ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-19 21:17:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2,181 Commits 27 Branches 6 Tags 21 MiB
8a8634f6a3
Commit Graph

686 Commits

Author SHA1 Message Date
Thierry Laurion
8a8634f6a3
oem-factory-reset seal-hotpkey: unify prompts and vocabulary 
oem-factory-reset: bugfix, keytocard inverts prompts. First is keyring then smartcard.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:08:00 -04:00
Thierry Laurion
7cd44b6dc4
oem-factory-reset: further cleaning of code for proper validation and consistency checks for passphrases. Also skip flashing code on qemu boards with short explanation 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:56 -04:00
Thierry Laurion
9c3fb35358
initrd/bin/reboot: BugFix in nv41/ns50 condition check to call nitropad-shutdown.sh (otherwise output error on console for improper condition in ash 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:53 -04:00
Thierry Laurion
7f5d9700b7
gpg_auth function was not failing properly on failing, die instead 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:50 -04:00
Thierry Laurion
05fc4c1747
PCR extend ops inform users on what happens, otherwise we tpm commands output on screen without context 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:47 -04:00
Thierry Laurion
9e838ad615
oem-factory-reset: make passphrases variables able to contain strings and validate things more solidly 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:43 -04:00
Thierry Laurion
56b602974b
WiP: NK3 with p256 ECC algo supported for in-memory keygen and key-to-card op. With this commit, one can provision NK3 with thumb drive backup which enables authenticated recovery shell and USB boot. 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:40 -04:00
Thierry Laurion
b2cb9b4997
.ash_history: add history command for manual detached signed integrity validation 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:34 -04:00
Thierry Laurion
cf065eeba2
bin/reboot: fix parameter order so that we pause when in DEBUG before rebooting 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:30 -04:00
Thierry Laurion
27c457f04b
TPM2 DUK and TOTP/HOTP reseal fix, refactoring and ifferenciating tpm_password into tpm_owner_password and reusing correctly 
i
TODO: fix all TODO in PR prior of review + squash

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:27 -04:00
Thierry Laurion
729f2b17b8
WiP to be squashed: we need to refactor prompt_tpm_password which is used both for TPM Owner Password prompt and caching reused for TPM disk unlock key passphrase which of course fails 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:24 -04:00
Thierry Laurion
15f1d0b77a
To Squash: changes to reboot were not ash compliant 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:21 -04:00
Thierry Laurion
3fb84f0b42
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key 
gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:17 -04:00
Thierry Laurion
911eb07565
TPM1/TPM2: unify wording for TPM Owner Password and cache it externally to /tmp/secret/tpm_password to be reused in a boot session until recovery shell access or reboot 
TODO: Why two functions prompt_tpm_password and prompt_new_owner_password
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:14 -04:00
Thierry Laurion
754e3c9165
bin/reboot: intercept reboot call when in DEBUG mode to type 'r' to go to recovery shell instead of rebooting 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:11 -04:00
Thierry Laurion
2ea62ff17e
/etc/functions: add missing TRACE traces to get where TPM passphrase should be written to file and reused since not all in same functions/files for TPM2 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:08 -04:00
Thierry Laurion
88d00dfcb2
scripts: unify luks in text/prompts/messages to LUKS 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:07:01 -04:00
Thierry Laurion
2697a6ad1f
WiP: further removal of unecessary debug messages 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:06:58 -04:00
Thierry Laurion
1f28c71447
WiP: adapt dmesg in function of CONFIG_DEBUG_OUTPUT being enabled or not so and adapt further troubleshooting notes in code when keys cannot be accessed on media for whatever cause so user can understand what is happening when accessing GPG material on backup thumb drive 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:06:55 -04:00
Thierry Laurion
eceb97aa4d
WiP: provide proper info/warn/die messages explaining causes of errors linked to detach signing errors 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:06:51 -04:00
Thierry Laurion
2c55338be5
Wip: now supports both backup and copy to card and gpg_auth when backup exists. Might want to discuss that implementation. Some functions needed to be moved from functions to ash_functions so that gpg_auth can be called from recovery function. That might need to be discussed as well, recovery could be moved from ash_functions to functions instead. 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:06:48 -04:00
Thierry Laurion
b1e5c638cd
WiP 
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
 2023-11-01 10:06:45 -04:00
Thierry Laurion
139f77113c
ash_functions: make DEBUG call pass multiline messages one at a time to /tmp/debug.log and kmsg 2023-10-21 14:37:31 -04:00
Thierry Laurion
576e2a8fff
qubes release signing keys: move qubes-4.key to qubes-4.1.key, add qubes-4.2.key 2023-10-18 13:37:22 -04:00
Thierry Laurion
65e5286b5a
init: enable cttyhack so that init launches BOOTSCRIPT in a controlled terminal. DEBUG/TRACE now output on /dev/kmsg and console. 2023-10-10 12:28:52 -04:00
Thierry Laurion
0416896b82
etc/ash_function's warn/die/TRACE/DEBUG now output also under /dev/kmsg when DEBUG is enabled 2023-10-10 12:28:15 -04:00
Thierry Laurion
cba8c4542c
oem-factory-reset: fix call to mount-usb --mode rw (fix #1497) 2023-09-07 16:27:43 -04:00
tlaurion
9849b99717
Merge pull request #1495 from JonathonHall-Purism/improve_flash_sh 
initrd/bin/flash.sh: Improve speed and reliability
 2023-09-06 10:24:09 -04:00
tlaurion
2c3987f9a3
Merge pull request #1485 from Nitrokey/nx-nitropad 
add Nitropad NV41/NS50 TPM2 boards (2nd)
 2023-09-06 10:15:17 -04:00
tlaurion
54bce87691
Merge pull request #1496 from JonathonHall-Purism/unseal-hotp-die-on-error 
initrd/bin/unseal-hotp: Prevent script errors if unseal fails
 2023-09-05 16:24:56 -04:00
Jonathon Hall
4d7c1cb388
initrd/bin/unseal-hotp: Prevent script errors if unseal fails 
If the secret can't be unsealed, die immediately rather than continuing
on to generate errors.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
 2023-09-05 16:12:57 -04:00
Jonathon Hall
8342603993
initrd/bin/flash.sh: Improve speed and reliability 
Improve speed by pre-filtering only for lines containing any tokens of
interest to flashrom_progress_tokenize().

