fix

1 files changed, 313 insertions, 0 deletions

diff --git a/raveos-app-installer/raveos-secureboot-setup b/raveos-app-installer/raveos-secureboot-setup
new file mode 100644
index 0000000..a02b046
--- /dev/null
+++ b/raveos-app-installer/raveos-secureboot-setup
@@ -0,0 +1,313 @@
+#!/bin/bash
+set -u
+
+GLOBAL_GUID="8be4df61-93ca-11d2-aa0d-00e098032b8c"
+DB_GUID="d719b2cb-3d3a-4596-a3bc-dad00e67656f"
+
+SB_DIR=/usr/share/raveos/secureboot
+MS="$SB_DIR/ms"
+MACHINE_DIR=/etc/raveos/secureboot
+STATE=/var/lib/raveos-sb
+RESUME_UNIT=raveos-sb-resume.service
+WORK=""
+
+log() { echo "[raveos-sb] $*"; }
+
+cleanup() { [ -n "$WORK" ] && rm -rf "$WORK"; }
+trap cleanup EXIT
+
+efi_var() {
+    od -An -t u1 /sys/firmware/efi/efivars/"$1"-* 2>/dev/null | awk '{print $5}'
+}
+
+status_cmd() {
+    if [ ! -d /sys/firmware/efi/efivars ]; then
+        log "Nem UEFI rendszer - Secure Boot nem elerheto."
+        return 1
+    fi
+    local sb sm keys tools signed
+    sb=$(efi_var SecureBoot)
+    sm=$(efi_var SetupMode)
+    keys=0
+    [ -f "$MACHINE_DIR/machine.pem" ] && keys=1
+    tools=0
+    command -v sbsign >/dev/null 2>&1 && tools=1
+    signed=0
+    if [ "$keys" = "1" ] && command -v sbverify >/dev/null 2>&1; then
+        signed=1
+        for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do
+            [ -f "$f" ] || continue
+            sbverify --cert "$MACHINE_DIR/machine.pem" "$f" >/dev/null 2>&1 || signed=0
+        done
+    fi
+    echo "uefi=1"
+    echo "secureboot=${sb:-?}"
+    echo "setupmode=${sm:-?}"
+    echo "keys=$keys"
+    echo "tools=$tools"
+    echo "signed=$signed"
+    if [ -f "$STATE/pending" ]; then echo "pending=1"; else echo "pending=0"; fi
+    log "SecureBoot=${sb:-?} SetupMode=${sm:-?} gepkulcs=$keys alairasok=$signed"
+}
+
+deps_cmd() {
+    local need=()
+    local p
+    for p in sbsigntools efitools openssl zstd; do
+        pacman -Qq "$p" >/dev/null 2>&1 || need+=("$p")
+    done
+    if [ "${#need[@]}" -gt 0 ]; then
+        log "Hianyzo eszkozok telepitese: ${need[*]}"
+        pacman -S --noconfirm "${need[@]}" || return 1
+    fi
+}
+
+keygen_cmd() {
+    if [ -f "$MACHINE_DIR/machine.key" ]; then
+        log "A gepkulcs mar letezik."
+        return 0
+    fi
+    install -d -m 711 "$MACHINE_DIR"
+    openssl req -newkey rsa:2048 -nodes -keyout "$MACHINE_DIR/machine.key" -x509 -days 3650 \
+        -out "$MACHINE_DIR/machine.pem" \
+        -subj "/O=RaveOS/CN=RaveOS Machine Key" \
+        -addext "basicConstraints=critical,CA:TRUE" \
+        -addext "keyUsage=critical,digitalSignature,keyCertSign,cRLSign" \
+        -addext "extendedKeyUsage=codeSigning" 2>/dev/null || {
+        log "HIBA: gepkulcs generalas sikertelen"
+        return 1
+    }
+    chmod 600 "$MACHINE_DIR/machine.key"
+    chmod 644 "$MACHINE_DIR/machine.pem"
+    log "Gepkulcs generalva: CN=RaveOS Machine Key"
+}
+
+signfile_path() {
+    local c
+    for c in /usr/lib/modules/*/build/scripts/sign-file /usr/src/linux/scripts/sign-file; do
+        [ -x "$c" ] && { echo "$c"; return 0; }
+    done
+    return 1
+}
+
+sign_one() {
+    local key="$1" cert="$2" f="$3"
+    sbverify --cert "$cert" "$f" >/dev/null 2>&1 && return 0
+    if sbsign --key "$key" --cert "$cert" --output "$f.signed" "$f" 2>/dev/null; then
+        mv "$f.signed" "$f"
+        log "alairva: $f"
+        return 0
+    fi
+    log "FIGYELEM: nem sikerult alairni: $f"
+    return 1
+}
+
+sign_cmd() {
+    command -v sbsign >/dev/null 2>&1 || { log "HIBA: sbsign nem elerheto"; return 1; }
+    local key="$MACHINE_DIR/machine.key" cert="$MACHINE_DIR/machine.pem"
+    local n=0 f signfile t
+    for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-* /boot/memtest86+/memtest.efi; do
+        [ -f "$f" ] || continue
+        sign_one "$key" "$cert" "$f" && n=$((n + 1))
+    done
+    signfile=$(signfile_path) || signfile=""
