Commit Graph

552 Commits

Author SHA1 Message Date
Jonathon Hall
d51993b6a9
tpm-reset: Reduce duplication with tpmr reset
Use common password prompt logic in tpm-reset rather than duplicating
in tpmr reset.

Use common logic in config-gui.sh to reset the TPM.

Use common logic in oem-factory-reset to reset TPM.  Fixes extra
prompts for TPM2 owner password even when choosing to use a common
password.  Fix sense of "NO TPM" check in TOTP generation (which only
happened to work because CONFIG_TPM is empty for TPM2).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
ab57cd0b9a
tpmr: Fix wording of owner password prompt in tpm2_sealfile()
It's asking for the existing password, not a new password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
cf3ee19795
seal-hotpkey: Fix quoting in CONFIG_TPM test
$CONFIG_TPM needs to be quoted, or [ syntax is incorrect when it's
empty.  Fixes errors in console with TPM2 (but behavior was correct due
to [ still returning false as expected).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
55a41c3fdb
kexec-save-default: Always update TPM2 primary object handle hash
Resetting the TPM creates a new primary object, and there is no reason
for kexec-save-default to sign an old hash.  Always update the hash
instead of creating it only if it doesn't exist.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
7ea606524b
gui-init: Remove TPM2 primary handle hash when resetting TPM
Resetting the TPM invalidates the primary handle hash, and
kexec-save-default only generates a hash if none exists.  Remove the
hash file when it is invalidated.

OEM reset and "Reset Configuration" both already remove all kexec
files.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
8da5d5d723
Add dual support for real bash and busybox's bash(ash)
- modify bash to have it configured with -Os
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
tlaurion
5c7148f18d
Merge pull request #1305 from echo-84/yubikey-oem-factory-reset 2023-02-21 12:06:35 -05:00
Thierry Laurion
8259d3ca1e
Add TRACE function tracing function to output on console when enabled
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs
- Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc)
- add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
2023-02-20 11:44:52 -05:00
Thierry Laurion
5fbbbbc3f7
gui-init: fix sh: argument expected 2023-02-18 21:52:54 -05:00
Thierry Laurion
5bc2bc88e4
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config
-qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now
2023-02-18 21:52:44 -05:00
builder
e900d2027a Check Signature PIN and toggle forcesig if not forced 2023-02-01 20:34:07 -06:00
tlaurion
1c68befc59
Merge pull request #1296 from tlaurion/new_tails_key
/etc/distro/keys/tails.key: Replace with updated and minimized one
2023-01-27 16:07:55 -05:00
tlaurion
7be67e4992
Merge pull request #1297 from tlaurion/usb-scan_moved_to-media-scan
usb-scan->media-scan: usb-init calling media-scan usb
2023-01-27 16:07:17 -05:00
Thierry Laurion
150b95a034
TPM disk unlock key setup: Automatically override selected default boot option's initrd's crypttab file(s) to point to LUKS decryption key in injected cpio
- kexec-save-default extracts initrd crypttab files and creates /boot/kexec_initrd_crypttab_overrides.txt entries pointing to /secret.key
- kexec-insert-key applies /boot/kexec_initrd_crypttab_overrides.txt to replace initrd's crypttabs files pointing to inserted /secret.key through cpio
- Both scripts inform the user of applied magic on screen
2023-01-27 13:27:17 -05:00
HardenedVault
8a60930c6b
Make the path to crypttab within initramfs overridable
Not all distro put crypttab under /etc/ within initramfs, but finding it at
runtime needs unpacking, which may be hard to do, so it is made overridable
with a file at /boot/kexec_initrd_crypttab_path.txt, whose content could be
obtained with $ cpio -t < ${uncompressed_initrd} | grep crypttab .

