From 91978706279a19a3ac96393630876f3e50cbc518 Mon Sep 17 00:00:00 2001 From: Nippy Date: Fri, 9 Oct 2026 10:49:26 +0200 Subject: fix --- raveos-app-installer/raveos-secureboot-setup | 313 +++++++++++++++++++++++++++ 1 file changed, 313 insertions(+) create mode 100644 raveos-app-installer/raveos-secureboot-setup (limited to 'raveos-app-installer/raveos-secureboot-setup') diff --git a/raveos-app-installer/raveos-secureboot-setup b/raveos-app-installer/raveos-secureboot-setup new file mode 100644 index 0000000..a02b046 --- /dev/null +++ b/raveos-app-installer/raveos-secureboot-setup @@ -0,0 +1,313 @@ +#!/bin/bash +set -u + +GLOBAL_GUID="8be4df61-93ca-11d2-aa0d-00e098032b8c" +DB_GUID="d719b2cb-3d3a-4596-a3bc-dad00e67656f" + +SB_DIR=/usr/share/raveos/secureboot +MS="$SB_DIR/ms" +MACHINE_DIR=/etc/raveos/secureboot +STATE=/var/lib/raveos-sb +RESUME_UNIT=raveos-sb-resume.service +WORK="" + +log() { echo "[raveos-sb] $*"; } + +cleanup() { [ -n "$WORK" ] && rm -rf "$WORK"; } +trap cleanup EXIT + +efi_var() { + od -An -t u1 /sys/firmware/efi/efivars/"$1"-* 2>/dev/null | awk '{print $5}' +} + +status_cmd() { + if [ ! -d /sys/firmware/efi/efivars ]; then + log "Nem UEFI rendszer - Secure Boot nem elerheto." + return 1 + fi + local sb sm keys tools signed + sb=$(efi_var SecureBoot) + sm=$(efi_var SetupMode) + keys=0 + [ -f "$MACHINE_DIR/machine.pem" ] && keys=1 + tools=0 + command -v sbsign >/dev/null 2>&1 && tools=1 + signed=0 + if [ "$keys" = "1" ] && command -v sbverify >/dev/null 2>&1; then + signed=1 + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do + [ -f "$f" ] || continue + sbverify --cert "$MACHINE_DIR/machine.pem" "$f" >/dev/null 2>&1 || signed=0 + done + fi + echo "uefi=1" + echo "secureboot=${sb:-?}" + echo "setupmode=${sm:-?}" + echo "keys=$keys" + echo "tools=$tools" + echo "signed=$signed" + if [ -f "$STATE/pending" ]; then echo "pending=1"; else echo "pending=0"; fi + log "SecureBoot=${sb:-?} SetupMode=${sm:-?} gepkulcs=$keys alairasok=$signed" +} + +deps_cmd() { + local need=() + local p + for p in sbsigntools efitools openssl zstd; do + pacman -Qq "$p" >/dev/null 2>&1 || need+=("$p") + done + if [ "${#need[@]}" -gt 0 ]; then + log "Hianyzo eszkozok telepitese: ${need[*]}" + pacman -S --noconfirm "${need[@]}" || return 1 + fi +} + +keygen_cmd() { + if [ -f "$MACHINE_DIR/machine.key" ]; then + log "A gepkulcs mar letezik." + return 0 + fi + install -d -m 711 "$MACHINE_DIR" + openssl req -newkey rsa:2048 -nodes -keyout "$MACHINE_DIR/machine.key" -x509 -days 3650 \ + -out "$MACHINE_DIR/machine.pem" \ + -subj "/O=RaveOS/CN=RaveOS Machine Key" \ + -addext "basicConstraints=critical,CA:TRUE" \ + -addext "keyUsage=critical,digitalSignature,keyCertSign,cRLSign" \ + -addext "extendedKeyUsage=codeSigning" 2>/dev/null || { + log "HIBA: gepkulcs generalas sikertelen" + return 1 + } + chmod 600 "$MACHINE_DIR/machine.key" + chmod 644 "$MACHINE_DIR/machine.pem" + log "Gepkulcs generalva: CN=RaveOS Machine Key" +} + +signfile_path() { + local c + for c in /usr/lib/modules/*/build/scripts/sign-file /usr/src/linux/scripts/sign-file; do + [ -x "$c" ] && { echo "$c"; return 0; } + done + return 1 +} + +sign_one() { + local key="$1" cert="$2" f="$3" + sbverify --cert "$cert" "$f" >/dev/null 2>&1 && return 