From 140064bbf8029122b0a9152a874255182d369610 Mon Sep 17 00:00:00 2001 From: Kyle Rankin Date: Tue, 20 Feb 2018 15:35:37 -0800 Subject: [PATCH 1/4] Add graphical init menu that uses whiptail This is a modified version of the generic-init script that uses whiptail to generate a graphical menu. I changed two of the options so that the user can refresh the menu to get an updated TOTP code if needed. --- initrd/bin/gui-init | 83 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100755 initrd/bin/gui-init diff --git a/initrd/bin/gui-init b/initrd/bin/gui-init new file mode 100755 index 00000000..ab6f8a47 --- /dev/null +++ b/initrd/bin/gui-init @@ -0,0 +1,83 @@ +#!/bin/sh +# Boot from a local disk installation + +. /etc/functions +. /etc/config + +mount_boot() +{ + # Mount local disk if it is not already mounted + if ! grep -q /boot /proc/mounts ; then + mount -o ro /boot \ + || recovery "Unable to mount /boot" + fi +} + + +# Confirm we have a good TOTP unseal and ask the user for next choice +while true; do + last_half=X + unset totp_confirm + # update the TOTP code every thirty seconds + date=`date "+%Y-%m-%d %H:%M:%S"` + seconds=`date "+%s"` + half=`expr \( $seconds % 60 \) / 30` + if [ "$CONFIG_TPM" = n ]; then + TOTP="NO TPM" + elif [ "$half" != "$last_half" ]; then + last_half=$half; + TOTP=`unseal-totp` \ + || recovery "TOTP code generation failed" + fi + + whiptail --clear --title 'Heads Boot Menu' \ + --menu "$date\nTOTP code: $TOTP" 20 60 8 \ + 'y' ' Default boot' \ + 'n' ' TOTP does not match' \ + 'r' ' Refresh TOTP code' \ + 'm' ' Boot menu'\ + 'u' ' USB boot' \ + 'x' ' Exit to recovery shell' \ + 2>/tmp/whiptail + + totp_confirm=$(cat /tmp/whiptail) + + if [ "$totp_confirm" = "x" ]; then + recovery "User requested recovery shell" + fi + + if [ "$totp_confirm" = "r" ]; then + continue + fi + + if [ "$totp_confirm" = "n" ]; then + echo "" + echo "To correct clock drift: 'date -s HH:MM:SS'" + echo "and save it to the RTC: 'hwclock -w'" + echo "then reboot and try again" + echo "" + recovery "TOTP mismatch" + fi + + if [ "$totp_confirm" = "u" ]; then + exec /bin/usb-init + continue + fi + + if [ "$totp_confirm" = "m" ]; then + # Try to select a kernel from the menu + mount_boot + kexec-select-boot -m -b /boot -c "grub.cfg" + continue + fi + + if [ "$totp_confirm" = "y" -o -n "$totp_confirm" ]; then + # Try to boot the default + mount_boot + kexec-select-boot -b /boot -c "grub.cfg" \ + || recovery "Failed default boot" + fi + +done + +recovery "Something failed during boot" From 57405b0d2883c6f23491adfe84c11f81f5c28015 Mon Sep 17 00:00:00 2001 From: Kyle Rankin Date: Wed, 21 Feb 2018 15:58:54 -0800 Subject: [PATCH 2/4] Add menu for TOTP updates, provide sample board config to use gui-init --- boards/librem13v2.config | 29 +++++++++++++++++++++++++++++ initrd/bin/gui-init | 25 ++++++++++++++++++++----- 2 files changed, 49 insertions(+), 5 deletions(-) create mode 100644 boards/librem13v2.config diff --git a/boards/librem13v2.config b/boards/librem13v2.config new file mode 100644 index 00000000..5b79b33d --- /dev/null +++ b/boards/librem13v2.config @@ -0,0 +1,29 @@ +# Configuration for a librem13v2 +CONFIG_LINUX_CONFIG=config/linux-librem13v2.config + +CONFIG_COREBOOT=y +CONFIG_CRYPTSETUP=y +CONFIG_FLASHROM=y +CONFIG_GPG=y +CONFIG_KEXEC=y +CONFIG_UTIL_LINUX=y +CONFIG_LVM2=y +CONFIG_MBEDTLS=y +CONFIG_NEWT=y +CONFIG_PCIUTILS=y +CONFIG_POPT=y +CONFIG_QRENCODE=y +CONFIG_SLANG=y +CONFIG_TPMTOTP=y + +CONFIG_LINUX_USB=y + +CONFIG_BOOTSCRIPT=/bin/gui-init + +CONFIG_BOOT_REQ_HASH=n +CONFIG_BOOT_REQ_ROLLBACK=n +CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off" +CONFIG_BOOT_KERNEL_REMOVE="quiet" +CONFIG_BOOT_DEV="/dev/sda1" +CONFIG_BOOT_GUI_MENU_NAME="Purism Librem 13v2 Heads Boot Menu" +CONFIG_USB_BOOT_DEV="/dev/sdb1" diff --git a/initrd/bin/gui-init b/initrd/bin/gui-init index ab6f8a47..f48060cb 100755 --- a/initrd/bin/gui-init +++ b/initrd/bin/gui-init @@ -1,6 +1,8 @@ #!