mirror of
https://github.com/linuxboot/heads.git
synced 2025-02-21 09:31:51 +00:00
Merge pull request #546 from kylerankin/add_gpg_sc_keygen
Add GPG smartcard keygen feature
This commit is contained in:
tlaurion
GitHub
commit
ca067385bd
@ -67,6 +67,100 @@ file_selector() {
|
|||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
gpg_flash_rom() {
|
||||||
|
cat "$PUBKEY" | gpg --import
|
||||||
|
#update /.gnupg/trustdb.gpg to ultimately trust all user provided public keys
|
||||||
|
gpg --list-keys --fingerprint --with-colons |sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' |gpg --import-ownertrust
|
||||||
|
gpg --update-trust
|
||||||
|
|
||||||
|
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.kbx"); then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.kbx"
|
||||||
|
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.gpg"); then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.gpg"
|
||||||
|
if [ -e /.gnupg/pubring.gpg ];then
|
||||||
|
rm /.gnupg/pubring.gpg
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
#to be compatible with gpgv1
|
||||||
|
if [ -e /.gnupg/pubring.kbx ];then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.kbx" -f /.gnupg/pubring.kbx
|
||||||
|
if [ -e /.gnupg/pubring.gpg ];then
|
||||||
|
rm /.gnupg/pubring.gpg
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -e /.gnupg/pubring.gpg ];then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.gpg" -f /.gnupg/pubring.gpg
|
||||||
|
fi
|
||||||
|
|
||||||
|
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/trustdb.gpg") then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/trustdb.gpg"
|
||||||
|
fi
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/trustdb.gpg" -f /.gnupg/trustdb.gpg
|
||||||
|
|
||||||
|
#Remove old method owner trust exported file
|
||||||
|
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/otrust.txt") then
|
||||||
|
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/otrust.txt"
|
||||||
|
fi
|
||||||
|
|
||||||
|
/bin/flash.sh /tmp/gpg-gui.rom
|
||||||
|
whiptail --title 'BIOS Flashed Successfully' \
|
||||||
|
--msgbox "BIOS flashed successfully.\n\nIf your keys have changed, be sure to re-sign all files in /boot\nafter you reboot.\n\nPress Enter to reboot" 16 60
|
||||||
|
/bin/reboot
|
||||||
|
}
|
||||||
|
gpg_post_gen_mgmt() {
|
||||||
|
GPG_GEN_KEY=`grep -A1 pub /tmp/gpg_card_edit_output | tail -n1 | sed -nr 's/^([ ])*//p'`
|
||||||
|
gpg --export --armor $GPG_GEN_KEY > "/tmp/${GPG_GEN_KEY}.asc"
|
||||||
|
if (whiptail --title 'Add Public Key to USB disk?' \
|
||||||
|
--yesno "Would you like to copy the GPG public key you generated to a USB disk?\n\nOtherwise you will not be able to copy it outside of Heads later\n\nThe file will show up as ${GPG_GEN_KEY}.asc" 16 90) then
|
||||||
|
mount_usb
|
||||||
|
mount -o remount,rw /media
|
||||||
|
cp "/tmp/${GPG_GEN_KEY}.asc" "/media/${GPG_GEN_KEY}.asc"
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
whiptail --title "The GPG Key Copied Successfully" \
|
||||||
|
--msgbox "${GPG_GEN_KEY}.asc copied successfully." 16 60
|
||||||
|
else
|
||||||
|
whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Copy Failed' \
|
||||||
|
--msgbox "Unable to copy ${GPG_GEN_KEY}.asc to /media" 16 60
|
||||||
|
fi
|
||||||
|
umount /media
|
||||||
|
fi
|
||||||
|
if (whiptail --title 'Add Public Key to Running BIOS?' \
|
||||||
|
--yesno "Would you like to add the GPG public key you generated to the BIOS?\n\nThis makes it a trusted key used to sign files in /boot\n\n" 16 90) then
|
||||||
|
/bin/flash.sh -r /tmp/gpg-gui.rom
|
||||||
|
if [ ! -s /tmp/gpg-gui.rom ]; then
|
||||||
|
whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: BIOS Read Failed!' \
|
||||||
|
--msgbox "Unable to read BIOS" 16 60
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
PUBKEY="/tmp/${GPG_GEN_KEY}.asc"
|
||||||
|
gpg_flash_rom
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
gpg_sc_oem_reset() {
|
||||||
|
GPG_KEY_NAME=`date +%Y%m%d%H%M%S`
|
||||||
|
# Factory reset GPG card
|
||||||
|
{
|
||||||
|
echo admin
|
||||||
|
echo factory-reset
|
||||||
|
echo y
|
||||||
|
echo yes
|
||||||
|
} | gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit > /tmp/gpg_card_edit_output || return 1
|
||||||
|
# Generate OEM GPG keys
|
||||||
|
{
|
||||||
|
echo admin
|
||||||
|
echo generate
|
||||||
|
echo n
|
||||||
|
echo 12345678
|
||||||
|
echo 123456
|
||||||
|
echo 0
|
||||||
|
echo y
|
||||||
|
echo "OEM Key"
|
||||||
|
echo "oem-${GPG_KEY_NAME}@example.com"
|
||||||
|
echo "OEM-generated key"
|
||||||
|
} | gpg --command-fd=0 --status-fd=2 --pinentry-mode=loopback --card-edit > /tmp/gpg_card_edit_output || return 2
|
||||||
|
}
|
||||||
|
|
||||||
while true; do
|
while true; do
|
||||||
unset menu_choice
|
unset menu_choice
|
||||||
@ -75,7 +169,8 @@ while true; do
|
|||||||
'r' ' Add GPG key to running BIOS + reflash' \
|
'r' ' Add GPG key to running BIOS + reflash' \
|
||||||
'a' ' Add GPG key to standalone BIOS image + flash' \
|
'a' ' Add GPG key to standalone BIOS image + flash' \
|
||||||
'l' ' List GPG keys in your keyring' \
|
'l' ' List GPG keys in your keyring' \
|
||||||
'g' ' Generate GPG keys on a USB security token' \
|
'g' ' Generate GPG keys manually on a USB security token' \
|
||||||
|
'o' ' OEM Factory reset + auto keygen USB security token' \
|
||||||
'x' ' Exit' \
|
'x' ' Exit' \
|
||||||
2>/tmp/whiptail || recovery "GUI menu failed"
|
2>/tmp/whiptail || recovery "GUI menu failed"
|
||||||
|
|
||||||
@ -106,51 +201,11 @@ while true; do
|
|||||||
else
|
else
|
||||||
ROM=$FILE
|
ROM=$FILE
|
||||||
fi
|
fi
|
||||||
|
|
||||||
cat "$PUBKEY" | gpg --import
|
|
||||||
#update /.gnupg/trustdb.gpg to ultimately trust all user provided public keys
|
|
||||||
gpg --list-keys --fingerprint --with-colons |sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' |gpg --import-ownertrust
|
|
||||||
gpg --update-trust
|
|
||||||
|
|
||||||
cp "$ROM" /tmp/gpg-gui.rom
|
cp "$ROM" /tmp/gpg-gui.rom
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.kbx"); then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.kbx"
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.gpg"); then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.gpg"
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
rm /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
#to be compatible with gpgv1
|
|
||||||
if [ -e /.gnupg/pubring.kbx ];then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.kbx" -f /.gnupg/pubring.kbx
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
rm /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.gpg" -f /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/trustdb.gpg") then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/trustdb.gpg"
|
|
||||||
fi
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/trustdb.gpg" -f /.gnupg/trustdb.gpg
|
|
||||||
|
|
||||||
#Remove old method owner trust exported file
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/otrust.txt") then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/otrust.txt"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if (whiptail --title 'Flash ROM?' \
|
if (whiptail --title 'Flash ROM?' \
|
||||||
--yesno "This will replace your old ROM with $ROM\n\nDo you want to proceed?" 16 90) then
|
--yesno "This will replace your old ROM with $ROM\n\nDo you want to proceed?" 16 90) then
|
||||||
/bin/flash.sh /tmp/gpg-gui.rom
|
gpg_flash_rom
|
||||||
whiptail --title 'ROM Flashed Successfully' \
|
|
||||||
--msgbox "$ROM flashed successfully.\n\nIf your keys have changed, be sure to re-sign all files in /boot\nafter you reboot.\n\nPress Enter to reboot" 16 60
|
|
||||||
umount /media
|
|
||||||
/bin/reboot
|
|
||||||
else
|
else
|
||||||
exit 0
|
exit 0
|
||||||
fi
|
fi
|
||||||
@ -174,49 +229,9 @@ while true; do
|
|||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
cat "$PUBKEY" | gpg --import
|
|
||||||
#update /.gnupg/trustdb.gpg to ultimately trust all user provided public keys
|
|
||||||
gpg --list-keys --fingerprint --with-colons |sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' |gpg --import-ownertrust
|
|
||||||
gpg --update-trust
|
|
||||||
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.kbx"); then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.kbx"