0 + if sbsign --key "$key" --cert "$cert" --output "$f.signed" "$f" 2>/dev/null; then + mv "$f.signed" "$f" + log "alairva: $f" + return 0 + fi + log "FIGYELEM: nem sikerult alairni: $f" + return 1 +} + +sign_cmd() { + command -v sbsign >/dev/null 2>&1 || { log "HIBA: sbsign nem elerheto"; return 1; } + local key="$MACHINE_DIR/machine.key" cert="$MACHINE_DIR/machine.pem" + local n=0 f signfile t + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-* /boot/memtest86+/memtest.efi; do + [ -f "$f" ] || continue + sign_one "$key" "$cert" "$f" && n=$((n + 1)) + done + signfile=$(signfile_path) || signfile="" + if [ -n "$signfile" ]; then + install -m 755 "$signfile" /usr/local/bin/raveos-sign-file + local d sub m + for d in /usr/lib/modules/*/; do + for sub in extramodules updates/dkms extras; do + [ -d "${d}${sub}" ] || continue + while IFS= read -r -d '' m; do + if modinfo -F signer "$m" 2>/dev/null | grep -q "RaveOS Machine Key"; then + continue + fi + case "$m" in + *.ko) + /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$m" >/dev/null 2>&1 && n=$((n + 1)) + ;; + *.ko.zst) + t=$(mktemp -d) + if zstd -q -d -c "$m" > "$t/m.ko" 2>/dev/null && + /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$t/m.ko" >/dev/null 2>&1 && + zstd -q -f -o "$m" "$t/m.ko" 2>/dev/null; then + n=$((n + 1)) + fi + rm -rf "$t" + ;; + esac + done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null) + done + done + else + log "FIGYELEM: sign-file nem talalhato (kernel-headers nelkul a modulok kimaradnak)" + fi + log "Alairt elemek: $n" +} + +hook_cmd() { + install -d -m 755 /usr/local/bin /etc/pacman.d/hooks + install -m 755 "$SB_DIR/installed/raveos-sb-sign-local.sh" /usr/local/bin/raveos-sb-sign-local.sh + install -m 644 "$SB_DIR/installed/zz-raveos-sb-sign.hook" /etc/pacman.d/hooks/zz-raveos-sb-sign.hook + log "Pacman hook + helyi alairo telepitve." +} + +verify_cmd() { + local cert="$MACHINE_DIR/machine.pem" bad=0 f + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do + [ -f "$f" ] || continue + sbverify --cert "$cert" "$f" >/dev/null 2>&1 || { bad=1; log "NINCS alairva: $f"; } + done + [ "$bad" = "0" ] && log "Alairas-ellenorzes: rendben." + if command -v efi-readvar >/dev/null 2>&1; then + log "Firmware db tartalom:" + efi-readvar -v db 2>/dev/null | grep -E "CN *=|O *=" | head -14 + fi +} + +cert_to_esl() { + cert-to-efi-sig-list "$1" "$2" 2>/dev/null || return 1 + local sz + sz=$(stat -c %s "$2" 2>/dev/null || echo 0) + [ "$sz" -gt 100 ] +} + +build_db_esl() { + local out="$1" f + cert_to_esl "$SB_DIR/db.pem" "$WORK/raveos-db.esl" || return 1 + cert_to_esl "$MACHINE_DIR/machine.pem" "$WORK/machine.esl" || return 1 + cat "$WORK/raveos-db.esl" > "$out" + for f in "$MS/MicCorUEFCA2011_2011-06-27.pem" "$MS/MicWinProPCA2011_2011-10-19.pem" \ + "$MS/microsoft uefi ca 2023.pem" "$MS/windows uefi ca 2023.pem" \ + "$MS/microsoft option rom uefi ca 2023.pem"; do + [ -f "$f" ] || continue + cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" + done + cat "$WORK/machine.esl" >> "$out" +} + +build_kek_esl() { + local out="$1" f + cert_to_esl "$SB_DIR/KEK.pem" "$WORK/raveos-kek.esl" || return 1 + cat "$WORK/raveos-kek.esl" > "$out" + for f in "$MS/MicCorKEKCA2011_2011-06-24.pem" "$MS/microsoft corporation