The "target" field of the record within the crypttab stored in the root
file system for the luks container which is going to be unlocked via
kexec-insert-key should be modified into the same "luks-$uuid" format,
otherwise the boot sequence will get stuck when OS is trying to unlock them
again, in order to map them according to "target" fields written in the
crypttab stored in the root fs.
2023-01-27 12:56:32 -05:00
Thierry Laurion
268767d300
/etc/distro/keys/tails.key: Replace with updated and minimized one 2023-01-26 15:58:57 -05:00
Thierry Laurion
299977926c
usb-scan->media-scan: usb-init calling media-scan usb
media-scan accepts direct input of existing blkid and mount that passed device to /media
2023-01-26 15:38:58 -05:00
tlaurion
c1ae44d71c
Merge pull request #1289 from danielp96/master
/etc/functions: fix detection of virtual flash drive in qemu.
2023-01-26 14:33:38 -05:00
Thierry Laurion
e00280e663
gui-init: warn the user when sealing measurements through TOTP/HOTP requires TPM reset 2023-01-19 14:59:45 -05:00
Daniel Pineda
3cd8654566
/etc/functions: fix detection of virtual flash drive in qemu.
Adds check to detect device formatted as fat32 without partition table.

With fat32 fdisk does not print message about invalid partition table
and instead it'll print an empty table with header.
In both cases total output has the same length of 5 lines: 3 about
device info, 1 empty line and the 5th will be the table header or
invalid partition message.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-01-18 11:27:15 -06:00
tlaurion
e45980d33f
Merge pull request #1281 from tlaurion/usb_modules_load_order_fix 2023-01-17 12:13:04 -05:00
Thierry Laurion
256313a988
/etc/functions: fix order when loading usb modules to prevent warning 2023-01-16 15:21:14 -05:00
3hhh
d07df1e60b
initrd: escape_zero: allow some more characters
Since it's not supposed to be shell safe, just display safe
inside double quotes, we can allow some more characters.

Also fix the escape character not being escaped.
2023-01-14 13:14:09 +01:00
3hhh
2ae7f53e04
initrd: assert_signable: use recovery() instead of die()
and display some more information to the user, if
available
2023-01-14 10:27:42 +01:00
3hhh
c65d6b92c0
initrd: call assert_signable earlier
No need to check for the GPG card first.
2023-01-14 10:07:31 +01:00
3hhh
4ce8f664ad
initrd: work around a bug in busybox sha256sum
busybox sha256sum will create a checksum file for uncommon file names
(e.g. /boot/foo"$\n"bar), but fail to verify that exact file.
https://bugs.busybox.net/show_bug.cgi?id=14226

Thus disallow all files in /boot/ with strange file names at the time of
signing for now. Verifying in the presence of new files with such file
names in /boot/ is no issue for the kexec_tree verification due to the
previously implemented escaping mechanism.
2023-01-14 10:02:49 +01:00
3hhh
e368c3f6ea
initrd: speed up non-GUI booting
by not generating the kexec_tree diff in that case
2023-01-14 10:02:49 +01:00
3hhh
f52466edbf
initrd kexec_tree: fix various escaping issues
Attempt to fix the following issues:
1. unescaped file names may let an attacker display arbitrary
   whiptail prompts --> escape, original code by @JonathonHall-Purism
2. whiptail itself allows escape characters such as \n
   --> use an escape character not used by whiptail, i.e. #
3. performance issues caused by diff'ing too early -->
   only generate a diff to display to the user, if an actual issue is
   found
2023-01-14 10:02:49 +01:00
3hhh
60df237c37
initrd: fix error message to work with kexec_tree 2023-01-14 10:02:48 +01:00
3hhh
accd9f470d
initrd: track files in /boot in kexec_tree.txt
Fixes #1248
2023-01-14 10:02:27 +01:00
Thierry Laurion
90b2e0ca5d
kexec-save-default: do /boot operation in subshell
fixes screwed commit 6f6f37ec3a
2023-01-13 14:54:14 -05:00
tlaurion
1236cbc29e
Merge pull request #1277 from tlaurion/adjust_printf_clear 2023-01-13 12:23:53 -05:00
Thierry Laurion
1dd8fb4cf1
gui-init: add a print clear after TOTP Qr code being confirmed to be scanned by user 2023-01-13 11:25:27 -05:00
Thierry Laurion
3d5db5d9e2
functions: remove the last two print clear which prevented to troubleshoot console output 2023-01-13 11:24:26 -05:00
Thierry Laurion
87027d6a88
recovery call: since we operate under set -e, make sure that shred failing doesn't exit 2023-01-12 18:04:27 -05:00
Thierry Laurion
aa9b75f64d
/boot: make sure operations requiring to be happening under /boot are under subshells 2023-01-11 13:59:26 -05:00
Thierry Laurion
d3eb708bcb
TOTP code mismatch: better guidelines in code 2023-01-04 16:07:38 -05:00
Jonathon Hall
817b9b3bb7
gui-init: Always go to main menu when selecting "continue to main menu"
If the user selects "continue to main menu" from an error, do not show
any more error prompts until reaching the main menu.

