Commit Graph

581 Commits

Author SHA1 Message Date
Krystian Hebel
9a72749675
initrd/bin/talos-init: remove alias for cbmem and bump coreboot revision
Updated cbmem searches for CBMEM exposed by kernel in sysfs before
trying to read it from memory directly. As such, there is no need for
pointing to that file explicitly.

New coreboot revision also fixes output of 'cbmem -t' caused by wrong
endianness.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-07-12 14:50:54 +02:00
Krystian Hebel
d1a18f1f83
initrd/bin/tpmr: replay PCR values from event log instead of assumming their values
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-07-12 14:50:42 +02:00
Thierry Laurion
f289b11290
kexec-insert-key: have output line for Building initrd on a new line 2023-07-07 15:32:59 -04:00
Thierry Laurion
d9a2b17dec
kexec-boot: display kexec command to be executed in DEBUG mode and permit to abort call. 2023-07-07 15:32:01 -04:00
Thierry Laurion
92e29c4891
Merge branch 'upstream_flashrom_13' into staging_all 2023-06-28 12:47:11 -04:00
Jonathon Hall
a1be4e4467
modules/flashrom: Update to 1776bb46
Update flashrom - in particular, this includes support for new chipsets
like Jasper Lake.

CONFIG_INTERAL_X86 was created so CONFIG_INTERNAL could apply to other
platforms, enable it for x86.

The default build target now requires sphinx, just build flashrom
itself.

Update flashrom_progress - filter out noise in newer flashrom that
chokes the progress bar implementation, make size detection more
robust, improve progress bar implementation slightly.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Co-signed by: Thierry Laurion <insurgo@riseup.net.
2023-06-27 12:23:44 -04:00
Marcin Cieślak
b849cc022e
With gpg 2.3+ user name can be empty 2023-06-27 11:40:02 -04:00
Thierry Laurion
c20c2bc580
oem-factory-reset needed changes to comply with gpg 2.4 toolstack changes 2023-06-27 11:39:59 -04:00
Marcin Cieślak
fda88486ee
Do not start second scdaemon for /etc/distro 2023-06-27 11:39:52 -04:00
Thierry Laurion
995a6931f1
config-gui.sh: permit io386 platform locking to be dynamically disabled at runtime
ash_functions: make sure /tmp/config is sourced before going to recovery shell
TODO: revisit https://source.puri.sm/firmware/pureboot/-/blob/Release-27/initrd/bin/config-gui.sh#L33 to have proper config store later on
2023-06-20 12:42:12 -04:00
Thierry Laurion
39bb6ea313
lock_chip: parametrize locking in function of board config exported config option
kexec-boot: depend on io386 presence and board config option to call lock_chip
2023-06-20 12:40:00 -04:00
Thierry Laurion
699a961381
io386: replace check for io386 to call lock_chip by a single common call from kexec-boot prior of real kexec 2023-06-12 13:51:20 -04:00
persmule
3f1c76ce11
Introduce io386 to heads and use it to finalize chipset at runtime
On some newer platforms of intel (confirmed on nehalem, sandy/ivy
bridge), coreboot after commit [2ac149d294af795710eb4bb20f093e9920604abd](https://review.coreboot.org/cgit/coreboot.git/commit/?id=2ac149d294af795710eb4bb20f093e9920604abd)
registers an SMI to lockdown some registers on the chipset, as well
as access to the SPI flash, optionally. The SMI will always be triggered
by coreboot during S3 resume, but can be triggered by either coreboot
or the payload during normal boot path.

Enabling lockdown access to SPI flash will effectly write-protect it,
but there is no runtime option for coreboot to control it, so letting
coreboot to trigger such SMI will leave the owner of the machine lost
any possibility to program the SPI flash with its own OS, and becomes
a nightmare if the machine is uneasy to disassemble, so a scheme could
be implement, in which the SMI to lockdown chipset and SPI flash is left
for a payload to trigger, and temporarily disabling such triggering in
order to program the SPI flash needs authentication.

I have implemented a passcode-protected runtime-disableable lockdown
with grub, described [here](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/grub-for-coreboot.md#update-for-coreboot-after-commit-2ac149d294af795710eb4bb20f093e9920604abd). In order to implement a similar scheme for
Heads, I wrote [io386](https://github.com/hardenedlinux/io386).

With this commit, io386 will be called before entering boot routine
to trigger the SMI to finalize the chipset and write protect the SPI
flash at the same time. Entering recovery shell will leave the flash
writable.

(The authentication routine implemented in previous revisions has been
split as an independent commit.)

