modification de l'initramfs pour DMCrypt et ecryptfs
This commit is contained in:
@@ -18,4 +18,5 @@ do_install:append() {
|
||||
install -m 0644 ${WORKDIR}/locale.conf ${D}${sysconfdir}
|
||||
install -m 0644 ${WORKDIR}/vconsole.conf ${D}${sysconfdir}
|
||||
install -d ${D}/data
|
||||
install -d ${D}${sysconfdir}/keys
|
||||
}
|
||||
|
||||
@@ -5,6 +5,7 @@ INITRAMFS_SCRIPTS = "\
|
||||
initramfs-module-debug \
|
||||
initramfs-module-cryptfs \
|
||||
initramfs-module-cryptfs-tpm2 \
|
||||
initramfs-module-ecryptfs \
|
||||
"
|
||||
|
||||
PACKAGE_INSTALL = "\
|
||||
|
||||
@@ -49,38 +49,38 @@ cryptfs_gen_passphrase() {
|
||||
cryptfs_run() {
|
||||
# Similar to rootfs, we need to wait for the device to become available
|
||||
C=0
|
||||
delay=${bootparam_rootdelay:-1}
|
||||
timeout=${bootparam_roottimeout:-5}
|
||||
#while true; do
|
||||
# if [ $(( $C * $delay )) -gt $timeout ]; then
|
||||
# fatal "root '$bootparam_root' doesn't exist or does not contain a /dev."
|
||||
# fi
|
||||
delay=${bootparam_datadelay:-1}
|
||||
timeout=${bootparam_datatimeout:-5}
|
||||
while true; do
|
||||
if [ $(( $C * $delay )) -gt $timeout ]; then
|
||||
fatal "root '$bootparam_data' doesn't exist or does not contain a /dev."
|
||||
fi
|
||||
|
||||
# if [ -n "$bootparam_root" ]; then
|
||||
# root_dev="$bootparam_root"
|
||||
# if [ "`echo ${bootparam_root} | cut -c1-5`" = "UUID=" ]; then
|
||||
# root_uuid=`echo $bootparam_root | cut -c6-`
|
||||
# root_dev=`readlink -f /dev/disk/by-uuid/$root_uuid`
|
||||
# elif [ "`echo ${bootparam_root} | cut -c1-9`" = "PARTUUID=" ]; then
|
||||
# root_partuuid=`echo $bootparam_root | cut -c10-`
|
||||
# root_dev=`readlink -f /dev/disk/by-partuuid/$root_partuuid`
|
||||
# elif [ "`echo ${bootparam_root} | cut -c1-10`" = "PARTLABEL=" ]; then
|
||||
# root_partlabel=`echo $bootparam_root | cut -c11-`
|
||||
# root_dev=`readlink -f /dev/disk/by-partlabel/$root_partlabel`
|
||||
# elif [ "`echo ${bootparam_root} | cut -c1-6`" = "LABEL=" ]; then
|
||||
# root_label=`echo $bootparam_root | cut -c7-`
|
||||
# root_dev=`readlink -f /dev/disk/by-label/$root_label`
|
||||
# fi
|
||||
if [ -n "$bootparam_data" ]; then
|
||||
root_dev="$bootparam_data"
|
||||
if [ "`echo ${bootparam_data} | cut -c1-5`" = "UUID=" ]; then
|
||||
root_uuid=`echo $bootparam_data | cut -c6-`
|
||||
root_dev=`readlink -f /dev/disk/by-uuid/$root_uuid`
|
||||
elif [ "`echo ${bootparam_data} | cut -c1-9`" = "PARTUUID=" ]; then
|
||||
root_partuuid=`echo $bootparam_data | cut -c10-`
|
||||
root_dev=`readlink -f /dev/disk/by-partuuid/$root_partuuid`
|
||||
elif [ "`echo ${bootparam_data} | cut -c1-10`" = "PARTLABEL=" ]; then
|
||||
root_partlabel=`echo $bootparam_data | cut -c11-`
|
||||
root_dev=`readlink -f /dev/disk/by-partlabel/$root_partlabel`
|
||||
elif [ "`echo ${bootparam_data} | cut -c1-6`" = "LABEL=" ]; then
|
||||
root_label=`echo $bootparam_data | cut -c7-`
|
||||
root_dev=`readlink -f /dev/disk/by-label/$root_label`
|
||||
fi
|
||||
|
||||
# [ -e "$root_dev" ] && break
|
||||
# fi
|
||||
# debug "Sleeping for $delay second(s) to wait root to settle..."
|
||||
# sleep $delay
|
||||
# C=$(( $C + 1 ))
|
||||
#done
|
||||
[ -e "$root_dev" ] && break
|
||||
fi
|
||||
debug "Sleeping for $delay second(s) to wait root to settle..."
