From caa25b21eb22ce2c40f7c8e809bf7f139092b444 Mon Sep 17 00:00:00 2001 From: Christian Foerster Date: Fri, 17 May 2024 10:41:50 +0200 Subject: [PATCH] fix 2 spelling errors; improve UX Signed-off-by: Christian Foerster --- initrd/bin/kexec-seal-key | 124 +++++++++++++++++++++----------------- 1 file changed, 69 insertions(+), 55 deletions(-) mode change 100755 => 100644 initrd/bin/kexec-seal-key diff --git a/initrd/bin/kexec-seal-key b/initrd/bin/kexec-seal-key old mode 100755 new mode 100644 index 0481ebb2a..e6ae8648b --- a/initrd/bin/kexec-seal-key +++ b/initrd/bin/kexec-seal-key @@ -1,5 +1,5 @@ #!/bin/bash -# This will generate a disk encryption key and seal / ecncrypt +# This will generate a disk encryption key and seal / encrypt # with the current PCRs and then store it in the TPM NVRAM. # It will then need to be bundled into initrd that is booted. set -e -o pipefail @@ -46,10 +46,12 @@ DEBUG "$(pcrs)" # LUKS Key slot 0 is the manual recovery pass phrase # that they user entered when they installed OS, -# key slot 1 is the one that we've generated. -read -s -p "Enter LUKS Disk Recovery Key/passphrase: " disk_password -echo -n "$disk_password" >"$RECOVERY_KEY" -echo +# key slot 1 is the one that we've generated. TODO: this description needs to be updated in accordance with the new design from PR 1541 +read_LUKS_DRK_passphrase_from_user() { + read -s -p "Enter LUKS Disk Recovery Key/passphrase: " disk_password + echo -n "$disk_password" >"$RECOVERY_KEY" + echo +} read -s -p "New LUKS TPM Disk Unlock Key passphrase for booting: " key_password echo @@ -70,59 +72,71 @@ dd \ 2>/dev/null || die "Unable to generate 128 random bytes" -# Count the number of slots used on each device for dev in $(cat "$KEY_DEVICES" | cut -d\ -f1); do - DEBUG "Checking number of slots used on $dev LUKS header" - #check if the device is a LUKS device with luks[1,2] - # Get the number of key slots used on the LUKS header. - # LUKS1 Format is : - # Slot 0: ENABLED - # Slot 1: ENABLED - # Slot 2: DISABLED - # Slot 3: DISABLED - #... - # Slot 7: DISABLED - # Luks2 only reports on enabled slots. - # luks2 Format is : - # 0: luks2 - # 1: luks2 - # Meaning that the number of slots used is the number of lines returned by a grep on the LUKS2 above format. - # We need to count the number of ENABLED slots for both LUKS1 and LUKS2 - # create regex pattern for both LUKS1 and LUKS2 - regex="Slot [0-9]*: ENABLED" - regex+="\|" - regex+="[0-9]*: luks2" - slots_used=$(cryptsetup luksDump "$dev" | grep -c "$regex" || die "Unable to get number of slots used on $dev") - - DEBUG "Number of slots used on $dev LUKS header: $slots_used" - # If slot1 is the only one used, warn and die with proper messages - if [ "$slots_used" -eq 1 ]; then - # Check if slot 1 is the only one existing - if [ "$(cryptsetup luksDump "$dev" | grep -c "Slot 1: ENABLED")" -eq 1 ] || [ "$(cryptsetup luksDump "$dev" | grep -c "1: luks2")" -eq 1 ]; then - warn "Slot 1 is the only one existing on $dev LUKS header. Heads cannot use it to store TPM sealed LUKS Disk Unlock Key" - warn "Slot 1 should not be the only slot existing on $dev LUKS header. Slot 0 should be used to store LUKS Disk Recovery Key/passphrase" - die "You can safely fix this before continuing through Heads recovery shell: cryptsetup luksAddKey $dev" + for tries in 1 2 3; do + read_LUKS_DRK_passphrase_from_user + DEBUG "Testing $RECOVERY_KEY keyfile created from provided passphrase against $dev" + if ! cryptsetup luksOpen --test-passphrase --key-file "$RECOVERY_KEY" $dev; then + if [ $tries == 3 ]; then + die "Failed to unlock $dev with provided passphrase 3 times. Exiting..." + fi + warn "$dev: Unable to unlock LUKS device with provided passphrase. Try again (CAPS LOCK on?)