mirror of
https://github.com/linuxboot/heads.git
synced 2025-04-06 19:06:49 +00:00
Added rollback protection to generic boot
Changed the checking of required hashes or required rollback state to be right before boot, allowing the user to sign/set defaults in interactive mode. Also cleaned up usages of recovery and fixed iso parameter regression.
This commit is contained in:
Francis Lam
parent
8004b5df2a
commit
d67360a24b
@ -21,5 +21,6 @@ CONFIG_LINUX_E1000E=y
|
||||
CONFIG_BOOTSCRIPT=/bin/local-init
|
||||
|
||||
CONFIG_BOOT_REQ_HASH=n
|
||||
CONFIG_BOOT_REQ_ROLLBACK=n
|
||||
CONFIG_BOOT_DEV="/dev/sda1"
|
||||
CONFIG_USB_BOOT_DEV="/dev/sdb1"
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Check for valid kexec params and copy to tmp
|
||||
. /etc/functions
|
||||
|
||||
MEDIA="$1"
|
||||
if [ ! -d /tmp/kexec ]; then
|
||||
mkdir /tmp/kexec \
|
||||
|| recovery 'failed to make kexec tmp dir'
|
||||
else
|
||||
rm -rf /tmp/kexec/* \
|
||||
|| recovert 'failed to empty kexec tmp dir'
|
||||
fi
|
||||
|
||||
if [ ! -r $MEDIA/kexec.sig ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ `find $MEDIA/kexec*.txt | wc -l` -eq 0 ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if sha256sum `find $MEDIA/kexec*.txt` | gpg --verify $MEDIA/kexec.sig - ; then
|
||||
echo "+++ Found verified kexec boot params"
|
||||
cp $MEDIA/kexec*.txt /tmp/kexec
|
||||
fi
|
||||
@ -16,16 +16,19 @@ if ! [ -r "$ISOSIG" ]; then
|
||||
fi
|
||||
|
||||
gpgv "$ISOSIG" "$MOUNTED_ISO_PATH" \
|
||||
|| recovery 'ISO signature failed'
|
||||
|| die 'ISO signature failed'
|
||||
|
||||
echo '+++ Mounting ISO and booting'
|
||||
mount -t iso9660 -o loop $MOUNTED_ISO_PATH /boot \
|
||||
|| recovery '$MOUNTED_ISO_PATH: Unable to mount /boot'
|
||||
|| die '$MOUNTED_ISO_PATH: Unable to mount /boot'
|
||||
|
||||
DEV_UUID=`blkid $DEV | tail -1 | tr " " "\n" | grep UUID | cut -d\" -f2`
|
||||
ADD="fromiso=/dev/disk/by-uuid/$DEV_UUID/$ISO_PATH"
|
||||
REMOVE=""
|
||||
|
||||
paramsdir="/media/kexec_iso/$ISO_PATH/"
|
||||
check_config $paramsdir
|
||||
|
||||
ADD_FILE=/tmp/kexec/kexec_iso_add.txt
|
||||
if [ -r $ADD_FILE ]; then
|
||||
NEW_ADD=`cat $ADD_FILE`
|
||||
@ -40,4 +43,7 @@ if [ -r $REMOVE_FILE ]; then
|
||||
fi
|
||||
|
||||
# Call kexec and indicate that hashes have been verified
|
||||
kexec-select-boot -b /boot/ -d /media/ -p "/media/kexec_iso/$ISO_PATH/" -a "$ADD" -r "$REMOVE" -c "*.cfg" -u -h
|
||||
kexec-select-boot -b /boot/ -d /media/ -p "$paramsdir" \
|
||||
-a "$ADD" -r "$REMOVE" -c "*.cfg" -u -i
|
||||
|
||||
die "Something failed in selecting boot"
|
||||
|
||||
@ -7,13 +7,12 @@ while getopts "b:d:p:e:i:" arg; do
|
||||
b) bootdir="$OPTARG" ;;
|
||||
d) paramsdev="$OPTARG" ;;
|
||||
p) paramsdir="$OPTARG" ;;
|
||||
e) entry="$OPTARG" ;;
|
||||
i) index="$OPTARG" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$bootdir" -o -z "$entry" -o -z "$index" ]; then
|
||||
die "Usage: $0 -b /boot/ -e \"boot params|...\" -i 1 "