/bin/sh # Boot from a local disk installation +CONFIG_BOOT_GUI_MENU_NAME='Heads Boot Menu' + . /etc/functions . /etc/config @@ -14,9 +16,8 @@ mount_boot() } -# Confirm we have a good TOTP unseal and ask the user for next choice +last_half=X while true; do - last_half=X unset totp_confirm # update the TOTP code every thirty seconds date=`date "+%Y-%m-%d %H:%M:%S"` @@ -30,15 +31,16 @@ while true; do || recovery "TOTP code generation failed" fi - whiptail --clear --title 'Heads Boot Menu' \ + whiptail --clear --title "$CONFIG_BOOT_GUI_MENU_NAME" \ --menu "$date\nTOTP code: $TOTP" 20 60 8 \ 'y' ' Default boot' \ 'n' ' TOTP does not match' \ 'r' ' Refresh TOTP code' \ - 'm' ' Boot menu'\ + 'm' ' Boot menu' \ 'u' ' USB boot' \ + 'g' ' Generate new TOTP secret' \ 'x' ' Exit to recovery shell' \ - 2>/tmp/whiptail + 2>/tmp/whiptail || recovery "GUI menu failed" totp_confirm=$(cat /tmp/whiptail) @@ -64,6 +66,19 @@ while true; do continue fi + if [ "$totp_confirm" = "g" ]; then + if (whiptail --title 'Generate new TOTP secret' \ + --yesno "This will erase your old secret and replace it with a new one!\n\nDo you want to proceed?" 16 60) then + echo "Scan the QR code to add the new TOTP secret" + /bin/seal-totp + echo "Hit Enter to return to the main menu" + read + else + echo "Returning to the main menu" + fi + continue + fi + if [ "$totp_confirm" = "m" ]; then # Try to select a kernel from the menu mount_boot From 6ab78ae236c59758bfc3bbda3d2bdea509e86e31 Mon Sep 17 00:00:00 2001 From: Kyle Rankin Date: Thu, 22 Feb 2018 13:18:16 -0800 Subject: [PATCH 3/4] Add gui option to kexec-select-boot, use in gui-init menu option When selecting the boot menu option (m) in the gui-init you call out to kexec-select-boot. To better maintain the graphical menu experience, I've added a -g option to kexec-select-boot that, when set, will use a graphical whiptail menu for the most common menu selection modes. --- initrd/bin/gui-init | 2 +- initrd/bin/kexec-select-boot | 45 +++++++++++++++++++++++++++++------- 2 files changed, 38 insertions(+), 9 deletions(-) diff --git a/initrd/bin/gui-init b/initrd/bin/gui-init index f48060cb..08335488 100755 --- a/initrd/bin/gui-init +++ b/initrd/bin/gui-init @@ -82,7 +82,7 @@ while true; do if [ "$totp_confirm" = "m" ]; then # Try to select a kernel from the menu mount_boot - kexec-select-boot -m -b /boot -c "grub.cfg" + kexec-select-boot -m -b /boot -c "grub.cfg" -g continue fi diff --git a/initrd/bin/kexec-select-boot b/initrd/bin/kexec-select-boot index 034890bb..c3cc05f1 100755 --- a/initrd/bin/kexec-select-boot +++ b/initrd/bin/kexec-select-boot @@ -12,7 +12,8 @@ valid_hash="n" valid_global_hash="n" valid_rollback="n" force_menu="n" -while getopts "b:d:p:a:r:c:uim" arg; do +gui_menu="n" +while getopts "b:d:p:a:r:c:uimg" arg; do case $arg in b) bootdir="$OPTARG" ;; d) paramsdev="$OPTARG" ;; @@ -23,6 +24,7 @@ while getopts "b:d:p:a:r:c:uim" arg; do u) unique="y" ;; m) force_menu="y" ;; i) valid_hash="y"; valid_rollback="y" ;; + g) gui_menu="y" ;; esac done @@ -80,6 +82,24 @@ get_menu_option() { if [ $num_options -eq 1 -a $first_menu = "y" ]; then option_index=1 + elif [ "$gui_menu" = "y" ]; then + MENU_OPTIONS="" + n=0 + while read option + do + parse_option + n=`expr $n + 1` + name=$(echo $name | tr " " "_") + kernel=$(echo $kernel | cut -f2 -d " ") + MENU_OPTIONS="$MENU_OPTIONS $n ${name}_[$kernel]" + done < $TMP_MENU_FILE + + whiptail --clear --title "Select your boot