123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156 |
- #!/bin/bash -e
- # vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
- #
- # Copyright (c) 2017 Red Hat, Inc.
- # Author: Javier Martinez Canillas <javierm@redhat.com>
- #
- # This program is free software: you can redistribute it and/or modify
- # it under the terms of the GNU General Public License as published by
- # the Free Software Foundation, either version 3 of the License, or
- # (at your option) any later version.
- #
- # This program is distributed in the hope that it will be useful,
- # but WITHOUT ANY WARRANTY; without even the implied warranty of
- # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- # GNU General Public License for more details.
- #
- # You should have received a copy of the GNU General Public License
- # along with this program. If not, see <http://www.gnu.org/licenses/>.
- #
- SUMMARY="Encrypts using a TPM2.0 chip binding policy"
- # The owner hierarchy is the one that should be used by the Operating System.
- auth="o"
- # Algorithm type must be keyedhash for object with user provided sensitive data.
- alg_create_key="keyedhash"
- # Attributes for the created TPM2 object with the JWK as sensitive data.
- obj_attr="fixedtpm|fixedparent|sensitivedataorigin|noda|adminwithpolicy"
- function on_exit() {
- if ! rm -rf $TMP; then
- echo "Delete temporary files failed!" >&2
- exit 1
- fi
- }
- if [ "$1" == "--summary" ]; then
- echo "$SUMMARY"
- exit 0
- fi
- if [ -t 0 ]; then
- echo >&2
- echo "Usage: clevis encrypt tpm2 CONFIG < PLAINTEXT > JWE" >&2
- echo >&2
- echo $SUMMARY >&2
- echo >&2
- echo "This command uses the following configuration properties:" >&2
- echo >&2
- echo " hash: <string> Hash algorithm used in the computation of the object name (default: sha256)" >&2
- echo >&2
- echo " key: <string> Algorithm type for the generated key (default: ecc)" >&2
- echo >&2
- echo " pcr_bank: <string> PCR algorithm bank to use for policy (default: sha1)" >&2
- echo >&2
- echo " pcr_ids: <string> PCR list used for policy. If not present, no policy is used" >&2
- echo >&2
- echo " pcr_digest: <string> Binary PCR hashes encoded in base64. If not present, the hash values are looked up" >&2
- echo >&2
- exit 1
- fi
- export TPM2TOOLS_TCTI_NAME=device
- export TPM2TOOLS_DEVICE_FILE=`ls /dev/tpmrm? 2>/dev/null`
- if [ -z "${TPM2TOOLS_DEVICE_FILE[0]}" ]; then
- echo "A TPM2 device with the in-kernel resource manager is needed!" >&2
- exit 1
- fi
- if ! [[ -r "${TPM2TOOLS_DEVICE_FILE[0]}" && -w "${TPM2TOOLS_DEVICE_FILE[0]}" ]]; then
- echo "The ${TPM2TOOLS_DEVICE_FILE[0]} device must be readable and writable!" >&2
- exit 1
- fi
- if ! cfg=`jose fmt -j "$1" -Oo- 2>/dev/null`; then
- echo "Configuration is malformed!" >&2
- exit 1
- fi
- hash=`jose fmt -j- -Og hash -u- <<< "$cfg"` || hash="sha256"
- key=`jose fmt -j- -Og key -u- <<< "$cfg"` || key="ecc"
- pcr_bank=`jose fmt -j- -Og pcr_hash -u- <<< "$cfg"` || pcr_bank="sha1"
- pcr_ids=`jose fmt -j- -Og pcr_ids -u- <<< "$cfg"` || true
- pcr_digest=`jose fmt -j- -Og pcr_digest -u- <<< "$cfg"` || true
- if ! jwk=`jose jwk gen -i '{"alg":"A256GCM"}'`; then
- echo "Generating a jwk failed!" >&2
- exit 1
- fi
- if ! TMP=`mktemp -d`; then
- echo "Creating a temporary dir for TPM files failed!" >&2
- exit 1
- fi
- trap 'on_exit' EXIT
- if ! tpm2_createprimary -Q -H "$auth" -g "$hash" -G "$key" -C $TMP/primary.context; then
- echo "Creating TPM2 primary key failed!" >&2
- exit 1
- fi
- if [ -n "$pcr_ids" ]; then
- if [ -z "$pcr_digest" ]; then
- if ! tpm2_pcrlist -Q -L "$pcr_bank":"$pcr_ids" -o $TMP/pcr.digest; then
- echo "Creating PCR hashes file failed!" >&2
- exit 1
- fi
- else
- if ! jose b64 dec -i- -O "$TMP"/pcr.digest <<< "$pcr_digest"; then
- echo "Error decoding PCR digest!" >&2
- exit 1
- fi
- fi
- if ! tpm2_createpolicy -Q -P -L "$pcr_bank":"$pcr_ids" -F $TMP/pcr.digest -f $TMP/pcr.policy; then
- echo "create policy fail, please check the environment or parameters!"
- exit 1
- fi
- policy_options="-L $TMP/pcr.policy"
- fi
- if ! tpm2_create -Q -g "$hash" -G "$alg_create_key" -c $TMP/primary.context -u $TMP/jwk.pub \
- -r $TMP/jwk.priv -A "$obj_attr" $policy_options -I- <<< "$jwk"; then
- echo "Creating TPM2 object for jwk failed!" >&2
- exit 1
- fi
- if ! jwk_pub=`jose b64 enc -I $TMP/jwk.pub`; then
- echo "Encoding jwk.pub in Base64 failed!" >&2
- exit 1
- fi
- if ! jwk_priv=`jose b64 enc -I $TMP/jwk.priv`; then
- echo "Encoding jwk.priv in Base64 failed!" >&2
- exit 1
- fi
- jwe='{"protected":{"clevis":{"pin":"tpm2","tpm2":{}}}}'
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$hash" -s hash -UUUUo-`
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$key" -s key -UUUUo-`
- if [ -n "$pcr_ids" ]; then
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$pcr_bank" -s pcr_bank -UUUUo-`
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$pcr_ids" -s pcr_ids -UUUUo-`
- fi
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_pub" -s jwk_pub -UUUUo-`
- jwe=`jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_priv" -s jwk_priv -UUUUo-`
- jose jwe enc -i- -k- -I- -c < <(echo -n "$jwe$jwk"; cat)
|