|
||||
if [ -z "$bootdir" -o -z "$index" ]; then
|
||||
die "Usage: $0 -b /boot/ -i menu_option "
|
||||
fi
|
||||
|
||||
if [ -z "$paramsdev" ]; then
|
||||
@ -24,14 +23,25 @@ if [ -z "$paramsdir" ]; then
|
||||
paramsdir="$bootdir"
|
||||
fi
|
||||
|
||||
TMP_MENU_FILE="/tmp/kexec/kexec_menu.txt"
|
||||
ENTRY_FILE="$paramsdir/kexec_default.$index.txt"
|
||||
HASH_FILE="$paramsdir/kexec_default_hashes.txt"
|
||||
|
||||
if [ ! -r "$TMP_MENU_FILE" ]; then
|
||||
die "No menu options available, please run kexec-select-boot"
|
||||
fi
|
||||
|
||||
entry=`head -n $index $TMP_MENU_FILE | tail -1`
|
||||
if [ -z "$entry" ]; then
|
||||
die "Invalid menu index $index"
|
||||
fi
|
||||
|
||||
# try to switch to rw mode
|
||||
mount -o rw,remount $paramsdev
|
||||
|
||||
if [ ! -d $paramsdir ]; then
|
||||
mkdir -p $paramsdir
|
||||
mkdir -p $paramsdir \
|
||||
|| die "Failed to create params directory"
|
||||
fi
|
||||
rm "$paramsdir/kexec_default.*.txt" 2>/dev/null
|
||||
echo "$entry" > $ENTRY_FILE
|
||||
@ -40,9 +50,9 @@ if [ ! -r $ENTRY_FILE -o ! -r $HASH_FILE ]; then
|
||||
die "Failed to write default config"
|
||||
fi
|
||||
|
||||
if ! kexec-sign-config $paramsdir; then
|
||||
die "Failed to sign default config"
|
||||
fi
|
||||
# sign and auto-roll config counter
|
||||
kexec-sign-config -p $paramsdir -u \
|
||||
|| die "Failed to sign default config"
|
||||
|
||||
# switch back to ro mode
|
||||
mount -o ro,remount $paramsdev
|
||||
|
||||
@ -1,4 +1,6 @@
|
||||
#!/bin/sh
|
||||
# Generic configurable boot script via kexec
|
||||
set -o pipefail
|
||||
. /etc/config
|
||||
. /etc/functions
|
||||
|
||||
@ -6,8 +8,10 @@ add=""
|
||||
remove=""
|
||||
config="*.cfg"
|
||||
unique="n"
|
||||
hashed="n"
|
||||
while getopts "b:d:p:a:r:c:uh" arg; do
|
||||
valid_hash="n"
|
||||
valid_global_hash="n"
|
||||
valid_rollback="n"
|
||||
while getopts "b:d:p:a:r:c:ui" arg; do
|
||||
case $arg in
|
||||
b) bootdir="$OPTARG" ;;
|
||||
d) paramsdev="$OPTARG" ;;
|
||||
@ -16,7 +20,7 @@ while getopts "b:d:p:a:r:c:uh" arg; do
|
||||
r) remove="$OPTARG" ;;
|
||||
c) config="$OPTARG" ;;
|
||||
u) unique="y" ;;
|
||||
h) hashed="y" ;;
|
||||
i) valid_hash="y"; valid_rollback="y" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
@ -32,11 +36,40 @@ if [ -z "$paramsdir" ]; then
|
||||
paramsdir="$bootdir"
|
||||
fi
|
||||
|
||||
verify_global_hashes()
|
||||
{
|
||||
echo "+++ Checking verified boot hash file "
|
||||
# Check the hashes of all the files
|
||||
if cd $bootdir && sha256sum -c "$TMP_HASH_FILE" ; then
|
||||
echo "+++ Verified boot hashes "
|
||||
valid_hash='y'
|
||||
valid_global_hash='y'
|
||||
else
|
||||
die "$TMP_HASH_FILE: boot hash mismatch"
|
||||
fi
|
||||
}
|
||||
|
||||
verify_rollback_counter()
|
||||
{
|
||||
TPM_COUNTER=`grep counter $TMP_ROLLBACK_FILE | cut -d- -f2`
|
||||
if [ -z "$TPM_COUNTER" ]; then
|
||||
die "$TMP_ROLLBACK_FILE: TPM counter not found?"