option" \ + --menu "Choose the boot option [1-$n, a to abort]:" 20 120 8 \ + -- $MENU_OPTIONS \ + 2>/tmp/whiptail || die "Aborting boot attempt" + + option_index=$(cat /tmp/whiptail) else echo "+++ Select your boot option:" n=0 @@ -105,14 +125,23 @@ get_menu_option() { } confirm_menu_option() { - echo "+++ Please confirm the boot details for $name:" - echo $option + if [ "$gui_menu" = "y" ]; then + whiptail --clear --title "Confirm boot details" \ + --menu "Confirm the boot details for $name:\n\n$option\n\n" 20 120 8 \ + -- 'y' "Boot $name" 'd' "Make $name the default" \ + 2>/tmp/whiptail || die "Aborting boot attempt" - read \ - -n 1 \ - -p "Confirm selection by pressing 'y', make default with 'd': " \ - option_confirm - echo + option_confirm=$(cat /tmp/whiptail) + else + echo "+++ Please confirm the boot details for $name:" + echo $option + + read \ + -n 1 \ + -p "Confirm selection by pressing 'y', make default with 'd': " \ + option_confirm + echo + fi } parse_option() { From fbbfc8e22f3a6e15df710b259fc31bb2d521584d Mon Sep 17 00:00:00 2001 From: Kyle Rankin Date: Fri, 23 Feb 2018 12:13:21 -0800 Subject: [PATCH 4/4] Replace remaining text-only options in main workflow w/ gui menus In particular I added a GUI menu to instruct the user if there is no TOTP code registered (as is the case upon first flash) and also added better handling of the case the user selects 'default boot' when there is no default boot set yet. Apart from that where there were text-only menus left in gui-init I've replaced them with GUI menus. --- initrd/bin/gui-init | 163 ++++++++++++++++++++++++++------------------ 1 file changed, 96 insertions(+), 67 deletions(-) diff --git a/initrd/bin/gui-init b/initrd/bin/gui-init index 08335488..252462f1 100755 --- a/initrd/bin/gui-init +++ b/initrd/bin/gui-init @@ -8,90 +8,119 @@ CONFIG_BOOT_GUI_MENU_NAME='Heads Boot Menu' mount_boot() { - # Mount local disk if it is not already mounted - if ! grep -q /boot /proc/mounts ; then - mount -o ro /boot \ - || recovery "Unable to mount /boot" - fi + # Mount local disk if it is not already mounted + if ! grep -q /boot /proc/mounts ; then + mount -o ro /boot \ + || recovery "Unable to mount /boot" + fi } last_half=X while true; do + MAIN_MENU_OPTIONS="" unset totp_confirm - # update the TOTP code every thirty seconds - date=`date "+%Y-%m-%d %H:%M:%S"` - seconds=`date "+%s"` - half=`expr \( $seconds % 60 \) / 30` - if [ "$CONFIG_TPM" = n ]; then - TOTP="NO TPM" - elif [ "$half" != "$last_half" ]; then - last_half=$half; - TOTP=`unseal-totp` \ - || recovery "TOTP code generation failed" - fi + # update the TOTP code every thirty seconds + date=`date "+%Y-%m-%d %H:%M:%S"` + seconds=`date "+%s"` + half=`expr \( $seconds % 60 \) / 30` + if [ "$CONFIG_TPM" = n ]; then + TOTP="NO TPM" + elif [ "$half" != "$last_half" ]; then + last_half=$half; + TOTP=`unseal-totp` + if [ $? -ne 0 ]; then + whiptail --clear --title "ERROR: TOTP Generation Failed!" \ + --menu "ERROR: Heads couldn't generate the TOTP code.\n\nIf you have just reflashed your BIOS, you will need to generate a new TOTP secret.\n\nIf you have not just reflashed your BIOS, THIS COULD INDICATE TAMPERING!\n\nHow would you like to proceed?" 