- kexec-save-default extracts initrd crypttab files and creates /boot/kexec_initrd_crypttab_overrides.txt entries pointing to /secret.key
- kexec-insert-key applies /boot/kexec_initrd_crypttab_overrides.txt to replace initrd's crypttabs files pointing to inserted /secret.key through cpio
- Both scripts inform the user of applied magic on screen
Not all distro put crypttab under /etc/ within initramfs, but finding it at
runtime needs unpacking, which may be hard to do, so it is made overridable
with a file at /boot/kexec_initrd_crypttab_path.txt, whose content could be
obtained with $ cpio -t < ${uncompressed_initrd} | grep crypttab .
The "target" field of the record within the crypttab stored in the root
file system for the luks container which is going to be unlocked via
kexec-insert-key should be modified into the same "luks-$uuid" format,
otherwise the boot sequence will get stuck when OS is trying to unlock them
again, in order to map them according to "target" fields written in the
crypttab stored in the root fs.
Adds check to detect device formatted as fat32 without partition table.
With fat32 fdisk does not print message about invalid partition table
and instead it'll print an empty table with header.
In both cases total output has the same length of 5 lines: 3 about
device info, 1 empty line and the 5th will be the table header or
invalid partition message.
Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
Since it's not supposed to be shell safe, just display safe
inside double quotes, we can allow some more characters.
Also fix the escape character not being escaped.
busybox sha256sum will create a checksum file for uncommon file names
(e.g. /boot/foo"$\n"bar), but fail to verify that exact file.
https://bugs.busybox.net/show_bug.cgi?id=14226
Thus disallow all files in /boot/ with strange file names at the time of
signing for now. Verifying in the presence of new files with such file
names in /boot/ is no issue for the kexec_tree verification due to the
previously implemented escaping mechanism.
Attempt to fix the following issues:
1. unescaped file names may let an attacker display arbitrary
whiptail prompts --> escape, original code by @JonathonHall-Purism
2. whiptail itself allows escape characters such as \n
--> use an escape character not used by whiptail, i.e. #
3. performance issues caused by diff'ing too early -->
only generate a diff to display to the user, if an actual issue is
found
If the user selects "continue to main menu" from an error, do not show
any more error prompts until reaching the main menu.
We still try to initialize everything (GPG, TOTP, HOTP) so that the
main menu can still show TOTP/HOTP if GPG is not configured, etc., but
no more prompts are shown after selecting "continue to main menu".
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
A lot of echo_entry() is now common to elf/multiboot/xen kernels, just
branch for the type-specific logic.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
If a boot option doesn't refer to a valid file for the kernel/initrd,
ignore it. Such an option is never bootable, because we would fail to
find the kernel/initrd. This could happen if the path contained GRUB
variables, or specified a device that wasn't /boot, etc.
This is checked before expanding GRUB variables. It's unlikely that
any kernel/initrd path containing variables would end up working when
all variables expand to nothing (since we do not handle GRUB
variables).
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Some configs specify kernel/initrd paths relative to a device (often
found in a variable). Assume the device is the /boot partition and
ignore the device specification.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Extract exclusion for unpartitioned block device of partitioned media
to gui_functions, and exclude them even if kernel hasn't listed the
partitions yet. (Fixes flash/USB boot prompts incorrectly trying to
use the whole device for partitioned media the first time.)
Ignore block devices of size 0, like empty USB SD card readers.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
- Have Talos II supported by detecting correctly size of mtd chip (not internal: different flashrom output needs to be parsed for chip size)
- Read SPI content only once: 66% speedup (TOCTOU? Don't think so, nothing should happen in parallel when flashing insingle user mode)
- Have the main flash_progress loop not break, but break in flash_rom state subcases (otherwise, verifying step was breaking)
- Change "Initializing internal Flash Programmer" -> "Initializing Flash Programmer"
- Apply changes suggested by @SergiiDmytruk under https://github.com/osresearch/heads/pull/1230#issuecomment-1295332539 to reduce userland wasted time processing flashrom -V output
It specifies whitespace-separated list of console devices to run Heads
on in addition to the default one.
Example for board config:
export CONFIG_BOOT_EXTRA_TTYS="tty0 tty1"
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
EC signatures requires that the digest has the corresponding length. Removing the hardcoded sha2-256 hash function and adding support of sha2-384 and sha2-512 should allow using EC crypto.
- Take System Info changes from 06311ff068 (Thanks to @nestire)
- Move changes to seperate script under /bin/oem-system-info-xx30
- Add additional camera and wifi card IDs, add synaptic touchpad detection if kernel has module built in
Above changes squashed in this commit.
