Commit Graph

851 Commits

Author SHA1 Message Date
Marcin Cieślak
fda88486ee
Do not start second scdaemon for /etc/distro 2023-06-27 11:39:52 -04:00
Jonathon Hall
8289d1bb29
oem-factory-reset: Offer to use all defaults on Librem boards only
Introduce CONFIG_OEMRESET_OFFER_DEFAULTS and enable it on Librem
boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:20:21 -04:00
Jonathon Hall
f6134e9c35
gui-init: Opt into skipping QR code scan for Librem boards only
Introduce CONFIG_TOTP_SKIP_QRCODE to skip this step and enable it on
Librem boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-23 08:18:59 -04:00
Jonathon Hall
71243c1a13
config-gui.sh,gui-init: Fix whiptail message box sizes to 16 60
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:36:04 -04:00
Jonathon Hall
89858f52a9
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 15:15:23 -04:00
Jonathon Hall
c5183253a6
Add CONFIG_BRAND_NAME and allow overriding in Makefile with BRAND_NAME
Use CONFIG_BRAND_NAME to control the brand name displayed in the UI.
Override by setting BRAND_NAME when building, either in the Makefile or
on the command line.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:47:59 -04:00
Jonathon Hall
3c4a9fcf0d
Rename CONFIG_PUREBOOT_BASIC to CONFIG_BASIC
Remove brand name from this configuration variable.  For backward
compatibility, update config.user in init if the branded variable is
present.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 14:42:46 -04:00
Jonathon Hall
1bf8331ffb
Blob jail: Add zstd-decompress, decompress more complex archives
Debian 12's initrd by default now consists of an uncompressed cpio
archive containing microcode, followed by a zstd-compressed cpio
archive.  inject_firmware.sh only supported gzip-compressed cpio, so it
could not extract /init from this archive.

Add zstd-decompress to decompress zstd streams (uncompressed size is
about 180 KB).

Add unpack_initramfs.sh which is able to decompress uncompressed, gzip,
or zstd archives, with multiple segments, much like the Linux kernel
itself does.

Use unpack_initramfs.sh to extract /init for blob jail.

Don't compress the new archive segment containing firmware and the
updated /init.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:50 -04:00
Jonathon Hall
e9a5b27e6c
librem_mini,librem_mini_v2: Don't use three values for auto poweron
PureBoot doesn't have any other three-valued settings and this doesn't
present very well in the config UI.

Instead make this a two-valued setting; drop the mode that forces the
EC setting to "stay off" at every boot because this is the default.

When disabling automatic power-on, disable the EC BRAM setting too.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:49 -04:00
Jonathon Hall
5e555359a4
config-gui.sh: Fix refactors, simplify implementation more
Stop manually loading config values, just update config in environment.

Never test values against "n", since many default to empty.  Always
test ="y" or !="y", any other value is off.

Add set_user_config() function to set a value in config.user,
combine configs, and update config in environment.  Use it in setting
implementations.

Remove toggle_config, it wasn't very useful because the settings still
test y/n in order to show specific confirmation and success messages.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:48 -04:00
Jonathon Hall
01594a823b
config-gui.sh: Update sizes of whiptail prompts
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:48 -04:00
Matt DeVillier
87eff7b775
gui-init: Implement blob jail feature
Blob jail provides device firmware blobs to the OS, so the OS does not
have to ship them.  The firmware is passed through the initrd to
/run/firmware, so it works with both installed and live OSes, and there
are no race conditions between firmware load and firmware availability.

The injection method in the initrd is specific to the style of init
script used by PureOS, since it must add a copy command to copy the
firmware from the initrd to /run.  If the init script is not of this
type, boot proceeds without device firmware.

This feature can be enabled or disabled from the config GUI.

Blob jail is enabled automatically if the Intel AX200 Wi-Fi module is
installed and the feature hasn't been explicitly configured.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
2d3ecfa41e
librem_mini/librem_mini_v2: Add automatic power-on setting
Mini v1/v2's EC can automatically power on the system when power is
applied, based on a value in EC BRAM.  Add a configuration setting to
optionally set this value.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
d148d3136a
init: Add optional board-specific init script
Boards can place a file in $(board)/initrd/bin/board-init.sh to perform
board-specific initialization.

If present, the board's $(board)/initrd directory is included in the
initrd via board.initrd.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:47 -04:00
Jonathon Hall
206d59dc71
Add USB autoboot feature to PureBoot Basic
USB autoboot automatically boots to a USB flash drive if one is present
during boot.  This is intended for headless deployments as a method to
recover the installed operating system from USB without needing to
attach a display and keyboard.

USB autoboot can be controlled in config.user and the config GUI.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Jonathon Hall
b0e0a91c97
Add PureOS signing key
Add the PureOS archive signing key to the keys accepted for signed
ISOs.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:46 -04:00
Kyle Rankin
79da79a5e4
Implement Restricted Boot Mode
Restricted Boot mode only allows booting from signed files, whether that
is signed kernels in /boot or signed ISOs on mounted USB disks. This
disables booting from abitrary USB disks as well as the forced "unsafe"
boot mode. This also disables the recovery console so you can't bypass
this mode simply by running kexec manually.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Matt DeVillier
4bc6159ab6
Add PureBoot Basic Mode
PureBoot Basic mode provides the full Linux userspace in firmware from
Heads without requiring verified boot or a Librem Key.  Basic and
verified boot can be switched freely without changing firmware, such as
if a Librem Key is lost.

PureBoot Basic can apply firmware updates from a USB flash drive, and
having a complete Linux userspace enables more sophisticated recovery
options.

Basic mode boots to the first boot option by default, setting a default
is not required.  This can be configured in the config GUI.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Jonathon Hall
468643ee82
functions: Add toggle_config function for use in config GUI
toggle_config() toggles the value of a config.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
39c655ae1d
Add load_config_value() and get_config_display_action()
Add these two functions for use in config-gui.sh for future toggles.

load_config_value() obtains the value of a config setting, defaulting
to 'n'.  get_config_display_action() displays 'Enable' or 'Disable'
depending on the current value.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
606c29f0ec
Extract enable_usb_storage() from mount-usb
enable_usb_storage() inserts usb-storage.ko if not already loaded, then
waits for USB storage devices to appear.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:44 -04:00
Jonathon Hall
b365f1324a
Extract pause_automatic_boot() from gui-init to gui_functions
pause_automatic_boot() prompts that an automatic boot is about to occur
and allows the user to interrupt it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Jonathon Hall
5d7afa2e02
kexec-select-boot: Extract boot menu scanning logic
Move boot menu scanning logic to scan_boot_options() in /etc/functions

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Jonathon Hall
3a917bb90b
config-gui.sh: Extract utilities from config-gui.sh
Extract utilities from config-gui.sh for use in additional config
settings.  read_rom() reads the current ROM with a message for failure.
replace_rom_file() replaces a CBFS file in a ROM.  set_config() sets a
configuration variable in a file.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:43 -04:00
Matt DeVillier
14a5d19f1f
Move show_system_info() from gui-init to gui-functions
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:42 -04:00
Matt DeVillier
3191bfbdaf
oem-factory-reset: Add 'use defaults' prompt to simplify user options
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-21 13:26:42 -04:00
Kyle Rankin
efc49c7425
Add Root file hash feature
Currently Heads will check files in /boot for tampering before booting
into a system. It would be nice if you could use the trusted environment
within Heads and extend this to check files in / itself. This new script
adds that functionality, however due to the length of time it takes to
perform these kinds of checks, it doesn't run automatically (yet).

This feature can be configured from the config GUI - the root device/
directories to check can be set, and it can be configured to run during
boot.

To make this a bit easier to use, I added a feature to detect whether
the hash file exists and if not, to display a more limited menu to the
user guiding them to create the initial hash file. Otherwise it will
display the date the file was last modified, which can be useful to
determine how stale it is.
2023-06-21 13:26:37 -04:00
Thierry Laurion
995a6931f1
config-gui.sh: permit io386 platform locking to be dynamically disabled at runtime
ash_functions: make sure /tmp/config is sourced before going to recovery shell
TODO: revisit https://source.puri.sm/firmware/pureboot/-/blob/Release-27/initrd/bin/config-gui.sh#L33 to have proper config store later on
2023-06-20 12:42:12 -04:00
Thierry Laurion
39bb6ea313
lock_chip: parametrize locking in function of board config exported config option
kexec-boot: depend on io386 presence and board config option to call lock_chip
2023-06-20 12:40:00 -04:00
Matt DeVillier
d094dcd346
gui-init/seal-libremkey: reduce friction when generating new secret
Reduce friction when generating a new TOTP/HOTP secret by eliminating
an unnecessary 'press enter to continue' prompt following QR code
generation, and by attempting to use the default admin PIN set by
the OEM factory reset function. Fall back to prompting the user
if the default PIN fails.

Also, ensure error messages are visible to users before being returned
back to the GUI menu from which they came by wrapping existing calls to die()

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2023-06-14 09:58:35 -04:00
Kyle Rankin
d937426306
Use the Librem Key as a TPM work-alike in the absence of a TPM
On machines without a TPM, we'd still like some way for the BIOS to
attest that it has not been modified. With a Librem Key, we can have the
BIOS use its own ROM measurement converted to a SHA256sum and truncated
so it fits within an HOTP secret. Like with a TPM, a malicious BIOS with
access to the correct measurements can send pre-known good measurements
to the Librem Key.

This approach provides one big drawback in that we have to truncate the
SHA256sum to 20 characters so that it fits within the limitations of
HOTP secrets. This means the possibility of collisions is much higher
but again, an attacker could also capture and spoof an existing ROM's
measurements if they have prior access to it, either with this approach
or with a TPM.

Signed-off-by: Kyle Rankin <kyle.rankin@puri.sm>
2023-06-14 09:58:34 -04:00
Thierry Laurion
699a961381
io386: replace check for io386 to call lock_chip by a single common call from kexec-boot prior of real kexec 2023-06-12 13:51:20 -04:00
persmule
3f1c76ce11
Introduce io386 to heads and use it to finalize chipset at runtime
On some newer platforms of intel (confirmed on nehalem, sandy/ivy
bridge), coreboot after commit [2ac149d294af795710eb4bb20f093e9920604abd](https://review.coreboot.org/cgit/coreboot.git/commit/?id=2ac149d294af795710eb4bb20f093e9920604abd)
registers an SMI to lockdown some registers on the chipset, as well
as access to the SPI flash, optionally. The SMI will always be triggered
by coreboot during S3 resume, but can be triggered by either coreboot
or the payload during normal boot path.