|
||||
fi
|
||||
|
||||
read_tpm_counter $TPM_COUNTER \
|
||||
|| die "Failed to read TPM counter"
|
||||
|
||||
sha256sum -c $TMP_ROLLBACK_FILE \
|
||||
|| die "Invalid TPM counter state"
|
||||
|
||||
valid_rollback="y"
|
||||
}
|
||||
|
||||
first_menu="y"
|
||||
get_menu_option() {
|
||||
num_options=`cat $TMP_MENU_FILE | wc -l`
|
||||
if [ $num_options -eq 0 ]; then
|
||||
recovery "No boot options"
|
||||
die "No boot options"
|
||||
fi
|
||||
|
||||
if [ $num_options -eq 1 -a $first_menu = "y" ]; then
|
||||
@ -56,7 +89,7 @@ get_menu_option() {
|
||||
option_index
|
||||
|
||||
if [ "$option_index" = "a" ]; then
|
||||
recovery "Aborting boot attempt"
|
||||
die "Aborting boot attempt"
|
||||
fi
|
||||
fi
|
||||
first_menu="n"
|
||||
@ -89,7 +122,7 @@ scan_options() {
|
||||
kexec-parse-boot $i >> $option_file
|
||||
done
|
||||
if [ ! -r $option_file ]; then
|
||||
recovery "Failed to parse any boot options"
|
||||
die "Failed to parse any boot options"
|
||||
fi
|
||||
if [ "$unique" = 'y' ]; then
|
||||
sort $option_file | uniq > $TMP_MENU_FILE
|
||||
@ -98,6 +131,32 @@ scan_options() {
|
||||
fi
|
||||
}
|
||||
|
||||
save_default_option() {
|
||||
read \
|
||||
-n 1 \
|
||||
-p "Saving a default will modify the disk. Proceed? (y/n): " \
|
||||
default_confirm
|
||||
echo
|
||||
|
||||
if [ "$default_confirm" = "y" ]; then
|
||||
if kexec-save-default \
|
||||
-b "$bootdir" \
|
||||
-d "$paramsdev" \
|
||||
-p "$paramsdir" \
|
||||
-i "$option_index" \
|
||||
; then
|
||||
echo "+++ Saved defaults to device"
|
||||
sleep 2
|
||||
default_failed="n"
|
||||
return
|
||||
else
|
||||
echo "Failed to save defaults"
|
||||
fi
|
||||
fi
|
||||
|
||||
option_confirm="n"
|
||||
}
|
||||
|
||||
default_select() {
|
||||
# Attempt boot with expected parameters
|
||||
|
||||
@ -108,7 +167,9 @@ default_select() {
|
||||
expectedoption=`cat $TMP_DEFAULT_FILE`
|
||||
option=`head -n $default_index $TMP_MENU_FILE | tail -1`
|
||||
if [ "$option" != "$expectedoption" ]; then
|
||||
recovery "Boot entry has changed: expected $expectedoption, found $option"
|
||||
warn "!!! Boot entry has changed - please set a new default"
|
||||
sleep 5
|
||||
return
|
||||
fi
|
||||
parse_option
|
||||
|
||||
@ -117,30 +178,19 @@ default_select() {
|
||||
# Check the hashes of all the files
|
||||
if cd $bootdir && sha256sum -c "$TMP_DEFAULT_HASH_FILE" ; then
|
||||
echo "+++ Verified default boot hashes "
|
||||
valid_hash='y'
|
||||
else
|
||||
recovery "$TMP_DEFAULT_HASH_FILE: default boot hash mismatch"
|
||||
die "$TMP_DEFAULT_HASH_FILE: default boot hash mismatch"
|
||||
fi
|
||||
|
||||
echo "+++ Executing default boot for $name:"
|
||||
kexec-boot -b "$bootdir" -e "$option" -a "$add" -r "$remove"
|
||||
recovery "Something failed"
|
||||
do_boot
|
||||
