Commit Graph

64 Commits

Author SHA1 Message Date
Jonathon Hall
2f329d9007
kbd: Add setfont from kbd to set large console font on large displays
Build kbd and ship setfont if enabled with CONFIG_KBD.

When CONFIG_KBD is enabled, setconsolefont.sh will double the console
font size on large displays (>1600 lines tall as a heuristic).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-08-11 14:40:04 -04:00
Jonathon Hall
61609ff709
initrd/init: Prevent Restricted Boot bypass
The early recovery shell ("hold R") and serial recovery both could
bypass Restricted Boot since they occurred before config.user was
loaded.  Load config.user earlier before these recovery methods.

Executing a shell directly (if recovery failed) also would bypass
Restricted Boot, additionally leaking /tmp/secret.  Remove this from
the early recovery shell logic.  Also remove the final failsafe exec
and move the "just in case" recovery from normal boot here instead, in
case the regular init script fails.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-07-11 16:42:38 -04:00
Jonathon Hall
3c4a9fcf0d
Rename CONFIG_PUREBOOT_BASIC to CONFIG_BASIC
Remove brand name from this configuration variable.  For backward
compatibility, update config.user in init if the branded variable is
present.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:42:46 -04:00
Matt DeVillier
87eff7b775
gui-init: Implement blob jail feature
Blob jail provides device firmware blobs to the OS, so the OS does not
have to ship them.  The firmware is passed through the initrd to
/run/firmware, so it works with both installed and live OSes, and there
are no race conditions between firmware load and firmware availability.

The injection method in the initrd is specific to the style of init
script used by PureOS, since it must add a copy command to copy the
firmware from the initrd to /run.  If the init script is not of this
type, boot proceeds without device firmware.

This feature can be enabled or disabled from the config GUI.

Blob jail is enabled automatically if the Intel AX200 Wi-Fi module is
installed and the feature hasn't been explicitly configured.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
d148d3136a
init: Add optional board-specific init script
Boards can place a file in $(board)/initrd/bin/board-init.sh to perform
board-specific initialization.

If present, the board's $(board)/initrd directory is included in the
initrd via board.initrd.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Matt DeVillier
4bc6159ab6
Add PureBoot Basic Mode
PureBoot Basic mode provides the full Linux userspace in firmware from
Heads without requiring verified boot or a Librem Key.  Basic and
verified boot can be switched freely without changing firmware, such as
if a Librem Key is lost.

PureBoot Basic can apply firmware updates from a USB flash drive, and
having a complete Linux userspace enables more sophisticated recovery
options.

Basic mode boots to the first boot option by default, setting a default
is not required.  This can be configured in the config GUI.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Kyle Rankin
d937426306
Use the Librem Key as a TPM work-alike in the absence of a TPM
On machines without a TPM, we'd still like some way for the BIOS to
attest that it has not been modified. With a Librem Key, we can have the
BIOS use its own ROM measurement converted to a SHA256sum and truncated
so it fits within an HOTP secret. Like with a TPM, a malicious BIOS with
access to the correct measurements can send pre-known good measurements
to the Librem Key.

This approach provides one big drawback in that we have to truncate the
SHA256sum to 20 characters so that it fits within the limitations of
HOTP secrets. This means the possibility of collisions is much higher
but again, an attacker could also capture and spoof an existing ROM's
measurements if they have prior access to it, either with this approach
or with a TPM.

Signed-off-by: Kyle Rankin <kyle.rankin@puri.sm>
2023-06-14 09:58:34 -04:00
Jonathon Hall
6a9e7e293e
fstab, init: Remove securityfs mount
This is unused, remove it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 14:11:02 -04:00
Jonathon Hall
ea5b8dc30f
tpmr: Provide startsession for TPM1 and TPM2
It's a no-op on TPM1, but provide it so init doesn't have to
distinguish TPM1/TPM2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:10:24 -04:00
Jonathon Hall
5c33130ddc
init: Fixes for legacy-flash boards
Fix `[ -a` to POSIX `[ -e`.  Only run cbfs-init, key-init on normal
boards with bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:52:06 -04:00
Jonathon Hall
0760b6f237
init: Use busybox ash
init must use busybox ash because it is used on legacy-flash boards.
Change shebang, move needed functions to ash_functions.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:26:41 -04:00
Jonathon Hall
719dc57970
init: Always create symlinks for bash
No need to test whether bash is a symlink, bash ships on all boards
using the normal init script now.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
4b58788063
init: Execute /bin/sh for interactive shell, not /bin/bash
bash will not be the default interactive shell since readline support
increases the binary size significantly.  Use /bin/sh (busybox ash) for
that.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00
Jonathon Hall
b500505312
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized).  Some checks were
incorrect and are fixed by this change.  Most checks are now unchanged
relative to master.

