Currently Heads will check files in /boot for tampering before booting
into a system. It would be nice if you could use the trusted environment
within Heads and extend this to check files in / itself. This new script
adds that functionality, however due to the length of time it takes to
perform these kinds of checks, it doesn't run automatically (yet).
This feature can be configured from the config GUI - the root device/
directories to check can be set, and it can be configured to run during
boot.
To make this a bit easier to use, I added a feature to detect whether
the hash file exists and if not, to display a more limited menu to the
user guiding them to create the initial hash file. Otherwise it will
display the date the file was last modified, which can be useful to
determine how stale it is.
Reduce friction when generating a new TOTP/HOTP secret by eliminating
an unnecessary 'press enter to continue' prompt following QR code
generation, and by attempting to use the default admin PIN set by
the OEM factory reset function. Fall back to prompting the user
if the default PIN fails.
Also, ensure error messages are visible to users before being returned
back to the GUI menu from which they came by wrapping existing calls to die()
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
On machines without a TPM, we'd still like some way for the BIOS to
attest that it has not been modified. With a Librem Key, we can have the
BIOS use its own ROM measurement converted to a SHA256sum and truncated
so it fits within an HOTP secret. Like with a TPM, a malicious BIOS with
access to the correct measurements can send pre-known good measurements
to the Librem Key.
This approach provides one big drawback in that we have to truncate the
SHA256sum to 20 characters so that it fits within the limitations of
HOTP secrets. This means the possibility of collisions is much higher
but again, an attacker could also capture and spoof an existing ROM's
measurements if they have prior access to it, either with this approach
or with a TPM.
Signed-off-by: Kyle Rankin <kyle.rankin@puri.sm>
This isn't in a loop, continue makes no sense. ash had silently
ignored it. Proceeding to the do_boot below is the correct behavior.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
For partitioned media or when more than one device is present, this
fixes a benign script error that ash had apparently ignored.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
- Trace calls need to happen after sourcing /etc/functions not before
- Move sourcing of external files at beginning of file, remove /etc/functions sourcing duplicate
- gpg error redirection was sent to /dev/null where expected to be added to whiptail in case of error (2>&1 instead and redirection to file)
Problem
When using a custom password for TPM, the OEM re-ownership process is broken
Impact
The OEM re-ownership process breaks for any user setting a custom password and not just using 12345678
First appeared
6923fb5e20
Detail
on line 498, if blank, the TPM custom password is overwritten with TPM_PASS_DEF (eg, when no custom password is set by the user installing)
```
if [ "$TPM_PASS" == "" ]; then TPM_PASS=$TPM_PASS_DEF; fi
```
so far so good. $TPM_PASS should be used for all TPM interaction from this point. $TMP_PASS_DEF is now a disposed of variable.
we see that happens when resetting the TPM on line 712 (generate_checksums) is that $TPM_PASS is used (correctly)
```## reset TPM and set password
if [ "$CONFIG_TPM" = "y" ]; then
echo -e "\nResetting TPM...\n"
tpmr reset "$TPM_PASS" >/dev/null 2>/tmp/error
---SNIP
```
The TPM now has either the custom password of the user, or the default of 12345678 depending on user selection.
On line 712, we duck into the generate_checksums sub, which for some reason reverts to TPM_PASS_DEF
```
# create Heads TPM counter
if [ "$CONFIG_TPM" = "y" ];then
if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
tpmr counter_create \
-pwdo "$TPM_PASS_DEF" \
--SNIP
```
This then, rightly, fails due to
```
Authentication failed (Incorrect Password) (ox1) from TPM_CreateCounter
```
- /tmp/initrd_extract was attempted to be deleted while under that directory when no crypptab found.
- changing of directory to / is non-conditional prior of deletion: move to cleaning step
- Clarity on message displayed to user when a generic crypttab will be generated in case of no OS override
TPM password must be 1-32 characters. Loop if the password is not
valid or the repeated password doesn't match, so the user can try
again.
Move prompt_new_owner_password to functions and use in both gui-init
and tpm-reset.
Fixes#1336
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
They're the same other than a TRACE, combine them. Use busybox
insmod since the insmod script uses bash, we don't need the TPM PCRs on
legacy-flash-boards.
Remove PCR4 extend, these boards lack TPM configuration. Update ROM
example name.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Multiple traps overwrite each other. While no tpmr functions have more
than one trap right now, it is fragile, and the quoting is complex due
to double expansion. Use at_exit to add exit handlers that accumulate
and do not require special quoting.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
tpm-reset is just a prompt for the password followed by tpmr reset.
oem-factory-reset already bypasses the prompt, just call tpmr reset
directly.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
These were still writing some debugging output containing flags and
PCRs even when debug was not enabled. Use DEBUG.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
We just set the TPM owner password, so there's no need to make the user
enter it again. Eliminates some failure modes if the user mistypes it
or enters the wrong password.
