vincent/meta-cyber-secureboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ajout de recettes pour signature via HSM distant et PKCS#11

Browse Source
This commit is contained in:
BENOIT Vincent
2024-02-06 19:06:09 +00:00
parent fd18eadb3f
commit 11486c1fee
5 changed files with 69 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
recipes-core/initrdscripts/files/ecryptfs
+28 -4
View File
@@ -26,7 +26,7 @@ create_tpm_prim_key() {
check_tpm2
local contextfile=${dirpath}/key.ctxt
local ret=`/usr/bin/tpm2_createprimary --key-algorithm=rsa2048 --key-context=${contextfile}`
local ret=`/usr/bin/tpm2_createprimary --key-algorithm=rsa2048 --key-context=${contextfile} 2>/dev/null`
if [ $? -ne 0 ]; then
echo "err: create primary failed"
exit 1
@@ -47,6 +47,21 @@ persistent_handle() {
fi
}
load_trusted_blob() {
local keypath=$1
local handle=$2
local blob=`cat ${keypath}`
echo "add trusted blob to linux key"
/bin/keyctl add trusted kmk-trusted "load ${blob} keyhandle=${handle}" @u
}
load_encrypted_blob() {
local keypath=$1
local blob=`cat ${keypath}`
echo "add encrypted blob to linux key"
/bin/keyctl add encrypted 1001100110011001 "load ${blob}" @u
}
create_key_master_key() {
local handle=$1
local keypath=$2
@@ -66,14 +81,16 @@ create_key_master_key() {
local res=`/bin/keyctl pipe ${kmk} > ${keypath}`
if [ $? -eq 0 ]; then
echo "revoke kmk-trusted"
/bin/keyctl revoke ${kmk}
/bin/keyctl revoke "${kmk}"
if [ $? -eq 0 ]; then
load_trusted_blob "${keypath}" "${handle}"
fi
fi
fi
}
create_encrypted_key() {
local keypath=$1
local filename="ecryptfs-encrypted.blob"
echo "add ecryptfs key from trusted kmk ..."
local encrypted=`/bin/keyctl add encrypted 1001100110011001 "new ecryptfs trusted:kmk-trusted 64" @u`
@@ -85,7 +102,10 @@ create_encrypted_key() {
local res=`/bin/keyctl pipe ${encrypted} > ${keypath}`
if [ $? -eq 0 ]; then
echo "revoke ecryptfs-encrypted key"
/bin/keyctl revoke ${encrypted}
/bin/keyctl revoke "${encrypted}"
if [ $? -eq 0 ]; then
load_encrypted_blob "${keypath}"
fi
fi
fi
}
@@ -100,12 +120,16 @@ ecryptfs_run() {
echo "*-* persistent handle *-*"
persistent_handle /tmp/key.ctxt
echo "*-* storage primary key: ${storage_prim_key} *-*"
echo "${storage_prim_key}" > "$ROOTFS_DIR/etc/keys/tpm_key_handle"
/bin/keyctl clear @u
/bin/keyctl link @u @s
echo "*-* create_key_master_key *-*"
create_key_master_key ${storage_prim_key} "$ROOTFS_DIR/etc/keys/${kmk_filename}"
echo "*-* create_encrypted_key *-*"
create_encrypted_key "$ROOTFS_DIR/etc/keys/${encrypted_filename}"
elif [ -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ] && [ -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ]; then
load_trusted_blob "$ROOTFS_DIR/etc/keys/${kmk_filename}" `cat "$ROOTFS_DIR/etc/keys/tpm_key_handle"`
load_encrypted_blob "$ROOTFS_DIR/etc/keys/${encrypted_filename}"
fi
echo "*-* END *-*"
}