Skip to content

Commit 2f5115f

Browse files
tlauriontlaurion
committed
initrd+boards: feature-freeze hardening across TPM, tracing, root-hashes, and prompts
- add cross-script full trace-stack context in initrd/etc/functions (TRACE_STACK + TRACE_FUNC chaining) for end-to-end call-path visibility - harden TPM/TOTP/HOTP and rollback flows across initrd/bin/gui-init, initrd/bin/tpmr, initrd/bin/seal-totp, initrd/bin/unseal-totp, initrd/bin/unseal-hotp, initrd/bin/kexec-sign-config, and initrd/bin/oem-factory-reset - improve reset-vs-reseal guidance, TPM2 primary-handle checks, and ensure reseal failures propagate to callers - make counter increment/create pipeline error handling reliable with local pipefail in initrd/etc/functions - remove sensitive TPM owner-password length debug metadata and apply helper cleanups (partition parsing compatibility, local scoping, formatting) - fix root-hashes LVM handling for Qubes/device-mapper naming by robust VG detection and dashed VG/LV mapper escaping in initrd/bin/root-hashes-gui.sh + initrd/etc/functions - fix DUK passphrase prompt UX in initrd/bin/kexec-seal-key (repeat prompt placement and inline entry behavior) - add qemu tpm1/tpm2 prod_quiet board configs and correct *_hotp-prod_quiet board-name exports for coverage/testing Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1 parent b175948 commit 2f5115f

File tree

13 files changed

+481
-57
lines changed

13 files changed

+481
-57
lines changed

‎boards/qemu-coreboot-fbwhiptail-tpm1-hotp-prod_quiet/qemu-coreboot-fbwhiptail-tpm1-hotp-prod_quiet.config‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
9191
export CONFIG_BOOT_RECOVERY_SERIAL="/dev/ttyS0"
9292
export CONFIG_BOOT_KERNEL_ADD="console=ttyS0 console=tty systemd.zram=0"
9393
export CONFIG_BOOT_KERNEL_REMOVE="quiet rhgb splash"
94-
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm1-hotp"
94+
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm1-hotp-prod_quiet"
9595
#export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
9696

9797
export CONFIG_KEYBOARD_KEYMAP="/usr/lib/kbd/keymaps/i386/qwerty/us.map"