warn "Failed to boot default option"
|
||||
}
|
||||
|
||||
user_select() {
|
||||
# No default expected boot parameters, ask user
|
||||
|
||||
# Optionally enforce device file hashes
|
||||
if [ -r $TMP_HASH_FILE ]; then
|
||||
echo "+++ Checking verified boot hash file "
|
||||
# Check the hashes of all the files
|
||||
if cd $bootdir && sha256sum -c "$TMP_HASH_FILE" ; then
|
||||
echo "+++ Verified boot hashes "
|
||||
hashed='y'
|
||||
else
|
||||
recovery "$TMP_HASH_FILE: boot hash mismatch"
|
||||
fi
|
||||
fi
|
||||
|
||||
option_confirm=""
|
||||
while [ "$option_confirm" != "y" -a "$option_confirm" != "d" ]
|
||||
do
|
||||
@ -148,12 +198,7 @@ user_select() {
|
||||
confirm_menu_option
|
||||
|
||||
if [ "$option_confirm" = 'd' ]; then
|
||||
if ! kexec-save-default -b "$bootdir" -d "$paramsdev" -p "$paramsdir" -e "$option" -i "$option_index"; then
|
||||
echo "!!!!!! Failed to save defaults"
|
||||
else
|
||||
echo "+++ Saved defaults to device"
|
||||
sleep 2
|
||||
fi
|
||||
save_default_option
|
||||
fi
|
||||
done
|
||||
|
||||
@ -162,31 +207,66 @@ user_select() {
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ "$CONFIG_BOOT_REQ_HASH" = "y" -a "$hashed" = "n" ]; then
|
||||
recovery "!!!!!! Missing required boot hashes"
|
||||
do_boot
|
||||
}
|
||||
|
||||
do_boot()
|
||||
{
|
||||
if [ "$CONFIG_BOOT_REQ_ROLLBACK" = "y" -a "$valid_rollback" = "n" ]; then
|
||||
warn "!!! Missing required rollback counter state"
|
||||
return
|
||||
fi
|
||||
|
||||
if [ "$CONFIG_BOOT_REQ_HASH" = "y" -a "$valid_hash" = "n" ]; then
|
||||
warn "!!! Missing required boot hashes"
|
||||
return
|
||||
fi
|
||||
|
||||
kexec-boot -b "$bootdir" -e "$option" -a "$add" -r "$remove"
|
||||
recovery "Something failed"
|
||||
die "!!! Failed to boot w/ options: $option"
|
||||
}
|
||||
|
||||
while true; do
|
||||
kexec-check-config $paramsdir
|
||||
check_config $paramsdir
|
||||
|
||||
TMP_MENU_FILE="/tmp/kexec/kexec_menu.txt"
|
||||
TMP_HASH_FILE="/tmp/kexec/kexec_hashes.txt"
|
||||
TMP_DEFAULT_FILE=`find /tmp/kexec/kexec_default.*.txt 2>/dev/null | head -1`
|
||||
TMP_DEFAULT_HASH_FILE="/tmp/kexec/kexec_default_hashes.txt"
|
||||
TMP_ROLLBACK_FILE="/tmp/kexec/kexec_rollback.txt"
|
||||
|
||||
# if no saved options, scan the boot directory and generate
|
||||
if [ ! -r $TMP_MENU_FILE ]; then
|
||||
if [ ! -r "$TMP_MENU_FILE" ]; then
|
||||
scan_options
|
||||
fi
|
||||
|
||||
if [ -r "$TMP_DEFAULT_FILE" -a -r "$TMP_DEFAULT_HASH_FILE" ]; then
|
||||
# Optionally enforce device file hashes
|
||||
if [ -r "$TMP_HASH_FILE" ]; then
|
||||
valid_global_hash="n"
|
||||
|
||||
verify_global_hashes
|
||||
|
||||
if [ "$valid_global_hash" = "n" ]; then
|
||||
die "Failed to verify global hashes"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -r "$TMP_ROLLBACK_FILE" ]; then