Enabling lockdown access to SPI flash will effectly write-protect it,
but there is no runtime option for coreboot to control it, so letting
coreboot to trigger such SMI will leave the owner of the machine lost
any possibility to program the SPI flash with its own OS, and becomes
a nightmare if the machine is uneasy to disassemble, so a scheme could
be implement, in which the SMI to lockdown chipset and SPI flash is left
for a payload to trigger, and temporarily disabling such triggering in
order to program the SPI flash needs authentication.

I have implemented a passcode-protected runtime-disableable lockdown
with grub, described [here](https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/grub-for-coreboot.md#update-for-coreboot-after-commit-2ac149d294af795710eb4bb20f093e9920604abd). In order to implement a similar scheme for
Heads, I wrote [io386](https://github.com/hardenedlinux/io386).

With this commit, io386 will be called before entering boot routine
to trigger the SMI to finalize the chipset and write protect the SPI
flash at the same time. Entering recovery shell will leave the flash
writable.

(The authentication routine implemented in previous revisions has been
split as an independent commit.)

Originally proposed under PR#326
2023-06-12 13:05:49 -04:00
Sergii Dmytruk
abd99a0f28
initrd/bin/talos-init: disable fast-reset
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2023-06-07 01:10:14 +03:00
Thierry Laurion
7b949a1a44
initrd/bin/seal-totp: PCR0-4 cannot be expected to be 0 on PPC64.
Seal with extended PCR values, expected to be the same at unseal-totp operation
2023-06-04 20:20:46 +03:00
Thierry Laurion
d917ca1c96
Qubes weekly signing key has changed. Removed testing and replaced.
Already minimized and cleaned upstream, taken from https://qubes.notset.fr/iso/ today
2023-05-24 12:13:07 -04:00
Thierry Laurion
40872d8b31
kexec-parse-boot: fix isolinux iso booting 2023-04-17 16:19:08 -04:00
Thierry Laurion
7ec658ffdf
kexec-iso-init: add TinyCore iso boot logic (Based on https://github.com/u-root/webboot/) 2023-04-17 16:18:22 -04:00
Thierry Laurion
4a78225548
media-scan/usb-init: add debugging info 2023-04-17 16:17:55 -04:00
Jonathon Hall
1217cffbc1
kexec-select-boot: Fix errant continue
This isn't in a loop, continue makes no sense.  ash had silently
ignored it.  Proceeding to the do_boot below is the correct behavior.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-04-12 09:12:14 -04:00
Jonathon Hall
f1708bf3a7
mount-usb: Fix word splitting in test for USB devices
For partitioned media or when more than one device is present, this
fixes a benign script error that ash had apparently ignored.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-04-12 09:12:10 -04:00
tlaurion
a447674a89
Merge pull request #1313 from Dasharo/talos_fan_speed 2023-04-03 19:40:38 -04:00
Thierry Laurion
8dbe85ddaf
Fix 'Tracing...' text output still stating functions instead of ash_functions where they are called from 2023-04-03 14:31:21 -04:00
Thierry Laurion
429d8bbead
move enable_usb from /etc/functions to /etc/ash_functions so that usb keyboard can be enabled from init
Reminder: insmod is a bash script and will fail on legacy-flash boards (which should not enable USB_KEYBOARD anyway)
2023-04-03 14:31:09 -04:00
Krystian Hebel
1a69b1dd07
initrd/bin/talos-init: add alias for cbmem
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
Krystian Hebel
9550d2b541
initrd/bin/talos-init: send IPL complete message to BMC
BMC awaits this message before it takes control over CPU fans speed.

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-03-30 21:04:01 +02:00
Thierry Laurion
65b81e6702
oem-factory-reset: remove duplicates and add proper error redirection to file
- Trace calls need to happen after sourcing /etc/functions not before
- Move sourcing of external files at beginning of file, remove /etc/functions sourcing duplicate
- gpg error redirection was sent to /dev/null where expected to be added to whiptail in case of error (2>&1 instead and redirection to file)
2023-03-30 13:12:24 -04:00
ThePlexus
277465b347
fix broken OEM re-ownership process
Problem
When using a custom password for TPM, the OEM re-ownership process is broken

Impact 
The OEM re-ownership process breaks for any user setting a custom password and not just using 12345678 

First appeared
6923fb5e20

Detail
on line 498, if blank, the TPM custom password is overwritten with TPM_PASS_DEF (eg, when no custom password is set by the user installing)

```
if [ "$TPM_PASS" == "" ]; then TPM_PASS=$TPM_PASS_DEF; fi
```
so far so good.  $TPM_PASS should be used for all TPM interaction from this point. $TMP_PASS_DEF is now a disposed of variable.

we see that happens when resetting the TPM on line 712 (generate_checksums) is that $TPM_PASS is used (correctly)

```## reset TPM and set password
if [ "$CONFIG_TPM" = "y" ]; then
  echo -e "\nResetting TPM...\n"
  tpmr reset "$TPM_PASS" >/dev/null 2>/tmp/error
---SNIP
```
The TPM now has either the custom password of the user, or the default of 12345678 depending on user selection.

On line 712, we duck into the generate_checksums sub, which for some reason reverts to TPM_PASS_DEF

```
    # create Heads TPM counter
    if [ "$CONFIG_TPM" = "y" ];then
	    if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
		    tpmr counter_create \
			 -pwdo "$TPM_PASS_DEF" \
--SNIP
```

This then, rightly, fails due to 
```
Authentication failed (Incorrect Password) (ox1) from TPM_CreateCounter
```
2023-03-29 21:05:52 +01:00
Thierry Laurion
ab16b3b26f
ikexec-save-default: fix case when no crypttab found in initrd
- /tmp/initrd_extract was attempted to be deleted while under that directory when no crypptab found.
- changing of directory to / is non-conditional prior of deletion: move to cleaning step
- Clarity on message displayed to user when a generic crypttab will be generated in case of no OS override
2023-03-14 10:42:21 -04:00
Jonathon Hall
6a9e7e293e
fstab, init: Remove securityfs mount
This is unused, remove it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 14:11:02 -04:00
Jonathon Hall
1f8c88a7eb
gui-init, tpm-reset: Enforce TPM password maximum length
TPM password must be 1-32 characters.  Loop if the password is not
valid or the repeated password doesn't match, so the user can try
again.

Move prompt_new_owner_password to functions and use in both gui-init
and tpm-reset.

Fixes #1336

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:34:40 -04:00
Jonathon Hall
30963e121f
Combine t430-flash.init, x23-flash.init, fix insmod
They're the same other than a TRACE, combine them.  Use busybox
insmod since the insmod script uses bash, we don't need the TPM PCRs on
legacy-flash-boards.

Remove PCR4 extend, these boards lack TPM configuration.  Update ROM
example name.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:23:29 -04:00
Jonathon Hall
ea5b8dc30f
tpmr: Provide startsession for TPM1 and TPM2
It's a no-op on TPM1, but provide it so init doesn't have to
distinguish TPM1/TPM2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:10:24 -04:00
Jonathon Hall
5c33130ddc
init: Fixes for legacy-flash boards
Fix `[ -a` to POSIX `[ -e`.  Only run cbfs-init, key-init on normal
boards with bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:52:06 -04:00
Jonathon Hall
0c4fdf343b
poweroff, reboot: Do not use bash
These need to work on legacy-flash boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:51:42 -04:00
Jonathon Hall
0760b6f237
init: Use busybox ash
init must use busybox ash because it is used on legacy-flash boards.
Change shebang, move needed functions to ash_functions.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:26:41 -04:00
Jonathon Hall
55b3fcfe1a
tpmr: Use at_exit for cleanup traps
Multiple traps overwrite each other.  While no tpmr functions have more
than one trap right now, it is fragile, and the quoting is complex due
to double expansion.  Use at_exit to add exit handlers that accumulate
and do not require special quoting.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:50:43 -05:00
Jonathon Hall
b21d8f7a94
oem-factory-reset: Use tpmr reset
tpm-reset is just a prompt for the password followed by tpmr reset.
oem-factory-reset already bypasses the prompt, just call tpmr reset
directly.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:46:01 -05:00
Jonathon Hall
ff481b98fb
gui-init: Fix spelling of generate_totp_hotp()
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:42:19 -05:00
Jonathon Hall
a0272270fe
gui-init, kexec-unseal-key: Move PCR debugging output to DEBUG calls
These were still writing some debugging output containing flags and
PCRs even when debug was not enabled.  Use DEBUG.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:39:54 -05:00
Jonathon Hall
698fc83046
gui-init: Eliminate extra TPM owner password prompts in TPM reset
We just set the TPM owner password, so there's no need to make the user
enter it again.  Eliminates some failure modes if the user mistypes it
or enters the wrong password.

Allow optionally passing in the TPM owner password in tpmr seal,
check_tpm_counter(), seal-totp, and generate_totp_htop().  The user is
still prompted if the password is needed but was not provided, so
existing uses in other contexts continue to work unchanged.

Prompt for the password in reset_tpm() and pass it down to each of the
above.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:36:24 -05:00
Jonathon Hall
9d34dd6687
tpmr: Apply owner password to endorsement hierarchy
Heads doesn't use the endorsement hierarchy, but we shouldn't leave it
with an empty password following a tpm2 clear.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:09 -05:00
Jonathon Hall
67f3ac5103
tpmr: Provide reset for both TPM1 and TPM2
tpmr reset now works for both TPM1 and TPM2; bring in TPM1 logic from
tpm-reset.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:07:44 -05:00
Jonathon Hall
a2e4392497
tpmr: Do not hash sealing passwords, always pass passwords as hex
Don't hash password used to seal an object.  This limits the password
to 32-characters but avoids obfuscating the usage of the password.  The
32-character limit is considered acceptable because password limits are
lower already (GPG token limits to 25 chars).  We may allow >32 char
passwords in the future by hashing only if the password is >32 chars.

