fix: remove host FDE requirement, fix remaining audit partials
Host FDE is no longer required — only guest (ISO) FDE matters per owner direction. The build host's security posture is the owner's responsibility. The Docker container already isolates the build process. Changes: - run.sh: Removed check_host_fde() function and its call in iso build path - run.sh: Fixed SB key chmod in inline SECUREBOOT_HOOK (C-04 complete) - run.sh: Fixed cache manifest format — no longer capped at 20 files (H-09) - docs/PRD.md: Removed FR-011 Host FDE, renumbered FR-011 = Secure Boot/UKI - docs/COMPLIANCE.md: Replaced fraudulent ✅ summary with honest aspirational - config/hooks/installed/encryption-validation.sh: lsblk discovery (H-06) - src/security-hardening.sh: Synced WiFi blacklist with live hook (M-12) - tests/: Updated 3 test files for guest encryption instead of host FDE - AGENTS.md, README.md, audit docs: Removed host FDE references - STATUS.md: Updated for current state - JOURNAL.md: Added ADR-017 (host FDE not required) 782 tests pass, 0 fail, 0 shellcheck warnings. Reference: DeepReport-2026-05-08.md C-02, C-04, H-06, H-09, M-12 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
This commit is contained in:
86
run.sh
86
run.sh
@@ -41,82 +41,6 @@ mkdir -p "${OUTPUT_DIR}" "${BUILD_DIR}"
|
||||
# HOST FDE CHECK (MANDATORY)
|
||||
# ============================================================================
|
||||
|
||||
# Check if host system has full disk encryption enabled
|
||||
# This is MANDATORY - building or testing a secure OS on an unencrypted host
|
||||
# defeats the entire security model
|
||||
check_host_fde() {
|
||||
log_info "Checking host system for Full Disk Encryption..."
|
||||
|
||||
local has_luks=false
|
||||
local encrypted_root=false
|
||||
|
||||
# Method 1: Check for LUKS devices via lsblk
|
||||
if lsblk -o TYPE,FSTYPE 2>/dev/null | grep -q "crypt"; then
|
||||
has_luks=true
|
||||
log_info "Found LUKS encrypted partitions"
|
||||
fi
|
||||
|
||||
# Method 2: Check if root filesystem is on a dm-crypt device
|
||||
if [[ -e /dev/mapper/root ]] || [[ -e /dev/mapper/rootfs ]]; then
|
||||
encrypted_root=true
|
||||
log_info "Root filesystem appears to be on encrypted device"
|
||||
fi
|
||||
|
||||
# Method 3: Check /etc/crypttab for configured encrypted partitions
|
||||
if [[ -f /etc/crypttab ]] && grep -qE "^[^#]" /etc/crypttab 2>/dev/null; then
|
||||
has_luks=true
|
||||
log_info "Found encrypted partitions in /etc/crypttab"
|
||||
fi
|
||||
|
||||
# Method 4: Check for dm-crypt devices in /sys/block
|
||||
if find /sys/block -maxdepth 1 -name 'dm-*' -print -quit 2>/dev/null | grep -q .; then
|
||||
for dm_dev in /sys/block/dm-*; do
|
||||
if [[ -f "${dm_dev}/dm/name" ]]; then
|
||||
local dm_name
|
||||
dm_name=$(cat "${dm_dev}/dm/name" 2>/dev/null)
|
||||
# Check if this is a LUKS device
|
||||
if [[ -f "${dm_dev}/dm/uuid" ]] && grep -qi "CRYPT-LUKS" "${dm_dev}/dm/uuid" 2>/dev/null; then
|
||||
has_luks=true
|
||||
log_info "Found LUKS device: ${dm_name}"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Method 5: Check root mount point for encryption
|
||||
local root_device
|
||||
root_device=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")
|
||||
if [[ "$root_device" == /dev/mapper/* ]] || [[ "$root_device" == *"crypt"* ]]; then
|
||||
encrypted_root=true
|
||||
log_info "Root filesystem is on encrypted device: $root_device"
|
||||
fi
|
||||
|
||||
# Require at least one indicator of FDE
|
||||
if [[ "$has_luks" == "true" || "$encrypted_root" == "true" ]]; then
|
||||
log_info "Host FDE check PASSED"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# FDE not detected - this is a FATAL error
|
||||
log_error "============================================================"
|
||||
log_error "SECURITY REQUIREMENT VIOLATION"
|
||||
log_error "============================================================"
|
||||
log_error "Host system does NOT have Full Disk Encryption enabled."
