mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-19 04:57:55 +00:00
efc49c7425
Currently Heads will check files in /boot for tampering before booting into a system. It would be nice if you could use the trusted environment within Heads and extend this to check files in / itself. This new script adds that functionality, however due to the length of time it takes to perform these kinds of checks, it doesn't run automatically (yet). This feature can be configured from the config GUI - the root device/ directories to check can be set, and it can be configured to run during boot. To make this a bit easier to use, I added a feature to detect whether the hash file exists and if not, to display a more limited menu to the user guiding them to create the initial hash file. Otherwise it will display the date the file was last modified, which can be useful to determine how stale it is.
45 lines
1.1 KiB
Makefile
45 lines
1.1 KiB
Makefile
# Configuration for a librem mini v2
|
|
CONFIG_LINUX_CONFIG=config/linux-librem_common.config
|
|
CONFIG_COREBOOT_CONFIG=config/coreboot-librem_mini_v2.config
|
|
|
|
export CONFIG_COREBOOT=y
|
|
export CONFIG_COREBOOT_VERSION=4.17
|
|
export CONFIG_LINUX_VERSION=5.10.5
|
|
export CONFIG_PURISM_BLOBS=y
|
|
|
|
CONFIG_CRYPTSETUP2=y
|
|
CONFIG_FLASHROM=y
|
|
CONFIG_FLASHTOOLS=y
|
|
CONFIG_GPG2=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_UTIL_LINUX=y
|
|
CONFIG_LVM2=y
|
|
CONFIG_MBEDTLS=y
|
|
CONFIG_PCIUTILS=y
|
|
CONFIG_POPT=y
|
|
CONFIG_QRENCODE=y
|
|
CONFIG_TPMTOTP=y
|
|
|
|
CONFIG_CAIRO=y
|
|
CONFIG_FBWHIPTAIL=y
|
|
CONFIG_HOTPKEY=y
|
|
|
|
CONFIG_LINUX_USB=y
|
|
|
|
export CONFIG_TPM=n
|
|
export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
|
|
|
|
export CONFIG_BOOTSCRIPT=/bin/gui-init
|
|
export CONFIG_BOOT_REQ_HASH=n
|
|
export CONFIG_BOOT_REQ_ROLLBACK=n
|
|
export CONFIG_BOOT_KERNEL_ADD="intel_iommu=igfx_off"
|
|
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
|
|
export CONFIG_BOOT_DEV="/dev/nvme0n1p1"
|
|
export CONFIG_BOARD_NAME="Librem Mini v2"
|
|
export CONFIG_FLASHROM_OPTIONS="-p internal"
|
|
export CONFIG_USB_KEYBOARD=y
|
|
export CONFIG_AUTO_BOOT_TIMEOUT=5
|
|
export CONFIG_ROOT_DEV="/dev/nvme0n1p2"
|
|
export CONFIG_ROOT_DIRLIST="bin boot lib sbin usr"
|
|
export CONFIG_ROOT_CHECK_AT_BOOT="n"
|