mirror of
https://github.com/linuxboot/heads.git
synced 2025-02-01 08:47:58 +00:00
6db03b0bdd
When playing with long fbwhiptail/whiptail messages, this commit played around the long string using fold. ''' echo -e "This will replace the encrypted container content and its LUKS Disk Recovery Key.\n\nThe passphrase associated with this key will be asked from the user under the following conditions:\n 1-Every boot if no Disk Unlock Key was added to the TPM\n 2-If the TPM fails (hardware failure)\n 3-If the firmware has been tampered with/modified by the user\n\nThis process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present.\n\nAt the next prompt, you may be asked to select which file corresponds to the LUKS device container.\n\nHit Enter to continue." | fold -w 70 -s ''' Which gave the exact output of what will be inside of the fbwhiptail prompt, fixed to 70 chars width: ''' This will replace the encrypted container content and its LUKS Disk Recovery Key. The passphrase associated with this key will be asked from the user under the following conditions: 1-Every boot if no Disk Unlock Key was added to the TPM 2-If the TPM fails (hardware failure) 3-If the firmware has been tampered with/modified by the user This process requires you to type the current LUKS Disk Recovery Key passphrase and will delete the LUKS TPM Disk Unlock Key slot, if set up, by setting a default boot LUKS key slot (1) if present. At the next prompt, you may be asked to select which file corresponds to the LUKS device container. Hit Enter to continue. ''' Therefore, for long prompts in the future, one can just deal with "\n 1-" alignments to be respected in prompts and have fold deal with cutting the length of strings properly. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
89 lines
2.3 KiB
Bash
Executable File
89 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Generate a TPM key used to unlock LUKS disks
|
|
|
|
. /etc/functions
|
|
|
|
TRACE "kexec-save-key: start"
|
|
set -e -o pipefail
|
|
. /etc/functions
|
|
|
|
lvm_volume_group=""
|
|
skip_sign="n"
|
|
while getopts "sp:d:l:" arg; do
|
|
case $arg in
|
|
s) skip_sign="y" ;;
|
|
p) paramsdir="$OPTARG" ;;
|
|
d) paramsdev="$OPTARG" ;;
|
|
l) lvm_volume_group="$OPTARG" ;;
|
|
esac
|
|
done
|
|
|
|
DEBUG "kexec-save-key prior of parsing: paramsdir: $paramsdir, paramsdev: $paramsdev, lvm_volume_group: $lvm_volume_group"
|
|
|
|
shift $(expr $OPTIND - 1)
|
|
key_devices="$@"
|
|
|
|
DEBUG "kexec-save-key: key_devices: $key_devices"
|
|
|
|
if [ -z "$paramsdir" ]; then
|
|
die "Usage: $0 [-s] -p /boot [-l qubes_dom0] [/dev/sda2 /dev/sda5 ...] "
|
|
fi
|
|
|
|
if [ -z "$paramsdev" ]; then
|
|
paramsdev="$paramsdir"
|
|
DEBUG "kexec-save-key: paramsdev modified to : $paramsdev"
|
|
fi
|
|
|
|
paramsdev="${paramsdev%%/}"
|
|
paramsdir="${paramsdir%%/}"
|
|
|
|
DEBUG "kexec-save-key prior of last override: paramsdir: $paramsdir, paramsdev: $paramsdev, lvm_volume_group: $lvm_volume_group"
|
|
|
|
if [ -n "$lvm_volume_group" ]; then
|
|
lvm vgchange -a y $lvm_volume_group ||
|
|
die "Failed to activate the LVM group"
|
|
for dev in /dev/$lvm_volume_group/*; do
|
|
key_devices="$key_devices $dev"
|
|
done
|
|
fi
|
|
|
|
if [ -z "$key_devices" ]; then
|
|
die "No devices specified for TPM key insertion"
|
|
fi
|
|
|
|
# try to switch to rw mode
|
|
mount -o rw,remount $paramsdev
|
|
|
|
rm -f $paramsdir/kexec_key_lvm.txt || true
|
|
if [ -n "$lvm_volume_group" ]; then
|
|
DEBUG "kexec-save-key saving under $paramsdir/kexec_key_lvm.txt : lvm_volume_group: $lvm_volume_group"
|
|
echo "$lvm_volume_group" >$paramsdir/kexec_key_lvm.txt ||
|
|
die "Failed to write lvm group to key config "
|
|
fi
|
|
|
|
rm -f $paramsdir/kexec_key_devices.txt || true
|
|
for dev in $key_devices; do
|
|
DEBUG "Getting UUID for $dev"
|
|
uuid=$(cryptsetup luksUUID "$dev" 2>/dev/null) ||
|
|
die "Failed to get UUID for device $dev"
|
|
DEBUG "Saving under $paramsdir/kexec_key_devices.txt : dev: $dev, uuid: $uuid"
|
|
echo "$dev $uuid" >>$paramsdir/kexec_key_devices.txt ||
|
|
die "Failed to add $dev:$uuid to key devices config"
|
|
done
|
|
|
|
kexec-seal-key $paramsdir ||
|
|
die "Failed to save and generate LUKS TPM Disk Unlock Key"
|
|
|
|
if [ "$skip_sign" != "y" ]; then
|
|
extparam=
|
|
if [ "$CONFIG_IGNORE_ROLLBACK" != "y" ]; then
|
|
extparam=-r
|
|
fi
|
|
# sign and auto-roll config counter
|
|
kexec-sign-config -p $paramsdir $extparam ||
|
|
die "Failed to sign updated config"
|
|
fi
|
|
|
|
# switch back to ro mode
|
|
mount -o ro,remount $paramsdev
|