20 60 4 \ + 'g' ' Generate new TOTP secret' \ + 'i' ' Ignore error and continue to default boot menu' \ + 'x' ' Exit to recovery shell' \ + 2>/tmp/whiptail || recovery "GUI menu failed" - whiptail --clear --title "$CONFIG_BOOT_GUI_MENU_NAME" \ - --menu "$date\nTOTP code: $TOTP" 20 60 8 \ - 'y' ' Default boot' \ - 'n' ' TOTP does not match' \ - 'r' ' Refresh TOTP code' \ - 'm' ' Boot menu' \ - 'u' ' USB boot' \ - 'g' ' Generate new TOTP secret' \ - 'x' ' Exit to recovery shell' \ - 2>/tmp/whiptail || recovery "GUI menu failed" + totp_confirm=$(cat /tmp/whiptail) + fi + fi - totp_confirm=$(cat /tmp/whiptail) + if [ "$totp_confirm" = "i" -o -z "$totp_confirm" ]; then + whiptail --clear --title "$CONFIG_BOOT_GUI_MENU_NAME" \ + --menu "$date\nTOTP code: $TOTP" 20 60 8 \ + 'y' ' Default boot' \ + 'r' ' TOTP does not match, refresh code' \ + 'n' ' TOTP does not match after refresh, troubleshoot' \ + 'm' ' Show OS boot menu' \ + 'u' ' USB boot' \ + 'g' ' Generate new TOTP secret' \ + 'x' ' Exit to recovery shell' \ + 2>/tmp/whiptail || recovery "GUI menu failed" - if [ "$totp_confirm" = "x" ]; then - recovery "User requested recovery shell" - fi + totp_confirm=$(cat /tmp/whiptail) + fi - if [ "$totp_confirm" = "r" ]; then - continue - fi + if [ "$totp_confirm" = "x" ]; then + recovery "User requested recovery shell" + fi - if [ "$totp_confirm" = "n" ]; then - echo "" - echo "To correct clock drift: 'date -s HH:MM:SS'" - echo "and save it to the RTC: 'hwclock -w'" - echo "then reboot and try again" - echo "" - recovery "TOTP mismatch" - fi + if [ "$totp_confirm" = "r" ]; then + continue + fi - if [ "$totp_confirm" = "u" ]; then - exec /bin/usb-init - continue - fi + if [ "$totp_confirm" = "n" ]; then + if (whiptail --title "TOTP code mismatched" \ + --yesno "TOTP code mismatches could indicate either TPM tampering or clock drift:\n\nTo correct clock drift: 'date -s HH:MM:SS'\nand save it to the RTC: 'hwclock -w'\nthen reboot and try again.\n\nWould you like to exit to a recovery console?" 30 60) then + echo "" + echo "To correct clock drift: 'date -s HH:MM:SS'" + echo "and save it to the RTC: 'hwclock -w'" + echo "then reboot and try again" + echo "" + recovery "TOTP mismatch" + else + continue + fi + fi - if [ "$totp_confirm" = "g" ]; then - if (whiptail --title 'Generate new TOTP secret' \ - --yesno "This will erase your old secret and replace it with a new one!\n\nDo you want to proceed?" 16 60) then + if [ "$totp_confirm" = "u" ]; then + exec /bin/usb-init + continue + fi + + if [ "$totp_confirm" = "g" ]; then + if (whiptail --title 'Generate new TOTP secret' \ + --yesno "This will erase your old secret and replace it with a new one!\n\nDo you want to proceed?" 16 60) then echo "Scan the QR code to add the new TOTP secret" - /bin/seal-totp - echo "Hit Enter to return to the main menu" + /bin/seal-totp + echo "Once you have scanned the QR code, hit Enter to reboot" read - else - echo "Returning to the main menu" - fi - continue - fi + /bin/reboot + else + echo "Returning to the main menu" + fi + continue + fi - if [ "$totp_confirm" = "m" ]; then - # Try to select a kernel from the menu - mount_boot - kexec-select-boot -m -b /boot -c "grub.cfg" -g - continue - fi + if [ "$totp_confirm" = "m" ]; then + # Try to select a kernel from the menu + mount_boot + kexec-select-boot -m -b /boot -c "grub.cfg" -g + continue + fi - if [ "$totp_confirm" = "y" -o -n "$totp_confirm" ]; then - # Try to boot the default - mount_boot - kexec-select-boot -b /boot -c "grub.cfg" \ - || recovery "Failed default boot" - fi + if [ "$totp_confirm" = "y" -o -n "$totp_confirm" ]; then + # Try to boot the default + mount_boot + DEFAULT_FILE=`find /boot/kexec_default.*.txt 2>/dev/null | head -1` + if [ -r "$DEFAULT_FILE" ]; then + kexec-select-boot -b /boot -c "grub.cfg" \ + || recovery "Failed default boot" + else + if (whiptail --title 'No Default Boot Option Configured' \ + --yesno "There is no default boot option configured yet. Would you like to load a menu of boot options? Otherwise you will return to the main menu." 16 60) then + kexec-select-boot -m -b /boot -c "grub.cfg" -g + else + echo "Returning to the main menu" + fi + continue + fi + fi done