diff options
Diffstat (limited to 'test/units/TEST-86-MULTI-PROFILE-UKI.sh')
| -rwxr-xr-x | test/units/TEST-86-MULTI-PROFILE-UKI.sh | 65 |
1 files changed, 25 insertions, 40 deletions
diff --git a/test/units/TEST-86-MULTI-PROFILE-UKI.sh b/test/units/TEST-86-MULTI-PROFILE-UKI.sh index 042cc59419..1af0788d5e 100755 --- a/test/units/TEST-86-MULTI-PROFILE-UKI.sh +++ b/test/units/TEST-86-MULTI-PROFILE-UKI.sh @@ -25,57 +25,42 @@ fi echo "CURRENT EVENT LOG + PCRS:" /usr/lib/systemd/systemd-pcrlock -if test ! -f /run/systemd/stub/profile; then - openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out /root/pcrsign.private.pem - openssl rsa -pubout -in /root/pcrsign.private.pem -out /root/pcrsign.public.pem +test -f /run/systemd/stub/profile - ukify build --extend="$CURRENT_UKI" --output=/tmp/extended0.efi --profile='ID=profile0 -TITLE="Profile Zero"' --measure-base="$CURRENT_UKI" --pcr-private-key=/root/pcrsign.private.pem --pcr-public-key=/root/pcrsign.public.pem --pcr-banks=sha256,sha384,sha512 +# shellcheck source=/dev/null +. /run/systemd/stub/profile - ukify build --extend=/tmp/extended0.efi --output=/tmp/extended1.efi --profile='ID=profile1 -TITLE="Profile One"' --measure-base=/tmp/extended0.efi --cmdline="testprofile1=1 $(cat /proc/cmdline)" --pcr-private-key=/root/pcrsign.private.pem --pcr-public-key=/root/pcrsign.public.pem --pcr-banks=sha256,sha384,sha512 - - ukify build --extend=/tmp/extended1.efi --output=/tmp/extended2.efi --profile='ID=profile2 -TITLE="Profile Two"' --measure-base=/tmp/extended1.efi --cmdline="testprofile2=1 $(cat /proc/cmdline)" --pcr-private-key=/root/pcrsign.private.pem --pcr-public-key=/root/pcrsign.public.pem --pcr-banks=sha256,sha384,sha512 - - echo "EXTENDED UKI:" - ukify inspect /tmp/extended2.efi - rm /tmp/extended0.efi /tmp/extended1.efi - mv /tmp/extended2.efi "$CURRENT_UKI" +if [[ "$ID" == "main" ]]; then + if [[ -f /root/encrypted.raw ]]; then + exit 1 + fi - # Prepare a disk image, locked to the PCR measurements of the UKI we just generated + # Prepare a disk image, locked to the PCR measurements of the current UKI truncate -s 32M /root/encrypted.raw echo -n "geheim" >/root/encrypted.secret cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom /root/encrypted.raw --key-file=/root/encrypted.secret - systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs= --tpm2-public-key=/root/pcrsign.public.pem --unlock-key-file=/root/encrypted.secret /root/encrypted.raw + systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs= --unlock-key-file=/root/encrypted.secret /root/encrypted.raw rm -f /root/encrypted.secret +fi + +# Validate that with the current profile we can fulfill the PCR 11 policy +systemd-cryptsetup attach multiprof /root/encrypted.raw - tpm2-device=auto,headless=1 +systemd-cryptsetup detach multiprof +if [[ "$ID" == "main" ]]; then + bootctl set-default "$(basename "$CURRENT_UKI")@profile1" reboot exit 0 +elif [[ "$ID" == "profile1" ]]; then + grep testprofile1=1 /proc/cmdline + bootctl set-default "$(basename "$CURRENT_UKI")@profile2" + reboot + exit 0 +elif [[ "$ID" == "profile2" ]]; then + grep testprofile2=1 /proc/cmdline + rm /root/encrypted.raw else - # shellcheck source=/dev/null - . /run/systemd/stub/profile - - # Validate that with the current profile we can fulfill the PCR 11 policy - systemd-cryptsetup attach multiprof /root/encrypted.raw - tpm2-device=auto,headless=1 - systemd-cryptsetup detach multiprof - - if [ "$ID" = "profile0" ]; then - grep -v testprofile /proc/cmdline - echo "default $(basename "$CURRENT_UKI")@profile1" >"$(bootctl -p)/loader/loader.conf" - reboot - exit 0 - elif [ "$ID" = "profile1" ]; then - grep testprofile1=1 /proc/cmdline - echo "default $(basename "$CURRENT_UKI")@profile2" >"$(bootctl -p)/loader/loader.conf" - reboot - exit 0 - elif [ "$ID" = "profile2" ]; then - grep testprofile2=1 /proc/cmdline - rm /root/encrypted.raw - else - exit 1 - fi + exit 1 fi touch /testok |