path: root/raveos-app-installer/raveos-secureboot-setup

#!/bin/bash
set -u

GLOBAL_GUID="8be4df61-93ca-11d2-aa0d-00e098032b8c"
DB_GUID="d719b2cb-3d3a-4596-a3bc-dad00e67656f"

SB_DIR=/usr/share/raveos/secureboot
MS="$SB_DIR/ms"
MACHINE_DIR=/etc/raveos/secureboot
STATE=/var/lib/raveos-sb
RESUME_UNIT=raveos-sb-resume.service
WORK=""

log() { echo "[raveos-sb] $*"; }

cleanup() { [ -n "$WORK" ] && rm -rf "$WORK"; }
trap cleanup EXIT

efi_var() {
    od -An -t u1 /sys/firmware/efi/efivars/"$1"-* 2>/dev/null | awk '{print $5}'
}

status_cmd() {
    if [ ! -d /sys/firmware/efi/efivars ]; then
        log "Nem UEFI rendszer - Secure Boot nem elerheto."
        return 1
    fi
    local sb sm keys tools signed
    sb=$(efi_var SecureBoot)
    sm=$(efi_var SetupMode)
    keys=0
    [ -f "$MACHINE_DIR/machine.pem" ] && keys=1
    tools=0
    command -v sbsign >/dev/null 2>&1 && tools=1
    signed=0
    if [ "$keys" = "1" ] && command -v sbverify >/dev/null 2>&1; then
        signed=1
        for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do
            [ -f "$f" ] || continue
            sbverify --cert "$MACHINE_DIR/machine.pem" "$f" >/dev/null 2>&1 || signed=0
        done
    fi
    echo "uefi=1"
    echo "secureboot=${sb:-?}"
    echo "setupmode=${sm:-?}"
    echo "keys=$keys"
    echo "tools=$tools"
    echo "signed=$signed"
    if [ -f "$STATE/pending" ]; then echo "pending=1"; else echo "pending=0"; fi
    log "SecureBoot=${sb:-?} SetupMode=${sm:-?} gepkulcs=$keys alairasok=$signed"
}

deps_cmd() {
    local need=()
    local p
    for p in sbsigntools efitools openssl zstd; do
        pacman -Qq "$p" >/dev/null 2>&1 || need+=("$p")
    done
    if [ "${#need[@]}" -gt 0 ]; then
        log "Hianyzo eszkozok telepitese: ${need[*]}"
        pacman -S --noconfirm "${need[@]}" || return 1
    fi
}

keygen_cmd() {
    if [ -f "$MACHINE_DIR/machine.key" ]; then
        log "A gepkulcs mar letezik."
        return 0
    fi
    install -d -m 711 "$MACHINE_DIR"
    openssl req -newkey rsa:2048 -nodes -keyout "$MACHINE_DIR/machine.key" -x509 -days 3650 \
        -out "$MACHINE_DIR/machine.pem" \
        -subj "/O=RaveOS/CN=RaveOS Machine Key" \
        -addext "basicConstraints=critical,CA:TRUE" \
        -addext "keyUsage=critical,digitalSignature,keyCertSign,cRLSign" \
        -addext "extendedKeyUsage=codeSigning" 2>/dev/null || {
        log "HIBA: gepkulcs generalas sikertelen"
        return 1
    }
    chmod 600 "$MACHINE_DIR/machine.key"
    chmod 644 "$MACHINE_DIR/machine.pem"
    log "Gepkulcs generalva: CN=RaveOS Machine Key"
}

signfile_path() {
    local c
    for c in /usr/lib/modules/*/build/scripts/sign-file /usr/src/linux/scripts/sign-file; do
        [ -x "$c" ] && { echo "$c"; return 0; }
    done
    return 1
}

sign_one() {
    local key="$1" cert="$2" f="$3"
    sbverify --cert "$cert" "$f" >/dev/null 2>&1 && return 0
    if sbsign --key "$key" --cert "$cert" --output "$f.signed" "$f" 2>/dev/null; then
        mv "$f.signed" "$f"
        log "alairva: $f"
        return 0
    fi
    log "FIGYELEM: nem sikerult alairni: $f"
    return 1
}

