Skip to content

Commit 40bfdf4

Browse files
oldiumoldium
committed
Added TPM 1.2 support for Dracut
Signed-off-by: Oldřich Jedlička <[email protected]>
1 parent ddbe5f9 commit 40bfdf4

File tree

5 files changed

+150
-0
lines changed

5 files changed

+150
-0
lines changed

‎src/luks/dracut/clevis-pin-tpm1/meson.build‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
dracut = dependency('dracut', required: false)
2+
3+
if dracut.found()
4+
dracutdir = dracut.get_pkgconfig_variable('dracutmodulesdir') + '/60' + meson.project_name() + '-pin-tpm1'
5+
6+
configure_file(
7+
input: 'module-setup.sh.in',
8+
output: 'module-setup.sh',
9+
install_dir: dracutdir,
10+
configuration: data,
11+
)
12+
else
13+
warning('Will not install dracut module clevis-pin-tpm2 due to missing dependencies!')
14+
endif

‎src/luks/dracut/clevis-pin-tpm1/module-setup.sh.in‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
#!/bin/bash
2+
# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
3+
#
4+
# Copyright (c) 2024 Oldřich Jedlička
5+
#
6+
# Author: Oldřich Jedlička <[email protected]>
7+
#
8+
# This program is free software: you can redistribute it and/or modify
9+
# it under the terms of the GNU General Public License as published by
10+
# the Free Software Foundation, either version 3 of the License, or
11+
# (at your option) any later version.
12+
#
13+
# This program is distributed in the hope that it will be useful,
14+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
15+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16+
# GNU General Public License for more details.
17+
#
18+
# You should have received a copy of the GNU General Public License
19+
# along with this program. If not, see <http://www.gnu.org/licenses/>.
20+
#
21+
22+
check() {
23+
require_binaries clevis-decrypt-tpm1 tpm_version tpm_unsealdata tcsd stdbuf || return 1
24+
if [[ $hostonly ]]; then
25+
[ -d /var/lib/tpm ] || return 1
26+
else
27+
[ -f /usr/share/trousers/system.data.auth ] || \
28+
[ -f /var/lib/tpm/system.data.auth ] || \
29+
return 1
30+
fi
31+
if dracut_module_included "systemd"; then
32+
# shellcheck disable=SC2154 # $systemdsystemunitdir is a dracut variable
33+
[ -f "$systemdsystemunitdir"/tcsd.service ] || \
34+
[ -f "$systemdsystemunitdir"/tcsd.service.d/clevis-tcsd.conf ] || \
35+
return 1
36+
fi
37+
return 0
38+
}
39+
40+
depends() {
41+
echo clevis network
42+
return 0
43+
}
44+
45+
install() {
46+
if dracut_module_included "systemd"; then
47+
inst_multiple \
48+
"$systemdsystemunitdir/tcsd.service" \
49+
"$systemdsystemunitdir/tcsd.service.d/clevis-tcsd.conf"
50+
# shellcheck disable=SC2154 # $initdir is a dracut variable
51+
systemctl -q --root "$initdir" add-wants cryptsetup.target tcsd.service
52+
else
53+
inst_multiple \
54+
awk chmod chown mkfifo mktemp ip ps stdbuf \
55+
@libexecdir@/clevis-luks-tpm1-functions
56+
if [ -f /usr/libexec/coreutils/libstdbuf.so ]; then
57+
inst_multiple /usr/libexec/coreutils/libstdbuf.so*
58+
else
59+
inst_libdir_file 'coreutils/libstdbuf.so*'
60+
fi
61+
fi
62+
63+
inst_multiple \
64+
clevis-decrypt-tpm1 \
65+
tcsd \
66+
tpm_version \
67+
tpm_unsealdata
68+
69+
inst_rules 60-tpm-udev.rules
70+
71+
if ! [[ $hostonly ]] || ! dracut_module_included "systemd"; then
72+
# /etc/hosts is installed only in host-only mode with systemd, so
73+
# we need to create our own in order to get tpm tools working.
74+
# The localhost entry is required by tpm tools.
75+
if [ ! -f "$initdir/etc/hosts" ]; then
76+
echo "127.0.0.1 localhost" >> "$initdir/etc/hosts"
77+
echo "::1 localhost ip6-localhost ip6-loopback" >> "$initdir/etc/hosts"
78+
echo "ff02::1 ip6-allnodes" >> "$initdir/etc/hosts"
79+
echo "ff02::2 ip6-allrouters" >> "$initdir/etc/hosts"
80+
fi
81+
fi
82+
83+
if [[ $hostonly ]]; then
84+
inst /etc/tcsd.conf
85+
inst_multiple /var/lib/tpm/*
86+
else
87+
inst_dir /etc
88+
touch "$initdir/etc/tcsd.conf"
89+
chmod 0640 "$initdir/etc/tcsd.conf"
90+
chown root:tss "$initdir/etc/tcsd.conf"
91+
92+
inst_dir /var/lib/tpm
93+
if [ -f /usr/share/trousers/system.data.auth ]; then
94+
inst /usr/share/trousers/system.data.auth /var/lib/tpm/system.data
95+
else
96+
inst /var/lib/tpm/system.data.auth /var/lib/tpm/system.data
97+
fi
98+
fi
99+
100+
chown -R tss:tss "$initdir/var/lib/tpm"
101+
chmod -R u=rwX,go= "$initdir/var/lib/tpm"
102+
}
103+
104+
installkernel() {
105+
hostonly='' instmods '=drivers/char/tpm'
106+
}

