Commit Graph

254 Commits

Author SHA1 Message Date
Trammell hudson
0d9a1e5038
initrd: helper to load the SATA modules and mount a partition 2019-08-12 14:59:18 +02:00
Matt DeVillier
0d51b62ebb
gpg-gui: add option to replace existing key(s)
Introduce option to remove any existing key(s) from firmware
and add a user-suppled key, before reflashing.

Move existing code for adding a new key to a separate function
so it can be reused for new feature without duplication.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:19 -05:00
Matt DeVillier
b1d57dac66
gui-init: retry mounting /boot after device changed
If CONFIG_BOOT_DEV isn't set or otherwise fails to mount,
we prompt the user to change the /boot device, but never
attempt to mount it to ensure it's sane, leading to
potential failures later in the config/boot process.

Ensure that CONFIG_BOOT_DEV is updated after the /boot device
is changed, and attempt to re-mount /boot after the change.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:19 -05:00
Matt DeVillier
57c4207bf8
gpg_flash_rom: persist user config when flashing
If the user has changed the /boot config but not yet flashed,
it's reasonable for them to expect that flashing to add/update
a GPG key won't revert those changes.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:19 -05:00
Matt DeVillier
a9e494f670
gpg-gui: prompt user to update checksums after adding key
In order to streamline the initial setup, prompt user to
update checksums/sign /boot files after adding a key and
updating the firmware, in order to avoid an extra reboot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:18 -05:00
Matt DeVillier
ed2f19d862
gui-init: move update_checksums() to /etc/functions
Move the non-GUI component of update_checksums() to
/etc/functions so it can be reused outside of gui-init.

Add check that /boot/kexec_default_hashes.txt exists before parsing
it, since doesn't exist if there's no default boot target set yet.
Eliminates spurious error text and/or premature exit depending on
state of errexit.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:18 -05:00
Matt DeVillier
db5d282a7b
seal-libremkey: add newlines for readability
improve readability of console output by adding newlines as needed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:17 -05:00
Matt DeVillier
94f7f98022
gui-init: update Settings, Boot Options menu text
'Options' makes more sense than 'Settings' given the submenu's contents.
Tidy up Boot Options as well

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-07-12 11:51:17 -05:00
Kyle Rankin
20d79f5ab5
Merge pull request #589 from MrChromebox/small_fixes
Small fixes
2019-06-25 08:52:06 -07:00
Matt DeVillier
6cfbc86618
initrd: don't mount efivars fs on non-linuxboot systems
it doesn't exist and produces a spurious error on Heads systems

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:07:10 -05:00
Matt DeVillier
4a85c85336
gui-init: load USB modules at startup
ensures external USB keyboards are accessible

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:06:52 -05:00
Matt DeVillier
2686c836c6
gui-init: ensure /boot is sane first thing
Before anything else, ensure that a default boot device
is set. If not, prompt the user to set one.  If set, ensure
that /boot can be mounted successfully; else prompt the
user to select a new boot device.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:06:30 -05:00
Matt DeVillier
f772f2d088
unseal-hotp: ensure /boot mounted before checking HOTP secret
If /boot isn't mounted, we can't read the HOTP secret, so no
point in reading from the TPM. This speeds up getting to the
main menu in the case of an inaccessible or non-existant /boot,
and maintains the warning condition from not being able to
validate the HOTP.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:04:03 -05:00
Matt DeVillier
65d669d408
Skip prompt to set default boot when booting from USB
Since a USB boot target can't be the default (at least currently,
/boot must be on internal media), skip the extraneous prompt to
set it as such when booting from USB.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:01:18 -05:00
Matt DeVillier
3306dbb66d
flash-gui: clean up ROM list
Exclude dot folders from ROM search path, so that files in
.Trash (eg) aren't shown. Sort the remaining options.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:00:54 -05:00
Matt DeVillier
e0e0019250
kexec-select-boot: correct order of USB boot options
Using sort on USB boot options produces a reverse-ordered list,
leading users to often select the wrong option.  Add the -r
parameter to sort to correct the list order and make the default
option the first in the list.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 09:57:24 -05:00
Matt DeVillier
5eb758711d
unseal-hotp: fix/rename mount_boot()
Because of the way unseal-hotp is called from gui-init,
dropping to a recovery shell when failing to mount /boot
causes it to hang, leaving the user stranded until they
kill it with CTRL+C. Instead, simply return and continue
to the main GUI menu where the user can address the problem.