Improve reliability by avoiding dropping tokens that cross a stream
buffer boundary.  Occasionally, a token could be missed if it crosses a
stream buffer boundary, due to read timing out too quickly before the
next buffer is flushed.  If this was a state-changing token,
flashrom_progress() would hang forever.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
 2023-09-05 16:04:30 -04:00
Jonathon Hall
003bec4fd4
initrd/bin/flash-gui.sh: Exit instead of errant return 
Return is not valid outside of a function - exit instead.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
 2023-09-05 15:57:13 -04:00
tlaurion
8272d33e7c
Merge pull request #1482 from tlaurion/ease_tpm_disk_unlock_key_resealing_after_totp_mismatch-warn_and_die_changes 
Ease TPM Disk Unlock Key sealing/resealing after TOTP mismatch (firmware upgrade) + warn and die changes
 2023-09-05 11:48:50 -04:00
Markus Meissner
a00aed50d7
reboot/poweroff: run nitropad-shutdown.sh for required boards 2023-09-05 17:13:56 +02:00
Markus Meissner
fabddb4f7a
flash-gui.sh: add .npf handling; add create-npf.sh 2023-09-05 17:13:56 +02:00
Markus Meissner
902866cc29
add nitropad-shutdown.sh for EC based poweroff 2023-09-05 17:13:56 +02:00
Markus Meissner
075d40950b
oem-factory-reset: introduce GPG_ALGO 
* use GPG_ALGO as gpg key generation algorithm
* determine GPG_ALGO during runtime like this:
  * if CONFIG_GPG_ALGO is set, use as preference
  * adapt based on usb-token capabilities (currently only Nitrokey 3)
 2023-09-05 12:28:52 +02:00
Thierry Laurion
47eba7d80b
kexec-save-default: Fix multiple LUKS/LVM+LUKS suggestion + other working uniformization for DUK 2023-09-02 11:49:57 -04:00
Thierry Laurion
e291797e65
kexec-save-default : Finally fix #1474 under #1482 2023-09-02 04:21:08 -04:00
Thierry Laurion
8b0fc0f129
kexec-seal/save-key /etc/functions : some more uniformisation of TPM DUK verbiage 2023-09-02 04:19:43 -04:00
Thierry Laurion
51b1ad39c3
sbin/insmod wrapper: Add TRACE and DEBUG traces 2023-09-02 04:16:16 -04:00
Thierry Laurion
52947e2767
WiP TPM DUK cleanup 2023-09-02 01:53:31 -04:00
Thierry Laurion
e9dbce2adf
bin/unpack_initramfs.sh: Add TRACE and DEBUG traces 2023-09-02 01:51:50 -04:00
Thierry Laurion
0ba10e5174
path substitution still not working. This is PoC to be tested. Had to go 2023-09-01 18:19:29 -04:00
Thierry Laurion
a2a30020c0
TPM Disk Unlock Key setup: use unpack_initrd.sh, replace none with /secret.key. Still no joy 2023-09-01 16:28:53 -04:00
Thierry Laurion
4a7e23b4c6
Address review for: first set up of TPM DUK and renewal after firmware upg 2023-09-01 15:18:36 -04:00
Thierry Laurion
64ad01f333
WiP: Staging commit to facilitate review, will squash into previous commits once confirmed good 2023-08-31 14:36:27 -04:00
Thierry Laurion
67c865d151
TPM DISK Unlock Key : add cryptroot/crypttab to fix #1474 
Tested working on both TPM1/TPM2 under debian bookwork, standard encrypted TLVM setup
 2023-08-30 18:07:21 -04:00
Thierry Laurion
4910c1188f
TPM Disk Unlock Key sealing/renewal cleanup (Triggered automatically when resealing TOTP) 
Changes:
- As per master: when TOTP cannot unseal TOTP, user is prompted to either reset or regenerate TOTP
- Now, when either is done and a previous TPM Disk Unlock Key was setuped, the user is guided into:
  - Regenerating checksums and signing them
  - Regenerating TPM disk Unlock Key and resealing TPM disk Unlock Key with passphrase into TPM
  - LUKS header being modified, user is asked to resign kexec.sig one last time prior of being able to default boot
- When no previous Disk Unlock Key was setuped, the user is guided into:
  - The above, plus
    - Detection of LUKS containers,suggesting only relevant partitions

- Addition of TRACE and DEBUG statements to troubleshoot actual vs expected behavior while coding
  - Were missing under TPM Disk Unlock Key setup codepaths

- Fixes for #645 : We now check if only one slots exists and we do not use it if its slot1.
  - Also shows in DEBUG traces now

Unrelated staged changes
- ash_functions: warn and die now contains proper spacing and eye attaction
- all warn and die calls modified if containing warnings and too much punctuation
- unify usage of term TPM Disk Unlock Key and Disk Recovery Key
 2023-08-30 18:06:29 -04:00