Always pass passwords as hex to tpm2-tools to avoid possible ambiguity
if the password begins with a control prefix like 'hex:' or 'file:'.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 14:46:34 -05:00
Jonathon Hall
298cde26ab
tpmr: Set dictionary lockout parameters and auth when resetting TPM2
Set consistent dictionary lockout parameters suited to Heads.  Disable
lockout reset by setting a random password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 12:25:08 -05:00
Thierry Laurion
536f4a1623
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts
gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout)
kexec-seal-key: Add DEBUG statement for PCR precalc
seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops
seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret
tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls
tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1
tpmr: add DO_WITH_DEBUG calls for calcfuturepcr
functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL

Not so related but part of output review and corrections:
kexec-insert-key: cosmetic changes prepending "+++" to disk related changes
kexec-save-default: cosmetic changes prepending "+++" to disk related changes
config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-10 12:11:57 -05:00
Jonathon Hall
77060b0031
tpmr: Delete outdated TODO in tpm2_seal
The sealing password is now hashed, so there's no length limit.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:18:11 -05:00
Jonathon Hall
733fea8e2d
tpmr: Add TRACE to cleanup functions
Add TRACE to cleanup_shred, cleanup_session

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:17:01 -05:00
Jonathon Hall
ebabcffbdc
tpmr: Use existing HMAC session in tpm2_unseal
We already have HMAC sessions for encryption and decryption, there's no
need to create an ad-hoc session in tpm2_unseal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:07:00 -05:00
Jonathon Hall
8d834f649d
tpmr: Add missing traces to tpm2_kexec_finalize, tpm2_shutdown
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:06:31 -05:00
Jonathon Hall
c62b96b4a6
tpmr: Move tpm1_unseal next to tpm2_unseal
All the other tpm2/tpm1 corresponding wrappers are next to each other,
do the same for unseal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:44:47 -05:00
Jonathon Hall
d88fcca2f2
kexec-seal-key, seal-totp: Silence dd status when setting up PCRs
Add status=none to dd invocations building PCR data.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:42:19 -05:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark.  Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Jonathon Hall
215ff2a397
reboot, poweroff: Prepare TPM2 for shutdown
TPM2 must be prepared for shutdown, or it may track an auth failure for
dictionary attack prevention (per the spec, to prevent an attack by
attempting to authenticate and then powering off the TPM before it can
update the nonvolatile counter).

Add tpmr shutdown to prepare for shutdown (no-op on TPM1).  Invoke it
from poweroff and reboot.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:20:21 -05:00
Jonathon Hall
c7d0f7969e
kexec-seal-key: Fix masked parameter position in tpmr seal
The password was moved to parameter 7 in an earlier commit.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:19:37 -05:00
Jonathon Hall
7b8824adf1
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2
Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for
both TPM1 and TPM2.

Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key.  This is
essentially the TPM2 logic now that tpmr provides the same wrapped
commands for both TPM1 and TPM2.

Remove algorithm prefix from PCR list in tpmr unseal for consistency
with tpmr seal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:57 -05:00
Jonathon Hall
641bea4d46
tpmr: Don't add newline when extending PCR with literal data
tpmr extend with -ic (extend with literal data) was adding a newline,
use echo -n so it only includes the data given in the hash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
809b55666b
kexec-seal-key: Clean up TODOs and TPM2 seal
Clean up TODO comments.

Clean up redirections for tpm2 pcrread, use bash redirect to command.

Use DO_WITH_DEBUG --mask-position to trace tpmr seal for TPM2 and hide
the password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
719dc57970
init: Always create symlinks for bash
No need to test whether bash is a symlink, bash ships on all boards
using the normal init script now.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
92a6b5410d
tpmr: Improve debug output, hide secrets, trim extend output more
Provide mask_param() function to uniformly mask secret parameters,
while still indicating whether they are empty.

Extend DO_WITH_DEBUG to allow masking a password parameter by position,
using mask_param().  Move from ash_functions to functions (isn't used
by ash scripts).

Mask password parameters in kexec-unseal-key and tpmr seal.  Use
mask_param() on existing masked params in tpmr.

Trim more troubleshooting output from tpm2_extend() in tpmr.

Clarify tpmr kexec_finalize echo; it's the TPM's platform heirarchy,
users might not know what this was referring to.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
93459563d0
tpmr: Delete unimplemented nvram commands
nv_definespace, nv_writevalue, and nv_readvalue were never actually
implemented, remove them.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
7afb1e474f
tpmr: Provide HMAC session when unsealing with policy
Provide an HMAC session to tpm2 when unsealing with an auth policy.
The HMAC session is used for transport encryption.

This allows transport encryption to work when unsealing.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
58c0b7c979
tpmr: Remove PCR debug dump, silence nonsense unseal errors for new TPM
Remove dump of all PCRs from tpm2_extend, it was causing other errors
to roll off the screen before they could be inspected, and it's no
longer needed now that TPM2 is working.

Silence nonsense errors from unseal if TPM2 hasn't been reset.  tpm2 -S
with a file that doesn't exist would complain that the parameter format
was not understood (looks like a script error), when the actual problem
was that the file doesn't exist yet.  We can't try to unseal anyway
without a primary handle, so just exit unsuccessfully in that case.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
b5985fef03
kexec-seal-key: Reset PCR 23 before precomputing with it
Precomputation relies on PCR 23 being 0 initially, so reset it in case
it isn't.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00
Jonathon Hall
eda24d85bf
*-flash.init: Use busybox ash
Busybox no longer has CONFIG_BASH since we are deploying bash on most
boards.  We also should clearly indicate which scripts cannot use
bashisms.

Change shebang in x230-flash.init, t430-flash.init, flash.sh to
/bin/ash.  Execute /bin/sh for interactive shells.

Move key functions needed by those scripts to initrd/etc/ash_functions.
Source ash_functions instead of functions in those scripts, so any
bashisms in other functions won't break parsing of the script in ash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00
Jonathon Hall
4b58788063
init: Execute /bin/sh for interactive shell, not /bin/bash
bash will not be the default interactive shell since readline support
increases the binary size significantly.  Use /bin/sh (busybox ash) for
that.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00
Jonathon Hall
c98ae5b53d
recovery, passwd: Use /bin/sh for interactive shells
Use /bin/sh (ash in busybox builds) for interactive shells, not bash.
Preparation for trimming interactive features from bash to reduce size.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
7ab5e5c3e3
tpmr: Clean up TODOs about size parameter to tpm2_unseal
The size parameter is actually the size of the sealed secret to TPM1,
not the unsealed data size.  TPM2 does not observe the sealed secret,
so just ignore that parameter.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:51 -05:00
Jonathon Hall
0a38717e20
tpmr: Wrap TPM1 and TPM2 unseal actions so scripts can invoke either
Provide tpmr unseal to unseal a file with TPM1 or TPM2.  For TPM1, it
wraps tpm nv_readvalue and tpm unsealfile.  For TPM2, it wraps tpm2
unseal.

kexec-unseal-key, seal-hotpkey, unseal-hotp, and unseal-totp no longer
need to differentiate TPM1/TPM2.

Fixes spurious shred errors on TPM2 that only apply to TPM1 (temporary
sealed secret file and shred are now internal to tpmr).

Fixes TPM1 disk unlock key unsealing due to logic errors relating to
exit status of tpmr unseal or tpm unsealfile (now always uses status of
tpmr unseal).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:50 -05:00
Jonathon Hall
55e5a41eca
tpmr: Add kexec_finalize command to finalize TPM before boot
TPM2 locks the platform heirarchy, flushes transient objects, and
flushes sessions.  (This now cleans up sessions created during
startsession that previously were not cleaned up, although the OS might
flush all sessions as well.)

TPM1 currently does not do anything, but the command is accepted so
kexec-boot does not need to differentiate TPM1/2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
f324b72be6
tpmr: Seal/unseal using sha256 of password
TPM2 is only required to support password lengths up to its longest
hash size (32 chars for sha256).  Pass the sha256 of the password
instead of the actual password so the password can be arbitrarily long.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
6efabeb520
tpmr: Set flags properly on sealed file
Set flags 'fixedtpm|fixedparent|adminwithpolicy'.  Plain password auth
is no longer allowed.  For objects sealed with a password, the password
is part of the auth policy, so both PCRs and password must be satisfied
to unseal.

Tested by manually attempting to unseal disk unlock key with password:
    tpm2 unseal -c 0x81000003 -p "<password>"

This now correctly returns an error indicating this auth method is not
allowed.

Relative to the documented default flags for tpm2_create:

* sign, decrypt: Not applicable to a sealed object, tpm2_create
  automatically removed these from the defaults.
* fixedtpm, fixedparent: Kept
* sensitivedataorigin: Not applicable an object where the sensitive
  data is not generated by the TPM.
* userwithauth: Removed this, "user" actions must satisfy auth policy.
* adminwithpolicy: Added this, "admin" actions must satisfy auth
  policy.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:49 -05:00
Jonathon Hall
bc736450cb
kexec-select-boot: For debug inspection, drop to recovery
After saving a disk unlock key, if debug output is enabled, drop to
a recovery shell to allow inspection of debug output.

The script isn't intended to return from this point after sealing a
key - returning attempts to boot, which can't unseal the key.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Jonathon Hall
8bf5415e79
tpmr: Add seal/unseal debug tracing
Trace parameters to seal/unseal and some key tpm2 invocations.  Trace
invocation of tpmr seal/unseal for disk unlock key.

Add DO_WITH_DEBUG() to trace a command and parameters, then execute it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Jonathon Hall
e6acaad215
tpmr: Fix sealing/unsealing file with both PCRs and passwords
When sealing/unsealing with a password, use a policy including both the
specified PCRs and the object password.  Fixes sealing and unsealing
disk unlock key.

tpm2 seems to have a bug in parameter decryption when using a policy
session and password in this way, disable encryption in the policy
session as a workaround.

Flags still need to be set on the sealed object correctly, as the
password is normally allowed on its own as an alternative to policy
auth.

Add -Q to some tpm2 invocations to silence diagnostics on stdout.