We still try to initialize everything (GPG, TOTP, HOTP) so that the
main menu can still show TOTP/HOTP if GPG is not configured, etc., but
no more prompts are shown after selecting "continue to main menu".

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-23 14:01:02 -05:00
Thierry Laurion
81b4bb77de
whiptail: no more whiptail reseting console on call (--clear)
So we have console logs to troubleshoot errors and catch them correctly
2022-11-15 15:11:58 -05:00
tlaurion
5682a62675
Merge pull request #1243 from tlaurion/give_console_output_to_users 2022-11-15 11:13:45 -05:00
Thierry Laurion
83591fbbc1
talos II: die when tgz archive is corrupt 2022-11-14 18:05:32 -05:00
Thierry Laurion
b67f8e19ce
init: add 2 seconds pause on die, 1 second on warning so users see console messages 2022-11-14 18:04:04 -05:00
tlaurion
5e00800877
Merge pull request #1222 from SergiiDmytruk/flashrom 2022-11-11 15:37:25 -05:00
Sergii Dmytruk
472ca6fb30
flash-gui.sh: accept tgz package for Talos boards
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:45 +02:00
Sergii Dmytruk
5ee3219322
Add cbfs wrapper script to handle PNOR
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:12 +02:00
Jonathon Hall
3c0e5c06c6
kexec-parse-boot: Refactor common parts of echo_entry()
A lot of echo_entry() is now common to elf/multiboot/xen kernels, just
branch for the type-specific logic.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:38 -05:00
Jonathon Hall
698360199c
kexec-parse-boot: Ensure kernel/initrd paths exist in boot option
If a boot option doesn't refer to a valid file for the kernel/initrd,
ignore it.  Such an option is never bootable, because we would fail to
find the kernel/initrd.  This could happen if the path contained GRUB
variables, or specified a device that wasn't /boot, etc.

This is checked before expanding GRUB variables.  It's unlikely that
any kernel/initrd path containing variables would end up working when
all variables expand to nothing (since we do not handle GRUB
variables).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:38 -05:00
Jonathon Hall
2a8a7655d3
kexec-parse-boot: Trim device specifications from GRUB entries
Some configs specify kernel/initrd paths relative to a device (often
found in a variable).  Assume the device is the /boot partition and
ignore the device specification.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:34 -05:00
Thierry Laurion
9bb6be8874
whiptail: fixate width to 80 characters and have height dynamic to all whiptail/fbwhiptail prompts 2022-11-09 11:51:27 -05:00
tlaurion
77c6ac9bea
Merge pull request #1235 from JonathonHall-Purism/partitioned-usb-improvements
mount-usb: Improve reliability with partitioned disks
2022-11-04 13:40:15 -04:00
Matt DeVillier
297369fd8b
oem-factory-reset: Add missing newline to prompt
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-11-03 18:42:32 -04:00
Jonathon Hall
a8a843ecc8
mount-usb: Improve reliability with partitioned disks
Extract exclusion for unpartitioned block device of partitioned media
to gui_functions, and exclude them even if kernel hasn't listed the
partitions yet.  (Fixes flash/USB boot prompts incorrectly trying to
use the whole device for partitioned media the first time.)

Ignore block devices of size 0, like empty USB SD card readers.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-03 18:22:03 -04:00
Thierry Laurion
5a7902c5ab
flash.sh: single firmware read backup and logic fixes
- Have Talos II supported by detecting correctly size of mtd chip (not internal: different flashrom output needs to be parsed for chip size)
- Read SPI content only once: 66% speedup (TOCTOU? Don't think so, nothing should happen in parallel when flashing insingle user mode)
- Have the main flash_progress loop not break, but break in flash_rom state subcases (otherwise, verifying step was breaking)
- Change "Initializing internal Flash Programmer" -> "Initializing Flash Programmer"
- Apply changes suggested by @SergiiDmytruk under https://github.com/osresearch/heads/pull/1230#issuecomment-1295332539 to reduce userland wasted time processing flashrom -V output
2022-10-28 14:59:24 -04:00
Sergii Dmytruk
565963d51d
Add CONFIG_BOOT_EXTRA_TTYS option
It specifies whitespace-separated list of console devices to run Heads
on in addition to the default one.