‎src/luks/dracut/clevis/clevis-cleanup-hook.sh.in‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@
2222
(
2323
[ -s /run/clevis.pid ] || exit 0
2424

25+
if [ -f @libexecdir@/clevis-luks-tpm1-functions ]; then
26+
. @libexecdir@/clevis-luks-tpm1-functions
27+
stop_tcsd
28+
fi
29+
2530
pid=$(cat /run/clevis.pid)
2631
child_pids=$(ps -A -o pid,ppid | awk -v pid="$pid" '$2==pid { print $1 }')
2732
for kill_pid in $pid $child_pids; do

‎src/luks/dracut/clevis/clevis-password-unlocker.in‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ clevisloop() {
115115
local askpass_info
116116
local sleep_time
117117
local OLD_CRYPTTAB_SOURCE=""
118+
local tpm1cfg_attempted=0
118119

119120
while true; do
120121
# Re-get the askpass PID in case there are multiple encrypted devices
@@ -138,6 +139,11 @@ EOM
138139
[ "$CRYPTTAB_SOURCE" = "$OLD_CRYPTTAB_SOURCE" ] && continue
139140
OLD_CRYPTTAB_SOURCE="$CRYPTTAB_SOURCE"
140141

142+
if [[ " $pins " == *" tpm1 "* ]] && [ $tpm1cfg_attempted -eq 0 ]; then
143+
tpm1cfg_attempted=1
144+
do_configure_tpm1
145+
fi
146+
141147
if luks_decrypt "${CRYPTTAB_SOURCE}" "${PASSFIFO}"; then
142148
info "Unlocked ${CRYPTTAB_SOURCE} with clevis"
143149

@@ -153,6 +159,24 @@ EOM
153159
done
154160
}
155161

162+
do_configure_tpm1() {
163+
local tcsd_output=
164+
165+
[ -x @bindir@/clevis-decrypt-tpm1 ] && [ -f @libexecdir@/clevis-luks-tpm1-functions ] || return
166+
167+
. @libexecdir@/clevis-luks-tpm1-functions
168+
169+
info "Starting TCSD daemon"
170+
171+
if ! tcsd_output=$(start_tcsd 2>&1); then
172+
if [ -n "$tcsd_output" ]; then
173+
echo "Unable to start TCSD: $tcsd_output" | vwarn
174+
else
175+
warn "Unable to start TCSD"
176+
fi
177+
fi
178+
}
179+
156180
mkdir -p /var/cache/clevis-disks
157181
chmod 0700 /var/cache/clevis-disks
158182

‎src/luks/dracut/meson.build‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
subdir('clevis')
22
subdir('clevis-pin-tang')
3+
subdir('clevis-pin-tpm1')
34
subdir('clevis-pin-tpm2')
45
subdir('clevis-pin-sss')
56
subdir('clevis-pin-null')

0 commit comments

Comments
 (0)