Originally proposed under PR#326
2023-06-12 13:05:49 -04:00
Sergii Dmytruk
abd99a0f28
initrd/bin/talos-init: disable fast-reset
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:10:14 +03:00
Thierry Laurion
7b949a1a44
initrd/bin/seal-totp: PCR0-4 cannot be expected to be 0 on PPC64.
Seal with extended PCR values, expected to be the same at unseal-totp operation
2023-06-04 20:20:46 +03:00
Thierry Laurion
d917ca1c96
Qubes weekly signing key has changed. Removed testing and replaced.
Already minimized and cleaned upstream, taken from https://qubes.notset.fr/iso/ today
2023-05-24 12:13:07 -04:00
Thierry Laurion
40872d8b31
kexec-parse-boot: fix isolinux iso booting 2023-04-17 16:19:08 -04:00
Thierry Laurion
7ec658ffdf
kexec-iso-init: add TinyCore iso boot logic (Based on https://github.com/u-root/webboot/) 2023-04-17 16:18:22 -04:00
Thierry Laurion
4a78225548
media-scan/usb-init: add debugging info 2023-04-17 16:17:55 -04:00
Jonathon Hall
1217cffbc1
kexec-select-boot: Fix errant continue
This isn't in a loop, continue makes no sense.  ash had silently
ignored it.  Proceeding to the do_boot below is the correct behavior.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-04-12 09:12:14 -04:00
Jonathon Hall
f1708bf3a7
mount-usb: Fix word splitting in test for USB devices
For partitioned media or when more than one device is present, this
fixes a benign script error that ash had apparently ignored.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-04-12 09:12:10 -04:00
tlaurion
a447674a89
Merge pull request #1313 from Dasharo/talos_fan_speed 2023-04-03 19:40:38 -04:00
Thierry Laurion
8dbe85ddaf
Fix 'Tracing...' text output still stating functions instead of ash_functions where they are called from 2023-04-03 14:31:21 -04:00
Thierry Laurion
429d8bbead
move enable_usb from /etc/functions to /etc/ash_functions so that usb keyboard can be enabled from init
Reminder: insmod is a bash script and will fail on legacy-flash boards (which should not enable USB_KEYBOARD anyway)
2023-04-03 14:31:09 -04:00
Krystian Hebel
1a69b1dd07
initrd/bin/talos-init: add alias for cbmem
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
Krystian Hebel
9550d2b541
initrd/bin/talos-init: send IPL complete message to BMC
BMC awaits this message before it takes control over CPU fans speed.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
Thierry Laurion
65b81e6702
oem-factory-reset: remove duplicates and add proper error redirection to file
- Trace calls need to happen after sourcing /etc/functions not before
- Move sourcing of external files at beginning of file, remove /etc/functions sourcing duplicate
- gpg error redirection was sent to /dev/null where expected to be added to whiptail in case of error (2>&1 instead and redirection to file)
2023-03-30 13:12:24 -04:00
ThePlexus
277465b347
fix broken OEM re-ownership process
Problem
When using a custom password for TPM, the OEM re-ownership process is broken

Impact 
The OEM re-ownership process breaks for any user setting a custom password and not just using 12345678 

First appeared
6923fb5e20

Detail
on line 498, if blank, the TPM custom password is overwritten with TPM_PASS_DEF (eg, when no custom password is set by the user installing)

```
if [ "$TPM_PASS" == "" ]; then TPM_PASS=$TPM_PASS_DEF; fi
```
so far so good.  $TPM_PASS should be used for all TPM interaction from this point. $TMP_PASS_DEF is now a disposed of variable.

we see that happens when resetting the TPM on line 712 (generate_checksums) is that $TPM_PASS is used (correctly)

```## reset TPM and set password
if [ "$CONFIG_TPM" = "y" ]; then
  echo -e "\nResetting TPM...\n"
  tpmr reset "$TPM_PASS" >/dev/null 2>/tmp/error
---SNIP
```
The TPM now has either the custom password of the user, or the default of 12345678 depending on user selection.

On line 712, we duck into the generate_checksums sub, which for some reason reverts to TPM_PASS_DEF

```
    # create Heads TPM counter
    if [ "$CONFIG_TPM" = "y" ];then
	    if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
		    tpmr counter_create \
			 -pwdo "$TPM_PASS_DEF" \
--SNIP
```

This then, rightly, fails due to 
```
Authentication failed (Incorrect Password) (ox1) from TPM_CreateCounter
```
2023-03-29 21:05:52 +01:00
Thierry Laurion
ab16b3b26f
ikexec-save-default: fix case when no crypttab found in initrd
- /tmp/initrd_extract was attempted to be deleted while under that directory when no crypptab found.
- changing of directory to / is non-conditional prior of deletion: move to cleaning step
- Clarity on message displayed to user when a generic crypttab will be generated in case of no OS override
2023-03-14 10:42:21 -04:00
Jonathon Hall
6a9e7e293e
fstab, init: Remove securityfs mount
This is unused, remove it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 14:11:02 -04:00
Jonathon Hall
1f8c88a7eb
gui-init, tpm-reset: Enforce TPM password maximum length
TPM password must be 1-32 characters.  Loop if the password is not
valid or the repeated password doesn't match, so the user can try
again.

Move prompt_new_owner_password to functions and use in both gui-init
and tpm-reset.

Fixes #1336

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:34:40 -04:00
Jonathon Hall
30963e121f
Combine t430-flash.init, x23-flash.init, fix insmod
They're the same other than a TRACE, combine them.  Use busybox
insmod since the insmod script uses bash, we don't need the TPM PCRs on
legacy-flash-boards.