Pass filename for unsealed secret rather than capturing from stdout
for robustness against tpm2 diagnostics on stdout.

Fix unseal result check in kexec-unseal-key.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:48 -05:00
Thierry Laurion
1e5544b934
Add DEBUG traces and have TPM2 boards enable TRACE and DEBUG calls
- /tmp/debug.log is created and appended by all TRACE and DEBUG calls in code
- fix some logic errors seen when no DEBUG entry were outputted in /tmp/debug.log
2023-03-08 12:45:47 -05:00
Jonathon Hall
79e10ee135
kexec-unseal-key, tpmr: Deduplicate TPM1/2 code and always use stdin pass
Always send password via stdin to tpm2 create, tpm2 unseal.  The password
could being with things like 'file:', 'str:', 'pcr:' that would be
interpreted by tpm2.

Deduplicate the TPM1/2 code in kexec-unseal-key.  The TPM2 code was not
actually prompting for the password or sending it to tpmr unseal.

Password is still not working yet though.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:47 -05:00
Jonathon Hall
2c6caa18a7
kexec-(un)seal-key: Delete CONFIG_AUTO_UNLOCK logic
CONFIG_AUTO_UNLOCK does not exist in Heads.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:47 -05:00
Jonathon Hall
b500505312
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1.
Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and
shouldn't, the differences should be localized).  Some checks were
incorrect and are fixed by this change.  Most checks are now unchanged
relative to master.

There are not that many places outside of tpmr that need to
differentiate TPM1 and TPM2.  Some of those are duplicate code that
should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and
some more are probably good candidates for abstracting in tpmr so the
business logic doesn't have to know TPM1 vs. TPM2.

Previously, CONFIG_TPM could be variously 'y', 'n', or empty.  Now it
is always 'y' or 'n', and 'y' means "any TPM".  Board configs are
unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this
doesn't have to be duplicated and can't be mistakenly mismatched.

There were a few checks for CONFIG_TPM = n that only coincidentally
worked for TPM2 because CONFIG_TPM was empty (not 'n').  This test is
now OK, but the checks were also cleaned up to '!= "y"' for robustness.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
d51993b6a9
tpm-reset: Reduce duplication with tpmr reset
Use common password prompt logic in tpm-reset rather than duplicating
in tpmr reset.

Use common logic in config-gui.sh to reset the TPM.

Use common logic in oem-factory-reset to reset TPM.  Fixes extra
prompts for TPM2 owner password even when choosing to use a common
password.  Fix sense of "NO TPM" check in TOTP generation (which only
happened to work because CONFIG_TPM is empty for TPM2).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
ab57cd0b9a
tpmr: Fix wording of owner password prompt in tpm2_sealfile()
It's asking for the existing password, not a new password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:46 -05:00
Jonathon Hall
cf3ee19795
seal-hotpkey: Fix quoting in CONFIG_TPM test
$CONFIG_TPM needs to be quoted, or [ syntax is incorrect when it's
empty.  Fixes errors in console with TPM2 (but behavior was correct due
to [ still returning false as expected).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
55a41c3fdb
kexec-save-default: Always update TPM2 primary object handle hash
Resetting the TPM creates a new primary object, and there is no reason
for kexec-save-default to sign an old hash.  Always update the hash
instead of creating it only if it doesn't exist.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:45 -05:00
Jonathon Hall
7ea606524b
gui-init: Remove TPM2 primary handle hash when resetting TPM
Resetting the TPM invalidates the primary handle hash, and
kexec-save-default only generates a hash if none exists.  Remove the
hash file when it is invalidated.

OEM reset and "Reset Configuration" both already remove all kexec
files.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:44 -05:00
Thierry Laurion
8da5d5d723
Add dual support for real bash and busybox's bash(ash)
- modify bash to have it configured with -Os
2023-03-08 12:45:44 -05:00
Thierry Laurion
6923fb5e20
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards
-coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations)
-swtpm set to be launched under TPM v2.0 mode under board config
-Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized)
This is skeleton for TPM v2 integration under Heads

-------------
WiP

TODO:
- libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built
- Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing
- init tries to bind fd and fails currently
- Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output
- When no OS' /boot can be mounted, do not try to TPM reset (will fail)

- seal-hotpkey is not working properly
- setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM)
  - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase.
- primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup
- would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only
- tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help.
  - Implementing them would be better
- REVIEW TODOS IN CODE
- READD CIRCLECI CONFIG

Current state:
- TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid)
- TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without.
 - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails.

- Current tests are with fbwhiptail (no clear called so having traces on command line of what happens)
 - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities
2023-03-08 12:45:43 -05:00
tlaurion
5c7148f18d
Merge pull request #1305 from echo-84/yubikey-oem-factory-reset 2023-02-21 12:06:35 -05:00
Thierry Laurion
8259d3ca1e
Add TRACE function tracing function to output on console when enabled
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs
- Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc)
- add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
2023-02-20 11:44:52 -05:00
Thierry Laurion
5fbbbbc3f7
gui-init: fix sh: argument expected 2023-02-18 21:52:54 -05:00
Thierry Laurion
5bc2bc88e4
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config
-qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now
2023-02-18 21:52:44 -05:00
builder
e900d2027a Check Signature PIN and toggle forcesig if not forced 2023-02-01 20:34:07 -06:00
tlaurion
1c68befc59
Merge pull request #1296 from tlaurion/new_tails_key
/etc/distro/keys/tails.key: Replace with updated and minimized one
2023-01-27 16:07:55 -05:00
tlaurion
7be67e4992
Merge pull request #1297 from tlaurion/usb-scan_moved_to-media-scan
usb-scan->media-scan: usb-init calling media-scan usb
2023-01-27 16:07:17 -05:00
Thierry Laurion
150b95a034
TPM disk unlock key setup: Automatically override selected default boot option's initrd's crypttab file(s) to point to LUKS decryption key in injected cpio
- kexec-save-default extracts initrd crypttab files and creates /boot/kexec_initrd_crypttab_overrides.txt entries pointing to /secret.key
- kexec-insert-key applies /boot/kexec_initrd_crypttab_overrides.txt to replace initrd's crypttabs files pointing to inserted /secret.key through cpio
- Both scripts inform the user of applied magic on screen
2023-01-27 13:27:17 -05:00
HardenedVault
8a60930c6b
Make the path to crypttab within initramfs overridable
Not all distro put crypttab under /etc/ within initramfs, but finding it at
runtime needs unpacking, which may be hard to do, so it is made overridable
with a file at /boot/kexec_initrd_crypttab_path.txt, whose content could be
obtained with $ cpio -t < ${uncompressed_initrd} | grep crypttab .

The "target" field of the record within the crypttab stored in the root
file system for the luks container which is going to be unlocked via
kexec-insert-key should be modified into the same "luks-$uuid" format,
otherwise the boot sequence will get stuck when OS is trying to unlock them
again, in order to map them according to "target" fields written in the
crypttab stored in the root fs.
2023-01-27 12:56:32 -05:00
Thierry Laurion
268767d300
/etc/distro/keys/tails.key: Replace with updated and minimized one 2023-01-26 15:58:57 -05:00
Thierry Laurion
299977926c
usb-scan->media-scan: usb-init calling media-scan usb
media-scan accepts direct input of existing blkid and mount that passed device to /media
2023-01-26 15:38:58 -05:00
tlaurion
c1ae44d71c
Merge pull request #1289 from danielp96/master
/etc/functions: fix detection of virtual flash drive in qemu.
2023-01-26 14:33:38 -05:00
Thierry Laurion
e00280e663
gui-init: warn the user when sealing measurements through TOTP/HOTP requires TPM reset 2023-01-19 14:59:45 -05:00
Daniel Pineda
3cd8654566
/etc/functions: fix detection of virtual flash drive in qemu.
Adds check to detect device formatted as fat32 without partition table.

With fat32 fdisk does not print message about invalid partition table
and instead it'll print an empty table with header.
In both cases total output has the same length of 5 lines: 3 about
device info, 1 empty line and the 5th will be the table header or
invalid partition message.

Signed-off-by: Daniel Pineda <daniel.pineda@puri.sm>
2023-01-18 11:27:15 -06:00
tlaurion
e45980d33f
Merge pull request #1281 from tlaurion/usb_modules_load_order_fix 2023-01-17 12:13:04 -05:00
Thierry Laurion
256313a988
/etc/functions: fix order when loading usb modules to prevent warning 2023-01-16 15:21:14 -05:00
3hhh
d07df1e60b
initrd: escape_zero: allow some more characters
Since it's not supposed to be shell safe, just display safe
inside double quotes, we can allow some more characters.

Also fix the escape character not being escaped.
2023-01-14 13:14:09 +01:00
3hhh
2ae7f53e04
initrd: assert_signable: use recovery() instead of die()
and display some more information to the user, if
available
2023-01-14 10:27:42 +01:00
3hhh
c65d6b92c0
initrd: call assert_signable earlier
No need to check for the GPG card first.
2023-01-14 10:07:31 +01:00
3hhh
4ce8f664ad
initrd: work around a bug in busybox sha256sum
busybox sha256sum will create a checksum file for uncommon file names
(e.g. /boot/foo"$\n"bar), but fail to verify that exact file.
https://bugs.busybox.net/show_bug.cgi?id=14226

Thus disallow all files in /boot/ with strange file names at the time of
signing for now. Verifying in the presence of new files with such file
names in /boot/ is no issue for the kexec_tree verification due to the
previously implemented escaping mechanism.
2023-01-14 10:02:49 +01:00
3hhh
e368c3f6ea
initrd: speed up non-GUI booting
by not generating the kexec_tree diff in that case
2023-01-14 10:02:49 +01:00
3hhh
f52466edbf
initrd kexec_tree: fix various escaping issues
Attempt to fix the following issues:
1. unescaped file names may let an attacker display arbitrary
   whiptail prompts --> escape, original code by @JonathonHall-Purism
2. whiptail itself allows escape characters such as \n
   --> use an escape character not used by whiptail, i.e. #
3. performance issues caused by diff'ing too early -->
   only generate a diff to display to the user, if an actual issue is
   found
2023-01-14 10:02:49 +01:00
3hhh
60df237c37
initrd: fix error message to work with kexec_tree 2023-01-14 10:02:48 +01:00
3hhh
accd9f470d
initrd: track files in /boot in kexec_tree.txt
Fixes #1248
2023-01-14 10:02:27 +01:00
Thierry Laurion
90b2e0ca5d
kexec-save-default: do /boot operation in subshell
fixes screwed commit 6f6f37ec3a
2023-01-13 14:54:14 -05:00
tlaurion
1236cbc29e
Merge pull request #1277 from tlaurion/adjust_printf_clear 2023-01-13 12:23:53 -05:00
Thierry Laurion
1dd8fb4cf1
gui-init: add a print clear after TOTP Qr code being confirmed to be scanned by user 2023-01-13 11:25:27 -05:00
Thierry Laurion
3d5db5d9e2
functions: remove the last two print clear which prevented to troubleshoot console output 2023-01-13 11:24:26 -05:00
Thierry Laurion
87027d6a88
recovery call: since we operate under set -e, make sure that shred failing doesn't exit 2023-01-12 18:04:27 -05:00
Thierry Laurion
aa9b75f64d
/boot: make sure operations requiring to be happening under /boot are under subshells 2023-01-11 13:59:26 -05:00
Thierry Laurion
d3eb708bcb
TOTP code mismatch: better guidelines in code 2023-01-04 16:07:38 -05:00
Jonathon Hall
817b9b3bb7
gui-init: Always go to main menu when selecting "continue to main menu"
If the user selects "continue to main menu" from an error, do not show
any more error prompts until reaching the main menu.