|
||||
# in the case of iso boot with a rollback file, do not assume valid
|
||||
valid_rollback="n"
|
||||
|
||||
verify_rollback_counter
|
||||
fi
|
||||
|
||||
if [ "$default_failed" != "y" \
|
||||
-a -r "$TMP_DEFAULT_FILE" \
|
||||
-a -r "$TMP_DEFAULT_HASH_FILE" ] \
|
||||
; then
|
||||
default_select
|
||||
default_failed="y"
|
||||
else
|
||||
user_select
|
||||
fi
|
||||
|
||||
recovery "Something failed again"
|
||||
done
|
||||
|
||||
die "!!! Shouldn't get here""
|
||||
|
||||
@ -2,24 +2,57 @@
|
||||
# Sign a valid directory of kexec params
|
||||
. /etc/functions
|
||||
|
||||
MEDIA="$1"
|
||||
rollback="n"
|
||||
update_counter="n"
|
||||
while getopts "p:c:u" arg; do
|
||||
case $arg in
|
||||
p) paramsdir="$OPTARG" ;;
|
||||
c) counter="$OPTARG"; rollback="y" ;;
|
||||
u) update_counter="y"; rollback="y" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "$MEDIA" ]; then
|
||||
die "Usage: $0 /boot "
|
||||
if [ -z "$paramsdir" ]; then
|
||||
die "Usage: $0 -p /boot/ [ -u | -c counter ]"
|
||||
fi
|
||||
|
||||
confirm_gpg_card
|
||||
|
||||
if [ "$rollback" = "y" ]; then
|
||||
rollback_file="$paramsdir/kexec_rollback.txt"
|
||||
|
||||
if [ -n "$counter" ]; then
|
||||
# use existing counter
|
||||
read_tpm_counter $counter \
|
||||
|| die "$paramsdir: Unable to read tpm counter '$counter'"
|
||||
else
|
||||
# increment counter
|
||||
check_tpm_counter $rollback_file \
|
||||
|| die "$paramsdir: Unable to find/create tpm counter"
|
||||
counter="$TPM_COUNTER"
|
||||
|
||||
increment_tpm_counter $counter \
|
||||
|| die "$paramsdir: Unable to increment tpm counter"
|
||||
fi
|
||||
|
||||
sha256sum /tmp/counter-$counter > $rollback_file \
|
||||
|| die "$paramsdir: Unable to create rollback file"
|
||||
fi
|
||||
|
||||
param_files=`find $paramsdir/kexec*.txt`
|
||||
if [ -z "$param_files" ]; then
|
||||
die "$paramsdir: No kexec parameter files to sign"
|
||||
fi
|
||||
|
||||
for tries in 1 2 3; do
|
||||
if sha256sum `find $MEDIA/kexec*.txt` | gpg \
|
||||
if sha256sum $param_files | gpg \
|
||||
--digest-algo SHA256 \
|
||||
--detach-sign \
|
||||
-a \
|
||||
> $MEDIA/kexec.sig \
|
||||
> $paramsdir/kexec.sig \
|
||||
; then
|
||||
exit 0
|
||||
fi
|
||||
done
|
||||
|
||||
warn "$MEDIA: Unable to sign boot hashes"
|
||||
exit 1
|
||||
die "$paramsdir: Unable to sign kexec hashes"
|
||||
|
||||
@ -19,10 +19,10 @@ fi
|
||||
# Mount local disk
|
||||
if ! grep -q /boot /proc/mounts ; then
|
||||
mount -o ro "$CONFIG_BOOT_DEV" /boot \
|
||||
|| recovery '$CONFIG_BOOT_DEV: Unable to mount /boot'
|
||||
|| recovery "$CONFIG_BOOT_DEV: Unable to mount /boot"
|
||||
fi
|
||||
|
||||
# Attempt to pull verified config from device
|
||||
kexec-select-boot -b /boot/ -c "grub.cfg"
|
||||
|
||||
recovery "Something failed..."