‎boards/qemu-coreboot-fbwhiptail-tpm1-prod_quiet/qemu-coreboot-fbwhiptail-tpm1-prod_quiet.config‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Configuration for building a coreboot ROM that works in
2+
# the qemu emulator in console mode thanks to Whiptail
3+
#
4+
# TPM can be used with a qemu software TPM (TIS, 1.2).
5+
export CONFIG_COREBOOT=y
6+
export CONFIG_COREBOOT_VERSION=25.09
7+
export CONFIG_LINUX_VERSION=6.1.8
8+
9+
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm1-prod.config
10+
CONFIG_LINUX_CONFIG=config/linux-qemu.config
11+
12+
#Enable only one RESTRICTED/BASIC boot modes below to test them manually (we cannot inject config under QEMU (no internal flashing)
13+
#export CONFIG_RESTRICTED_BOOT=y
14+
#export CONFIG_BASIC=y
15+
16+
#Enable HAVE_GPG_KEY_BACKUP to test GPG key backup drive (we cannot inject config under QEMU (no internal flashing))
17+
#export CONFIG_HAVE_GPG_KEY_BACKUP=y
18+
19+
#On-demand hardware support (modules.cpio)
20+
CONFIG_LINUX_USB=y
21+
CONFIG_LINUX_E1000=y
22+
#CONFIG_MOBILE_TETHERING=y
23+
#Runtime on-demand additional hardware support (modules.cpio)
24+
export CONFIG_LINUX_USB_COMPANION_CONTROLLER=y
25+
26+
27+
28+
#Modules packed into tools.cpio
29+
ifeq "$(CONFIG_UROOT)" "y"
30+
CONFIG_BUSYBOX=n
31+
else
32+
#Modules packed into tools.cpio
33+
CONFIG_CRYPTSETUP2=y
34+
CONFIG_FLASHPROG=y
35+
CONFIG_FLASHTOOLS=y
36+
CONFIG_GPG2=y
37+
CONFIG_KEXEC=y
38+
CONFIG_UTIL_LINUX=y
39+
CONFIG_LVM2=y
40+
CONFIG_MBEDTLS=y
41+
CONFIG_PCIUTILS=y
42+
#Runtime tools to write to MSR
43+
#CONFIG_MSRTOOLS=y
44+
#Remote attestation support
45+
# TPM2 requirements
46+
#CONFIG_TPM2_TSS=y
47+
#CONFIG_OPENSSL=y
48+
#Remote Attestation common tools
49+
CONFIG_POPT=y
50+
CONFIG_QRENCODE=y
51+
CONFIG_TPMTOTP=y
52+
#HOTP based remote attestation for supported USB Security dongle
53+
#With/Without TPM support
54+
#CONFIG_HOTPKEY=y
55+
#Nitrokey Storage admin tool (deprecated)
56+
#CONFIG_NKSTORECLI=n
57+
#GUI Support
58+
#Console based Whiptail support(Console based, no FB):
59+
#CONFIG_SLANG=y
60+
#CONFIG_NEWT=y
61+
#FBWhiptail based (Graphical):
62+
CONFIG_CAIRO=y
63+
CONFIG_FBWHIPTAIL=y
64+
#Additional tools (tools.cpio):
65+
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
66+
CONFIG_DROPBEAR=y
67+
endif
68+
69+
#Runtime configuration
70+
#Automatically boot if HOTP is valid
71+
export CONFIG_AUTO_BOOT_TIMEOUT=5
72+
#TPM2 requirements
73+
#export CONFIG_TPM2_TOOLS=y
74+
#export CONFIG_PRIMARY_KEY_TYPE=ecc
75+
#TPM1 requirements
76+
export CONFIG_TPM=y
77+
#Enable DEBUG output
78+
export CONFIG_DEBUG_OUTPUT=n
79+
export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
80+
#Enable TPM2 pcap output under /tmp
81+
export CONFIG_TPM2_CAPTURE_PCAP=n
82+
#Enable quiet mode: technical information logged under /tmp/debug.log
83+
export CONFIG_QUIET_MODE=y
84+
export CONFIG_BOOTSCRIPT=/bin/gui-init
85+
#text-based original init:
86+
#export CONFIG_BOOTSCRIPT=/bin/generic-init
87+
export CONFIG_BOOT_REQ_HASH=n
88+
export CONFIG_BOOT_REQ_ROLLBACK=n
89+
export CONFIG_BOOT_RECOVERY_SERIAL="/dev/ttyS0"
90+
export CONFIG_BOOT_KERNEL_ADD="console=ttyS0 console=tty systemd.zram=0"
91+
export CONFIG_BOOT_KERNEL_REMOVE="quiet rhgb splash"
92+
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm1-prod_quiet"
93+
#export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
94+
95+
export CONFIG_KEYBOARD_KEYMAP="/usr/lib/kbd/keymaps/i386/qwerty/us.map"
96+
97+
BOARD_TARGETS := qemu

‎boards/qemu-coreboot-fbwhiptail-tpm2-hotp-prod_quiet/qemu-coreboot-fbwhiptail-tpm2-hotp-prod_quiet.config‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ CONFIG_LINUX_CONFIG=config/linux-qemu.config
1717
#Enable HAVE_GPG_KEY_BACKUP to test GPG key backup drive (we cannot inject config under QEMU (no internal flashing))
1818
#export CONFIG_HAVE_GPG_KEY_BACKUP=y
1919

20+
2021
#On-demand hardware support (modules.cpio)
2122
CONFIG_LINUX_USB=y
2223
CONFIG_LINUX_E1000=y
@@ -90,7 +91,7 @@ export CONFIG_BOOT_REQ_ROLLBACK=n
9091
export CONFIG_BOOT_RECOVERY_SERIAL="/dev/ttyS0"
9192
export CONFIG_BOOT_KERNEL_ADD="console=ttyS0 console=tty systemd.zram=0"
9293
export CONFIG_BOOT_KERNEL_REMOVE="quiet rhgb splash"
93-
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm2-hotp"
94+
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm2-hotp-prod_quiet"
9495
#export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
9596

9697
export CONFIG_KEYBOARD_KEYMAP="/usr/lib/kbd/keymaps/i386/qwerty/us.map"

