Commit Graph

111 Commits

Author SHA1 Message Date
Trammell hudson
9c9b5bcd2b
Merge branch 'add_gui_hash_alert' of https://github.com/kylerankin/heads 2018-03-08 14:41:44 -05:00
Trammell hudson
1043da2860
Merge branch 'add_force_boot_mode' of https://github.com/kylerankin/heads 2018-03-08 11:53:56 -05:00
Trammell hudson
6443442912
restore /etc/motd 2018-03-08 01:14:41 -05:00
Trammell hudson
091ae92b6f
Merge branch 'KGPE-D16_port_NoTPM' of https://github.com/tlaurion/heads 2018-03-08 01:13:16 -05:00
Thierry Laurion
31dd1f4b62
kexec-boot patch so that xen can be booted from bootdir and referred xen.gz and not internal flash xen.gz 2018-03-08 00:58:50 -05:00
Kyle Rankin
8152e8c796
Add a "force" option to kexec-select-boot to bypass hash checks
The point of this change is to provide a failsafe (failunsafe?) mode for
less technically-savvy users who will ultimately be using Heads by
default on Librem laptops.

There are some scenarios where an end user might forget to update hashes
in /boot after an initrd change or might have some other hash mismatch.
Currently that user would then be stuck in a recovery console in Heads
not knowing what to do within that limited shell environment to fix the
situation.

This change adds a 'force' mode to kexec-select-boot that goes straight
into a boot menu and bypasses the hash checks so the user could more
easily get back into their system to attempt to repair it. It adds
appropriate warnings about why this is a risky option and moves it down
toward the bottom of the menu. The goal would be to just have this be an
emergency option our support could guide a user to if they ended up in
this situation.
2018-03-05 14:46:15 -08:00
Thierry Laurion
1c1a1a215d
reverting changes that were not merged from other branches 2018-03-01 01:53:37 -05:00
Thierry Laurion
9eadb07280
Merging to osresearch master 2018-03-01 01:37:36 -05:00
Thierry Laurion
23ae788c6f
Board, linux and coreboot configs 2018-03-01 00:40:46 -05:00
Trammell hudson
f9a12a270a
Merge branch 'add_gui_init' of https://github.com/kylerankin/heads into kylerankin-add_gui_init 2018-02-28 15:06:06 -05:00
Trammell hudson
a84ea7b9de
Merge branch 'tpm-optional' of https://github.com/persmule/heads 2018-02-28 13:33:01 -05:00
Trammell hudson
e4106c6969
Merge branch 'clean_up_init' of https://github.com/kylerankin/heads 2018-02-26 13:15:34 -05:00
Francis Lam
e9312e19bf
Cleanup of init to support server and desktop
Guarded linuxboot specific init entries
Removed Makefile entries into separate file (conflicts with srcing /etc/config)
Added CONFIG_BOOT_LOCAL/_REMOTE to control interface setup
Fixed CONFIG_TPM usage
2018-02-25 11:51:19 -08:00
persmule
b5072390ee
Make TPM dependency optional and controlled by flag CONFIG_TPM
if "CONFIG_TPM=y" is not present in the config file, functionalities
needing TPM could be disabled, while leaving other functionalities intact.

This will make Heads a more general-usage bootloader payload atop coreboot.
2018-02-24 14:46:33 -08:00
persmule
43ba7a777d fix the broken if syntax 2018-02-24 14:49:10 +08:00
Kyle Rankin
fbbfc8e22f
Replace remaining text-only options in main workflow w/ gui menus
In particular I added a GUI menu to instruct the user if there is no
TOTP code registered (as is the case upon first flash) and also added
better handling of the case the user selects 'default boot' when there
is no default boot set yet. Apart from that where there were text-only
menus left in gui-init I've replaced them with GUI menus.
2018-02-23 12:13:21 -08:00
Kyle Rankin
6ab78ae236
Add gui option to kexec-select-boot, use in gui-init menu option
When selecting the boot menu option (m) in the gui-init you call out to
kexec-select-boot. To better maintain the graphical menu experience,
I've added a -g option to kexec-select-boot that, when set, will use a
graphical whiptail menu for the most common menu selection modes.
2018-02-22 13:18:16 -08:00
Kyle Rankin
57405b0d28
Add menu for TOTP updates, provide sample board config to use gui-init 2018-02-21 15:58:54 -08:00
Kyle Rankin
140064bbf8
Add graphical init menu that uses whiptail
This is a modified version of the generic-init script that uses whiptail
to generate a graphical menu. I changed two of the options so that the
user can refresh the menu to get an updated TOTP code if needed.
2018-02-20 15:35:37 -08:00
persmule
baa30a2026 Add OHCI and UHCI drivers to initrd.
USB smart card readers are most full speed devices, and there is no
"rate-matching hubs" beneath the root hub on older (e.g. GM45) plat-
forms, which has companion OHCI or UHCI controllers and needs cor-
responding drivers to communicate with card readers directly plugged
into the motherboard, otherwise a discrete USB hub should be inserted
between the motherboard and the reader.

This time I make inserting linux modules for OHCI and UHCI controllable
with option CONFIG_LINUX_USB_COMPANION_CONTROLLER.

A linux config for x200 is added as an example.

Tested on my x200s and elitebook revolve 810g1.
2018-02-15 22:59:22 +08:00
persmule
9bf131b601 Make TPM dependency optional and controlled by flag CONFIG_TPM
if "CONFIG_TPM=y" is not present in the config file, functionalities
needing TPM could be disabled, while leaving other functionalities intact.

