diff options
Diffstat (limited to 'raveos-app-installer/raveos-secureboot-setup')
| -rw-r--r-- | raveos-app-installer/raveos-secureboot-setup | 313 |
1 files changed, 0 insertions, 313 deletions
diff --git a/raveos-app-installer/raveos-secureboot-setup b/raveos-app-installer/raveos-secureboot-setup deleted file mode 100644 index 149bfda..0000000 --- a/raveos-app-installer/raveos-secureboot-setup +++ /dev/null @@ -1,313 +0,0 @@ -#!/bin/bash -set -u - -GLOBAL_GUID="8be4df61-93ca-11d2-aa0d-00e098032b8c" -DB_GUID="d719b2cb-3d3a-4596-a3bc-dad00e67656f" - -SB_DIR=/usr/share/raveos/secureboot -MS="$SB_DIR/ms" -MACHINE_DIR=/etc/raveos/secureboot -STATE=/var/lib/raveos-sb -RESUME_UNIT=raveos-sb-resume.service -WORK="" - -log() { echo "[raveos-sb] $*"; } - -cleanup() { [ -n "$WORK" ] && rm -rf "$WORK"; } -trap cleanup EXIT - -efi_var() { - od -An -t u1 /sys/firmware/efi/efivars/"$1"-* 2>/dev/null | awk '{print $5}' -} - -status_cmd() { - if [ ! -d /sys/firmware/efi/efivars ]; then - log "Nem UEFI rendszer - Secure Boot nem elerheto." - return 1 - fi - local sb sm keys tools signed - sb=$(efi_var SecureBoot) - sm=$(efi_var SetupMode) - keys=0 - [ -f "$MACHINE_DIR/machine.pem" ] && keys=1 - tools=0 - command -v sbsign >/dev/null 2>&1 && tools=1 - signed=0 - if [ "$keys" = "1" ] && command -v sbverify >/dev/null 2>&1; then - signed=1 - for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do - [ -f "$f" ] || continue - sbverify --cert "$MACHINE_DIR/machine.pem" "$f" >/dev/null 2>&1 || signed=0 - done - fi - echo "uefi=1" - echo "secureboot=${sb:-?}" - echo "setupmode=${sm:-?}" - echo "keys=$keys" - echo "tools=$tools" - echo "signed=$signed" - if [ -f "$STATE/pending" ]; then echo "pending=1"; else echo "pending=0"; fi - log "SecureBoot=${sb:-?} SetupMode=${sm:-?} gepkulcs=$keys alairasok=$signed" -} - -deps_cmd() { - local need=() - local p - for p in sbsigntools efitools openssl zstd; do - pacman -Qq "$p" >/dev/null 2>&1 || need+=("$p") - done - if [ "${#need[@]}" -gt 0 ]; then - log "Hianyzo eszkozok telepitese: ${need[*]}" - pacman -S --noconfirm "${need[@]}" || return 1 - fi -} - -keygen_cmd() { - if [ -f "$MACHINE_DIR/machine.key" ]; then - log "A gepkulcs mar letezik." - return 0 - fi - install -d -m 711 "$MACHINE_DIR" - openssl req -newkey rsa:2048 -nodes -keyout "$MACHINE_DIR/machine.key" -x509 -days 3650 \ - -out "$MACHINE_DIR/machine.pem" \ - -subj "/O=RaveOS/CN=RaveOS Machine Key" \ - -addext "basicConstraints=critical,CA:TRUE" \ - -addext "keyUsage=critical,digitalSignature,keyCertSign,cRLSign" \ - -addext "extendedKeyUsage=codeSigning" 2>/dev/null || { - log "HIBA: gepkulcs generalas sikertelen" - return 1 - } - chmod 600 "$MACHINE_DIR/machine.key" - chmod 644 "$MACHINE_DIR/machine.pem" - log "Gepkulcs generalva: CN=RaveOS Machine Key" -} - -signfile_path() { - local c - for c in /usr/lib/modules/*/build/scripts/sign-file /usr/src/linux/scripts/sign-file; do - [ -x "$c" ] && { echo "$c"; return 0; } - done - return 1 -} - -sign_one() { - local key="$1" cert="$2" f="$3" - sbverify --cert "$cert" "$f" >/dev/null 2>&1 && return 0 - if sbsign --key "$key" --cert "$cert" --output "$f.signed" "$f" 2>/dev/null; then - mv "$f.signed" "$f" - log "alairva: $f" - return 0 - fi - log "FIGYELEM: nem sikerult alairni: $f" - return 1 -} - -sign_cmd() { - command -v sbsign >/dev/null 2>&1 || { log "HIBA: sbsign nem elerheto"; return 1; } - local key="$MACHINE_DIR/machine.key" cert="$MACHINE_DIR/machine.pem" - local n=0 f signfile t - for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-* /boot/memtest86+/memtest.efi; do - [ -f "$f" ] || continue - sign_one "$key" "$cert" "$f" && n=$((n + 1)) - done - signfile=$(signfile_path) || signfile="" - if [ -n "$signfile" ]; then - install -m 755 "$signfile" /usr/local/bin/raveos-sign-file - local d sub m - for d in /usr/lib/modules/*/; do - for sub in extramodules updates/dkms extras; do - [ -d "${d}${sub}" ] || continue - while IFS= read -r -d '' m; do - if modinfo -F signer "$m" 2>/dev/null | grep -q "RaveOS Machine Key"; then - continue - fi - case "$m" in - *.ko) - /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$m" >/dev/null 2>&1 && n=$((n + 1)) - ;; - *.ko.zst) - t=$(mktemp -d) - if zstd -q -d -c "$m" > "$t/m.ko" 2>/dev/null && - /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$t/m.ko" >/dev/null 2>&1 && - zstd -q -f -o "$m" "$t/m.ko" 2>/dev/null; then - n=$((n + 1)) - fi - rm -rf "$t" - ;; - esac - done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null) - done - done - else - log "FIGYELEM: sign-file nem talalhato (kernel-headers nelkul a modulok kimaradnak)" - fi - log "Alairt elemek: $n" -} - -hook_cmd() { - install -d -m 755 /usr/local/bin /etc/pacman.d/hooks - install -m 755 "$SB_DIR/installed/raveos-sb-sign-local.sh" /usr/local/bin/raveos-sb-sign-local.sh - install -m 644 "$SB_DIR/installed/zz-raveos-sb-sign.hook" /etc/pacman.d/hooks/zz-raveos-sb-sign.hook - log "Pacman hook + helyi alairo telepitve." -} - -verify_cmd() { - local cert="$MACHINE_DIR/machine.pem" bad=0 f - for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do - [ -f "$f" ] || continue - sbverify --cert "$cert" "$f" >/dev/null 2>&1 || { bad=1; log "NINCS alairva: $f"; } - done - [ "$bad" = "0" ] && log "Alairas-ellenorzes: rendben." - if command -v efi-readvar >/dev/null 2>&1; then - log "Firmware db tartalom:" - efi-readvar -v db 2>/dev/null | grep -E "CN *=|O *=" | head -14 - fi -} - -cert_to_esl() { - cert-to-efi-sig-list "$1" "$2" 2>/dev/null || return 1 - local sz - sz=$(stat -c %s "$2" 2>/dev/null || echo 0) - [ "$sz" -gt 100 ] -} - -build_db_esl() { - local out="$1" f - cert_to_esl "$SB_DIR/db.pem" "$WORK/raveos-db.esl" || return 1 - cert_to_esl "$MACHINE_DIR/machine.pem" "$WORK/machine.esl" || return 1 - cat "$WORK/raveos-db.esl" > "$out" - for f in "$MS/MicCorUEFCA2011_2011-06-27.pem" "$MS/MicWinProPCA2011_2011-10-19.pem" \ - "$MS/microsoft uefi ca 2023.pem" "$MS/windows uefi ca 2023.pem" \ - "$MS/microsoft option rom uefi ca 2023.pem"; do - [ -f "$f" ] || continue - cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" - done - cat "$WORK/machine.esl" >> "$out" -} - -build_kek_esl() { - local out="$1" f - cert_to_esl "$SB_DIR/KEK.pem" "$WORK/raveos-kek.esl" || return 1 - cat "$WORK/raveos-kek.esl" > "$out" - for f in "$MS/MicCorKEKCA2011_2011-06-24.pem" "$MS/microsoft corporation kek 2k ca 2023.pem"; do - [ -f "$f" ] || continue - cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" - done -} - -clear_var() { - local name="$1" guid="$2" f - f="/sys/firmware/efi/efivars/${name}-${guid}" - [ -e "$f" ] || return 0 - chattr -i "$f" 2>/dev/null || true - rm -f "$f" 2>/dev/null || log "FIGYELEM: ${name} regi valtozo torlese nem sikerult" -} - -enroll_cmd() { - local sm t - sm=$(efi_var SetupMode) - if [ "${sm:-0}" != "1" ]; then - log "A firmware nincs Setup Mode-ban." - return 10 - fi - for t in cert-to-efi-sig-list efi-updatevar; do - command -v "$t" >/dev/null 2>&1 || { log "HIBA: $t nem elerheto (efitools)"; return 1; } - done - [ -f "$SB_DIR/PK.auth" ] || { log "HIBA: hianyzik a PK.auth"; return 1; } - - WORK=$(mktemp -d) - build_db_esl "$WORK/db.esl" || { log "HIBA: db ESL epites"; return 1; } - build_kek_esl "$WORK/KEK.esl" || { log "HIBA: KEK ESL epites"; return 1; } - - log "Meglevo PK/KEK/db valtozok torlese..." - clear_var PK "$GLOBAL_GUID" - clear_var KEK "$GLOBAL_GUID" - clear_var db "$DB_GUID" - - log "db irasa (RaveOS + Microsoft + gepkulcs)..." - efi-updatevar -e -f "$WORK/db.esl" db || { log "HIBA: db iras"; return 1; } - - log "KEK irasa (RaveOS + Microsoft)..." - efi-updatevar -e -f "$WORK/KEK.esl" KEK || { log "HIBA: KEK iras"; return 1; } - - log "PK irasa (elore alairt PK.auth)..." - efi-updatevar -f "$SB_DIR/PK.auth" PK || { log "HIBA: PK iras"; return 1; } - - log "Kulcsok telepitve a firmware-be." -} - -setup_cmd() { - status_cmd || return 1 - log "FIGYELEM (BitLocker): ha a Windowson BitLocker van, elotte inditsd el a Windowst es futtasd:" - log " manage-bde -protectors -disable C: -rebootcount 2" - log " vagy legyen keznel a 48 jegyu helyreallitasi kulcs." - deps_cmd || return 1 - keygen_cmd || return 1 - sign_cmd || return 1 - hook_cmd || return 1 - install -d -m 755 "$STATE" - local rc - enroll_cmd - rc=$? - if [ "$rc" = "0" ]; then - verify_cmd - rm -f "$STATE/pending" - log "KESZ. A BIOS-ban allitsd a Secure Boot-ot Enabled-re, majd ujrainditas." - return 0 - fi - if [ "$rc" = "10" ]; then - install -m 644 "$SB_DIR/installed/raveos-sb-resume.service" /etc/systemd/system/"$RESUME_UNIT" - systemctl daemon-reload - systemctl enable "$RESUME_UNIT" >/dev/null 2>&1 - touch "$STATE/pending" - log "A BIOS-ban: Secure Boot menuben Key Management, Clear Secure Boot keys (Setup Mode)," - log "ments, majd inditsd ujra a gepet. Boot utan a folyamat magatol befejezodik." - return 10 - fi - return "$rc" -} - -resume_cmd() { - [ -f "$STATE/pending" ] || exit 0 - if enroll_cmd; then - verify_cmd - rm -f "$STATE/pending" - date -Is > "$STATE/done" - systemctl disable "$RESUME_UNIT" >/dev/null 2>&1 - log "Secure Boot beallitas befejezve. A BIOS-ban allitsd a Secure Boot-ot Enabled-re." - exit 0 - fi - exit 1 -} - -need_root() { - if [ "$(id -u)" != "0" ]; then - echo "[raveos-sb] Root jogosultsag szukseges." >&2 - exit 1 - fi -} - -case "${1:-}" in - --status) - status_cmd - ;; - --verify) - verify_cmd - ;; - --setup) - need_root - setup_cmd - ;; - --resume) - need_root - resume_cmd - ;; - --resign) - need_root - keygen_cmd && sign_cmd && verify_cmd - ;; - *) - echo "hasznalat: raveos-secureboot-setup --status|--setup|--resume|--resign|--verify" >&2 - exit 2 - ;; -esac |