+    if [ -n "$signfile" ]; then
+        install -m 755 "$signfile" /usr/local/bin/raveos-sign-file
+        local d sub m
+        for d in /usr/lib/modules/*/; do
+            for sub in extramodules updates/dkms extras; do
+                [ -d "${d}${sub}" ] || continue
+                while IFS= read -r -d '' m; do
+                    if modinfo -F signer "$m" 2>/dev/null | grep -q "RaveOS Machine Key"; then
+                        continue
+                    fi
+                    case "$m" in
+                        *.ko)
+                            /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$m" >/dev/null 2>&1 && n=$((n + 1))
+                            ;;
+                        *.ko.zst)
+                            t=$(mktemp -d)
+                            if zstd -q -d -c "$m" > "$t/m.ko" 2>/dev/null &&
+                               /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$t/m.ko" >/dev/null 2>&1 &&
+                               zstd -q -f -o "$m" "$t/m.ko" 2>/dev/null; then
+                                n=$((n + 1))
+                            fi
+                            rm -rf "$t"
+                            ;;
+                    esac
+                done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null)
+            done
+        done
+    else
+        log "FIGYELEM: sign-file nem talalhato (kernel-headers nelkul a modulok kimaradnak)"
+    fi
+    log "Alairt elemek: $n"
+}
+
+hook_cmd() {
+    install -d -m 755 /usr/local/bin /etc/pacman.d/hooks
+    install -m 755 "$SB_DIR/installed/raveos-sb-sign-local.sh" /usr/local/bin/raveos-sb-sign-local.sh
+    install -m 644 "$SB_DIR/installed/zz-raveos-sb-sign.hook" /etc/pacman.d/hooks/zz-raveos-sb-sign.hook
+    log "Pacman hook + helyi alairo telepitve."
+}
+
+verify_cmd() {
+    local cert="$MACHINE_DIR/machine.pem" bad=0 f
+    for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do
+        [ -f "$f" ] || continue
+        sbverify --cert "$cert" "$f" >/dev/null 2>&1 || { bad=1; log "NINCS alairva: $f"; }
+    done
+    [ "$bad" = "0" ] && log "Alairas-ellenorzes: rendben."
+    if command -v efi-readvar >/dev/null 2>&1; then
+        log "Firmware db tartalom:"
+        efi-readvar -v db 2>/dev/null | grep -E "CN *=|O *=" | head -14
+    fi
+}
+
+cert_to_esl() {
+    cert-to-efi-sig-list "$1" "$2" 2>/dev/null || return 1
+    local sz
+    sz=$(stat -c %s "$2" 2>/dev/null || echo 0)
+    [ "$sz" -gt 100 ]
+}
+
+build_db_esl() {
+    local out="$1" f
+    cert_to_esl "$SB_DIR/db.pem" "$WORK/raveos-db.esl" || return 1
+    cert_to_esl "$MACHINE_DIR/machine.pem" "$WORK/machine.esl" || return 1
+    cat "$WORK/raveos-db.esl" > "$out"
+    for f in "$MS/MicCorUEFCA2011_2011-06-27.pem" "$MS/MicWinProPCA2011_2011-10-19.pem" \
+             "$MS/microsoft uefi ca 2023.pem" "$MS/windows uefi ca 2023.pem" \
+             "$MS/microsoft option rom uefi ca 2023.pem"; do
+        [ -f "$f" ] || continue
+        cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out"
+    done
+    cat "$WORK/machine.esl" >> "$out"
+}
+
+build_kek_esl() {
+    local out="$1" f
+    cert_to_esl "$SB_DIR/KEK.pem" "$WORK/raveos-kek.esl" || return 1
+    cat "$WORK/raveos-kek.esl" > "$out"
+    for f in "$MS/MicCorKEKCA2011_2011-06-24.pem" "$MS/microsoft corporation kek 2k ca 2023.pem"; do
+        [ -f "$f" ] || continue
+        cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out"
+    done
+}
+
+clear_var() {
+    local name="$1" guid="$2" f
+    f="/sys/firmware/efi/efivars/${name}-${guid}"
+    [ -e "$f" ] || return 0
+    chattr -i "$f" 2>/dev/null || true
+    rm -f "$f" 2>/dev/null || log "FIGYELEM: ${name} regi valtozo torlese nem sikerult"
+}
+
+enroll_cmd() {
+    local sm t
+    sm=$(efi_var SetupMode)
+    if [ "${sm:-0}" != "1" ]; then
+        log "A firmware nincs Setup Mode-ban."