Rename the function to clarify difference from other versions
of mount_boot() which do drop to the recovery shell.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 09:57:02 -05:00
Matt DeVillier
77949c9cff
libremkey_hotp_initialize: handle spaces in admin pin/pass
Fix HOTP verfication failure if LK admin pin/passphrase contains
spaces by quoting the variables when passed to functions.

Test: set LK admin pin to passphrase with spaces, generate
new TOTP/HOTP, verification passes.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-24 23:30:39 -05:00
Matt DeVillier
286303d95c
libremkey-hotp-verification: pass in key file directly
Reading the file into a variable and then redirecting to stdin
via echo() can cause the binary data to be truncated, leading
to an invalid base32 value and failure to properly generate
and validate the HOTP code.

To resolve this, pass the file directly to hotp(), and ensure
it is removed properly regardless of success or failure to
prevent leakage.

Fixes "Invalid base32 string" error seen when attempting to
generate a new TOTP secret.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-24 23:29:06 -05:00
Martin Kepplinger
186895d414 gui-init: move Refresh TOTP/HOTP to the Main Boot Menu
also, rename the current menu entry to being smaller and simpler.

Closes #574
2019-05-27 11:12:50 +02:00
Martin Kepplinger
e203de9669 gui-init: rename Advanced Settings to Settings
Since there are no other settings to choose from, there don't have to
be "advanced" ones.
2019-05-25 10:40:50 +02:00
Martin Kepplinger
0dc8d9f82e gui-init: move Exit to Shell menu entry under Advanced Settings
Exiting the GUI to a shell is not expected to be part of our users'
everyday workflow, and thus this menu entry doesn't have to be on
the main page.
2019-05-25 10:30:18 +02:00
Martin Kepplinger
fbe39745b4 gui-init: add Power Off to the Main Boot Menu
Add a main boot menu entry to power off. This enables users to
only verify the firmware integrity using OTP, and do nothing more.

After having left the device out of sight, one might want to do
a quick sanity check only.

Since we already have a script to safely power down, we make use of
it now.
2019-05-24 11:36:49 +02:00
Martin Kepplinger
00bf4740e3 initrd: x230-flash: fix commandline instructions for flashing
flashrom-x230.sh is now flash.sh
2019-05-23 13:10:53 +02:00
tlaurion
08ad2d4d20
Merge pull request #559 from heads105/fc30kexec2
Parse grub config files for Fedora 29/30
2019-05-03 09:20:22 -04:00
paul
73c6f3fcc0 Parse grub config files for Fedora 29/30 2019-05-02 22:23:59 +01:00
Thierry Laurion
260507cafd
Revert "Support Fedora 30 boot configuration"
This reverts commit bc5343c626.
2019-05-01 14:26:15 -04:00
tlaurion
ca067385bd
Merge pull request #546 from kylerankin/add_gpg_sc_keygen
Add GPG smartcard keygen feature
2019-05-01 09:07:25 -04:00
paul
bc5343c626 Support Fedora 30 boot configuration 2019-04-30 12:32:30 +01:00
tlaurion
dac412a798
Merge pull request #548 from kylerankin/add_dynamic_usb_detection
Detect USB disk dynamically
2019-04-23 15:59:26 -04:00
Kyle Rankin
553cf0958b
Add dynamic USB device detection
Instead of relying on a hard-coded USB disk, it would be better if the
mount script attempted to dynamically detect available USB disks. This
modification to the USB mount script attempts to handle the common case
of a single USB disk but can also handle the case of multiple disks
where it will present the user with all available USB disks
2019-04-19 14:11:45 -07:00
Kyle Rankin
efd6b066a2
Add a "Factory reset" GPG option
This mimics tlauion's OEM work in the sense that a user (or OEM) could
choose this option and it will reset an OpenPGP smart card and
automatically generate a random key on it. The idea is to allow an OEM
to set up a Librem Key and Heads on a machine before shipping with a
random key, so the user can test for tampering when they receive the
machine, and then the user can choose to reset all of the keys with
their chosen keys after that fact.
2019-04-19 08:35:01 -07:00
Kyle Rankin
76a068935d
Bugfixes to mount-usb
This change fixes some edge cases where a single usb disk was inserted
with multiple partitions on it, among others.
2019-04-16 12:55:00 -07:00
Kyle Rankin
152689d5d5
Detect USB disk dynamically
Currently Heads relies on a hard-coded config value to determine which
USB disk to mount. This can be problematic when trying to distribute a
pre-built version of Heads that can work on multiple disk
configurations. I've modified the USB mounting script so that it
attempts to detect all USB boot disks present on the system, pick sane
defaults, and prompt the user when there are multiple choices.