‎boards/qemu-coreboot-fbwhiptail-tpm2-prod_quiet/qemu-coreboot-fbwhiptail-tpm2-prod_quiet.config‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Configuration for building a coreboot ROM that works in
2+
# the qemu emulator in graphical mode thanks to FBWhiptail
3+
#
4+
# TPM can be used with a qemu software TPM (TIS, 2.0).
5+
export CONFIG_COREBOOT=y
6+
export CONFIG_COREBOOT_VERSION=25.09
7+
export CONFIG_LINUX_VERSION=6.1.8
8+
9+
CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-tpm2-prod.config
10+
CONFIG_LINUX_CONFIG=config/linux-qemu.config
11+
12+
#Enable only one RESTRICTED/BASIC boot modes below to test them manually (we cannot inject config under QEMU (no internal flashing)
13+
#export CONFIG_RESTRICTED_BOOT=y
14+
#export CONFIG_BASIC=y
15+
16+
#Enable HAVE_GPG_KEY_BACKUP to test GPG key backup drive (we cannot inject config under QEMU (no internal flashing))
17+
#export CONFIG_HAVE_GPG_KEY_BACKUP=y
18+
19+
20+
#On-demand hardware support (modules.cpio)
21+
CONFIG_LINUX_USB=y
22+
CONFIG_LINUX_E1000=y
23+
#CONFIG_MOBILE_TETHERING=y
24+
#Runtime on-demand additional hardware support (modules.cpio)
25+
export CONFIG_LINUX_USB_COMPANION_CONTROLLER=y
26+
27+
28+
29+
#Modules packed into tools.cpio
30+
ifeq "$(CONFIG_UROOT)" "y"
31+
CONFIG_BUSYBOX=n
32+
else
33+
#Modules packed into tools.cpio
34+
CONFIG_CRYPTSETUP2=y
35+
CONFIG_FLASHPROG=y
36+
CONFIG_FLASHTOOLS=y
37+
CONFIG_GPG2=y
38+
CONFIG_KEXEC=y
39+
CONFIG_UTIL_LINUX=y
40+
CONFIG_LVM2=y
41+
CONFIG_MBEDTLS=y
42+
CONFIG_PCIUTILS=y
43+
#Runtime tools to write to MSR
44+
CONFIG_MSRTOOLS=y
45+
#Remote attestation support
46+
# TPM2 requirements
47+
CONFIG_TPM2_TSS=y
48+
CONFIG_OPENSSL=y
49+
#Remote Attestation common tools
50+
CONFIG_POPT=y
51+
CONFIG_QRENCODE=y
52+
CONFIG_TPMTOTP=y
53+
#HOTP based remote attestation for supported USB Security dongle
54+
#With/Without TPM support
55+
#CONFIG_HOTPKEY=y
56+
#Nitrokey Storage admin tool (deprecated)
57+
#CONFIG_NKSTORECLI=n
58+
#GUI Support
59+
#Console based Whiptail support(Console based, no FB):
60+
#CONFIG_SLANG=y
61+
#CONFIG_NEWT=y
62+
#FBWhiptail based (Graphical):
63+
CONFIG_CAIRO=y
64+
CONFIG_FBWHIPTAIL=y
65+
#Additional tools (tools.cpio):
66+
#SSH server (requires ethernet drivers, eg: CONFIG_LINUX_E1000E)
67+
CONFIG_DROPBEAR=y
68+
endif
69+
70+
#Runtime configuration
71+
#Automatically boot if HOTP is valid
72+
export CONFIG_AUTO_BOOT_TIMEOUT=5
73+
#TPM2 requirements
74+
export CONFIG_TPM2_TOOLS=y
75+
export CONFIG_PRIMARY_KEY_TYPE=ecc
76+
#TPM1 requirements
77+
#export CONFIG_TPM=y
78+
#Enable DEBUG output
79+
#export CONFIG_DEBUG_OUTPUT=y
80+
#export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y
81+
#Enable TPM2 pcap output under /tmp
82+
export CONFIG_TPM2_CAPTURE_PCAP=y
83+
#Enable quiet mode: technical information logged under /tmp/debug.log
84+
export CONFIG_QUIET_MODE=y
85+
export CONFIG_BOOTSCRIPT=/bin/gui-init
86+
#text-based original init:
87+
#export CONFIG_BOOTSCRIPT=/bin/generic-init
88+
export CONFIG_BOOT_REQ_HASH=n
89+
export CONFIG_BOOT_REQ_ROLLBACK=n
90+
export CONFIG_BOOT_RECOVERY_SERIAL="/dev/ttyS0"
91+
export CONFIG_BOOT_KERNEL_ADD="console=ttyS0 console=tty systemd.zram=0"
92+
export CONFIG_BOOT_KERNEL_REMOVE="quiet rhgb splash"
93+
export CONFIG_BOARD_NAME="qemu-coreboot-fbwhiptail-tpm2-prod_quiet"
94+
#export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
95+
96+
export CONFIG_KEYBOARD_KEYMAP="/usr/lib/kbd/keymaps/i386/qwerty/us.map"
97+
98+
BOARD_TARGETS := qemu

