Commit Graph

1706 Commits

Author SHA1 Message Date
tlaurion
5b6370c70c
Merge pull request #1298 from tlaurion/fixup_xx20_xx30_cbfs_size
xx20/xx30 maximized coreboot configs: Fix CONFIG_CBFS_SIZE to reflect ifd.bin's BIOS region (xx20: gain of 0.59mb, xx30: gain of 0.4mb
2023-02-09 12:33:35 -05:00
Thierry Laurion
e7f1e3e7a7
xx20/xx30 maximized coreboot configs: Fix CONFIG_CBFS_SIZE to reflect ifd.bin's BIOS regions.
The calculations outlined at https://github.com/osresearch/heads/pull/1282#discussion_r1072473677
Sums to having 'ifdtool -f layout.txt ifd_shrinked.bin && cat layout.txt'
The example for T440p:
00000000:00000fff fd
00021000:00bfffff bios
00003000:00020fff me
00001000:00002fff gbe

Here: 00bfffff-00021000=BDEFFF
Which is exact result of @rbeslow's calculations.

There is an issue on haswell, maybe because of car, maybe because of non native memory init blob.
But this is not the case for xx20/xx30 boards.
2023-02-09 12:28:59 -05:00
tlaurion
77f8d5a4f6
Merge pull request #967 from tlaurion/x230-maximized-fhd
Add x230-maximized-fhd_edp and x230-hotp-maximized-fhd_edp boards
2023-02-09 12:24:54 -05:00
tlaurion
8ec0cd377a
Merge pull request #1309 from tlaurion/osresearch_net-back
README: point to https://osresearch.net again (DNS name renewed)
2023-02-08 11:34:56 -05:00
Thierry Laurion
4ac16e0368
README: point to https://osresearch.net again (DNS name renewed) 2023-02-08 11:32:50 -05:00
tlaurion
305851ab4b
Temporary mitigation to osresearch.net having expired
Temporal mitigation to https://github.com/osresearch/heads/issues/1308 and https://github.com/osresearch/heads-wiki/issues/122
2023-02-07 11:42:35 -05:00
tlaurion
411ca09f73
Merge pull request #1304 from tlaurion/CircleCI_informe_where_full_build_logs_are
CircleCI step name change : Make Board -> Make Board (FULL ORDERED BUILD LOGS HERE UNTIL JOB FAILED)
2023-01-31 19:07:22 -05:00
Thierry Laurion
074d19875c
CircleCI step name change : Make Board -> Make Board (FULL ORDERED BUILD LOGS HERE UNTIL JOB FAILED) 2023-01-31 19:06:33 -05:00
Thierry Laurion
2b05a6b42c
Add x230-maximized-fhd_edp and x230-hotp-maximized-fhd_edp boards
- add x230-maximized-fhd_edp and x230-hotp-maximized-fhd_edp board configs
- add/rework coreboot patch for x230 fhd variant to be applied on top of 4.13
- add coreboot config to point to x230-edp variant, fixing path to vbt file since default path is wrong under. Comment made upstream https://review.coreboot.org/c/coreboot/+/28950/22#message-4904ce82f01ba0505b391e072e4537b6a9f1a229
  - remove no gfx init and replace with libgfxinit(defonfig default), set internal display as default
- add x230-hotp-maximized-fhd_edp and x230-maximized-fhd_edp to CircleCI builds
- One single shared coreboot config between boards/x230-hotp-maximized-fhd_edp/x230-hotp-maximized-fhd_edp.config and boards/x230-maximized-fhd_edp/x230-maximized-fhd_edp.config
- Coreboot 4.13 patch from coreboot at patches/coreboot-4.13/0002-x230-fhd-variant.patch
- config/coreboot-x230-maximized-fhd_edp.config points to seperate coreboot config per patch (CONFIG_BOARD_LENOVO_X230_EDP)
2023-01-31 09:58:43 -05:00
tlaurion
1c68befc59
Merge pull request #1296 from tlaurion/new_tails_key
/etc/distro/keys/tails.key: Replace with updated and minimized one
2023-01-27 16:07:55 -05:00
tlaurion
7be67e4992
Merge pull request #1297 from tlaurion/usb-scan_moved_to-media-scan
usb-scan->media-scan: usb-init calling media-scan usb
2023-01-27 16:07:17 -05:00
tlaurion
f440ad3d31
Merge pull request #1284 from tlaurion/hardenedvault-crypttab-path_remix_enable_discard
WiP : TPM disk unlock key setup (kexec-save-key) reuses OS initrd's crypttab files as base for /secret.key override (kexec-insert-key)
2023-01-27 13:31:44 -05:00
Thierry Laurion
150b95a034
TPM disk unlock key setup: Automatically override selected default boot option's initrd's crypttab file(s) to point to LUKS decryption key in injected cpio
- kexec-save-default extracts initrd crypttab files and creates /boot/kexec_initrd_crypttab_overrides.txt entries pointing to /secret.key
- kexec-insert-key applies /boot/kexec_initrd_crypttab_overrides.txt to replace initrd's crypttabs files pointing to inserted /secret.key through cpio
- Both scripts inform the user of applied magic on screen
2023-01-27 13:27:17 -05:00
HardenedVault
8a60930c6b
Make the path to crypttab within initramfs overridable
Not all distro put crypttab under /etc/ within initramfs, but finding it at
runtime needs unpacking, which may be hard to do, so it is made overridable
with a file at /boot/kexec_initrd_crypttab_path.txt, whose content could be
obtained with $ cpio -t < ${uncompressed_initrd} | grep crypttab .