I've also removed the USB configuration option from config-gui.sh as
this config option is no longer used.
2019-04-15 15:05:03 -07:00
Kyle Rankin
c028f7752e
Add GPG smartcard keygen feature
This change updates the very basic GPG smartcard feature in the GPG GUI
so that it can properly support generating a key from within Heads. It
offers the user the option to copy the generated GPG public key to a USB
thumb drive so it's not lost as well as the option to reflash the
current Heads BIOS with this new public key added to the keyring.

I've moved the common functions required to flash a new ROM with GPG
changes into a shared function at the top of the script.
2019-04-10 09:34:31 -07:00
Thierry Laurion
1fda1fffb0
Keep Xen cmdline arguments while appending Heads required ones. Fixes #536 2019-03-17 19:37:31 -04:00
Thierry Laurion
2740317d67
shred TOTP_SECRET also when generation is successful 2019-02-24 11:11:00 -05:00
Thierry Laurion
8310a3d62e
also shred LUKS sealed secret when done instead of rm it 2019-02-24 10:29:09 -05:00
Thierry Laurion
b3a6c285c8
also shred LUKS key when done instead of rm it 2019-02-24 10:29:07 -05:00
Thierry Laurion
9fbfb41a71
reverting shred on a file that is not a secret to be shredded 2019-02-24 10:29:05 -05:00
Thierry Laurion
14c76d062c
supress errors on console when files don't exist (equivalent of rm -f) 2019-02-24 10:28:57 -05:00
Thierry Laurion
0722d42d65
using shred instead of rm on secret related files. 2019-02-24 10:27:20 -05:00
Kyle Rankin
07cf7d7577
Revert "Remove "pipefail" so unmatched greps don't cause script to exit"
This reverts commit 9279d60a1a.
2019-02-19 06:48:35 -08:00
Kyle Rankin
9279d60a1a
Remove "pipefail" so unmatched greps don't cause script to exit 2019-02-19 06:48:17 -08:00
Kyle Rankin
cfddb4ed2e
Add GPG GUI
It makes more logical sense for GPG functions to be split out into their
own menu instead of being part of the "Flash" menu. This creates a
gpg-gui.sh script and moves GPG options there while adding a few
additional features (like listing keys and initial smartcard key
generation support).
2019-02-19 06:48:08 -08:00
tlaurion
564f3ee201
Merge pull request #490 from kylerankin/add_empty_keyring_detection
Add empty keyring detection, clean up main menu
2019-02-08 15:01:28 -05:00
tlaurion
695993b593
Merge branch 'master' into gpg2 2019-02-08 13:29:02 -05:00
Kyle Rankin
181c621c84
Touch /tmp/config when entering recovery mode 2019-02-08 10:25:12 -08:00
Thierry Laurion
005a19eeda
properly deal with trusting keys to supress UX confusion about trusted keys
key-init makes sure trustdb is updated at run time and user and distro keys are ultimately trusted. Each time a file is signed, the related public key is showed without error on it's trustability.
flash-gui deals with gpg1 to gpg2 migration. If pubring.kbx is found, pubring.gpg is deleted from running rom dump.
2019-02-08 12:38:38 -05:00
Thierry Laurion
5eee5aa296
GPG2 required changes for key and trustdb generation and inclusion in rom
.ash_history: add examples to generate keys and otrust in rom
flash-gui: export otrust and import it in rom
key-init: import otrust.txt if present to supress warning about user public key being untrusted
2019-01-29 11:18:11 -05:00