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/pubring.gpg"); then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/pubring.gpg"
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
rm /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
#to be compatible with gpgv1
|
|
||||||
if [ -e /.gnupg/pubring.kbx ];then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.kbx" -f /.gnupg/pubring.kbx
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
rm /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [ -e /.gnupg/pubring.gpg ];then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/pubring.gpg" -f /.gnupg/pubring.gpg
|
|
||||||
fi
|
|
||||||
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/trustdb.gpg") then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/trustdb.gpg"
|
|
||||||
fi
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -a "heads/initrd/.gnupg/trustdb.gpg" -f /.gnupg/trustdb.gpg
|
|
||||||
|
|
||||||
#Remove old method owner trust exported file
|
|
||||||
if (cbfs -o /tmp/gpg-gui.rom -l | grep -q "heads/initrd/.gnupg/otrust.txt") then
|
|
||||||
cbfs -o /tmp/gpg-gui.rom -d "heads/initrd/.gnupg/otrust.txt"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if (whiptail --title 'Update ROM?' \
|
if (whiptail --title 'Update ROM?' \
|
||||||
--yesno "This will reflash your BIOS with the updated version\n\nDo you want to proceed?" 16 90) then
|
--yesno "This will reflash your BIOS with the updated version\n\nDo you want to proceed?" 16 90) then
|
||||||
/bin/flash.sh /tmp/gpg-gui.rom
|
gpg_flash_rom
|
||||||
whiptail --title 'BIOS Updated Successfully' \
|
|
||||||
--msgbox "BIOS updated successfully.\n\nIf your keys have changed, be sure to re-sign all files in /boot\nafter you reboot.\n\nPress Enter to reboot" 16 60
|
|
||||||
umount /media
|
|
||||||
/bin/reboot
|
|
||||||
else
|
else
|
||||||
exit 0
|
exit 0
|
||||||
fi
|
fi
|
||||||
@ -230,13 +245,36 @@ while true; do
|
|||||||
;;
|
;;
|
||||||
"g" )
|
"g" )
|
||||||
confirm_gpg_card
|
confirm_gpg_card
|
||||||
|
echo -e "\n\n\n\n"
|
||||||
echo "********************************************************************************"
|
echo "********************************************************************************"
|
||||||
echo "*"
|
echo "*"
|
||||||
echo "* INSTRUCTIONS:"
|
echo "* INSTRUCTIONS:"
|
||||||
echo "* Type 'admin' and then 'generate' and follow the prompts to generate a GPG key."
|
echo "* Type 'admin' and then 'generate' and follow the prompts to generate a GPG key."
|
||||||
|
echo "* Type 'quit' once you have generated the key to exit GPG."
|
||||||
echo "*"
|
echo "*"
|
||||||
echo "********************************************************************************"
|
echo "********************************************************************************"
|
||||||
gpg --card-edit
|
gpg --card-edit > /tmp/gpg_card_edit_output
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
gpg_post_gen_mgmt
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
"o" )
|
||||||
|
if (whiptail $CONFIG_WARNING_BG_COLOR --title 'WARNING: Factory Reset USB Security Token?' \
|
||||||
|
--yesno "This will perform a FACTORY RESET of the USB security token!\n\nThis will:\n* Reset all security token passwords to default\n* Erase any keys on the security token\n* Generate new automated GPG keys on the token\n\nAny data now on the USB security token will be LOST!\n\nDo you want to proceed?" 16 120) then
|
||||||
|
confirm_gpg_card
|
||||||
|
gpg_sc_oem_reset
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
gpg_post_gen_mgmt
|
||||||
|
elif [ $? -eq 1 ]; then
|
||||||
|
GPG_OUTPUT=`cat /tmp/gpg_card_edit_output`
|
||||||
|
whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Factory Reset Failed!' \
|
||||||
|
--msgbox "Factory Reset Failed!\n\n$GPG_OUTPUT" 16 120
|
||||||
|
elif [ $? -eq 2 ]; then
|
||||||
|
GPG_OUTPUT=`cat /tmp/gpg_card_edit_output`
|
||||||
|
whiptail $CONFIG_ERROR_BG_COLOR --title 'ERROR: Automatic Keygen Failed!' \
|
||||||
|
--msgbox "Automatic Keygen Failed!\n\n$GPG_OUTPUT" 16 120
|
||||||
|
fi
|
||||||
|
fi
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user