|
||||
log_error ""
|
||||
log_error "Building or testing KNEL-Football Secure OS requires the"
|
||||
log_error "host system to be encrypted with LUKS. An unencrypted host"
|
||||
log_error "defeats the entire security model."
|
||||
log_error ""
|
||||
log_error "To enable FDE on Debian/Ubuntu:"
|
||||
log_error " 1. Backup all data"
|
||||
log_error " 2. Reinstall with 'Guided - use entire disk and set up encrypted LVM'"
|
||||
log_error " 3. Or use: https://github.com/The Firefoxlyer/encrypt-existing-debian"
|
||||
log_error ""
|
||||
log_error "This check is MANDATORY and cannot be bypassed."
|
||||
log_error "============================================================"
|
||||
return 1
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# VM TESTING FUNCTIONS (merged from test-iso.sh)
|
||||
# ============================================================================
|
||||
@@ -1065,11 +989,6 @@ main() {
|
||||
KNEL_BUILD_MODE="production"
|
||||
log_info "Build mode: PRODUCTION (prompts for credentials during install)"
|
||||
fi
|
||||
if ! check_host_fde; then
|
||||
log_error "Host FDE check FAILED - cannot build on unencrypted host"
|
||||
log_error "See PRD FR-011: Host FDE is MANDATORY"
|
||||
exit 1
|
||||
fi
|
||||
echo "Building KNEL-Football secure ISO..."
|
||||
echo "ALL operations run inside Docker container"
|
||||
echo "Timezone: America/Chicago"
|
||||
@@ -1178,6 +1097,7 @@ echo "=========================================="
|
||||
# Secure Boot key directory
|
||||
SB_KEY_DIR="/tmp/secureboot-keys"
|
||||
mkdir -p "$SB_KEY_DIR"
|
||||
chmod 700 "$SB_KEY_DIR"
|
||||
|
||||
# Generate Secure Boot keys if not present
|
||||
if [[ ! -f "$SB_KEY_DIR/db.key" ]]; then
|
||||
@@ -1198,6 +1118,7 @@ if [[ ! -f "$SB_KEY_DIR/db.key" ]]; then
|
||||
-nodes -subj "/CN=KNEL-Football db/" \
|
||||
-keyout "$SB_KEY_DIR/db.key" \
|
||||
-out "$SB_KEY_DIR/db.crt" 2>/dev/null
|
||||
chmod 600 "$SB_KEY_DIR"/*.key
|
||||
|
||||
# Create ESL files
|
||||
echo "[SB] Creating EFI Signature Lists..."
|
||||
@@ -1366,7 +1287,8 @@ if [ -n "$ISO_FILE" ]; then
|
||||
|
||||
# H-09: Cache integrity - record SHA256 of cached files
|
||||
if [ -d /cache ]; then
|
||||
echo "$(date +%s) $(sha256sum /cache/* 2>/dev/null | head -20)" > /cache/.cache-manifest 2>/dev/null || true
|
||||
echo "$(date +%s)" > /cache/.cache-manifest
|
||||
sha256sum /cache/* 2>/dev/null >> /cache/.cache-manifest || true
|
||||
fi
|
||||
|
||||
# Write build info for reproducibility verification
|
||||
|
||||
Reference in New Issue
Block a user