Remove PCR4 extend, these boards lack TPM configuration.  Update ROM
example name.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:23:29 -04:00
Jonathon Hall
ea5b8dc30f
tpmr: Provide startsession for TPM1 and TPM2
It's a no-op on TPM1, but provide it so init doesn't have to
distinguish TPM1/TPM2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:10:24 -04:00
Jonathon Hall
5c33130ddc
init: Fixes for legacy-flash boards
Fix `[ -a` to POSIX `[ -e`.  Only run cbfs-init, key-init on normal
boards with bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:52:06 -04:00
Jonathon Hall
0c4fdf343b
poweroff, reboot: Do not use bash
These need to work on legacy-flash boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:51:42 -04:00
Jonathon Hall
0760b6f237
init: Use busybox ash
init must use busybox ash because it is used on legacy-flash boards.
Change shebang, move needed functions to ash_functions.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:26:41 -04:00
Jonathon Hall
55b3fcfe1a
tpmr: Use at_exit for cleanup traps
Multiple traps overwrite each other.  While no tpmr functions have more
than one trap right now, it is fragile, and the quoting is complex due
to double expansion.  Use at_exit to add exit handlers that accumulate
and do not require special quoting.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:50:43 -05:00
Jonathon Hall
b21d8f7a94
oem-factory-reset: Use tpmr reset
tpm-reset is just a prompt for the password followed by tpmr reset.
oem-factory-reset already bypasses the prompt, just call tpmr reset
directly.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:46:01 -05:00
Jonathon Hall
ff481b98fb
gui-init: Fix spelling of generate_totp_hotp()
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:42:19 -05:00
Jonathon Hall
a0272270fe
gui-init, kexec-unseal-key: Move PCR debugging output to DEBUG calls
These were still writing some debugging output containing flags and
PCRs even when debug was not enabled.  Use DEBUG.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:39:54 -05:00
Jonathon Hall
698fc83046
gui-init: Eliminate extra TPM owner password prompts in TPM reset
We just set the TPM owner password, so there's no need to make the user
enter it again.  Eliminates some failure modes if the user mistypes it
or enters the wrong password.

Allow optionally passing in the TPM owner password in tpmr seal,
check_tpm_counter(), seal-totp, and generate_totp_htop().  The user is
still prompted if the password is needed but was not provided, so
existing uses in other contexts continue to work unchanged.

Prompt for the password in reset_tpm() and pass it down to each of the
above.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:36:24 -05:00
Jonathon Hall
9d34dd6687
tpmr: Apply owner password to endorsement hierarchy
Heads doesn't use the endorsement hierarchy, but we shouldn't leave it
with an empty password following a tpm2 clear.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:09 -05:00
Jonathon Hall
67f3ac5103
tpmr: Provide reset for both TPM1 and TPM2
tpmr reset now works for both TPM1 and TPM2; bring in TPM1 logic from
tpm-reset.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:07:44 -05:00
Jonathon Hall
a2e4392497
tpmr: Do not hash sealing passwords, always pass passwords as hex
Don't hash password used to seal an object.  This limits the password
to 32-characters but avoids obfuscating the usage of the password.  The
32-character limit is considered acceptable because password limits are
lower already (GPG token limits to 25 chars).  We may allow >32 char
passwords in the future by hashing only if the password is >32 chars.

Always pass passwords as hex to tpm2-tools to avoid possible ambiguity
if the password begins with a control prefix like 'hex:' or 'file:'.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 14:46:34 -05:00
Jonathon Hall
298cde26ab
tpmr: Set dictionary lockout parameters and auth when resetting TPM2
Set consistent dictionary lockout parameters suited to Heads.  Disable
lockout reset by setting a random password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 12:25:08 -05:00
Thierry Laurion
536f4a1623
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts
gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout)
kexec-seal-key: Add DEBUG statement for PCR precalc
seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops
seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret
tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls
tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1
tpmr: add DO_WITH_DEBUG calls for calcfuturepcr
functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL

Not so related but part of output review and corrections:
kexec-insert-key: cosmetic changes prepending "+++" to disk related changes
kexec-save-default: cosmetic changes prepending "+++" to disk related changes
config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-10 12:11:57 -05:00
Jonathon Hall
77060b0031
tpmr: Delete outdated TODO in tpm2_seal
The sealing password is now hashed, so there's no length limit.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:18:11 -05:00
Jonathon Hall
733fea8e2d
tpmr: Add TRACE to cleanup functions
Add TRACE to cleanup_shred, cleanup_session

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:17:01 -05:00
Jonathon Hall
ebabcffbdc
tpmr: Use existing HMAC session in tpm2_unseal
We already have HMAC sessions for encryption and decryption, there's no
need to create an ad-hoc session in tpm2_unseal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:07:00 -05:00
Jonathon Hall
8d834f649d
tpmr: Add missing traces to tpm2_kexec_finalize, tpm2_shutdown
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:06:31 -05:00