clevis.in 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
  1. #!/bin/bash
  2. #
  3. # Copyright (c) 2017 Shawn Rose
  4. # Author: Shawn Rose <shawnandrewrose@gmail.com>
  5. #
  6. # This program is free software: you can redistribute it and/or modify
  7. # it under the terms of the GNU General Public License as published by
  8. # the Free Software Foundation, either version 3 of the License, or
  9. # (at your option) any later version.
  10. #
  11. # This program is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. # GNU General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU General Public License
  17. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  18. #
  19. PREREQ="cryptroot"
  20. prereqs()
  21. {
  22. echo "$PREREQ"
  23. }
  24. case $1 in
  25. prereqs)
  26. prereqs
  27. exit 0
  28. ;;
  29. esac
  30. . @initramfstoolsdir@/hook-functions
  31. die() {
  32. code="$1"
  33. msg="$2"
  34. echo " (ERROR): $msg" >&2
  35. exit $1
  36. }
  37. find_binary() {
  38. bin_name="$1"
  39. resolved=$(which ${bin_name})
  40. [ -z "$resolved" ] && die 1 "Unable to find ${bin_name}"
  41. echo "$resolved"
  42. }
  43. if [ -n "${FORCE_CLEVIS}" ] && [ "${FORCE_CLEVIS}" != "n" ]; then
  44. for f in /sbin/cryptsetup /sbin/dmsetup /lib/cryptsetup/askpass; do
  45. if [ ! -e "${DESTDIR}${f}" ]; then
  46. die 2 "cryptsetup utility '$f' wasn't found in the generated ramdisk image. "
  47. fi
  48. done
  49. fi
  50. copy_exec @bindir@/clevis-decrypt-tang || die 1 "@bindir@/clevis-decrypt-tang not found"
  51. copy_exec @bindir@/clevis-decrypt-sss || die 1 "@bindir@/clevis-decrypt-sss not found"
  52. copy_exec @bindir@/clevis-decrypt || die 1 "@bindir@/clevis-decrypt not found"
  53. if [ -x @bindir@/clevis-decrypt-tpm2 ]; then
  54. copy_exec @bindir@/clevis-decrypt-tpm2 || die 1 "@bindir@/clevis-decrypt-tpm2 not found"
  55. tpm2_creatprimary_bin=$(find_binary "tpm2_createprimary")
  56. tpm2_unseal_bin=$(find_binary "tpm2_unseal")
  57. tpm2_load_bin=$(find_binary "tpm2_load")
  58. copy_exec "${tpm2_creatprimary_bin}" || die 1 "Unable to copy ${tpm2_creatprimary_bin}"
  59. copy_exec "${tpm2_unseal_bin}" || die 1 "Unable to copy ${tpm2_unseal_bin}"
  60. copy_exec "${tpm2_load_bin}" || die 1 "Unable to copy ${tpm2_load_bin}"
  61. for _LIBRARY in @libdir@/libtss2-tcti-device.so*; do
  62. if [ -e "${_LIBRARY}" ]; then
  63. copy_exec "${_LIBRARY}" || die 2 "Unable to copy ${_LIBRARY}"
  64. fi
  65. done
  66. fi
  67. luksmeta_bin=$(find_binary "luksmeta")
  68. jose_bin=$(find_binary "jose")
  69. copy_exec "${luksmeta_bin}" || die 2 "Unable to copy ${luksmeta_bin}"
  70. copy_exec "${jose_bin}" || die 2 "Unable to copy ${jose_bin}"
  71. copy_exec @bindir@/clevis || die 1 "@bindir@/clevis not found"
  72. curl_bin=$(find_binary "curl")
  73. awk_bin=$(find_binary "awk")
  74. bash_bin=$(find_binary "bash")
  75. copy_exec "${curl_bin}" || die 2 "Unable to copy ${curl_bin} to initrd image"
  76. copy_exec "${awk_bin}" || die 2 "Unable to copy ${awk_bin} to initrd image"
  77. copy_exec "${bash_bin}" || die 2 "Unable to copy ${bash_bin} to initrd image"