The "target" field of the record within the crypttab stored in the root
file system for the luks container which is going to be unlocked via
kexec-insert-key should be modified into the same "luks-$uuid" format,
otherwise the boot sequence will get stuck when OS is trying to unlock them
again, in order to map them according to "target" fields written in the
crypttab stored in the root fs.
2023-01-27 12:56:32 -05:00
Thierry Laurion
268767d300
/etc/distro/keys/tails.key: Replace with updated and minimized one 2023-01-26 15:58:57 -05:00
Thierry Laurion
299977926c
usb-scan->media-scan: usb-init calling media-scan usb
media-scan accepts direct input of existing blkid and mount that passed device to /media
2023-01-26 15:38:58 -05:00
tlaurion
c1ae44d71c
Merge pull request #1289 from danielp96/master
/etc/functions: fix detection of virtual flash drive in qemu.
2023-01-26 14:33:38 -05:00
tlaurion
075284374b
Merge pull request #1291 from tlaurion/warn_user_when_totp-hotp_seal_requires_tpm_reset
gui-init: warn the user when sealing measurements through TOTP/HOTP reset
2023-01-19 18:44:10 -05:00
Thierry Laurion
e00280e663
gui-init: warn the user when sealing measurements through TOTP/HOTP requires TPM reset 2023-01-19 14:59:45 -05:00
tlaurion
f2ba6679ca
Merge pull request #1287 from rbreslow/rb/musl-cross-echo-path
modules/musl-cross: use echo from the PATH to support NixOS
2023-01-18 15:22:55 -05:00
tlaurion
a9e31161ac
Merge pull request #1288 from rbreslow/rb/gh-syntax-highlighting
Add overrides for Makefile syntax highlighting
2023-01-18 15:22:21 -05:00
tlaurion
9da7744808
Merge pull request #1286 from rbreslow/rb/hotp-verification-include-path
modules/hotp-verification: source libusb headers from Makefile DESTDIR
2023-01-18 15:21:22 -05:00
Rocky Breslow
dbd302497d
modules/musl-cross: use echo from the PATH to support NixOS
NixOS doesn't have a traditional FHS where echo is available at
`/bin/echo`. Instead, we must rely on the PATH for any
distribution-managed utilities. Reverses
https://github.com/osresearch/heads/issues/106.
2023-01-18 12:42:41 -05:00
Rocky Breslow
a5fa2ecb0b
modules/hotp-verification: source libusb headers from Makefile DESTDIR
Before, the configure script sourced these from the system FHS
(/usr/include/libusb-1.0). The build failed on my NixOS build machine,
which doesn't store dependencies in a traditional FHS. And this is the
correct approach for reproducible builds.
2023-01-18 12:41:54 -05:00
Daniel Pineda
3cd8654566
/etc/functions: fix detection of virtual flash drive in qemu.
Adds check to detect device formatted as fat32 without partition table.

With fat32 fdisk does not print message about invalid partition table
and instead it'll print an empty table with header.
In both cases total output has the same length of 5 lines: 3 about
device info, 1 empty line and the 5th will be the table header or
invalid partition message.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-01-18 11:27:15 -06:00
Rocky Breslow
b6c3229deb
Add overrides for Makefile syntax highlighting
Fix GitHub syntax highlighting for the Coreboot/Heads config files, and
modules, which are all Makefiles.

See: https://github.com/github/linguist/blob/master/docs/overrides.md
2023-01-18 11:51:38 -05:00
tlaurion
e45980d33f
Merge pull request #1281 from tlaurion/usb_modules_load_order_fix 2023-01-17 12:13:04 -05:00
tlaurion
db5777ad91
Merge pull request #1262 from 3hhh/add-files 2023-01-17 12:12:13 -05:00
Thierry Laurion
256313a988
/etc/functions: fix order when loading usb modules to prevent warning 2023-01-16 15:21:14 -05:00
3hhh
d07df1e60b
initrd: escape_zero: allow some more characters
Since it's not supposed to be shell safe, just display safe
inside double quotes, we can allow some more characters.

