mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
7ab23c28b8
This reverts commit ec1d5e9fb5.
While the change enabled shasum calculation on mac, it broke it
on some Linux distros.
79 lines
2.1 KiB
Bash
Executable File
79 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Copyright (c) Edgeless Systems GmbH
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
# This script is used to precalculate the PCR[12] value for a Constellation OS image.
|
|
# PCR[12] contains the hash of the kernel command line and is measured by systemd-boot.
|
|
# This value was previously measured into PCR[8].
|
|
# This script may produce wrong results for systemd-boot versions < 251.
|
|
# Usage: precalculate_pcr_12.sh <path to image> <path to output file> <csp>
|
|
|
|
set -euo pipefail
|
|
shopt -s inherit_errexit
|
|
source "$(dirname "$0")/measure_util.sh"
|
|
|
|
get_cmdline_from_uki() {
|
|
local uki="$1"
|
|
local output="$2"
|
|
objcopy -O binary --only-section=.cmdline "${uki}" "${output}"
|
|
}
|
|
|
|
cmdline_measure() {
|
|
local path="$1"
|
|
local tmp
|
|
tmp=$(mktemp)
|
|
# convert to utf-16le and add a null terminator
|
|
iconv -f utf-8 -t utf-16le "${path}" -o "${tmp}"
|
|
truncate -s +2 "${tmp}"
|
|
sha256sum "${tmp}" | cut -d " " -f 1
|
|
rm "${tmp}"
|
|
}
|
|
|
|
write_output() {
|
|
local out="$1"
|
|
cat > "${out}" << EOF
|
|
{
|
|
"measurements": {
|
|
"12": {
|
|
"expected": "${expected_pcr_12}"
|
|
}
|
|
},
|
|
"cmdline": "${cmdline}",
|
|
"cmdline-sha256": "${cmdline_hash}"
|
|
}
|
|
EOF
|
|
}
|
|
|
|
IMAGE="$1"
|
|
OUT="$2"
|
|
CSP="$3"
|
|
|
|
DIR=$(mktempdir)
|
|
trap 'cleanup "${DIR}"' EXIT
|
|
|
|
extract "${IMAGE}" "/efi/EFI/Linux" "${DIR}/uki"
|
|
sudo chown -R "${USER}:${USER}" "${DIR}/uki"
|
|
cp "${DIR}"/uki/*.efi "${DIR}/03-uki.efi"
|
|
get_cmdline_from_uki "${DIR}/03-uki.efi" "${DIR}/cmdline"
|
|
cmdline=$(cat "${DIR}/cmdline")
|
|
|
|
cmdline_hash=$(cmdline_measure "${DIR}/cmdline")
|
|
cleanup "${DIR}"
|
|
|
|
expected_pcr_12=0000000000000000000000000000000000000000000000000000000000000000
|
|
expected_pcr_12=$(pcr_extend "${expected_pcr_12}" "${cmdline_hash}" "sha256sum")
|
|
if [[ ${CSP} == "azure" ]]; then
|
|
# Azure displays the boot menu
|
|
# triggering an extra measurement of the kernel command line.
|
|
expected_pcr_12=$(pcr_extend "${expected_pcr_12}" "${cmdline_hash}" "sha256sum")
|
|
fi
|
|
|
|
echo "Kernel commandline: ${cmdline}"
|
|
echo "Kernel Commandline measurement ${cmdline_hash}"
|
|
echo ""
|
|
echo "Expected PCR[12]: ${expected_pcr_12}"
|
|
echo ""
|
|
|
|
write_output "${OUT}"
|