+        return 10
+    fi
+    for t in cert-to-efi-sig-list efi-updatevar; do
+        command -v "$t" >/dev/null 2>&1 || { log "HIBA: $t nem elerheto (efitools)"; return 1; }
+    done
+    [ -f "$SB_DIR/PK.auth" ] || { log "HIBA: hianyzik a PK.auth"; return 1; }
+
+    WORK=$(mktemp -d)
+    build_db_esl "$WORK/db.esl" || { log "HIBA: db ESL epites"; return 1; }
+    build_kek_esl "$WORK/KEK.esl" || { log "HIBA: KEK ESL epites"; return 1; }
+
+    log "Meglevo PK/KEK/db valtozok torlese..."
+    clear_var PK "$GLOBAL_GUID"
+    clear_var KEK "$GLOBAL_GUID"
+    clear_var db "$DB_GUID"
+
+    log "db irasa (RaveOS + Microsoft + gepkulcs)..."
+    efi-updatevar -e -f "$WORK/db.esl" db || { log "HIBA: db iras"; return 1; }
+
+    log "KEK irasa (RaveOS + Microsoft)..."
+    efi-updatevar -e -f "$WORK/KEK.esl" KEK || { log "HIBA: KEK iras"; return 1; }
+
+    log "PK irasa (elore alairt PK.auth)..."
+    efi-updatevar -f "$SB_DIR/PK.auth" PK || { log "HIBA: PK iras"; return 1; }
+
+    log "Kulcsok telepitve a firmware-be."
+}
+
+setup_cmd() {
+    status_cmd || return 1
+    log "FIGYELEM (BitLocker): ha a Windowson BitLocker van, elotte inditsd el a Windowst es futtasd:"
+    log "  manage-bde -protectors -disable C: -rebootcount 2"
+    log "  vagy legyen keznel a 48 jegyu helyreallitasi kulcs."
+    deps_cmd || return 1
+    keygen_cmd || return 1
+    sign_cmd || return 1
+    hook_cmd || return 1
+    install -d -m 755 "$STATE"
+    local rc
+    enroll_cmd
+    rc=$?
+    if [ "$rc" = "0" ]; then
+        verify_cmd
+        rm -f "$STATE/pending"
+        log "KESZ. A BIOS-ban allitsd: Secure Boot -> Enabled, majd ujrainditas."
+        return 0
+    fi
+    if [ "$rc" = "10" ]; then
+        install -m 644 "$SB_DIR/installed/raveos-sb-resume.service" /etc/systemd/system/"$RESUME_UNIT"
+        systemctl daemon-reload
+        systemctl enable "$RESUME_UNIT" >/dev/null 2>&1
+        touch "$STATE/pending"
+        log "A BIOS-ban: Secure Boot -> Key Management -> Clear Secure Boot keys (Setup Mode),"
+        log "ments, majd inditsd ujra a gepet. Boot utan a folyamat magatol befejezodik."
+        return 10
+    fi
+    return "$rc"
+}
+
+resume_cmd() {
+    [ -f "$STATE/pending" ] || exit 0
+    if enroll_cmd; then
+        verify_cmd
+        rm -f "$STATE/pending"
+        date -Is > "$STATE/done"
+        systemctl disable "$RESUME_UNIT" >/dev/null 2>&1
+        log "Secure Boot beallitas befejezve. A BIOS-ban: Secure Boot -> Enabled."
+        exit 0
+    fi
+    exit 1
+}
+
+need_root() {
+    if [ "$(id -u)" != "0" ]; then
+        echo "[raveos-sb] Root jogosultsag szukseges." >&2
+        exit 1
+    fi
+}
+
+case "${1:-}" in
+    --status)
+        status_cmd
+        ;;
+    --verify)
+        verify_cmd
+        ;;
+    --setup)
+        need_root
+        setup_cmd
+        ;;
+    --resume)
+        need_root
+        resume_cmd
+        ;;
+    --resign)
+        need_root
+        keygen_cmd && sign_cmd && verify_cmd
+        ;;
+    *)
+        echo "hasznalat: raveos-secureboot-setup --status|--setup|--resume|--resign|--verify" >&2
+        exit 2
+        ;;
+esac