We still try to initialize everything (GPG, TOTP, HOTP) so that the
main menu can still show TOTP/HOTP if GPG is not configured, etc., but
no more prompts are shown after selecting "continue to main menu".

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-23 14:01:02 -05:00
Thierry Laurion
81b4bb77de
whiptail: no more whiptail reseting console on call (--clear)
So we have console logs to troubleshoot errors and catch them correctly
2022-11-15 15:11:58 -05:00
tlaurion
5682a62675
Merge pull request #1243 from tlaurion/give_console_output_to_users 2022-11-15 11:13:45 -05:00
Thierry Laurion
83591fbbc1
talos II: die when tgz archive is corrupt 2022-11-14 18:05:32 -05:00
Thierry Laurion
b67f8e19ce
init: add 2 seconds pause on die, 1 second on warning so users see console messages 2022-11-14 18:04:04 -05:00
tlaurion
5e00800877
Merge pull request #1222 from SergiiDmytruk/flashrom 2022-11-11 15:37:25 -05:00
Sergii Dmytruk
472ca6fb30
flash-gui.sh: accept tgz package for Talos boards
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:45 +02:00
Sergii Dmytruk
5ee3219322
Add cbfs wrapper script to handle PNOR
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-11-11 00:59:12 +02:00
Jonathon Hall
3c0e5c06c6
kexec-parse-boot: Refactor common parts of echo_entry()
A lot of echo_entry() is now common to elf/multiboot/xen kernels, just
branch for the type-specific logic.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:38 -05:00
Jonathon Hall
698360199c
kexec-parse-boot: Ensure kernel/initrd paths exist in boot option
If a boot option doesn't refer to a valid file for the kernel/initrd,
ignore it.  Such an option is never bootable, because we would fail to
find the kernel/initrd.  This could happen if the path contained GRUB
variables, or specified a device that wasn't /boot, etc.

This is checked before expanding GRUB variables.  It's unlikely that
any kernel/initrd path containing variables would end up working when
all variables expand to nothing (since we do not handle GRUB
variables).

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:38 -05:00
Jonathon Hall
2a8a7655d3
kexec-parse-boot: Trim device specifications from GRUB entries
Some configs specify kernel/initrd paths relative to a device (often
found in a variable).  Assume the device is the /boot partition and
ignore the device specification.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-10 11:30:34 -05:00
Thierry Laurion
9bb6be8874
whiptail: fixate width to 80 characters and have height dynamic to all whiptail/fbwhiptail prompts 2022-11-09 11:51:27 -05:00
tlaurion
77c6ac9bea
Merge pull request #1235 from JonathonHall-Purism/partitioned-usb-improvements
mount-usb: Improve reliability with partitioned disks
2022-11-04 13:40:15 -04:00
Matt DeVillier
297369fd8b
oem-factory-reset: Add missing newline to prompt
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-11-03 18:42:32 -04:00
Jonathon Hall
a8a843ecc8
mount-usb: Improve reliability with partitioned disks
Extract exclusion for unpartitioned block device of partitioned media
to gui_functions, and exclude them even if kernel hasn't listed the
partitions yet.  (Fixes flash/USB boot prompts incorrectly trying to
use the whole device for partitioned media the first time.)

Ignore block devices of size 0, like empty USB SD card readers.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-11-03 18:22:03 -04:00
Thierry Laurion
5a7902c5ab
flash.sh: single firmware read backup and logic fixes
- Have Talos II supported by detecting correctly size of mtd chip (not internal: different flashrom output needs to be parsed for chip size)
- Read SPI content only once: 66% speedup (TOCTOU? Don't think so, nothing should happen in parallel when flashing insingle user mode)
- Have the main flash_progress loop not break, but break in flash_rom state subcases (otherwise, verifying step was breaking)
- Change "Initializing internal Flash Programmer" -> "Initializing Flash Programmer"
- Apply changes suggested by @SergiiDmytruk under https://github.com/osresearch/heads/pull/1230#issuecomment-1295332539 to reduce userland wasted time processing flashrom -V output
2022-10-28 14:59:24 -04:00
Sergii Dmytruk
565963d51d
Add CONFIG_BOOT_EXTRA_TTYS option
It specifies whitespace-separated list of console devices to run Heads
on in addition to the default one.

Example for board config:

    export CONFIG_BOOT_EXTRA_TTYS="tty0 tty1"

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-09-01 00:28:15 +03:00
Sergii Dmytruk
75748e86b7
gui-init: fix TOTP/HOTP initialization on missing OS
Skip only GPG key check, but always init TOTP and HOTP.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-21 00:05:20 +03:00
Sergii Dmytruk
b989889e5f
init: assign CONFIG_TPM depending on /dev/tpm0 presence
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-08-20 23:56:47 +03:00
Victor Bessonov
a221321b6a Allow gpg to select digest algo
EC signatures requires that the digest has the corresponding length. Removing the hardcoded sha2-256 hash function and adding support of sha2-384 and sha2-512 should allow using EC crypto.
2022-07-23 01:10:52 +03:00
Thierry Laurion
cc28121beb
gui-init: Have TPMTOTP QrCode named under TOTP app with $BOARD_NAME 2022-06-22 16:43:29 -04:00
Thierry Laurion
810daebc58
oem-system-info-xx30: fix missing exec mode on shell script 2022-06-15 15:40:37 -04:00
Thierry Laurion
7548580450
create oem-system-info-xx30 (w/trackpad info)
- Take System Info changes from 06311ff068 (Thanks to @nestire)
- Move changes to seperate script under /bin/oem-system-info-xx30
- Add additional camera and wifi card IDs, add synaptic touchpad detection if kernel has module built in

Above changes squashed in this commit.
2022-06-10 10:00:25 -04:00
Thierry Laurion
32e7031678
bin/oem-factory-reset: prevent users to choose a GPG Admin PIN > 25 chars which would fail HOTP sealing
Fixes https://github.com/osresearch/heads/issues/1167
Circumvents https://github.com/Nitrokey/nitrokey-pro-firmware/issues/32
Adds validation so user cannot enter GPG User PIN > 64 while we are at it.

Note that GPG PINs can be up to 64 characters.
But GPG Admin PIN will fail HOTP sealing with GPG Admin PIN of more then 25 chars.

Edit: change upstream error to firmware issue, not nitrokey-app.
2022-06-02 14:08:39 -04:00
Thierry Laurion
4b9757ceef
Remove fedora public key. They don't detach sign ISOs since before 2020. 2022-05-17 15:54:21 -04:00
Thierry Laurion
dd0e4b0a8d
luks-functions: typo correction and consistent warnings across functions. 2022-05-03 16:45:20 -04:00
Thierry Laurion
37bb4906ce
oem-factory-reset: fix bug where it was impossible to just change LUKS passphrase without reencrypting encrypted container.
Since /etc/luks-functions are currently exporting passphrases tested good per cryptsetup to be reused in the code,
the logic calling both luks_reencrypt and luks_change_passphrase testing for non-empty luks_current_Disk_Recovery_Key_passphrase
was bogus.

This commit includes a new variable luks_new_Disk_Recovery_Key_desired which is set when reencryption is desired.
The 3 use cases (reencrypt+passphrase change, reencrypt no passphrase change and passphrase change alone now only test
for luks_new_Disk_Recovery_Key_desired and luks_new_Disk_Recovery_Key_passphrase_desired, nothing else.
2022-05-03 16:41:07 -04:00
Thierry Laurion
e60287fa1d
bin/network-init-recovery: generate random MAC and set it to eth0
network-init-reovery can be used to automatically set RTC clock to obtained NTP clock.
The script would fail if other devices devices previously registered on the network with the same MAC.
Consequently, maximized boards are detected here, and a full random MAC is generated and used instead of using hardcoded DE:AD:C0:FF:EE.
2022-04-29 10:26:12 -04:00
Thierry Laurion
37a343a49c
etc/functions: Add a function to generate random MAC address 2022-04-29 10:24:02 -04:00
Thierry Laurion
70572fd100
oem-factory-reset: Only set default boot option if no TPM Disk Unlock Key
This continues to generate checksums and sign them per new GPG User PIN, but does not set a default boot option.
The user hitting Default Boot on reboot will go through having to setup a new boot default, which will ask him to setup a Disk Unlock Key if desired.

