ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-24 07:06:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use luksHeaderBackup rather than luksDump to measure luks headers.

Browse Source
This commit is contained in:
HardenedVault 2022-01-19 07:07:03 +02:00 committed by tlaurion
parent fba79ab448
commit b4b0bc4a7a
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
initrd/bin/qubes-measure-luks
View File

@ -6,9 +6,13 @@ die() { echo >&2 "$@"; exit 1; }
# Measure the luks headers into PCR 6 # Measure the luks headers into PCR 6
for dev in "$@"; do for dev in "$@"; do
cryptsetup luksDump $dev \ cryptsetup luksHeaderBackup $dev \
|| die "$dev: Unable to measure" --header-backup-file /tmp/lukshdr-$(echo "$dev" | sed 's/\//_/g') \
done > /tmp/luksDump.txt || die "$dev: Unable to read luks header"
done
sha256sum /tmp/lukshdr-* > /tmp/luksDump.txt || die "Unable to hash luks headers"
rm /tmp/lukshdr-*
tpm extend -ix 6 -if /tmp/luksDump.txt \ tpm extend -ix 6 -if /tmp/luksDump.txt \
|| die "Unable to extend PCR" || die "Unable to extend PCR"