Allow optionally passing in the TPM owner password in tpmr seal,
check_tpm_counter(), seal-totp, and generate_totp_htop(). The user is
still prompted if the password is needed but was not provided, so
existing uses in other contexts continue to work unchanged.
Prompt for the password in reset_tpm() and pass it down to each of the
above.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Heads doesn't use the endorsement hierarchy, but we shouldn't leave it
with an empty password following a tpm2 clear.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Don't hash password used to seal an object. This limits the password
to 32-characters but avoids obfuscating the usage of the password. The
32-character limit is considered acceptable because password limits are
lower already (GPG token limits to 25 chars). We may allow >32 char
passwords in the future by hashing only if the password is >32 chars.
Always pass passwords as hex to tpm2-tools to avoid possible ambiguity
if the password begins with a control prefix like 'hex:' or 'file:'.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Set consistent dictionary lockout parameters suited to Heads. Disable
lockout reset by setting a random password.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout)
kexec-seal-key: Add DEBUG statement for PCR precalc
seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops
seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret
tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls
tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1
tpmr: add DO_WITH_DEBUG calls for calcfuturepcr
functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL
Not so related but part of output review and corrections:
kexec-insert-key: cosmetic changes prepending "+++" to disk related changes
kexec-save-default: cosmetic changes prepending "+++" to disk related changes
config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
We already have HMAC sessions for encryption and decryption, there's no
need to create an ad-hoc session in tpm2_unseal.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark. Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
TPM2 must be prepared for shutdown, or it may track an auth failure for
dictionary attack prevention (per the spec, to prevent an attack by
attempting to authenticate and then powering off the TPM before it can
update the nonvolatile counter).
Add tpmr shutdown to prepare for shutdown (no-op on TPM1). Invoke it
from poweroff and reboot.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for
both TPM1 and TPM2.
Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is
essentially the TPM2 logic now that tpmr provides the same wrapped
commands for both TPM1 and TPM2.
Remove algorithm prefix from PCR list in tpmr unseal for consistency
with tpmr seal.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
tpmr extend with -ic (extend with literal data) was adding a newline,
use echo -n so it only includes the data given in the hash.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Clean up TODO comments.
Clean up redirections for tpm2 pcrread, use bash redirect to command.
Use DO_WITH_DEBUG --mask-position to trace tpmr seal for TPM2 and hide
the password.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Provide mask_param() function to uniformly mask secret parameters,
while still indicating whether they are empty.
Extend DO_WITH_DEBUG to allow masking a password parameter by position,
using mask_param(). Move from ash_functions to functions (isn't used
by ash scripts).
Mask password parameters in kexec-unseal-key and tpmr seal. Use
mask_param() on existing masked params in tpmr.
Trim more troubleshooting output from tpm2_extend() in tpmr.
Clarify tpmr kexec_finalize echo; it's the TPM's platform heirarchy,
users might not know what this was referring to.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Provide an HMAC session to tpm2 when unsealing with an auth policy.
The HMAC session is used for transport encryption.
This allows transport encryption to work when unsealing.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Remove dump of all PCRs from tpm2_extend, it was causing other errors
to roll off the screen before they could be inspected, and it's no
longer needed now that TPM2 is working.
Silence nonsense errors from unseal if TPM2 hasn't been reset. tpm2 -S
with a file that doesn't exist would complain that the parameter format
was not understood (looks like a script error), when the actual problem
was that the file doesn't exist yet. We can't try to unseal anyway
without a primary handle, so just exit unsuccessfully in that case.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Busybox no longer has CONFIG_BASH since we are deploying bash on most
boards. We also should clearly indicate which scripts cannot use
bashisms.
Change shebang in x230-flash.init, t430-flash.init, flash.sh to
/bin/ash. Execute /bin/sh for interactive shells.
Move key functions needed by those scripts to initrd/etc/ash_functions.
Source ash_functions instead of functions in those scripts, so any
bashisms in other functions won't break parsing of the script in ash.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The size parameter is actually the size of the sealed secret to TPM1,
not the unsealed data size. TPM2 does not observe the sealed secret,
so just ignore that parameter.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Provide tpmr unseal to unseal a file with TPM1 or TPM2. For TPM1, it
wraps tpm nv_readvalue and tpm unsealfile. For TPM2, it wraps tpm2
unseal.
kexec-unseal-key, seal-hotpkey, unseal-hotp, and unseal-totp no longer
need to differentiate TPM1/TPM2.
Fixes spurious shred errors on TPM2 that only apply to TPM1 (temporary
sealed secret file and shred are now internal to tpmr).
Fixes TPM1 disk unlock key unsealing due to logic errors relating to
exit status of tpmr unseal or tpm unsealfile (now always uses status of
tpmr unseal).
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