|
||||
recovery "Something failed during boot"
|
||||
|
||||
@ -36,7 +36,7 @@ if [ -z "$TPM_COUNTER" ]; then
|
||||
recovery "$BOOT_HASHES: TPM counter not found?"
|
||||
fi
|
||||
|
||||
tpm counter_read -ix "$TPM_COUNTER" | tee "/tmp/counter-$TPM_COUNTER"
|
||||
read_tpm_counter $TPM_COUNTER
|
||||
|
||||
# Check the hashes of all the files
|
||||
sha256sum -c "$BOOT_HASHES" \
|
||||
|
||||
@ -14,33 +14,12 @@ fi
|
||||
|
||||
confirm_gpg_card
|
||||
|
||||
# if the /boot.hashes file already exists, read the TPM counter ID
|
||||
# from it.
|
||||
if [ -r "$BOOT_HASHES" ]; then
|
||||
TPM_COUNTER=`grep counter- "$BOOT_HASHES" | cut -d- -f2`
|
||||
else
|
||||
warn "$BOOT_HASHES does not exist; creating new TPM counter"
|
||||
read -s -p "TPM Owner password: " tpm_password
|
||||
echo
|
||||
tpm counter_create \
|
||||
-pwdo "$tpm_password" \
|
||||
-pwdc '' \
|
||||
-la 3135106223 \
|
||||
| tee /tmp/counter \
|
||||
|| die "Unable to create TPM counter"
|
||||
TPM_COUNTER=`cut -d: -f1 < /tmp/counter`
|
||||
fi
|
||||
|
||||
if [ -z "$TPM_COUNTER" ]; then
|
||||
die "$BOOT_HASHES: TPM Counter not found?"
|
||||
fi
|
||||
check_tpm_counter $BOOT_HASHES
|
||||
|
||||
mount -o rw,remount /boot \
|
||||
|| die "Could not remount /boot"
|
||||
|
||||
tpm counter_increment -ix "$TPM_COUNTER" -pwdc '' \
|
||||
| tee /tmp/counter-$TPM_COUNTER \
|
||||
|| die "Counter increment failed"
|
||||
increment_tpm_counter $TPM_COUNTER
|
||||
|
||||
sha256sum \
|
||||
"$XEN" \
|
||||
|
||||
@ -17,4 +17,4 @@ if [ ! "$totp_confirm" = "y" ]; then
|
||||
fi
|
||||
|
||||
usb-scan
|
||||
recovery "Something failed..."