Example for board config:

    export CONFIG_BOOT_EXTRA_TTYS="tty0 tty1"

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-09-01 00:28:15 +03:00
Sergii Dmytruk
75748e86b7
gui-init: fix TOTP/HOTP initialization on missing OS
Skip only GPG key check, but always init TOTP and HOTP.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-21 00:05:20 +03:00
Sergii Dmytruk
b989889e5f
init: assign CONFIG_TPM depending on /dev/tpm0 presence
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-20 23:56:47 +03:00
Victor Bessonov
a221321b6a Allow gpg to select digest algo
EC signatures requires that the digest has the corresponding length. Removing the hardcoded sha2-256 hash function and adding support of sha2-384 and sha2-512 should allow using EC crypto.
2022-07-23 01:10:52 +03:00
Thierry Laurion
cc28121beb
gui-init: Have TPMTOTP QrCode named under TOTP app with $BOARD_NAME 2022-06-22 16:43:29 -04:00
Thierry Laurion
810daebc58
oem-system-info-xx30: fix missing exec mode on shell script 2022-06-15 15:40:37 -04:00
Thierry Laurion
7548580450
create oem-system-info-xx30 (w/trackpad info)
- Take System Info changes from 06311ff068 (Thanks to @nestire)
- Move changes to seperate script under /bin/oem-system-info-xx30
- Add additional camera and wifi card IDs, add synaptic touchpad detection if kernel has module built in

Above changes squashed in this commit.
2022-06-10 10:00:25 -04:00
Thierry Laurion
32e7031678
bin/oem-factory-reset: prevent users to choose a GPG Admin PIN > 25 chars which would fail HOTP sealing
Fixes https://github.com/osresearch/heads/issues/1167
Circumvents https://github.com/Nitrokey/nitrokey-pro-firmware/issues/32
Adds validation so user cannot enter GPG User PIN > 64 while we are at it.

Note that GPG PINs can be up to 64 characters.
But GPG Admin PIN will fail HOTP sealing with GPG Admin PIN of more then 25 chars.

Edit: change upstream error to firmware issue, not nitrokey-app.
2022-06-02 14:08:39 -04:00
Thierry Laurion
4b9757ceef
Remove fedora public key. They don't detach sign ISOs since before 2020. 2022-05-17 15:54:21 -04:00
Thierry Laurion
dd0e4b0a8d
luks-functions: typo correction and consistent warnings across functions. 2022-05-03 16:45:20 -04:00
Thierry Laurion
37bb4906ce
oem-factory-reset: fix bug where it was impossible to just change LUKS passphrase without reencrypting encrypted container.
Since /etc/luks-functions are currently exporting passphrases tested good per cryptsetup to be reused in the code,
the logic calling both luks_reencrypt and luks_change_passphrase testing for non-empty luks_current_Disk_Recovery_Key_passphrase
was bogus.

This commit includes a new variable luks_new_Disk_Recovery_Key_desired which is set when reencryption is desired.
The 3 use cases (reencrypt+passphrase change, reencrypt no passphrase change and passphrase change alone now only test
for luks_new_Disk_Recovery_Key_desired and luks_new_Disk_Recovery_Key_passphrase_desired, nothing else.
2022-05-03 16:41:07 -04:00
Thierry Laurion
e60287fa1d
bin/network-init-recovery: generate random MAC and set it to eth0
network-init-reovery can be used to automatically set RTC clock to obtained NTP clock.
The script would fail if other devices devices previously registered on the network with the same MAC.
Consequently, maximized boards are detected here, and a full random MAC is generated and used instead of using hardcoded DE:AD:C0:FF:EE.
2022-04-29 10:26:12 -04:00
Thierry Laurion
37a343a49c
etc/functions: Add a function to generate random MAC address 2022-04-29 10:24:02 -04:00
Thierry Laurion
70572fd100
oem-factory-reset: Only set default boot option if no TPM Disk Unlock Key
This continues to generate checksums and sign them per new GPG User PIN, but does not set a default boot option.
The user hitting Default Boot on reboot will go through having to setup a new boot default, which will ask him to setup a Disk Unlock Key if desired.

