File aeon-check-1.0.2.obscpio of Package aeon-check

Overview Repositories Revisions Requests Users Attributes Meta

File aeon-check-1.0.2.obscpio of Package aeon-check

07070100000000000081A4000000000000000000000001672892750000042C000000000000000000000000000000000000001900000000aeon-check-1.0.2/LICENSEMIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
07070100000001000081A400000000000000000000000167289275000001DF000000000000000000000000000000000000001B00000000aeon-check-1.0.2/README.md# aeon-check

Initial design thoughts https://en.opensuse.org/Portal:Aeon/DevelopmentThoughts#aeon-check. This should be considered this project's long term goal.

Short term goal - Local checks only directly executing fixes for resolving specific bugs in Aeon RC3 and later

## Bugs Addressed
- Check existing Aeon Default Mode installations and confirm the TPM enrolment is using pcrlock not PCR hashes after incase enrolment steps occurred in an imperfect order (boo#1228416)
07070100000002000081ED0000000000000000000000016728927500000772000000000000000000000000000000000000001C00000000aeon-check-1.0.2/aeon-check#!/bin/bash
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: Copyright 2024 SUSE LLC
# SPDX-FileCopyrightText: Copyright 2024 Richard Brown

set -euo pipefail

# Setup logging
exec 3>&1 4>&2
trap 'exec 2>&4 1>&3' 0 1 2 3
exec 1>>/var/log/aeon-check.log 2>&1

boo1228416() {
    # Determine root device
    rootdev=/dev/$(dmsetup deps -o devname /dev/mapper/aeon_root | cut -d '(' -f2 | cut -d ')' -f1)
    # Check for failure conditions
    tpm2hashpcrs=$(cryptsetup luksDump ${rootdev} | grep 'tpm2-hash-pcrs:' | tr -d ' \t' | cut -d ':' -f2)
    tpm2pcrlock=$(cryptsetup luksDump ${rootdev} | grep 'tpm2-pcrlock:' | tr -d ' \t' | cut -d ':' -f2)
    # For boo1228416 to be an issue hashpcrs must be 7 and pcrlock must be false. Be paranoid, only match on both
    if [ "${tpm2hashpcrs}" == "7" ] && [ "${tpm2pcrlock}" == "false" ]; then
        echo "boo1228416 detected - TPM2 using pcr hashes not pcrlock - correcting"

# Need a keyfile to avoid requesting the recovery key when re-enrolling
        keyfile=$(mktemp /tmp/aeon-check.XXXXXXXXXX)
        dd bs=512 count=4 if=/dev/urandom of=${keyfile} iflag=fullblock
        chmod 400 ${keyfile}

# Should be slot 2, but better to check and be sure
        tpm2slot=$(systemd-cryptenroll ${rootdev} | grep tpm2 | xargs | cut -d ' ' -f1)

# Writing keyfile to slot 31 (end of the LUKS2 space) to avoid clashes with any customisation/extra keys
        cryptsetup luksAddKey --token-only --batch-mode --new-key-slot=31 ${rootdev} ${keyfile}

# Drop existing enrollment and re enroll
        systemd-cryptenroll --wipe-slot=${tpm2slot} ${rootdev}
        systemd-cryptenroll --unlock-key-file=${keyfile} --tpm2-device=auto ${rootdev}

# Wipe out keyfile and keyfile keyslot
        systemd-cryptenroll --wipe-slot=31 ${rootdev}
        rm ${keyfile}

echo "boo1228416 corrected"
    fi
}

boo122841607070100000003000081A4000000000000000000000001672892750000007C000000000000000000000000000000000000002400000000aeon-check-1.0.2/aeon-check.service[Unit]
Description=Aeon Check Tool

[Service]
Type=oneshot
ExecStart=/usr/sbin/aeon-check

[Install]
WantedBy=default.target07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!9 blocks

Places

File aeon-check-1.0.2.obscpio of Package aeon-check

Places