mirror of
https://github.com/linuxboot/heads.git
synced 2025-02-21 01:31:26 +00:00
8004b5df2a
Similar to qubes-update, it will save then verify the hashes of the kexec files. Once TOTP is verified, a normal boot will verify that the file hashes and all the kexec params match and if successful, boot directly to OS. Also added a config option to require hash verification for non-recovery boots, failing to recovery not met.
44 lines
1.2 KiB
Bash
Executable File
44 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# Boot from signed ISO
|
|
|
|
. /etc/functions
|
|
. /etc/config
|
|
|
|
MOUNTED_ISO_PATH="$1"
|
|
ISO_PATH="$2"
|
|
DEV="$3"
|
|
|
|
echo '+++ Verifying ISO'
|
|
# Verify the signature on the hashes
|
|
ISOSIG="$MOUNTED_ISO_PATH.sig"
|
|
if ! [ -r "$ISOSIG" ]; then
|
|
ISOSIG="$MOUNTED_ISO_PATH.asc"
|
|
fi
|
|
|
|
gpgv "$ISOSIG" "$MOUNTED_ISO_PATH" \
|
|
|| recovery 'ISO signature failed'
|
|
|
|
echo '+++ Mounting ISO and booting'
|
|
mount -t iso9660 -o loop $MOUNTED_ISO_PATH /boot \
|
|
|| recovery '$MOUNTED_ISO_PATH: Unable to mount /boot'
|
|
|
|
DEV_UUID=`blkid $DEV | tail -1 | tr " " "\n" | grep UUID | cut -d\" -f2`
|
|
ADD="fromiso=/dev/disk/by-uuid/$DEV_UUID/$ISO_PATH"
|
|
REMOVE=""
|
|
|
|
ADD_FILE=/tmp/kexec/kexec_iso_add.txt
|
|
if [ -r $ADD_FILE ]; then
|
|
NEW_ADD=`cat $ADD_FILE`
|
|
ADD=$(eval "echo \"$NEW_ADD\"")
|
|
echo "+++ Overriding standard ISO kernel add arguments: $ADD"
|
|
fi
|
|
REMOVE_FILE=/tmp/kexec/kexec_iso_remove.txt
|
|
if [ -r $REMOVE_FILE ]; then
|
|
NEW_REMOVE=`cat $REMOVE_FILE`
|
|
REMOVE=$(eval "echo \"$NEW_REMOVE\"")
|
|
echo "+++ Overriding standard ISO kernel remove arguments: $REMOVE"
|
|
fi
|
|
|
|
# Call kexec and indicate that hashes have been verified
|
|
kexec-select-boot -b /boot/ -d /media/ -p "/media/kexec_iso/$ISO_PATH/" -a "$ADD" -r "$REMOVE" -c "*.cfg" -u -h
|