Otherwise, hitting Default Boot goes into asking the user for its Disk Recovery Key passphrase, and requires to manually setup a default boot option.
2022-04-13 14:29:54 -04:00
Thierry Laurion
4e5f781be3
fix removal of --menu from commit ba054b15c3 2022-04-13 11:15:52 -04:00
Matt DeVillier
ba054b15c3
kexec-select-boot: use 'fold' to wrap kernel args at 80 char
Prevents truncation via fbwhiptail window

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 14:32:29 -05:00
Matt DeVillier
025f914eb3
kexec-select-boot: Skip duplicate prompt when setting new default boot entry
The text based prompt isn't needed when using a GUI menu for selection/confirmation, so skip it

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:29 -05:00
Matt DeVillier
19067a9a72
kexec-select-boot: Simplify boot selection confirmation, reverse order
Simplify the menu options by removing the duplication of the entry name
in the menu selections; instead, use clear verbiage to distinish
between booting one time and making the default. And as the majority of
the boot menu is shown is when the grub entires have changed and the
user is prompted to select a new default, so make that the first/default
menu option.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:27 -05:00
Matt DeVillier
7769d13996
kexec-select-boot: Simplify boot menu entries
Drop the duplicated kernel info which hurts readability, runs off the
end of the menu window. This also makes it easier to identify which
menu option is the default, and more closely resembles the grub menu
shown in a traditional BIOS boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 12:25:37 -05:00
Matt DeVillier
0f3f86d21e
etc/luks-functions: exit function when select_luks_container() returns non-zero
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:25 -05:00
Matt DeVillier
5b5880b4e8
select_luks_container(): return non-zero when no device found/selected
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
98c251678c
luks_reencrypt(): remove extraneous call to select_luks_container()
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
f3d4924646
/bin/reencrypt-luks: rename to /etc/luks-functions
Move/rename as file is only sourced, not directly executed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:07 -05:00
Thierry Laurion
7b15726e1d
functions: add loading of usb-hid via enable_usb
Testing points:
- All boards explicitely declaring CONFIG_USB_KEYBOARD=y gets USB Keyboard back under Heads
- All other boards are not impacted.
2022-04-05 13:53:09 -04:00
Thierry Laurion
9760181d09
Uniformize time display so it includes timezone
date=`date "+%Y-%m-%d %H:%M:%S %Z"`
2022-03-25 18:46:13 -04:00
Thierry Laurion
8f390f97c2
add integrity report in case some public key is already fused in firmware
- initrd/bin/oem-factory-reset: adds a measured integrity output prior of prompts. Goal is for stating TOTP/HOTP/boot detached signed measurements prior of initiating a Re-Ownership, validating provisioned OEM state.
2022-03-25 13:31:26 -04:00
Thierry Laurion
dacd99c629
add re-encrypting and passphrase change options to oem-factory-reset
- initrd/bin/oem-factory-reset: add 2 additional prompts defaulting to N, also explaining why its important.
2022-03-23 15:55:42 -04:00
Thierry Laurion
b976309498
add re-encrypt and passphrase change options to menu
- initrd/bin/gui-init : Add two additional menu options to LUKS reencrypt and LUKS passphrase change, calling functions of initrd/bin/reencrypt-luks
- initrd/bin/gui-init : Add option F for EOM Factory Reset / Reownership when no public key is exported by key-init
2022-03-23 15:50:58 -04:00
Thierry Laurion
058b07110b
add reencrypt-luks
initrd/bin/reencrypt-luks: add functions for reencryption and passphrase change. Feeds itself from external provisioning or local provisioning
2022-03-23 15:47:33 -04:00
Thierry Laurion
9016ebccc2 OEM Factory Reset -> OEM Factory Reset / Re-Ownership (with customs passwords and provisioned info given)
oem-factory-reset: adapt code so that custom passphrases can be provided by user without changing oem factory reset workflow.
    oem-factory-reset: output provisioned secrets on screen at the end of of the process.
    oem-factory-reset: warn user of what security components will be provisioned with defaults/customs PINs prior of choosing not after
    gui-init and oem-factory-reset: change OEM Factory Reset -> OEM Factory Reset / Re-Ownership to cover actual use cases
2022-03-11 14:24:54 -05:00
Thierry Laurion
acf709184f bin/kexec-iso-init: Add support for Arch iso support requirements (found at https://mbusb.aguslr.com/howto.html) 2022-03-07 19:02:29 -05:00
Thierry Laurion
3e526aea27 distro key: addition of arch minimized public key
bin/kexec-parse-boot: test 2bb1f52bf5 that fix correctly comma seperated arguments.