‎initrd/bin/gui-init‎

Lines changed: 51 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -174,11 +174,40 @@ generate_totp_hotp() {
174174
# clear screen
175175
printf "\033c"
176176
else
177-
warn "Unsealing TOTP/HOTP secret from previous sealed measurements failed"
178-
warn 'Try "Generate new HOTP/TOTP secret" option if you updated firmware content'
177+
# seal-totp already printed an explanatory error (e.g. missing
178+
# primary handle) and guided the user to reset the TPM. Don't add
179+
# confusing generic warnings here, just propagate failure.
180+
return 1
179181
fi
180182
}
181183

184+
prompt_missing_gpg_key_action() {
185+
TRACE_FUNC
186+
whiptail_error --title "ERROR: GPG keyring empty!" \
187+
--menu "Cannot continue TPM disk-key reseal because no GPG key is available.\n\nHow would you like to proceed?" 0 80 4 \
188+
'g' ' Add a GPG key to the running BIOS' \
189+
'F' ' OEM Factory Reset / Re-Ownership' \
190+
'm' ' Return to main menu' \
191+
'x' ' Exit to recovery shell' \
192+
2>/tmp/whiptail || recovery "GUI menu failed"
193+
194+
option=$(cat /tmp/whiptail)
195+
case "$option" in
196+
g)
197+
gpg-gui.sh && BG_COLOR_MAIN_MENU="normal"
198+
;;
199+
F)
200+
oem-factory-reset
201+
;;
202+
x)
203+
recovery "User requested recovery shell"
204+
;;
205+
m | *)
206+
return 1
207+
;;
208+
esac
209+
}
210+
182211
update_totp() {
183212
TRACE_FUNC
184213
# update the TOTP code
@@ -218,15 +247,19 @@ update_totp() {
218247
g)
219248
if (whiptail_warning --title 'Generate new TOTP/HOTP secret' \
220249
--yesno "This will erase your old secret and replace it with a new one!\n\nDo you want to proceed?" 0 80); then
221-
generate_totp_hotp && update_totp && BG_COLOR_MAIN_MENU="normal" && reseal_tpm_disk_decryption_key
250+
if generate_totp_hotp && update_totp && BG_COLOR_MAIN_MENU="normal"; then
251+
reseal_tpm_disk_decryption_key || prompt_missing_gpg_key_action
252+
fi
222253
fi
223254
;;
224255
i)
225256
skip_to_menu="true"
226257
return 1
227258
;;
228259
p)
229-
reset_tpm && update_totp && BG_COLOR_MAIN_MENU="normal" && reseal_tpm_disk_decryption_key
260+
if reset_tpm && update_totp && BG_COLOR_MAIN_MENU="normal"; then
261+
reseal_tpm_disk_decryption_key || prompt_missing_gpg_key_action
262+
fi
230263
;;
231264
x)
232265
recovery "User requested recovery shell"
@@ -290,7 +323,9 @@ update_hotp() {
290323
g)
291324
if (whiptail_warning --title 'Generate new TOTP/HOTP secret' \
292325
--yesno "This will erase your old secret and replace it with a new one!\n\nDo you want to proceed?" 0 80); then
293-
generate_totp_hotp && BG_COLOR_MAIN_MENU="normal" && reseal_tpm_disk_decryption_key
326+
if generate_totp_hotp && BG_COLOR_MAIN_MENU="normal"; then
327+
reseal_tpm_disk_decryption_key || prompt_missing_gpg_key_action
328+
fi
294329
fi
295330
;;
296331
i)
@@ -510,10 +545,14 @@ show_tpm_totp_hotp_options_menu() {
510545
option=$(cat /tmp/whiptail)
511546
case "$option" in
512547
g)
513-
generate_totp_hotp && reseal_tpm_disk_decryption_key
548+
if generate_totp_hotp; then
549+
reseal_tpm_disk_decryption_key || prompt_missing_gpg_key_action
550+
fi
514551
;;
515552
r)
516-
reset_tpm && reseal_tpm_disk_decryption_key
553+
if reset_tpm; then
554+
reseal_tpm_disk_decryption_key || prompt_missing_gpg_key_action
555+
fi
517556
;;
518557
t)
519558
prompt_totp_mismatch
@@ -566,15 +605,18 @@ reset_tpm() {
566605
DEBUG "TPM_COUNTER: $TPM_COUNTER"
567606
#TPM_COUNTER can be empty
568607