Otherwise, hitting Default Boot goes into asking the user for its Disk Recovery Key passphrase, and requires to manually setup a default boot option.
2022-04-13 14:29:54 -04:00
Thierry Laurion
4e5f781be3
fix removal of --menu from commit ba054b15c3 2022-04-13 11:15:52 -04:00
Matt DeVillier
ba054b15c3
kexec-select-boot: use 'fold' to wrap kernel args at 80 char
Prevents truncation via fbwhiptail window

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 14:32:29 -05:00
Matt DeVillier
025f914eb3
kexec-select-boot: Skip duplicate prompt when setting new default boot entry
The text based prompt isn't needed when using a GUI menu for selection/confirmation, so skip it

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:29 -05:00
Matt DeVillier
19067a9a72
kexec-select-boot: Simplify boot selection confirmation, reverse order
Simplify the menu options by removing the duplication of the entry name
in the menu selections; instead, use clear verbiage to distinish
between booting one time and making the default. And as the majority of
the boot menu is shown is when the grub entires have changed and the
user is prompted to select a new default, so make that the first/default
menu option.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:27 -05:00
Matt DeVillier
7769d13996
kexec-select-boot: Simplify boot menu entries
Drop the duplicated kernel info which hurts readability, runs off the
end of the menu window. This also makes it easier to identify which
menu option is the default, and more closely resembles the grub menu
shown in a traditional BIOS boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 12:25:37 -05:00
Matt DeVillier
0f3f86d21e
etc/luks-functions: exit function when select_luks_container() returns non-zero
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:25 -05:00
Matt DeVillier
5b5880b4e8
select_luks_container(): return non-zero when no device found/selected
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
98c251678c
luks_reencrypt(): remove extraneous call to select_luks_container()
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
f3d4924646
/bin/reencrypt-luks: rename to /etc/luks-functions
Move/rename as file is only sourced, not directly executed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:07 -05:00
Thierry Laurion
7b15726e1d
functions: add loading of usb-hid via enable_usb
Testing points:
- All boards explicitely declaring CONFIG_USB_KEYBOARD=y gets USB Keyboard back under Heads
- All other boards are not impacted.
2022-04-05 13:53:09 -04:00
Thierry Laurion
9760181d09
Uniformize time display so it includes timezone
date=`date "+%Y-%m-%d %H:%M:%S %Z"`
2022-03-25 18:46:13 -04:00
Thierry Laurion
8f390f97c2
add integrity report in case some public key is already fused in firmware
- initrd/bin/oem-factory-reset: adds a measured integrity output prior of prompts. Goal is for stating TOTP/HOTP/boot detached signed measurements prior of initiating a Re-Ownership, validating provisioned OEM state.
2022-03-25 13:31:26 -04:00
Thierry Laurion
dacd99c629
add re-encrypting and passphrase change options to oem-factory-reset
- initrd/bin/oem-factory-reset: add 2 additional prompts defaulting to N, also explaining why its important.
2022-03-23 15:55:42 -04:00
Thierry Laurion
b976309498
add re-encrypt and passphrase change options to menu
- initrd/bin/gui-init : Add two additional menu options to LUKS reencrypt and LUKS passphrase change, calling functions of initrd/bin/reencrypt-luks
- initrd/bin/gui-init : Add option F for EOM Factory Reset / Reownership when no public key is exported by key-init
2022-03-23 15:50:58 -04:00
Thierry Laurion
058b07110b
add reencrypt-luks
initrd/bin/reencrypt-luks: add functions for reencryption and passphrase change. Feeds itself from external provisioning or local provisioning
2022-03-23 15:47:33 -04:00
Thierry Laurion
9016ebccc2 OEM Factory Reset -> OEM Factory Reset / Re-Ownership (with customs passwords and provisioned info given)
oem-factory-reset: adapt code so that custom passphrases can be provided by user without changing oem factory reset workflow.
    oem-factory-reset: output provisioned secrets on screen at the end of of the process.
    oem-factory-reset: warn user of what security components will be provisioned with defaults/customs PINs prior of choosing not after
    gui-init and oem-factory-reset: change OEM Factory Reset -> OEM Factory Reset / Re-Ownership to cover actual use cases
2022-03-11 14:24:54 -05:00
Thierry Laurion
acf709184f bin/kexec-iso-init: Add support for Arch iso support requirements (found at https://mbusb.aguslr.com/howto.html) 2022-03-07 19:02:29 -05:00
Thierry Laurion
3e526aea27 distro key: addition of arch minimized public key
bin/kexec-parse-boot: test 2bb1f52bf5 that fix correctly comma seperated arguments.

Still TODO: when booting, Heads tries to find where the ISO with /dev/disk/by-label/ARCH_202202 wich is never brought up. uuids could, not sure why the label is not brought up correctly. Maybe an issue in the way Arch makes the ISO.
@tslilc : Any idea to continue #584 or modify #762?
2022-03-07 19:02:29 -05:00
tslil clingman
19a8f9c242 Tweak syslinux parsing code to be compatible with new Arch isos 2022-03-07 19:02:29 -05:00
Marek Marczykowski-Górecki
ab6425cc7e
Check for /bin/hotp_verification instead of CONFIG_HOTPKEY
CONFIG_HOTPKEY is not exported to the initrd, check for binary presence.
2022-03-04 00:49:37 +01:00
Marek Marczykowski-Górecki
13a12d157b Move enable_usb earlier
It is going to be enabled later anyway (if CONFIG_HOTPKEY=y), so it can
also be simplified by enabling it at the very beginning.

This enables USB keyboard consistently during all boot menus, including
the "No Bootable OS Found" prompt. It isn't a big deal for "normal"
laptop usage, but it is important for automatic tests and also
non-laptop systems.
2022-03-01 13:39:59 -05:00
Thierry Laurion
7a324bbd29
tails.key : merging of new long-term signing key with old one so old ISOs can still be booting from Heads
Reproducibility notes at https://github.com/osresearch/heads/pull/1023#issuecomment-1018735659

Fixes #1023
2022-01-21 12:58:25 -05:00
HardenedVault
b4b0bc4a7a Use luksHeaderBackup rather than luksDump to measure luks headers. 2022-01-19 10:12:37 -05:00
Thierry Laurion
90ad708849 Apply background colors when fbwhiptail binary is present. 2021-12-17 16:50:03 -05:00
Matt DeVillier
519bd445d6 flash.sh: Add progress bar
Show state of flashrom reads/writes by means of a progress bar,
as used in the Librem coreboot flashing scripts

v2: add adjustment for use with `--ifd`

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-12-17 16:48:34 -05:00
Thierry Laurion
415a08a732 board additions: w530, t530, t520 (hotp-maximized and maximized flavors only)
-CircleCI addition.
-Removal of t530-flash, w530-flash boards, flash scripts and associated coreboot configs (no more legacy boards additions)

This is a merger of #1071, #1072 and #1073 so that test builds are available over CircleCI until osresearch/master CircleCI gets unlocked.
2021-12-06 19:52:25 -05:00
eganonoa
ce435a4148 adding working w530 board, initrd and config files 2021-12-06 19:52:25 -05:00
eganonoa
66e5c23b13 adding working t530 board, initrd and config files 2021-12-06 19:52:25 -05:00
icequbes1
b35e1bcbb3 oem-factory-reset: fix whiptail height/width order 2021-11-24 17:00:25 -05:00
Matt DeVillier
fdbd9b2d48 gui-init: Handle overflow of list of files w/failed hashes
When files in /boot fail hash verification, the list of files
can sometimes overflow the whiptail msgbox, preventing the
prompt and buttons to update checksums from showing. To mitigate
this, if # of files is > 10, use less to show the file list and
present a separate prompt to update the checksums once the file
list has been viewed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-29 16:11:28 -04:00
Thierry Laurion
59aafa5506 NEWT: fix whiptail line width for output that could wrap line content over multiple lines 2021-10-29 14:53:53 -04:00
Thierry Laurion
2fc8813fc6 oem-factory-reset: fix output when fbwhiptail is not used
- Fixed inversed HEIGHT and WIDTH usage
- Fixed height to 30 and width to 90 as everywhere else

This was causing a blank screen when whiptail without framebuffer (fbwhiptail) was used.
Actually, it seems like the width and height under whiptail calls are only taken into consideration under NEWT, not FBWHIPTAIL.
2021-10-29 13:45:22 -04:00
Thierry Laurion
661b3b0e81 flash-gui: fix width of flash confirmation from 60 -> 90 chars as everywhere else
- Fix the flash prompt that was spreading filename over 2 lines (width 60 -> 90 as everywhere else)
2021-10-29 13:45:22 -04:00
Thierry Laurion
c6a36948c5 Whiptail: move BG_COLOR default definitions from gui-init to init
- Set them only when FBWHIPTAIL is used.
- If NEWT is used (console mode without framebuffer): set default to none.
2021-10-29 13:45:22 -04:00
Matt DeVillier
28c7202bd8 etc/functions: Improve handling of battery charge/health calcs
Some devices, like older Librem laptops, use BAT vs BAT0 for the
primary battery. Accomodate this by using BAT* instead of BAT0.

Could break on multi-battery devices, but none supported in tree
currently so more of a theoretical problem.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-26 17:19:15 -04:00
Matt DeVillier
61124979ec
oem-factory-reset: fix custom comment entry
copy/paste error resulted in user-entered comment never
being set/checked/used, and email address being overwritten.
Fix variable usage so comment and email are set correctly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-21 18:34:48 -05:00
Thierry Laurion
4dee35ae40 System Info: Add full charge Battery capacity (actual full charge capacity/design full charge capacity) 2021-10-19 20:21:55 -04:00
Matt DeVillier
de0ce98da3 etc/functions, gpg-gui: Filter boot device options with '/dev/'
Grepping on just 'Disk' can lead to disk UUID identifier strings
being added to /tmp/disklist, which then fail to parse later on.
Avoid this by grepping on 'Disk /dev' instead.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
1c6f623c25 gui-init: update $TOTP after generating new secret or resetting TPM
After updating/flashing a new ROM, a new TOTP secret must be generated,
but the $TOTP variable needs to be updated afterwards, otherwise it
will show the previous failure which led to the new secret being
created.

Fix this by re-calling update_totp() after generating a new secret
or resetting the TPM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
5746b8c970 gui-init: Drop elapsed time check for update_totp()
If user selects to manually update the TOTP via the menu,
we should do it regardless of elapsed time from previous
check. Otherwise, HOTP will be checked regardless of validity
of TOTP.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
feca95a0c1 gui-init: improve handling when HOTPKEY not present
Allow user to cancel HOTPKEY check, set BG color appropriately

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
a0308b808f etc/functions: push result handling of update_checksums() to callers
Modify update_checksums() to return 0/1 on success/failure, and modify
callers to notify the user on error with a GUI msg.

