4 Commits

Author	SHA1	Message	Date
Francis Lam	11aca354e9	Fixed edge case in kernel argument injection ... Debian 9 installer doesn't have kernel arguments so the iommu fix wasn't being applied properly.	2017-07-13 00:33:49 -04:00
Francis Lam	22a52ec4b8	Added TPM secret management to generic boot ... Also cleaned up error handling and boot parsing edge cases	2017-07-12 00:17:45 -04:00
Francis Lam	8004b5df2a	Added the ability to persist a default boot option ... Similar to qubes-update, it will save then verify the hashes of the kexec files. Once TOTP is verified, a normal boot will verify that the file hashes and all the kexec params match and if successful, boot directly to OS. Also added a config option to require hash verification for non-recovery boots, failing to recovery not met.	2017-07-04 19:49:14 -04:00
Francis Lam	3614044fff	Added a generic boot config and persistent params ... Refactored boot parsing code and applied that in local-init to scan /boot for grub options and allow the user to unsafely boot anything. This goes a long way to addressing #196. Optionally the user can customize those boot parameters or enforce arbitrary hashes on the boot device by creating and signing config files in /boot/ or /media/ or /media/kexec_iso/ISO_FILENAME/.	2017-07-02 23:01:04 -04:00