mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-22 06:17:52 +00:00
8259d3ca1e
- Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs - Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc) - add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action
22 lines
594 B
Bash
Executable File
22 lines
594 B
Bash
Executable File
#!/bin/sh
|
|
# Measure all of the luks disk encryption headers into
|
|
# a PCR so that we can detect disk swap attacks.
|
|
. /etc/functions
|
|
|
|
TRACE "Under /bin/qubes-measure-luks"
|
|
|
|
die() { echo >&2 "$@"; exit 1; }
|
|
|
|
# Measure the luks headers into PCR 6
|
|
for dev in "$@"; do
|
|
cryptsetup luksHeaderBackup $dev \
|
|
--header-backup-file /tmp/lukshdr-$(echo "$dev" | sed 's/\//_/g') \
|
|
|| die "$dev: Unable to read luks header"
|
|
done
|
|
|
|
sha256sum /tmp/lukshdr-* > /tmp/luksDump.txt || die "Unable to hash luks headers"
|
|
rm /tmp/lukshdr-*
|
|
|
|
tpm extend -ix 6 -if /tmp/luksDump.txt \
|
|
|| die "Unable to extend PCR"
|