITRD}" || die "Initrd signature failed"
echo "+++ Checking $KERNEL"
gpgv "${KERNEL}.asc" "${KERNEL}" || die "Kernel signature failed"
# should also check xen command line arguments!
# should also check kernel command line arguments!
kexec \
-l \
--module "/boot/vmlinuz-4.1.13-9.pvops.qubes.x86_64 placeholder root=/dev/mapper/qubes_dom0-root ro i915.preliminary_hw_support=1 rd.lvm.lv=qubes_dom0/root rd.luks.uuid=luks-0f662ac6-2939-48fe-bc95-f5a7e3d6fefb vconsole.font=latarcyrheb-sun16 rd.lvm.lv=qubes_dom0/swap rhgb" \
--module "/boot/initramfs-4.1.13-9.pvops.qubes.x86_64.img" \
--module "${KERNEL} root=LABEL=root rhgb" \
--module "${INITRD}" \
--command-line "no-real-mode reboot=no console=vga dom0_mem=min:1024M dom0_mem=max:4096M" \
/boot/xen-4.6.3.gz
"${XEN}"
echo "Ready to start Xen: run 'kexec -e' to execute it"