Luca Boccassi
7112e4755e
On a mkosi run on GHA: [ 9.547863] TEST-86-MULTI-PROFILE-UKI.sh[458]: + /usr/lib/systemd/systemd-measure --current [ 9.552790] TEST-86-MULTI-PROFILE-UKI.sh[463]: Measuring boot phases: enter-initrd, enter-initrd:leave-initrd, enter-initrd:leave-initrd:sysinit, enter-initrd:leave-initrd:sysinit:ready [ 9.553086] TEST-86-MULTI-PROFILE-UKI.sh[463]: Found container virtualization none. [ 9.553308] TEST-86-MULTI-PROFILE-UKI.sh[463]: Reading EFI variable /sys/firmware/efi/efivars/LoaderTpm2ActivePcrBanks-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f. [ 9.553486] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-esys.so.0' via dlopen(). [ 9.553676] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-rc.so.0' via dlopen(). [ 9.553867] TEST-86-MULTI-PROFILE-UKI.sh[463]: Loaded shared library 'libtss2-mu.so.0' via dlopen(). [ 9.554050] TEST-86-MULTI-PROFILE-UKI.sh[463]: Sorry, system lacks full TPM2 support. [FAILED] Failed to start TEST-86-MULTI-PROFILE-UKI.service - TEST-86-MULTI-PROFILE-UKI.
72 lines
1.9 KiB
Bash
Executable File
72 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
set -eux
|
|
set -o pipefail
|
|
|
|
export SYSTEMD_LOG_LEVEL=debug
|
|
|
|
if ! systemd-analyze has-tpm2; then
|
|
echo "Full TPM2 support not available, skipping the test"
|
|
exit 0
|
|
fi
|
|
|
|
bootctl
|
|
|
|
CURRENT_UKI=$(bootctl --print-stub-path)
|
|
|
|
echo "CURRENT UKI ($CURRENT_UKI):"
|
|
ukify inspect "$CURRENT_UKI"
|
|
if test -f /run/systemd/stub/profile; then
|
|
echo "CURRENT PROFILE:"
|
|
cat /run/systemd/stub/profile
|
|
fi
|
|
echo "CURRENT MEASUREMENT:"
|
|
/usr/lib/systemd/systemd-measure --current
|
|
if test -f /run/systemd/tpm2-pcr-signature.json; then
|
|
echo "CURRENT SIGNATURE:"
|
|
jq </run/systemd/tpm2-pcr-signature.json
|
|
fi
|
|
|
|
echo "CURRENT EVENT LOG + PCRS:"
|
|
/usr/lib/systemd/systemd-pcrlock
|
|
|
|
test -f /run/systemd/stub/profile
|
|
|
|
# shellcheck source=/dev/null
|
|
. /run/systemd/stub/profile
|
|
|
|
if [[ "$ID" == "main" ]]; then
|
|
if [[ -f /root/encrypted.raw ]]; then
|
|
exit 1
|
|
fi
|
|
|
|
# Prepare a disk image, locked to the PCR measurements of the current UKI
|
|
truncate -s 32M /root/encrypted.raw
|
|
echo -n "geheim" >/root/encrypted.secret
|
|
cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom /root/encrypted.raw --key-file=/root/encrypted.secret
|
|
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs= --unlock-key-file=/root/encrypted.secret /root/encrypted.raw
|
|
rm -f /root/encrypted.secret
|
|
fi
|
|
|
|
# Validate that with the current profile we can fulfill the PCR 11 policy
|
|
systemd-cryptsetup attach multiprof /root/encrypted.raw - tpm2-device=auto,headless=1
|
|
systemd-cryptsetup detach multiprof
|
|
|
|
if [[ "$ID" == "main" ]]; then
|
|
bootctl set-default "$(basename "$CURRENT_UKI")@profile1"
|
|
reboot
|
|
exit 0
|
|
elif [[ "$ID" == "profile1" ]]; then
|
|
grep testprofile1=1 /proc/cmdline
|
|
bootctl set-default "$(basename "$CURRENT_UKI")@profile2"
|
|
reboot
|
|
exit 0
|
|
elif [[ "$ID" == "profile2" ]]; then
|
|
grep testprofile2=1 /proc/cmdline
|
|
rm /root/encrypted.raw
|
|
else
|
|
exit 1
|
|
fi
|
|
|
|
touch /testok
|