." fi - else - DEBUG "Slot 1 is not the only existing slot on $dev LUKS header." - DEBUG "$dev LUKS header's slot 1 will store LUKS Disk Unlock Key that TPM will seal/unseal with LUKS TPM Disk Unlock Key passphrase" - fi -done + done -# Remove all the old keys from slot 1 -for dev in $(cat "$KEY_DEVICES" | cut -d\ -f1); do - echo "++++++ $dev: Removing old LUKS TPM Disk Unlock Key in LUKS slot 1" - cryptsetup luksKillSlot \ - --key-file "$RECOVERY_KEY" \ - $dev 1 || - warn "$dev: removal of LUKS TPM Disk Unlock Key in LUKS slot 1 failed: might not exist. Continuing" - - echo "++++++ $dev: Adding LUKS TPM Disk Unlock Key to LUKS slot 1" - cryptsetup luksAddKey \ - --key-file "$RECOVERY_KEY" \ - --key-slot 1 \ - $dev "$KEY_FILE" || - die "$dev: Unable to add LUKS TPM Disk Unlock Key to LUKS slot 1" + # We will use the following regex to find the slots that are enabled + regex="Slot ([0-9]+): ENABLED|\b([0-9]+): luks2" + + # good_slot will be the slot number where the passphrase was tested against as valid. We will keep that slot + good_slot=-1 + + # test each possible existing key slot of dev against keyfile $RECOVERY_KEY + for slot in $(cryptsetup luksDump "$dev" | grep -E "$regex" | sed -r 's/Slot ([0-9]+): ENABLED|\b([0-9]+): luks2/\1\2/'); do + if [ "$good_slot" -eq "-1" ]; then + if cryptsetup luksOpen --test-passphrase --key-file "$RECOVERY_KEY" $dev $slot; then + good_slot="$slot" + break; + fi + fi + done + + # if we found a good slot, we wipe all the other slots on current $dev + for slot in $(cryptsetup luksDump "$dev" | grep -E "$regex" | sed -r 's/Slot ([0-9]+): ENABLED|\b([0-9]+): luks2/\1\2/'); do + if [ "$slot" -ne "$good_slot" ]; then + #set wipe_desired to no by default + wipe_desired="no" + + if [ "$slot" -ne "1" ] && [ "$slot" -ne "8" ]; then + # Heads expects key-slot 1 or 8 to be used for TPM DUK setup. Ask user to confirm with big fat warning + read -p "WARNING: LUKS key-slot $slot is not typically used for TPM Disk Unlock Key setup. Are you sure you want to wipe it? [y/N] " -n 1 -r + # If user does not confirm, skip this slot + if [[ ! $REPLY =~ ^[Yy]$ ]]; then + wipe_desired="yes" + fi + else + # If slot is 1 or 8, we wipe it without asking since not DRK's good keyslot + wipe_desired="yes" + fi + + if [ "$wipe_desired" == "yes" ]; then + echo "++++++ $dev: Wiping LUKS key-slot $slot" + cryptsetup luksKillSlot \ + --key-file "$RECOVERY_KEY" \ + $dev $slot || + warn "$dev: removal of LUKS slot $slot failed: Continuing" + fi + fi + done + + # We then add the new key to the luks key slot 8 + for dev in $(cat "$KEY_DEVICES" | cut -d\ -f1); do + echo "++++++ $dev: Adding LUKS TPM Disk Unlock Key to LUKS key-slot 8" + cryptsetup luksAddKey \ + --key-file "$RECOVERY_KEY" \ + --new-key-slot 8 \ + $dev "$KEY_FILE" > /dev/null 2>&1|| + die "$dev: Unable to add LUKS TPM Disk Unlock Key to LUKS key-slot #8" + done done # Now that we have setup the new keys, measure the PCRs