Set background color as appropriate in gui-init.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
a87c54220c gui-init: skip initial checks if user selects option from mount_boot
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
43b50788c6 config-gui: Show error if no disks found
Currently, if no disks on system, selection of a new /boot
device will silently fail and simply return the user to the
previous screen. Add an error dialog if no disks found.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
32716c8ce6 gui*: Improve consistency of background color use
Persist the background color (and error state) through
the main menu and all submenus. Use warning
background color for destructive operations, error color
for errors.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
a86debb257 gui-init: chain initial checks outside of main loop
Checking the keyring for a GPG and updating the TOTP/HTOP
status need only happen once at initial boot; the latter
can be updated at any later time from the main menu itself.
Having them repeated each loop of the main menu is unnecessary
(and often annoying). Likewise, the default auto boot can be
moved and the first_pass (and unused MAIN_MENU_OPTIONS)
variable dropped.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
463ec15522 gui-init: Handle menu processing internally
Now that all menu options are encapsulated in shell
functions, move menu handling from the main loop to
inside the menu/submenu function itself.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
1f27dea220 gui-init: refactor into functions
Break menus and menu items into functions where possible.
Improves readability of code / functional flow, and
makes future refactoring easier.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
e6d6594e67 gui-init: Add line breaks between functions for readability
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
5a52606ad5 gui-init: rename 'update_totp' to 'generate_totp_hotp'
Name better reflects function purpose, allows 'update_totp'
to be used to actually update the TOTP code.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 14:42:15 -04:00
Matt DeVillier
1def8f95b4
kexec-boot: Streamline cmdline remove filtering
Use sed one-liner vs 3 bash inline commands

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2021-10-15 13:40:24 -05:00
chri2
1245701694
fix bug with e.g. nosplash parameter in kernel command line
strings from $cmdremove should only be removed from $cmdline if they are enclosed by spaces of if they are at the beginning of $cmdline followed by a space or if they are at the end of $cmdline prepended by a space
2021-09-29 06:57:18 +00:00
elliotvirzi
0ed8a886ee
Display TOTP secret as text
Enable use of TOTP devices without a camera
2021-08-07 17:40:13 +00:00
tlaurion
2918bcdf48
Merge pull request #1014 from tlaurion/q41_fepitrebot_distro_signing_key
Adding qubes-test distro public key to test QubesOS ISOs
2021-07-29 12:42:38 -04:00
Thierry Laurion
19d064ff96
Adding qubes-test distro public key to test QubesOS ISOs from https://qubes.notset.fr/iso/. Fixes https://github.com/osresearch/heads/issues/1010 2021-07-26 10:21:36 -04:00
Thierry Laurion
57417e149a
init: remove double heads motd banner, keeping the one sent to tty0 which is both local and remote 2021-07-25 19:53:35 -04:00
tlaurion
883f4958f8
Merge pull request #876 from hardenedvault/cryptsetup-2.3
Upgrade to cryptsetup 2.3 and make cryptsetup1/cryptsetup2 optionals
2021-02-04 18:21:38 -05:00
Thierry Laurion
64b1712e78
oem-factory-reset: set default KEY_LENGTH to 3072 and change expectation management message to console (Fixes #919) 2020-12-10 10:33:02 -05:00
alex-nitrokey
e31d6dcb8e Default to 4096 bit for OEM factory reset 2020-11-24 12:48:41 +01:00
Matt DeVillier
055165d61a gui-init: add support for auto-booting default target
if CONFIG_AUTO_BOOT_TIMEOUT exists and is set, and if HOTP
validation was successful, then attempt to boot the default
target after CONFIG_AUTO_BOOT_TIMEOUT seconds if not interrupted
by key press

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-09 22:26:50 -05:00
Matt DeVillier
f445b29dbe kexec-sign-config: fix args to getopts
The -u arg does not take a parameter, so remove the trailing colon.

Fixes /boot hashes not being updated when update_checksums() is called.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-11-06 15:16:29 -05:00
HardenedVault
057cc3c377 [WIP] cross build json-c and cryptsetup 2020-10-28 15:28:05 +02:00
Matt DeVillier
e7faac20db oem-factory-reset: Allow use without an installed OS
If an installed OS is not detected, then skip setting the
default boot device or generating /boot checksums.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 18:01:42 -04:00
Matt DeVillier
1fc123df4a gui-init: improve handling of blank/missing disk
Check for presence of CONFIG_BOOT_DEV, and if missing or
unable to be mounted, present the user with a menu offering the
option to select another disk, boot from USB, continue to
main menu, or drop to a recovery shell.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 18:01:42 -04:00
Matt DeVillier
6a3bb5897a Drop duplicate board-specific background color configs
Set and export currently-used defaults in gui-init, but still
allow for inidividual boards to override via config if desired.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
95442dccd4 flash-gui: improve readability of ROM filename
Strip the path prefix from the ROM filename, and place on own
line to prevent truncation with long filenames / narrow screens.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
755e9787a7 gui-init: add board name, kernel version to System Info
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
6df281813f Specify 'friendly' board name vs overriding CONFIG_BOOT_GUI_MENU_NAME
This will allow it to be used elsewhere within the UI.
Rename CONFIG_BOOT_GUI_MENU_NAME to better indicate use/function.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
8b3b8cedb5 gui_init: use consistent notation for main menu
sed -i 's/default boot menu/main menu/g'

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
998dc684f1 gpg_gui: use 'and' vs '+' in menu listings
Using words is more explicit and clear here rather than symbols.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
MrChromebox
85d7e29d18
Add new board: Purism Librem Server L1UM (#858)
* modules/coreboot: add option to use coreboot 4.11

Port patches from coreboot 4.8.1 to 4.11:
* 0000-measure-boot -> 0001
* 0010-cross-compiler-support

All other patches for coreboot 4.8.1 have either already been
integrated, or are for platforms which do not need to be migrated
to coreboot 4.11 (they will move to 4.12 or newer).

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add Broadwell-DE platform patch

Add a patch for FSP Broadwell-DE to make use of Heads' measured boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add patch to read serial # from CBFS

Will be used by multiple Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: add board support for Librem Server L1UM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Librem Server L1UM: add new board

Add board config, coreboot config, kernel config files.
Add conditional purism-blobs dependency to coreboot-4.11 module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* flash.sh: add special handling for librem_l1um board

Add support for persisting PCIe config via PCHSTRP9 in flash descriptor.
This is needed to support multiple variants of the L1UM server which
use the same firmware but differ in PCIe lane configuration via the
PCH straps configuration in the flash descriptor.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add 'Use PRIxPTR to print uintptr_t' patch

Cherry-picked from upstream coreboot (post-4.11), fixes compilation issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add target to build board librem_l1um

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 14:48:25 -04:00
Tom Hiller
636e40456e
fix: update chesksums of filenames with spaces (#847)
Signed-off-by: Tom Hiller <thrilleratplay@gmail.com>
2020-10-18 14:46:57 -04:00
alex-nitrokey
7baeebe9bf Change hash files only if gpg card is present
Update_checksum was already changing files in /boot, befor checking for
gpg card. If no card is present, the user will end up in the recovery
next time instead of getting the same dialog again. Therefore, the
confirm_gpg_card should be checked before altering files.

The dead -u flag/$update_counter is used to mark the necessisty to
update the hash files now.
2020-10-15 17:05:12 +02:00
MrChromebox
0eb1f69216
functions/recovery: loop recovery shell when exited (#835)
Currently, exiting the recovery shell results in a kernel panic,
necessitating a hard reset / power cycle. As this is less than ideal,
drop the exec and add a loop to restart the shell.

Addresses issue #833

Tested under qemu-coreboot-fbwhiptail

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-09-16 17:46:22 -04:00
alex-nitrokey
c7085d89c3
Remove quotes to fix use of asterisk in command
Changing the default boot was failing because remove the old entries did
not work as `rm "/some/path/*.txt"` does not work as intended, e.g. the
asterisk is no catch-all.
2020-08-26 13:21:57 +02:00
MrChromebox
a075347351
kexec-parse-boot/bls: Strip boot dir from front of grub entries (#804)
Some grub configs/bls entries contain the full paths to the
kernel/initrd files, which the parsers currently fail to handle,
causing a failed boot without any useful error being presented to the user.

To fix this, strip the bootdir prefix from the menu entries when parsing,
should it exist.

Test: build/boot Librem 13v2 w/F32 and bls entries containing absolute paths.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-24 16:42:33 -04:00
tlaurion
ae9fb74759
Merge pull request #763 from Nitrokey/storage-factoryreset
Delete AES keys of Nitrokey Storage after reset
2020-08-06 16:14:01 -04:00
tlaurion
3aa919ade9
Merge pull request #791 from MrChromebox/gui_boot_tweaks
GUI / Boot Device Tweaks
2020-08-06 16:13:21 -04:00
alex-nitrokey
872a4b0488 Merge remote-tracking branch 'upstream/master' into storage-factoryreset 2020-08-05 11:49:18 +02:00
alex-nitrokey
a224c43026 Add PID for Storage 2020-08-05 11:49:06 +02:00
Alexander Paetzelt
c725f869e2
Merge branch 'master' into gpgexport-factoryreset 2020-08-05 10:49:04 +02:00
Matt DeVillier
0b970b745e
config-gui: clean up boot device selection
When a new /boot device is selected, wait until after
successfully mounting the newly-selected device before
updating CONFIG_BOOT_DEV.

Also, don't assume /boot already mounted, as this can cause
a false failure and prevent mounting of the newly-selected device.

Lastly, tidy up the error output in case mounting /boot fails.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:49:26 -05:00
Matt DeVillier
0afa599491
Fix eval of DEV_NUM_PARTITIONS
Using 'let' in these scripts fails when evaluating to zero
for some reason, so replace with '$(())' which works as intended.