This will make Heads a more general-usage bootloader payload atop coreboot.
2018-02-15 22:42:12 +08:00
Kyle Rankin
c35f385cf7
Make eth0 init condition on module, remove early bin/ash
To avoid unnecessary errors, only load the eth0 network if the e1000
module exists. Also remove /bin/ash so CONFIG_BOOTSCRIPT works.
2018-02-14 11:50:21 -08:00
Trammell hudson
073834e5c0
Move the ld-musl symlink into the blobs/dev.cpio file.
This makes it possible to use musl-libc compiled tools
without the Heads runtime.
2018-02-13 17:44:26 -05:00
Trammell hudson
15a07b3fce
enable qemu networking and ssh key login () 2018-02-09 13:42:52 -05:00
Trammell hudson
23bd4107de
localhost should be defined 2018-02-09 12:05:49 -05:00
Trammell hudson
a3177acb38
fix typos in efivarfs 2018-02-08 17:25:32 -05:00
Trammell hudson
bac7576979
enable efivarfs if it is available 2018-02-08 16:49:49 -05:00
Trammell hudson
383f1f66a5
merge changes from master into nerf branch in preparation for closing nerf branch 2018-02-02 17:06:49 -05:00
Trammell hudson
4150454e1c
add normal directories to path for chroot calls 2018-02-02 15:50:17 -05:00
Trammell hudson
a4d7654b1e
Build the Heads/NERF firmware for the Dell R630 server.
This development branch builds a NERF firmware for the Dell R630
server.  It does not use coreboot; instead it branches directly
from the vendor's PEI core into Linux and the Heads runtime
that is setup to be run as an EFI executable.
2017-09-20 10:29:14 -04:00
Francis Lam
472ffd35c0
Moved kernel command line parameters to config 2017-09-02 14:13:29 -04:00
Francis Lam
7cec25542d
Allow boot without unseal of TPM LUKS key
Closes issue 

Also changed to procedure to show LVM volume groups and block
device ids to aid in choosing the right combination during the
TPM LUKS key sealing process.
2017-09-02 14:13:29 -04:00
Francis Lam
26b2d49897
Allow TPM LUKS key to be set during default selection
Closes 
2017-09-02 14:13:29 -04:00
Francis Lam
0897a20b84
Ensure recovery for failed default boot
Should close 

Added reboot and poweroff scripts using /proc/sysrq-trigger

Also cleaned up the boot loop in generic-init
2017-09-02 14:13:29 -04:00
Francis Lam
e8f3d206c5
Strip invalid leading/trailing '/' from script params 2017-09-02 14:13:29 -04:00
Trammell Hudson
b550a7f967
rework startup scripts to combine totp prompt with boot mode selection (issue ) 2017-07-18 13:44:02 -04:00
Trammell Hudson
3c8adf2cf1
remove no longer required vga patch from xen (issue ) 2017-07-18 13:31:08 -04:00
Trammell Hudson
af3170ebf7
remove trailing / on the /boot device parameter 2017-07-17 12:43:14 -04:00
Trammell Hudson
831dca5124
remove older qubes-specific files, no longer required in generic boot env 2017-07-17 12:31:58 -04:00
Trammell Hudson
22282da905
default to mounting USB device on /media 2017-07-17 12:24:15 -04:00
Trammell Hudson
86f3e9f5dc
add /boot and /media to /etc/fstab on startup (issue ) 2017-07-17 12:22:48 -04:00
Trammell Hudson
ba98d5dda6
Merge branch 'usb-boot' of https://github.com/flammit/heads into flammit-usb-boot 2017-07-17 08:52:48 -04:00
Francis Lam
11aca354e9
Fixed edge case in kernel argument injection
Debian 9 installer doesn't have kernel arguments so the iommu fix
wasn't being applied properly.
2017-07-13 00:33:49 -04:00
Francis Lam
2a9ca6fdba
Fixed regression on kexec-save-key 2017-07-12 00:43:08 -04:00
Francis Lam
22a52ec4b8
Added TPM secret management to generic boot
Also cleaned up error handling and boot parsing edge cases
2017-07-12 00:17:45 -04:00
Francis Lam
d67360a24b
Added rollback protection to generic boot
Changed the checking of required hashes or required rollback state
to be right before boot, allowing the user to sign/set defaults
in interactive mode.

Also cleaned up usages of recovery and fixed iso parameter
regression.
2017-07-08 16:59:37 -04:00
Francis Lam
8004b5df2a
Added the ability to persist a default boot option
Similar to qubes-update, it will save then verify the hashes of
the kexec files. Once TOTP is verified, a normal boot will verify
that the file hashes and all the kexec params match and if
successful, boot directly to OS.

Also added a config option to require hash verification for
non-recovery boots, failing to recovery not met.
2017-07-04 19:49:14 -04:00
Francis Lam
ce4b91cad9
Minor tweaks to signing params and boot options
Also split out usb-scan to allow manual initiation of scan from
the recovery shell
2017-07-03 13:07:03 -04:00
Francis Lam
3614044fff
Added a generic boot config and persistent params
Refactored boot parsing code and applied that in local-init to
scan /boot for grub options and allow the user to unsafely boot
anything.  This goes a long way to addressing .

Optionally the user can customize those boot parameters or enforce
arbitrary hashes on the boot device by creating and signing config
files in /boot/ or /media/ or /media/kexec_iso/ISO_FILENAME/.
2017-07-02 23:01:04 -04:00
Francis Lam
76a20288a3
Tweaks to allow qubes install w/o custom script
usb-boot automatically uses internal xen binary / command line
when multiboot is detected.

also tweaked to evaluate/remove variable refs in kexec arguments
2017-07-02 14:27:02 -04:00