569-
increment_tpm_counter $TPM_COUNTER>/dev/null 2>&1 ||
608+
increment_tpm_counter $TPM_COUNTER ||
570609
die "Unable to increment tpm counter"
571610

572611
DO_WITH_DEBUG sha256sum /tmp/counter-$TPM_COUNTER >/boot/kexec_rollback.txt ||
573612
die "Unable to create rollback file"
574613

575614
TRACE_FUNC
576615
# As a countermeasure for existing primary handle hash, we will now force sign /boot without it
577-
if (whiptail --title 'TPM Reset Successfully' \
616+
GPG_KEY_COUNT=$(gpg -k 2>/dev/null | wc -l)
617+
if [ "$GPG_KEY_COUNT" -eq 0 ]; then
618+
prompt_missing_gpg_key_action
619+
elif (whiptail --title 'TPM Reset Successfully' \
578620
--yesno "Would you like to update the checksums and sign all of the files in /boot?\n\nYou will need your GPG key to continue and this will modify your disk.\n\nOtherwise the system will reboot immediately." 0 80); then
579621
if ! update_checksums; then
580622
whiptail_error --title 'ERROR' \

‎initrd/bin/kexec-seal-key‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,10 @@ attempts=0
6969

7070
# Ask for the DRK passphrase first, before testing any devices
7171
while [ $attempts -lt 3 ] && [ $luks_drk_passphrase_valid -eq 0 ]; do
72-
read -r -s -p $'\nEnter LUKS Disk Recovery Key (DRK) passphrase that can unlock '"$key_devices"': ' disk_recovery_key_passphrase
72+
if [ $attempts -eq 0 ]; then
73+
echo
74+
fi
75+
read -r -s -p "Enter LUKS Disk Recovery Key (DRK) passphrase that can unlock $key_devices: " disk_recovery_key_passphrase
7376
echo
7477
echo -n "$disk_recovery_key_passphrase" >"$DISK_RECOVERY_KEY_FILE"
7578

@@ -103,15 +106,19 @@ done
103106
MIN_PASSPHRASE_LENGTH=12
104107
attempts=0
105108
while [ $attempts -lt 3 ]; do
106-
read -r -s -p $'\nNew LUKS TPM Disk Unlock Key (DUK) passphrase for booting (minimum '"$MIN_PASSPHRASE_LENGTH"' characters): ' key_password
107-
echo
109+
if [ $attempts -eq 0 ]; then
110+
echo
111+
fi
112+
read -r -s -p "New LUKS TPM Disk Unlock Key (DUK) passphrase for booting (minimum $MIN_PASSPHRASE_LENGTH characters): " key_password
108113
if [ ${#key_password} -lt $MIN_PASSPHRASE_LENGTH ]; then
114+
echo
109115
attempts=$((attempts + 1))
110116
warn "Disk Unlock Key (DUK) passphrase is too short. Please try again."
111117
continue
112118
fi
113119

114-
read -r -s -p $'\nRepeat LUKS TPM Disk Unlock Key (DUK) passphrase for booting: ' key_password2
120+
echo
121+
read -r -s -p "Repeat LUKS TPM Disk Unlock Key (DUK) passphrase for booting: " key_password2
115122
echo
116123
if [ "$key_password" != "$key_password2" ]; then
117124
attempts=$((attempts + 1))

0 commit comments

Comments
 (0)