blob: fac80d80e9e33d421f651ef0d67c57839dbf4e9e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
#!/bin/bash
# Copyright 2017 Corey Hinshaw <coreyhinshaw@gmail.com>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
usage () {
cat <<EOF
Usage: luks-tpm [OPTION]... DEVICE ACTION
Manage the LUKS TPM keys on DEVICE
Actions:
temp Set a temporary LUKS passphrase
reset Reset the LUKS TPM key
Options:
-h Print this help text
-m PATH Mount point for the tmpfs file system used to store TPM keyfiles
Default: /root/keyfs
-k PATH Sealed TPM keyfile path
Default: /boot/keyfile.enc
-t NUMBER LUKS slot number for the TPM keyfile
Default: 1
-r NUMBER LUKS slot number for temporary reset passphrase
Default: 2
-p NUMBER PCRs used to seal LUKS keyfile. May be specified more than once
Default: 0-7
-z Use the TPM SRK well-known password
EOF
}
add_temp_key() {
return_code=0
create_tmpfs
tpm_unsealdata -i "$SEALED_KEYFILE" -o "$KEYFILE" $WELL_KNOWN
echo "Preparing to set a temporary LUKS passphrase..."
cryptsetup luksAddKey --key-slot $RESET_KEY_SLOT --key-file "$KEYFILE" $ROOT_DEVICE < /dev/tty
if [ $? -eq 0 ]; then
echo "After booting into the current kernel, run"
echo " luks-tpm $(echo $ORIGINAL_ARGS | sed 's/temp$/reset/')"
echo "to generate a new TPM keyfile and remove this temporary key"
else
echo "A temporary passphrase was not set" >&2
return_code=5
fi
destroy_tmpfs
exit $return_code
}
reset_tpm_key() {
return_code=0
read -s -p "Enter any existing LUKS passphrase: " PASSPHRASE
echo
echo "Generating new LUKS key..."
create_tmpfs
dd bs=512 count=4 if=/dev/urandom of="$KEYFILE" > /dev/null 2>&1
echo "Removing current TPM key from slot $TPM_KEY_SLOT..."
echo $PASSPHRASE | cryptsetup luksKillSlot $ROOT_DEVICE $TPM_KEY_SLOT
echo "Adding new key to slot $TPM_KEY_SLOT..."
echo $PASSPHRASE | cryptsetup luksAddKey $ROOT_DEVICE "$KEYFILE" --key-slot $TPM_KEY_SLOT
addkey=$?
echo "Sealing keyfile with the TPM..."
tpm_sealdata $PCRS -i "$KEYFILE" -o "$SEALED_KEYFILE" $WELL_KNOWN
seal=$?
if [ $addkey -eq 0 ] && [ $seal -eq 0 ]; then
echo "Removing temporary passphrase from slot $RESET_KEY_SLOT..."
cryptsetup luksKillSlot --key-file "$KEYFILE" $ROOT_DEVICE $RESET_KEY_SLOT
else
echo "There was an error resetting the TPM key in slot $TPM_KEY_SLOT!" >&2
echo "The temporary reset ket in slot $RESET_KEY_SLOT has not been removed." >&2
return_code=4
fi
destroy_tmpfs
exit $return_code
}
create_tmpfs() {
mkdir -p "$TMPFS_MOUNT"
mount tmpfs "$TMPFS_MOUNT" -t tmpfs -o size=1m
if [ $? -ne 0 ]; then
echo "Could not create tmpfs. Aborting..." >&2
exit 3
fi
chmod 700 "$TMPFS_MOUNT"
}
destroy_tmpfs() {
umount "$TMPFS_MOUNT"
}
ORIGINAL_ARGS="$@"
TMPFS_MOUNT=/root/keyfs
SEALED_KEYFILE=/boot/keyfile.enc
TPM_KEY_SLOT=1
RESET_KEY_SLOT=2
PCRS="-p 0 -p 1 -p 2 -p 3 -p 4 -p 5 -p 6 -p 7"
WELL_KNOWN=""
while getopts ":hm:k:t:r:p:z" opt; do
case $opt in
h)
usage
exit 0
;;
m)
TMPFS_MOUNT="$OPTARG"
;;
k)
SEALED_KEYFILE="$OPTARG"
;;
t)
if [[ ! $OPTARG =~ ^-?[0-9]+$ ]] || [ $OPTARG -lt 0 ] || [ $OPTARG -gt 7 ]; then
echo "Invalid TPM key slot: $OPTARG" >&2
exit 1
fi
TPM_KEY_SLOT=$OPTARG
;;
r)
if [[ ! $OPTARG =~ ^-?[0-9]+$ ]] || [ $OPTARG -lt 0 ] || [ $OPTARG -gt 7 ]; then
echo "Invalid reset key slot: $OPTARG" >&2
exit 1
fi
RESET_KEY_SLOT=$OPTARG
;;
p)
if [[ ! $OPTARG =~ ^-?[0-9]+$ ]] || [ $OPTARG -lt 0 ] || [ $OPTARG -gt 23 ]; then
echo "Invalid PCR: $OPTARG" >&2
exit 1
fi
if [ -z $pcr_option ]; then
PCRS="-p $OPTARG"
else
PCRS="$PCRS -p $OPTARG"
fi
pcr_option=1
;;
z)
WELL_KNOWN="-z"
;;
\?)
echo "Invalid option: -$OPTARG" >&2
usage >2&
exit 1
;;
:)
echo "Option -$OPTARG requires an argument." >&2
exit 1
;;
esac
done
shift $((OPTIND-1))
ROOT_DEVICE="$1"
KEYFILE="$TMPFS_MOUNT/keyfile"
if [ -z $ROOT_DEVICE ]; then
echo "Device not specified!" >&2
usage >&2
exit 1
fi
if [ $EUID -ne 0 ]; then
echo "Must be run as root" >&2
exit 2
fi
if [ "$2" = "temp" ]; then
add_temp_key
elif [ "$2" = "reset" ]; then
reset_tpm_key
else
echo "Invalid action!" >&2
usage >&2
exit 1
fi
|