There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2.  Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.

Previously, CONFIG_TPM could be variously 'y', 'n', or empty.  Now it
is always 'y' or 'n', and 'y' means "any TPM".  Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.

There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n').  This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Thierry Laurion
8da5d5d723
Add dual support for real bash and busybox's bash(ash)
- modify bash to have it configured with -Os
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
Thierry Laurion
8259d3ca1e
Add TRACE function tracing function to output on console when enabled
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs
- Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc)
- add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
2023-02-20 11:44:52 -05:00
Thierry Laurion
5bc2bc88e4
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config
-qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now
2023-02-18 21:52:44 -05:00
Sergii Dmytruk
565963d51d
Add CONFIG_BOOT_EXTRA_TTYS option
It specifies whitespace-separated list of console devices to run Heads
on in addition to the default one.

Example for board config:

    export CONFIG_BOOT_EXTRA_TTYS="tty0 tty1"

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-09-01 00:28:15 +03:00
Sergii Dmytruk
b989889e5f
init: assign CONFIG_TPM depending on /dev/tpm0 presence
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-20 23:56:47 +03:00
Thierry Laurion
90ad708849 Apply background colors when fbwhiptail binary is present. 2021-12-17 16:50:03 -05:00
Thierry Laurion
c6a36948c5 Whiptail: move BG_COLOR default definitions from gui-init to init
- Set them only when FBWHIPTAIL is used.
- If NEWT is used (console mode without framebuffer): set default to none.
2021-10-29 13:45:22 -04:00
Thierry Laurion
57417e149a
init: remove double heads motd banner, keeping the one sent to tty0 which is both local and remote 2021-07-25 19:53:35 -04:00
Matt DeVillier
cdbd0fcf2a
gui-init: Fix RAM and firmware version strings
Show RAM in GB, since the calculation in MB is imprecise as
it excludes RAM allocated for GPU (eg).

Fix display of firmware version strings which contain spaces by
adjusting cut and simply chopping off the date at the end, which
is a fixed 10-char length.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-01 13:42:10 -05:00
alex-nitrokey
481082f2d8
Include adaption of @MrChromebox
See
5a3f599233
2020-06-25 10:40:25 +02:00
Matt DeVillier
1bd93d6679
Eliminate use of CONFIG_USB_BOOT_DEV
mount-usb switched to dynamic USB device detection a while back,
so eliminate instances of CONFIG_BOOT_USB_DEV, and derive the
mounted USB device from /etc/mtab in the one place where it's
actually needed (usb-scan). Clean up areas around calls to
mount-usb for clarity/readability.

Addresses issue 

Test: Build Librem 13v4, boot ISO file on USB

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 22:32:08 -06:00
Matt DeVillier
6b5adcca6f
init: load usb modules for devices using USB keyboard
Some (out of tree) servers require use of a USB keyboard, and need
the USB kernel modules loaded prior to checking for keypress to enter
a recovery console. Since loading the modules affects the value in PRC5
and can cause issues putting a LUKS key in TPM, guard the loading of the
USB modules with CONFIG_USB_KEYBOARD and remove the unguarded call from
gui-init.

This should resolve issues  and .

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 11:40:34 -06:00
Francis Lam
92e706bf1b init: fix invalid GPG_TTY variable
busyboy tty isn't working after the musl-cross-make change so
revert to known good value.
2020-01-25 20:45:03 -08:00
Matt DeVillier
6cfbc86618
initrd: don't mount efivars fs on non-linuxboot systems
it doesn't exist and produces a spurious error on Heads systems

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-06-25 10:07:10 -05:00
tlaurion
695993b593
Merge branch 'master' into gpg2 2019-02-08 13:29:02 -05:00
Jason Andryuk
ca3a5fd2eb
Set GPG_TTY before calling gpg in key-init
gpg2 needs GPG_TTY set to function properly.  We set it in /init so it
is inherited by all children.  The call to $(tty) must be after /dev and
(preferably) /dev/pts are mounted.

Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
2019-01-29 11:16:19 -05:00
Thierry Laurion
fb3e2066b8
GPG_TTY is forced to /dev/console under init. Ash console is never called; trying to get console tty from the tty returns "no console". NEEDs BETTER FIX. 2019-01-29 11:15:48 -05:00
Kyle Rankin
ab0f9dd32e
Move custom configs below recovery shell
For safety it would be better if we source any custom configs after the
recovery shell in init. That way we can recover from any config mistakes.
2018-12-06 16:34:47 -08:00
Kyle Rankin
64484206ed
Load cbfs before combining configs and building fstab 2018-12-06 16:27:36 -08:00
Kyle Rankin
3eb62eed1a
Use global /tmp/config that combines multiple config files
As part of the config gui we want to be able to have the system define
new config options without them being lost if the user makes their own
changes in CBFS. To allow that this change creates a function initiated
in init that combines all /etc/config* files into /tmp/config. All
existing scripts have been changed to source /tmp/config instead of
/etc/config. The config-gui.sh script now uses /etc/config.user to hold
user configuration options but the combine_configs function will allow
that to expand as others want to split configuration out further.

As it stands here are the current config files:

/etc/config -- Compiled-in configuration options
/etc/config.user -- User preferences that override /etc/config
/tmp/config -- Running config referenced by the BIOS, combination
               of existing configs
2018-12-06 15:24:28 -08:00
Francis Lam
c0f3a4bb79
Read and measure an EFI file into initrd during init 2018-04-29 19:58:44 -07:00
Francis Lam
37feebdc76
Read and measure CBFS files into initrd during init 2018-04-20 09:29:57 -07:00
Francis Lam
e86123769b
Moved network init to a separate bootscript
Enabled recovery serial console (tested on kgpe-d16)
Minor fix to kexec-boot to correct xen boot
Remove busybox power utils
2018-03-10 15:40:07 -08:00
persmule
43ba7a777d fix the broken if syntax 2018-02-24 14:49:10 +08:00
Kyle Rankin
c35f385cf7
Make eth0 init condition on module, remove early bin/ash
To avoid unnecessary errors, only load the eth0 network if the e1000
module exists. Also remove /bin/ash so CONFIG_BOOTSCRIPT works.
2018-02-14 11:50:21 -08:00
Trammell hudson
15a07b3fce
enable qemu networking and ssh key login () 2018-02-09 13:42:52 -05:00
Trammell hudson
bac7576979
enable efivarfs if it is available 2018-02-08 16:49:49 -05:00
Trammell hudson
4150454e1c
add normal directories to path for chroot calls 2018-02-02 15:50:17 -05:00
Trammell hudson
a4d7654b1e
Build the Heads/NERF firmware for the Dell R630 server.
This development branch builds a NERF firmware for the Dell R630
server.  It does not use coreboot; instead it branches directly
from the vendor's PEI core into Linux and the Heads runtime
that is setup to be run as an EFI executable.
2017-09-20 10:29:14 -04:00
Trammell Hudson
b550a7f967
rework startup scripts to combine totp prompt with boot mode selection (issue ) 2017-07-18 13:44:02 -04:00
Trammell Hudson
86f3e9f5dc
add /boot and /media to /etc/fstab on startup (issue ) 2017-07-17 12:22:48 -04:00
Francis Lam
efd662c63a
adds a USB boot option with basic parsing to kexec
Supports booting from USB media using either the root device or
a signed ISO as the boot device.  Boot options are parsed with
quick/dirty shell scripts to infer kexec params.

Closes  and begins to address 
2017-04-29 13:40:34 -04:00
Trammell Hudson
7f600072ad
pass -ic option to tpm extend (issue ) 2017-04-23 16:12:08 -04:00
Trammell Hudson
353a0efe6f
Rework /init and qubes setup scripts (issue , , , , )
This adds support for seamless booting of Qubes with a TPM disk key,
as well as signing of qubes files in /boot with a Yubikey.

The signed hashes also includes a TPM counter, which is incremented
when new hashes are signed.  This prevents rollback attacks against
the /boot filesystem.

The TPMTOTP value is presented to the user at the time of entering
the disk encryption keys.  Hitting enter will generate a new code.

The LUKS headers are included in the TPM sealing of the disk
encryption keys.
2017-04-12 06:57:58 -04:00
Trammell Hudson
1744612df6
mount only takes one filesystem 2017-04-10 13:11:19 -04:00