Still TODO: when booting, Heads tries to find where the ISO with /dev/disk/by-label/ARCH_202202 wich is never brought up. uuids could, not sure why the label is not brought up correctly. Maybe an issue in the way Arch makes the ISO.
@tslilc : Any idea to continue #584 or modify #762?
2022-03-07 19:02:29 -05:00
tslil clingman
19a8f9c242 Tweak syslinux parsing code to be compatible with new Arch isos 2022-03-07 19:02:29 -05:00
Marek Marczykowski-Górecki
ab6425cc7e
Check for /bin/hotp_verification instead of CONFIG_HOTPKEY
CONFIG_HOTPKEY is not exported to the initrd, check for binary presence.
2022-03-04 00:49:37 +01:00
Marek Marczykowski-Górecki
13a12d157b Move enable_usb earlier
It is going to be enabled later anyway (if CONFIG_HOTPKEY=y), so it can
also be simplified by enabling it at the very beginning.

This enables USB keyboard consistently during all boot menus, including
the "No Bootable OS Found" prompt. It isn't a big deal for "normal"
laptop usage, but it is important for automatic tests and also
non-laptop systems.
2022-03-01 13:39:59 -05:00
Thierry Laurion
7a324bbd29
tails.key : merging of new long-term signing key with old one so old ISOs can still be booting from Heads
Reproducibility notes at https://github.com/osresearch/heads/pull/1023#issuecomment-1018735659

Fixes #1023
2022-01-21 12:58:25 -05:00
HardenedVault
b4b0bc4a7a Use luksHeaderBackup rather than luksDump to measure luks headers. 2022-01-19 10:12:37 -05:00
Thierry Laurion
90ad708849 Apply background colors when fbwhiptail binary is present. 2021-12-17 16:50:03 -05:00
Matt DeVillier
519bd445d6 flash.sh: Add progress bar
Show state of flashrom reads/writes by means of a progress bar,
as used in the Librem coreboot flashing scripts

v2: add adjustment for use with `--ifd`

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-17 16:48:34 -05:00
Thierry Laurion
415a08a732 board additions: w530, t530, t520 (hotp-maximized and maximized flavors only)
-CircleCI addition.
-Removal of t530-flash, w530-flash boards, flash scripts and associated coreboot configs (no more legacy boards additions)

This is a merger of #1071, #1072 and #1073 so that test builds are available over CircleCI until osresearch/master CircleCI gets unlocked.
2021-12-06 19:52:25 -05:00
eganonoa
ce435a4148 adding working w530 board, initrd and config files 2021-12-06 19:52:25 -05:00
eganonoa
66e5c23b13 adding working t530 board, initrd and config files 2021-12-06 19:52:25 -05:00
icequbes1
b35e1bcbb3 oem-factory-reset: fix whiptail height/width order 2021-11-24 17:00:25 -05:00
Matt DeVillier
fdbd9b2d48 gui-init: Handle overflow of list of files w/failed hashes
When files in /boot fail hash verification, the list of files
can sometimes overflow the whiptail msgbox, preventing the
prompt and buttons to update checksums from showing. To mitigate
this, if # of files is > 10, use less to show the file list and
present a separate prompt to update the checksums once the file
list has been viewed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-29 16:11:28 -04:00
Thierry Laurion
59aafa5506 NEWT: fix whiptail line width for output that could wrap line content over multiple lines 2021-10-29 14:53:53 -04:00
Thierry Laurion
2fc8813fc6 oem-factory-reset: fix output when fbwhiptail is not used
- Fixed inversed HEIGHT and WIDTH usage
- Fixed height to 30 and width to 90 as everywhere else

This was causing a blank screen when whiptail without framebuffer (fbwhiptail) was used.
Actually, it seems like the width and height under whiptail calls are only taken into consideration under NEWT, not FBWHIPTAIL.
2021-10-29 13:45:22 -04:00