|
||||
recovery "Something failed during USB boot"
|
||||
|
||||
@ -7,13 +7,13 @@
|
||||
# Unmount any previous boot device
|
||||
if grep -q /boot /proc/mounts ; then
|
||||
umount /boot \
|
||||
|| recovery '$CONFIG_USB_BOOT_DEV: Unable to unmount /boot'
|
||||
|| die '$CONFIG_USB_BOOT_DEV: Unable to unmount /boot'
|
||||
fi
|
||||
|
||||
# Mount the USB boot device
|
||||
if ! grep -q /media /proc/mounts ; then
|
||||
mount-usb "$CONFIG_USB_BOOT_DEV" \
|
||||
|| recovery '$CONFIG_USB_BOOT_DEV: Unable to mount /media'
|
||||
|| die '$CONFIG_USB_BOOT_DEV: Unable to mount /media'
|
||||
fi
|
||||
|
||||
# Check for ISO first
|
||||
@ -31,7 +31,7 @@ get_menu_option() {
|
||||
option_index
|
||||
|
||||
if [ "$option_index" = "a" ]; then
|
||||
recovery "Aborting boot attempt"
|
||||
die "Aborting boot attempt"
|
||||
fi
|
||||
|
||||
if [ "$option_index" = "s" ]; then
|
||||
@ -56,7 +56,7 @@ if [ `cat /tmp/iso_menu.txt | wc -l` -gt 0 ]; then
|
||||
ISO=${option:7} # remove /media/ to get device relative path
|
||||
kexec-iso-init $MOUNTED_ISO $ISO $CONFIG_USB_BOOT_DEV
|
||||
|
||||
recovery "Something failed..."
|
||||
die "Something failed in iso init"
|
||||
fi
|
||||
fi
|
||||
|
||||
@ -64,4 +64,4 @@ echo "!!! Could not find any ISO, trying bootable USB"
|
||||
# Attempt to pull verified config from device
|
||||
kexec-select-boot -b /media/ -c "*.cfg" -u
|
||||
|
||||
recovery "Something failed..."
|
||||
die "Something failed in selecting boot"
|
||||
|
||||
@ -88,3 +88,67 @@ confirm_gpg_card()
|
||||
gpg --card-status \
|
||||
|| die "gpg card read failed"
|
||||
}
|
||||
|
||||
|
||||
check_tpm_counter()
|
||||
{
|
||||
# if the /boot.hashes file already exists, read the TPM counter ID
|
||||
# from it.
|
||||
if [ -r "$1" ]; then
|
||||
TPM_COUNTER=`grep counter- "$1" | cut -d- -f2`
|
||||
else
|
||||
warn "$BOOT_HASHES does not exist; creating new TPM counter"
|
||||
read -s -p "TPM Owner password: " tpm_password
|
||||
echo
|
||||
tpm counter_create \
|
||||
-pwdo "$tpm_password" \
|
||||
-pwdc '' \
|
||||
-la 3135106223 \
|
||||
| tee /tmp/counter \
|
||||
|| die "Unable to create TPM counter"
|
||||
TPM_COUNTER=`cut -d: -f1 < /tmp/counter`
|
||||
fi
|
||||
|
||||
if [ -z "$TPM_COUNTER" ]; then
|
||||
die "$1: TPM Counter not found?"
|
||||
fi
|
||||
}
|
||||
|
||||
read_tpm_counter()
|
||||
{
|
||||
tpm counter_read -ix "$1" | tee "/tmp/counter-$1" \
|
||||
|| die "Counter read failed"
|
||||
}
|
||||
|
||||
increment_tpm_counter()
|
||||
{
|
||||
tpm counter_increment -ix "$1" -pwdc '' \
|
||||
| tee /tmp/counter-$1 \
|
||||
|| die "Counter increment failed"
|
||||
}
|
||||
|
||||
check_config() {
|
||||
if [ ! -d /tmp/kexec ]; then
|
||||
mkdir /tmp/kexec \
|
||||
|| die 'Failed to make kexec tmp dir'
|
||||
else
|
||||
rm -rf /tmp/kexec/* \
|
||||
|| die 'Failed to empty kexec tmp dir'
|
||||
fi
|
||||
|
||||
if [ ! -r $1/kexec.sig ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if [ `find $1/kexec*.txt | wc -l` -eq 0 ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
if ! sha256sum `find $1/kexec*.txt` | gpgv $1/kexec.sig - ; then
|
||||
die 'Invalid signature on kexec boot params'
|
||||
fi
|
||||
|
||||
echo "+++ Found verified kexec boot params"
|
||||
cp $1/kexec*.txt /tmp/kexec \
|
||||
|| die "Failed to copy kexec boot params to tmp"
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user