kek 2k ca 2023.pem"; do + [ -f "$f" ] || continue + cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" + done +} + +clear_var() { + local name="$1" guid="$2" f + f="/sys/firmware/efi/efivars/${name}-${guid}" + [ -e "$f" ] || return 0 + chattr -i "$f" 2>/dev/null || true + rm -f "$f" 2>/dev/null || log "FIGYELEM: ${name} regi valtozo torlese nem sikerult" +} + +enroll_cmd() { + local sm t + sm=$(efi_var SetupMode) + if [ "${sm:-0}" != "1" ]; then + log "A firmware nincs Setup Mode-ban." + return 10 + fi + for t in cert-to-efi-sig-list efi-updatevar; do + command -v "$t" >/dev/null 2>&1 || { log "HIBA: $t nem elerheto (efitools)"; return 1; } + done + [ -f "$SB_DIR/PK.auth" ] || { log "HIBA: hianyzik a PK.auth"; return 1; } + + WORK=$(mktemp -d) + build_db_esl "$WORK/db.esl" || { log "HIBA: db ESL epites"; return 1; } + build_kek_esl "$WORK/KEK.esl" || { log "HIBA: KEK ESL epites"; return 1; } + + log "Meglevo PK/KEK/db valtozok torlese..." + clear_var PK "$GLOBAL_GUID" + clear_var KEK "$GLOBAL_GUID" + clear_var db "$DB_GUID" + + log "db irasa (RaveOS + Microsoft + gepkulcs)..." + efi-updatevar -e -f "$WORK/db.esl" db || { log "HIBA: db iras"; return 1; } + + log "KEK irasa (RaveOS + Microsoft)..." + efi-updatevar -e -f "$WORK/KEK.esl" KEK || { log "HIBA: KEK iras"; return 1; } + + log "PK irasa (elore alairt PK.auth)..." + efi-updatevar -f "$SB_DIR/PK.auth" PK || { log "HIBA: PK iras"; return 1; } + + log "Kulcsok telepitve a firmware-be." +} + +setup_cmd() { + status_cmd || return 1 + log "FIGYELEM (BitLocker): ha a Windowson BitLocker van, elotte inditsd el a Windowst es futtasd:" + log " manage-bde -protectors -disable C: -rebootcount 2" + log " vagy legyen keznel a 48 jegyu helyreallitasi kulcs." + deps_cmd || return 1 + keygen_cmd || return 1 + sign_cmd || return 1 + hook_cmd || return 1 + install -d -m 755 "$STATE" + local rc + enroll_cmd + rc=$? + if [ "$rc" = "0" ]; then + verify_cmd + rm -f "$STATE/pending" + log "KESZ. A BIOS-ban allitsd: Secure Boot -> Enabled, majd ujrainditas." + return 0 + fi + if [ "$rc" = "10" ]; then + install -m 644 "$SB_DIR/installed/raveos-sb-resume.service" /etc/systemd/system/"$RESUME_UNIT" + systemctl daemon-reload + systemctl enable "$RESUME_UNIT" >/dev/null 2>&1 + touch "$STATE/pending" + log "A BIOS-ban: Secure Boot -> Key Management -> Clear Secure Boot keys (Setup Mode)," + log "ments, majd inditsd ujra a gepet. Boot utan a folyamat magatol befejezodik." + return 10 + fi + return "$rc" +} + +resume_cmd() { + [ -f "$STATE/pending" ] || exit 0 + if enroll_cmd; then + verify_cmd + rm -f "$STATE/pending" + date -Is > "$STATE/done" + systemctl disable "$RESUME_UNIT" >/dev/null 2>&1 + log "Secure Boot beallitas befejezve. A BIOS-ban: Secure Boot -> Enabled." + exit 0 + fi + exit 1 +} + +need_root() { + if [ "$(id -u)" != "0" ]; then + echo "[raveos-sb] Root jogosultsag szukseges." >&2 + exit 1 + fi +} + +case "${1:-}" in + --status) + status_cmd + ;; + --verify) + verify_cmd + ;; + --setup) + need_root + setup_cmd + ;; + --resume) + need_root + resume_cmd + ;; + --resign) + need_root + keygen_cmd && sign_cmd && verify_cmd + ;; + *) + echo "hasznalat: raveos-secureboot-setup --status|--setup|--resume|--resign|--verify" >&2 + exit 2 + ;; +esac -- cgit v1.3