sign_cmd() {
    command -v sbsign >/dev/null 2>&1 || { log "HIBA: sbsign nem elerheto"; return 1; }
    local key="$MACHINE_DIR/machine.key" cert="$MACHINE_DIR/machine.pem"
    local n=0 f signfile t
    for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-* /boot/memtest86+/memtest.efi; do
        [ -f "$f" ] || continue
        sign_one "$key" "$cert" "$f" && n=$((n + 1))
    done
    signfile=$(signfile_path) || signfile=""
    if [ -n "$signfile" ]; then
        install -m 755 "$signfile" /usr/local/bin/raveos-sign-file
        local d sub m
        for d in /usr/lib/modules/*/; do
            for sub in extramodules updates/dkms extras; do
                [ -d "${d}${sub}" ] || continue
                while IFS= read -r -d '' m; do
                    if modinfo -F signer "$m" 2>/dev/null | grep -q "RaveOS Machine Key"; then
                        continue
                    fi
                    case "$m" in
                        *.ko)
                            /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$m" >/dev/null 2>&1 && n=$((n + 1))
                            ;;
                        *.ko.zst)
                            t=$(mktemp -d)
                            if zstd -q -d -c "$m" > "$t/m.ko" 2>/dev/null &&
                               /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$t/m.ko" >/dev/null 2>&1 &&
                               zstd -q -f -o "$m" "$t/m.ko" 2>/dev/null; then
                                n=$((n + 1))
                            fi
                            rm -rf "$t"
                            ;;
                    esac
                done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null)
            done
        done
    else
        log "FIGYELEM: sign-file nem talalhato (kernel-headers nelkul a modulok kimaradnak)"
    fi
    log "Alairt elemek: $n"
}

hook_cmd() {
    install -d -m 755 /usr/local/bin /etc/pacman.d/hooks
    install -m 755 "$SB_DIR/installed/raveos-sb-sign-local.sh" /usr/local/bin/raveos-sb-sign-local.sh
    install -m 644 "$SB_DIR/installed/zz-raveos-sb-sign.hook" /etc/pacman.d/hooks/zz-raveos-sb-sign.hook
    log "Pacman hook + helyi alairo telepitve."
}

verify_cmd() {
    local cert="$MACHINE_DIR/machine.pem" bad=0 f
    for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do
        [ -f "$f" ] || continue
        sbverify --cert "$cert" "$f" >/dev/null 2>&1 || { bad=1; log "NINCS alairva: $f"; }
    done
    [ "$bad" = "0" ] && log "Alairas-ellenorzes: rendben."
    if command -v efi-readvar >/dev/null 2>&1; then
        log "Firmware db tartalom:"
        efi-readvar -v db 2>/dev/null | grep -E "CN *=|O *=" | head -14
    fi
}

cert_to_esl() {
    cert-to-efi-sig-list "$1" "$2" 2>/dev/null || return 1
    local sz
    sz=$(stat -c %s "$2" 2>/dev/null || echo 0)
    [ "$sz" -gt 100 ]
}

build_db_esl() {
    local out="$1" f
    cert_to_esl "$SB_DIR/db.pem" "$WORK/raveos-db.esl" || return 1
    cert_to_esl "$MACHINE_DIR/machine.pem" "$WORK/machine.esl" || return 1
    cat "$WORK/raveos-db.esl" > "$out"
    for f in "$MS/MicCorUEFCA2011_2011-06-27.pem" "$MS/MicWinProPCA2011_2011-10-19.pem" \
             "$MS/microsoft uefi ca 2023.pem" "$MS/windows uefi ca 2023.pem" \
             "$MS/microsoft option rom uefi ca 2023.pem"; do
        [ -f "$f" ] || continue
        cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out"
    done
    cat "$WORK/machine.esl" >> "$out"
}

build_kek_esl() {
    local out="$1" f
    cert_to_esl "$SB_DIR/KEK.pem" "$WORK/raveos-kek.esl" || return 1
    cat "$WORK/raveos-kek.esl" > "$out"
    for f in "$MS/MicCorKEKCA2011_2011-06-24.pem" "$MS/microsoft corporation kek 2k ca 2023.pem"; do
        [ -f "$f" ] || continue
        cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out"
    done
}

clear_var() {
    local name="$1" guid="$2" f
    f="/sys/firmware/efi/efivars/${name}-${guid}"
    [ -e "$f" ] || return 0
    chattr -i "$f" 2>/dev/null || true
    rm -f "$f" 2>/dev/null || log "FIGYELEM: ${name} regi valtozo torlese nem sikerult"
}

