Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

Precalculate expected PCR[9]

Browse Source
This commit is contained in:
Malte Poll 2022-10-12 12:13:41 +02:00 committed by Malte Poll
parent 6859c6b00e
commit 835f7702a4
3 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
image/mkosi/measured-boot/precalculate_pcr_4.sh
View File

@ -67,5 +67,6 @@ echo "Stage 2 – sd-boot: ${sd_boot_authentihash}"
echo "Stage 3 – Unified Kernel Image (UKI): ${uki_authentihash}" echo "Stage 3 – Unified Kernel Image (UKI): ${uki_authentihash}"
echo "" echo ""
echo "Expected PCR[4]: ${expected_pcr_4}" echo "Expected PCR[4]: ${expected_pcr_4}"
echo ""
write_output "$2" write_output "$2"

1
image/mkosi/measured-boot/precalculate_pcr_8.sh
View File

@ -66,5 +66,6 @@ echo "Kernel commandline: ${cmdline}"
echo "Kernel Commandline measurement ${cmdline_hash}" echo "Kernel Commandline measurement ${cmdline_hash}"
echo "" echo ""
echo "Expected PCR[8]: ${expected_pcr_8}" echo "Expected PCR[8]: ${expected_pcr_8}"
echo ""
write_output "${OUT}" write_output "${OUT}"

54
image/mkosi/measured-boot/precalculate_pcr_9.sh Executable file
View File

@ -0,0 +1,54 @@
#!/usr/bin/env bash
# Copyright (c) Edgeless Systems GmbH
#
# SPDX-License-Identifier: AGPL-3.0-only
# This script is used to precalculate the PCR[9] value for a Constellation OS image.
# PCR[9] contains the hash of the initrd and is measured by the linux kernel after loading the initrd.
# Usage: precalculate_pcr_9.sh <path to image> <path to output file>
set -euo pipefail
source "$(dirname "$0")/measure_util.sh"
get_initrd_from_uki () {
local uki="$1"
local output="$2"
objcopy -O binary --only-section=.initrd "${uki}" "${output}"
}
initrd_measure () {
local path="$1"
sha256sum "${path}" | cut -d " " -f 1
}
write_output () {
local out="$1"
cat > "${out}" <<EOF
{
"pcr9": "${expected_pcr_9}",
"initrd": "${initrd_hash}"
}
EOF
}
DIR=$(mktempdir)
trap 'cleanup "${DIR}"' EXIT
extract "$1" "/efi/EFI/Linux" "${DIR}/uki"
sudo chown -R "$USER:$USER" "${DIR}/uki"
cp ${DIR}/uki/*.efi "${DIR}/03-uki.efi"
get_initrd_from_uki "${DIR}/03-uki.efi" "${DIR}/initrd"
initrd_hash=$(initrd_measure "${DIR}/initrd")
cleanup "${DIR}"
expected_pcr_9=0000000000000000000000000000000000000000000000000000000000000000
expected_pcr_9=$(pcr_extend "${expected_pcr_9}" "${initrd_hash}" "sha256sum")
echo "Initrd measurement ${initrd_hash}"
echo ""
echo "Expected PCR[9]: ${expected_pcr_9}"
echo ""
write_output "$2"