|
||||
sleep $delay
|
||||
C=$(( $C + 1 ))
|
||||
done
|
||||
|
||||
flags=""
|
||||
root_dev="/dev/mmcblk0p3"
|
||||
#root_dev="/dev/mmcblk0p3"
|
||||
mounted_dir="/data"
|
||||
key_slot=8
|
||||
|
||||
|
||||
@@ -0,0 +1,111 @@
|
||||
#!/bin/sh
|
||||
|
||||
#!/bin/sh
|
||||
#@author: vincent.benoit <vincent.benoit@scle.fr>
|
||||
#@date: 10/2023
|
||||
#@brief: ecryptfs and TPM
|
||||
|
||||
check_tpm2() {
|
||||
if [ ! -e /sys/class/tpm ]; then
|
||||
echo "Linux TPM subsystem not found"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
ecryptfs_enabled() {
|
||||
return 0
|
||||
}
|
||||
|
||||
create_tpm_prim_key() {
|
||||
local dirpath=$1
|
||||
if [ -z ${dirpath} ]; then
|
||||
echo "err: dir path (${dirpath}) doesn't exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
check_tpm2
|
||||
|
||||
local contextfile=${dirpath}/key.ctxt
|
||||
local ret=`/usr/bin/tpm2_createprimary --key-algorithm=rsa2048 --key-context=${contextfile}`
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "err: create primary failed"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
persistent_handle() {
|
||||
local handle=$1
|
||||
storage_prim_key=""
|
||||
local tmp_res=/tmp/persist.txt
|
||||
local ret=`/usr/bin/tpm2_evictcontrol -c ${handle} > ${tmp_res}`
|
||||
if [ $? -eq 0 ]; then
|
||||
local res=`cat ${tmp_res} | tail -1 | awk -F ": " '{print $2}'`
|
||||
if [ $res == "persisted" ]; then
|
||||
# store handle to var
|
||||
storage_prim_key=`cat ${tmp_res} | head -n 1 | awk -F ": " '{print $2}'`
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
create_key_master_key() {
|
||||
local handle=$1
|
||||
local keypath=$2
|
||||
|
||||
if [ -z ${handle} ]; then
|
||||
echo "err: handle (${handle}) empty"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "add kmk-trusted from TPM ..."
|
||||
local kmk=`/bin/keyctl add trusted kmk-trusted "new 32 keyhandle=${handle}" @u`
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "pipe kmk-trusted to file ..."
|
||||
if [ -f "${keypath}" ]; then
|
||||
echo "warn: ${keypath} already exists"
|
||||
fi
|
||||
local res=`/bin/keyctl pipe ${kmk} > ${keypath}`
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "revoke kmk-trusted"
|
||||
/bin/keyctl revoke ${kmk}
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
create_encrypted_key() {
|
||||
local keypath=$1
|
||||
local filename="ecryptfs-encrypted.blob"
|
||||
|
||||
echo "add ecryptfs key from trusted kmk ..."
|
||||
local encrypted=`/bin/keyctl add encrypted 1001100110011001 "new ecryptfs trusted:kmk-trusted 64" @u`
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "pipe encrypted key to file ..."
|
||||
if [ -f "${keypath}" ]; then
|
||||
echo "warn: ${keypath} already exists"
|
||||
fi
|
||||
local res=`/bin/keyctl pipe ${encrypted} > ${keypath}`
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "revoke ecryptfs-encrypted key"
|
||||
/bin/keyctl revoke ${encrypted}
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
ecryptfs_run() {
|
||||
kmk_filename="kmk-trusted.blob"
|
||||
encrypted_filename="ecryptfs-encrypted.blob"
|
||||
|
||||
if [ ! -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ] && [ ! -f "$ROOTFS_DIR/etc/keys/${kmk_filename}" ]; then
|
||||
echo "*-* create TPM primary key *-*"
|
||||
create_tpm_prim_key /tmp
|
||||
echo "*-* persistent handle *-*"
|
||||
persistent_handle /tmp/key.ctxt
|
||||
echo "*-* storage primary key: ${storage_prim_key} *-*"
|
||||
/bin/keyctl clear @u
|
||||
/bin/keyctl link @u @s
|
||||
echo "*-* create_key_master_key *-*"
|
||||
create_key_master_key ${storage_prim_key} "$ROOTFS_DIR/etc/keys/${kmk_filename}"
|
||||
echo "*-* create_encrypted_key *-*"
|
||||
create_encrypted_key "$ROOTFS_DIR/etc/keys/${encrypted_filename}"
|
||||
fi
|
||||
echo "*-* END *-*"
|
||||
}
|
||||
@@ -8,12 +8,14 @@ SRC_URI:append = " \
|
||||
file://dmverity \
|
||||
file://cryptfs \
|
||||
file://cryptfs_tpm2 \
|
||||
file://ecryptfs \
|
||||
"
|
||||
|
||||
PACKAGES:append = " \
|
||||
initramfs-module-verity \
|
||||
initramfs-module-cryptfs \
|
||||
initramfs-module-cryptfs-tpm2 \
|
||||
initramfs-module-ecryptfs \
|
||||
"
|
||||
|
||||
do_install:append() {
|
||||
@@ -23,6 +25,7 @@ do_install:append() {
|
||||
install -d ${D}/${sysconfdir}/cryptfs
|
||||
install -m 0644 ${WORKDIR}/cryptfs_tpm2 ${D}/${sysconfdir}/cryptfs/tpm2
|
||||
install -m 0755 ${WORKDIR}/cryptfs ${D}/init.d/95-cryptfs
|
||||
install -m 0755 ${WORKDIR}/ecryptfs ${D}/init.d/96-ecryptfs
|
||||
}
|
||||
|
||||
SUMMARY:initramfs-module-verity = "initramfs support for dm-verity filesystems"
|
||||
@@ -56,3 +59,14 @@ RDEPENDS:initramfs-module-cryptfs-tpm2 = " \
|
||||
FILES:initramfs-module-cryptfs-tpm2 = " \
|
||||
${sysconfdir}/cryptfs/tpm2 \
|
||||
"
|
||||
|
||||
|
||||
SUMMARY:initramfs-module-ecryptfs = "encrypted directory with support for tpm 2.0"
|
||||
RDEPENDS:initramfs-module-ecryptfs = " \
|
||||
${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'libtss2 libtss2-mu libtss2-tcti-device', '', d)} \
|
||||
tpm2-tools \
|
||||
keyutils \
|
||||
"
|
||||
FILES:initramfs-module-ecryptfs = " \
|
||||
/init.d/96-ecryptfs \
|
||||
"
|
||||
|
||||
Reference in New Issue
Block a user