enroll_cmd() {
    local sm t
    sm=$(efi_var SetupMode)
    if [ "${sm:-0}" != "1" ]; then
        log "A firmware nincs Setup Mode-ban."
        return 10
    fi
    for t in cert-to-efi-sig-list efi-updatevar; do
        command -v "$t" >/dev/null 2>&1 || { log "HIBA: $t nem elerheto (efitools)"; return 1; }
    done
    [ -f "$SB_DIR/PK.auth" ] || { log "HIBA: hianyzik a PK.auth"; return 1; }

    WORK=$(mktemp -d)
    build_db_esl "$WORK/db.esl" || { log "HIBA: db ESL epites"; return 1; }
    build_kek_esl "$WORK/KEK.esl" || { log "HIBA: KEK ESL epites"; return 1; }

    log "Meglevo PK/KEK/db valtozok torlese..."
    clear_var PK "$GLOBAL_GUID"
    clear_var KEK "$GLOBAL_GUID"
    clear_var db "$DB_GUID"

    log "db irasa (RaveOS + Microsoft + gepkulcs)..."
    efi-updatevar -e -f "$WORK/db.esl" db || { log "HIBA: db iras"; return 1; }

    log "KEK irasa (RaveOS + Microsoft)..."
    efi-updatevar -e -f "$WORK/KEK.esl" KEK || { log "HIBA: KEK iras"; return 1; }

    log "PK irasa (elore alairt PK.auth)..."
    efi-updatevar -f "$SB_DIR/PK.auth" PK || { log "HIBA: PK iras"; return 1; }

    log "Kulcsok telepitve a firmware-be."
}

setup_cmd() {
    status_cmd || return 1
    log "FIGYELEM (BitLocker): ha a Windowson BitLocker van, elotte inditsd el a Windowst es futtasd:"
    log "  manage-bde -protectors -disable C: -rebootcount 2"
    log "  vagy legyen keznel a 48 jegyu helyreallitasi kulcs."
    deps_cmd || return 1
    keygen_cmd || return 1
    sign_cmd || return 1
    hook_cmd || return 1
    install -d -m 755 "$STATE"
    local rc
    enroll_cmd
    rc=$?
    if [ "$rc" = "0" ]; then
        verify_cmd
        rm -f "$STATE/pending"
        log "KESZ. A BIOS-ban allitsd a Secure Boot-ot Enabled-re, majd ujrainditas."
        return 0
    fi
    if [ "$rc" = "10" ]; then
        install -m 644 "$SB_DIR/installed/raveos-sb-resume.service" /etc/systemd/system/"$RESUME_UNIT"
        systemctl daemon-reload
        systemctl enable "$RESUME_UNIT" >/dev/null 2>&1
        touch "$STATE/pending"
        log "A BIOS-ban: Secure Boot menuben Key Management, Clear Secure Boot keys (Setup Mode),"
        log "ments, majd inditsd ujra a gepet. Boot utan a folyamat magatol befejezodik."
        return 10
    fi
    return "$rc"
}

resume_cmd() {
    [ -f "$STATE/pending" ] || exit 0
    if enroll_cmd; then
        verify_cmd
        rm -f "$STATE/pending"
        date -Is > "$STATE/done"
        systemctl disable "$RESUME_UNIT" >/dev/null 2>&1
        log "Secure Boot beallitas befejezve. A BIOS-ban allitsd a Secure Boot-ot Enabled-re."
        exit 0
    fi
    exit 1
}

need_root() {
    if [ "$(id -u)" != "0" ]; then
        echo "[raveos-sb] Root jogosultsag szukseges." >&2
        exit 1
    fi
}

case "${1:-}" in
    --status)
        status_cmd
        ;;
    --verify)
        verify_cmd
        ;;
    --setup)
        need_root
        setup_cmd
        ;;
    --resume)
        need_root
        resume_cmd
        ;;
    --resign)
        need_root
        keygen_cmd && sign_cmd && verify_cmd
        ;;
    *)
        echo "hasznalat: raveos-secureboot-setup --status|--setup|--resume|--resign|--verify" >&2
        exit 2
        ;;
esac