Test: Boot device selection menu shown properly when
new/unpartitioned drive installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:58 -05:00
Matt DeVillier
244de9de94
gui-init: remove double-prompt for checksum update
Not need to prompt the user twice for the same action

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:38 -05:00
Matt DeVillier
5d641ee5b1
gui-init: Guard TPM reset function with CONFIG_TPM
Attempting to reset the TPM when once isn't present causes a kernel
panic, so let's not allow users to do that.

Test: verify 'No TPM Detected' shown on Librem Mini when Reset TPM
option selected from menu.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-30 14:47:01 -05:00
tlaurion
3c551cc249
Merge pull request #784 from MrChromebox/default_boot_fixes
Fix OEM factory reset and setting of default boot with F32
2020-07-30 15:42:08 -04:00
tlaurion
624faa1a9d
Merge pull request #778 from MrChromebox/usb_gui_tweaks
USB / GUI Tweaks
2020-07-30 13:54:25 -04:00
tlaurion
b9f487aa36
Merge pull request #779 from MrChromebox/pwd_fix
Encapsulate changes to working directory inside subshells
2020-07-30 13:54:15 -04:00
Matt DeVillier
97143953e8
Fix check for valid boot options
-r will always succeed since the file will be generated regardless
of number of boot entries found. Use -s instead to check for zero
file size.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:11 -05:00
Matt DeVillier
4c64ca631a
oem-factory-reset: Fix index used for default boot option
Since we sort the boot options prior to selecting the new default entry,
we need to use the index of the entry in the list prior to being sorted,
vs always setting it as 1. This fixes setting/booting of the default
OS target where the list entries are changed when calling sort.

Test: perform OEM factory reset with Fedora 32 installed, verify
default boot succeeds followng reset.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:01 -05:00
Matt DeVillier
009c10465a
oem-factory-reset: Parse BLS format grub files
The same grub parsing logic used in kexec-select-boot should
be used here as well, so copy it over.

Test: oem-factory-reset succeeds with Fedora 32 installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:23:50 -05:00
Matt DeVillier
a89d5a2780
seal-hotp: Fix HOTP key identification
With current implementation, Librem Keys with VID 0x316d are
not identified properly; correct the if/else logic to resolve.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-24 12:45:44 -05:00
tlaurion
7ea13ee000
Merge pull request #761 from Nitrokey/hotp-neutral
Fix branding issue with HOTP USB Security Dongles
2020-07-23 15:05:13 -04:00
Matt DeVillier
2dbe6c9d3b
gui-init: Improve readability of checksum dialogs
Add a linebreak before showing list of files with changed
checksums. Fix text truncation on checksum update prompt.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:48:01 -05:00
Matt DeVillier
5005c92953
oem-factory-reset: Improve readability of error output
Use fold to wrap long lines. Don't show pubkey filename if not needed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:55 -05:00
Matt DeVillier
d6ea02d7d5
flash-gui: Improve readability of prompts
Adjust text on GUI dialogs to prevent filenames from being truncated
and to improve clarity/readability.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:46 -05:00
Matt DeVillier
ba4fcefcea
usb-scan/mount: Improve USB handling
Currently, /media is mounted once per boot, which causes issues
if a user need to change USB sticks, or unknowning performs an
operation that mounts /media and then needs to access a different
USB stick later (eg, updating the firmware).

To mitigate this, always unmount /media if mounted before scanning
for USB devices, so the user can choose the correct device at the
time of its use.

Additionally, add a unique exit code for user abort so we're not
treating it the same as a failure, and use it to prevent unnecessary
GUI prompts when cancelling selection of a USB device.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:46:59 -05:00
tlaurion
d5262f11d4
Merge pull request #759 from Nitrokey/usb_label
Add partition Label to list of mount-usb
2020-07-18 22:33:03 -04:00
Alexander Paetzelt
d472c43c79
Fix quoting of variable 2020-07-15 09:49:00 +02:00
Matt DeVillier
c2c45dae0e
Encapsulate changes to working directory inside subshells
For the handful of operations which need to be done with /boot
as the pwd, encapsulate them in subshells to ensure the pwd
doesn't unexpectedly change for other operations, as functions
which need to mount/unmount /boot may fail if the pwd isn't root.

Also, set the pwd to root at the start of detect_boot_device as an
added safety measure.

Test: run oem-factory-reset function, ensure it doesn't fail to
detect boot device due to incorrect working directory.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-13 17:30:00 -05:00
Matt DeVillier
f7c4cae903
*gui.sh: move common ops to gui_functions
Move code duplicated across several GUI scripts into a common
gui_functions file and include/use that.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-10 17:37:07 -05:00
Alexander Paetzelt
6fe409aaf3 Still need the exported pubkey file 2020-07-07 11:16:18 +02:00
Alexander Paetzelt
43971dc029 Make export to USB drive an option 2020-07-07 10:32:22 +02:00
Matt DeVillier
cdbd0fcf2a
gui-init: Fix RAM and firmware version strings
Show RAM in GB, since the calculation in MB is imprecise as
it excludes RAM allocated for GPU (eg).

Fix display of firmware version strings which contain spaces by
adjusting cut and simply chopping off the date at the end, which
is a fixed 10-char length.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-01 13:42:10 -05:00
alex-nitrokey
19cd15cf96
Remove gnupg pubkey export in oem-factory-reset
Since #758 is merged, users have a option to export GnuPG pubkey if
necessary. Thus, we they do not need to insert a USB drive during
factory reset. Until now the whole process failed just because a user
did not provide a USB drive instead.

This shall be fixed by this commit
2020-06-30 19:16:10 +02:00
alex-nitrokey
30236ffbaa
Delete AES keys of Nitrokey Storage after reset
If smartcard Nitrokey Storage was factory-reset, we delete AES keys on
it as well.

Explaination: After oem-factory-reset was started the AES on the Nitrokey Storage that is used for the encrypted volume and the password safe is is not usable anymore because the smart card was factory-reset. To make it usable, a user needs to delete it via Nitrokey App. By doing so, the HOTP secret is deleted as well, resulting in a bad warning in Heads. Therefore, we are resetting AES key right after factory-reset with hotp_verification
2020-06-30 18:29:42 +02:00
alex-nitrokey
e0f0655b5d
Merge branch 'hotp-neutral' into storage-factoryreset 2020-06-30 16:17:51 +02:00
alex-nitrokey
84b2f9b540
Re-arrange the order of label and device 2020-06-30 09:28:35 +02:00
tlaurion
d579e731b9
Merge pull request #659 from MrChromebox/mount-usb-status
mount-usb: provide useful output when loading kernel modules
2020-06-28 15:30:16 -04:00
tlaurion
94476bb470
Merge pull request #747 from MrChromebox/factory_reset_no_tpm
oem-factory-reset: Handle non-TPM case
2020-06-28 15:26:16 -04:00
tlaurion
cc572f4c68
Merge pull request #758 from Nitrokey/gpg-export
Add option to export pubkey
2020-06-28 15:08:36 -04:00
alex-nitrokey
53dc659c01
Replace libremkey_htop_* by hotp_* 2020-06-25 15:35:47 +02:00
alex-nitrokey
e418ecbf71
Fix MEMTOTAL calculation 2020-06-25 10:41:01 +02:00
alex-nitrokey
481082f2d8
Include adaption of @MrChromebox
See
5a3f599233
2020-06-25 10:40:25 +02:00
alex-nitrokey
20b07dd1b3
swap label and device and minor formatting change 2020-06-25 09:46:11 +02:00
alex-nitrokey
c2a2134eb2
Merge remote-tracking branch 'upstream/master' into hotp-neutral 2020-06-24 18:22:13 +02:00
alex-nitrokey
fecb9cfd80
Rename CONFIG_HOTP_BRANDING to HOTP_BRANDING
reason: it not a config option anymore
2020-06-24 18:12:56 +02:00
alex-nitrokey
2fe946ccbe
Fix termonology 2020-06-24 17:54:39 +02:00
alex-nitrokey
3236f0e170
Change name seal-libremkey -> seal-hotpkey 2020-06-24 17:45:08 +02:00
alex-nitrokey
5867fc516c
Store HOTP USB Security Key branding in /boot 2020-06-24 17:40:49 +02:00
alex-nitrokey
92b1826537
/boot needs to get mounted first 2020-06-24 17:36:53 +02:00
alex-nitrokey
aab2c327e3
Fix warning box title 2020-06-24 17:25:39 +02:00
alex-nitrokey
407778eb9a
Remove unintented paranthesis 2020-06-24 16:16:03 +02:00
alex-nitrokey
53b67d27a4
Prepare usage of /boot/kexec_hotp_key as branding 2020-06-24 16:11:41 +02:00
alex-nitrokey
c07f3b7f7c
Add systeminfo menu option 2020-06-24 10:07:36 +02:00
alex-nitrokey
6d29ab71f9
dd partition Label to menu list 2020-06-24 09:44:50 +02:00
alex-nitrokey
2763711083
Add option to export pubkey 2020-06-23 15:32:51 +02:00
tlaurion
05c854753c
Merge pull request #625 from MrChromebox/tpm_luks
kexec-save-default: guard TPM LUKS usage with config option
2020-06-18 23:08:54 -04:00
tlaurion
fab603153b
Merge pull request #646 from alex-nitrokey/custom-userinfo
Add option to choose GnuPG userinfo during OEM reset
2020-06-17 14:00:31 -04:00
alex-nitrokey
28735a8c84
Add CONFIG_HOTP_BRANDING 2020-06-11 17:04:03 +02:00
alex-nitrokey
1ba73ac1d5
Rename CONFIG_LIBREMKEY to CONFIG_HOTPKEY 2020-06-11 15:29:51 +02:00
Matt DeVillier
cbad9b6637
oem-factory-reset: Handle non-TPM case
Guard TPM-related bits by checking CONFIG_TPM = y

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-06-09 12:45:39 -05:00
Matt DeVillier
0cae2d7805
kexec-save-default: guard TPM LUKS usage with config option
Add CONFIG_TPM_NO_LUKS_DISK_UNLOCK to allow Librem boards to opt
out of using TPM to store LUKS key, and use it to guard the user
option to add the disk encryption key to the TPM.

Select this option for all Librem boards; all other boards which
select CONFIG_TPM=y will have no change in functionality.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-06-08 11:40:55 -05:00