Also fix the escape character not being escaped.
2023-01-14 13:14:09 +01:00
3hhh
2ae7f53e04
initrd: assert_signable: use recovery() instead of die()
and display some more information to the user, if
available
2023-01-14 10:27:42 +01:00
3hhh
c65d6b92c0
initrd: call assert_signable earlier
No need to check for the GPG card first.
2023-01-14 10:07:31 +01:00
3hhh
4ce8f664ad
initrd: work around a bug in busybox sha256sum
busybox sha256sum will create a checksum file for uncommon file names
(e.g. /boot/foo"$\n"bar), but fail to verify that exact file.
https://bugs.busybox.net/show_bug.cgi?id=14226

Thus disallow all files in /boot/ with strange file names at the time of
signing for now. Verifying in the presence of new files with such file
names in /boot/ is no issue for the kexec_tree verification due to the
previously implemented escaping mechanism.
2023-01-14 10:02:49 +01:00
3hhh
e368c3f6ea
initrd: speed up non-GUI booting
by not generating the kexec_tree diff in that case
2023-01-14 10:02:49 +01:00
3hhh
f52466edbf
initrd kexec_tree: fix various escaping issues
Attempt to fix the following issues:
1. unescaped file names may let an attacker display arbitrary
   whiptail prompts --> escape, original code by @JonathonHall-Purism
2. whiptail itself allows escape characters such as \n
   --> use an escape character not used by whiptail, i.e. #
3. performance issues caused by diff'ing too early -->
   only generate a diff to display to the user, if an actual issue is
   found
2023-01-14 10:02:49 +01:00
3hhh
60df237c37
initrd: fix error message to work with kexec_tree 2023-01-14 10:02:48 +01:00
3hhh
accd9f470d
initrd: track files in /boot in kexec_tree.txt
Fixes #1248
2023-01-14 10:02:27 +01:00
tlaurion
febff85498
Merge pull request #1278 from tlaurion/kexec-save-default_fix_subshell_boot_ops
kexec-save-default: do /boot operation in subshell
2023-01-13 14:58:11 -05:00
Thierry Laurion
90b2e0ca5d
kexec-save-default: do /boot operation in subshell
fixes screwed commit 6f6f37ec3a
2023-01-13 14:54:14 -05:00
tlaurion
1236cbc29e
Merge pull request #1277 from tlaurion/adjust_printf_clear 2023-01-13 12:23:53 -05:00
Thierry Laurion
1dd8fb4cf1
gui-init: add a print clear after TOTP Qr code being confirmed to be scanned by user 2023-01-13 11:25:27 -05:00
Thierry Laurion
3d5db5d9e2
functions: remove the last two print clear which prevented to troubleshoot console output 2023-01-13 11:24:26 -05:00
tlaurion
cd269f12c2
Merge pull request #1276 from tlaurion/recovery_fix_when_not_secret_to_shred 2023-01-13 10:45:56 -05:00
Thierry Laurion
87027d6a88
recovery call: since we operate under set -e, make sure that shred failing doesn't exit 2023-01-12 18:04:27 -05:00
tlaurion
8e73d91121
Merge pull request #1273 from tlaurion/qemu-coreboot-tpm1-boards_fixes
qemu-coreboot-tpm boards: usage optimizations
2023-01-11 17:19:39 -05:00
tlaurion
6f6f37ec3a
Merge pull request #1272 from tlaurion/boot_ops_under_subshell
/boot: make sure operations requiring to be happening under /boot are under subshells
2023-01-11 16:24:26 -05:00
Thierry Laurion
080d439758
qemu-coreboot-tpm boards: usage optimizations
- ROOT_DISK_IMG is now dynamic (ROOT_DISK_IMG=/path/to/existing/provisioned/disk.img can be reused across run statements)
- Addition of missing boards to cover all use cases
- All TPM1 boards rely on common config/coreboot-qemu-tpm1.config
- boards/qemu-coreboot-fbwhiptail-tpm1-hotp/qemu-coreboot-fbwhiptail-tpm1-hotp.md has been generalized
 - all other boards are softlinked to the above for usage
2023-01-11 15:38:30 -05:00
Thierry Laurion
aa9b75f64d
/boot: make sure operations requiring to be happening under /boot are under subshells 2023-01-11 13:59:26 -05:00
tlaurion
395de880db
Merge pull request #1267 from tlaurion/better_totp_correction_guidelines_in_code 2023-01-06 08:44:15 -05:00
tlaurion
a772259cbd
Merge pull request #1261 from Baitinq/nix_fix
Makefile: Use path agnostic bash location
2023-01-05 10:38:13 -05:00