tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM
Replaces the shell/openssl-provider host enrolment (a35f2d6) with a static
Go + go-tpm binary, and moves BOTH host Go binaries out of the Packer VM.
fleet-enrol (files/enrol/, Go + go-tpm, no CGO):
- talks to /dev/tpmrm0 DIRECTLY via transport.FromReadWriter(os.File) — no
linuxtpm, so go-tpm is the only dep and there is NO tpm2-tools key-gen /
openssl tpm2 provider / curl in the image (removes the biggest bench risk,
the provider handle: key-ref).
- ensures the ECDSA key @0x81010001, builds the CSR (crypto.Signer over the
TPM key), POSTs CSR+context to the broker, shows the Plymouth fingerprint,
polls /status, writes the leaf cert to NV 0x01800001.
- tpmkey/ is an exported package so the TPM ceremony is tested against the
go-tpm software simulator from a SEPARATE simtest/ module (CGO stays out of
the shipped build). Transaction logic (mock broker) tested in-package.
- deps pinned by go.sum (not vendored): the binary now builds on the CI
runner, which has network — reproducible via pinned Go 1.26.4 + go.sum.
Out-of-VM build (decision): both fleet-enrol AND fleet-hostapi compile in the
CI "Build host Go binaries" step (Go 1.26.4, CGO off, -trimpath) and Packer
FILE-PROVISIONS the static binaries in. Dropped the in-VM `dnf install golang`
+ the 2d removal — the Rocky build image carries no Go toolchain / go-tpm tree.
Wiring:
- tpm-enrol.sh: now a thin GATE (empty-NV check, pre-auth DHCP on en*,
exec /usr/sbin/fleet-enrol, reboot-to-converge). module-setup.sh bundles the
binary (asserted) + reverts the tpm2-openssl/curl installs.
- diskless.pkr.hcl: file provisioners for both binaries; enrol installed to
/usr/sbin before the initramfs build + fapolicyd-trusted; lsinitrd asserts
fleet-enrol; dnf reverted to baseline (no tpm2-openssl/curl).
- gitea-main-ci.yaml: Set up Go + build both binaries + run the simulator
ceremony test, before packer validate.
TESTED here: transaction unit tests + the full TPM ceremony (key-gen -> persist
-> ECDSA sign -> CSR verify -> chunked NV write -> re-enrol) against the go-tpm
simulator. BENCH-VERIFY (real/swtpm, empty owner auth, pre-auth DHCP, Plymouth,
reboot-converge, prod HTTPS) tracked in docs/TODO.md #11.
This commit is contained in:
Audiobuzz
@@ -1,73 +1,47 @@
|
||||
#!/bin/bash
|
||||
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
|
||||
#
|
||||
# INLINE empty-NV enrolment (docs/tpm-enrolment-design.md, "inline single-UKI").
|
||||
# The production UKI auto-detects a host with NO client cert in TPM NV and, in
|
||||
# that case ONLY, branches into first-time identity enrolment:
|
||||
# 1. generate a signing key IN the TPM, persist at 0x81010001 (if absent)
|
||||
# 2. build a CSR with that key via the openssl tpm2 provider (key never leaves)
|
||||
# 3. pre-auth DHCP on the PHYSICAL NIC (plaintext L2 — same pre-auth permit the
|
||||
# firmware used to fetch the UKI; there is no macsec/identity yet)
|
||||
# 4. POST CSR + device context to the enrolment broker; show the returned
|
||||
# fingerprint on the Plymouth splash for an admin to cross-check + approve
|
||||
# 5. poll until APPROVED, write the issued cert (DER) to NV 0x01800001
|
||||
# 6. REBOOT — the next boot finds the cert present and runs the normal secure
|
||||
# path (this hook exits 0 immediately when a cert is already present).
|
||||
# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
|
||||
# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
|
||||
# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
|
||||
# which generates the key/CSR, talks to the broker, shows the Plymouth
|
||||
# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS
|
||||
# into the normal secure path. It is a no-op when a cert is already present
|
||||
# (normal boot — dot1x-macsec-up.sh reads NV) or under rd.dot1x=0 (test path).
|
||||
#
|
||||
# Empty-NV and the normal secure path are MUTUALLY EXCLUSIVE (a host with no cert
|
||||
# cannot do 802.1X→MACsec→NVMe at all), so this never interleaves with — or
|
||||
# reorders — the load-bearing secure boot sequence (invariant #2). Enrolment is
|
||||
# gated to the secure build (skipped under rd.dot1x=0) because the open/test path
|
||||
# has no trustworthy device identity to enrol (design open-question).
|
||||
# The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
|
||||
# owns only the boot-environment concerns: the empty-NV gate, the pre-auth DHCP
|
||||
# (which the secure-mode nm-unmanaged.sh otherwise withholds from en*), and the
|
||||
# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so
|
||||
# this never reorders the load-bearing boot sequence (invariant #2).
|
||||
|
||||
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
|
||||
|
||||
# One enrol attempt per boot. The stamp is set only once we COMMIT to enrolling
|
||||
# (NV confirmed empty) — not on entry — so the "cert present"/skip paths stay
|
||||
# re-runnable across repeated settled invocations, matching dot1x-macsec-up.sh
|
||||
# (which likewise stamps only on a terminal decision).
|
||||
STAMP=/run/dot1x/.enrol-done
|
||||
[ -e "$STAMP" ] && exit 0
|
||||
mkdir -p /run/dot1x
|
||||
|
||||
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
|
||||
|
||||
ply() { plymouth update --status="$1" 2>/dev/null || true; }
|
||||
plymsg() { plymouth message --text="$1" 2>/dev/null || true; }
|
||||
|
||||
# --- skip conditions --------------------------------------------------------
|
||||
# Test path: no real identity to enrol; leave the open-port boot untouched.
|
||||
if [ "$(getarg rd.dot1x=)" = "0" ]; then
|
||||
exit 0
|
||||
fi
|
||||
# Explicit opt-out (e.g. a provisioning-UKI variant handling enrol elsewhere).
|
||||
[ "$(getarg rd.dot1x=)" = "0" ] && exit 0 # test path: no identity to enrol
|
||||
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
|
||||
info "tpm-enrol: disabled by rd.fleet.enrol=0"
|
||||
exit 0
|
||||
info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
|
||||
fi
|
||||
|
||||
# --- knobs (override on the kernel cmdline) ---------------------------------
|
||||
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
|
||||
HANDLE=$(getarg rd.fleet.enrol.handle=); [ -n "$HANDLE" ] || HANDLE=0x81010001
|
||||
CN=$(getarg rd.fleet.enrol.cn=); [ -n "$CN" ] || CN=fleet-host
|
||||
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
|
||||
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
|
||||
# Human-approval wait. Generous but bounded: an abandoned enrol must not hang the
|
||||
# box forever (it drops to emergency, where the missing cert is diagnosable).
|
||||
WAITTMO=$(getarg rd.fleet.enrol.timeout=); [ -n "$WAITTMO" ] || WAITTMO=1800
|
||||
|
||||
# Wait briefly for the TPM resource-manager device so an early settle (before the
|
||||
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
|
||||
i=0
|
||||
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
|
||||
if [ ! -e /dev/tpmrm0 ]; then
|
||||
warn "tpm-enrol: /dev/tpmrm0 absent — no TPM; leaving to the secure path"
|
||||
exit 0
|
||||
fi
|
||||
[ -e /dev/tpmrm0 ] || { warn "tpm-enrol: no TPM (/dev/tpmrm0) — leaving to the secure path"; exit 0; }
|
||||
|
||||
# --- 0. already enrolled? then this is a normal boot — get out of the way ----
|
||||
# A present, non-empty NV cert means identity exists; dot1x-macsec-up.sh (next
|
||||
# hook) reads it and runs the secure path. Only an EMPTY/undefined NV enrols.
|
||||
# --- already enrolled? then this is a normal boot — do NOT touch the network -
|
||||
# (Bringing up en* here would fight the secure path, which needs it UNMANAGED for
|
||||
# wpa_supplicant. So gate on NV BEFORE any network action.)
|
||||
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
|
||||
&& [ -s /run/dot1x/nvprobe.der ]; then
|
||||
info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
|
||||
@@ -75,11 +49,9 @@ if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Committed to enrolling — set the once-per-boot lock now.
|
||||
# Committed to enrolling — one attempt per boot.
|
||||
: > "$STAMP"
|
||||
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
|
||||
ply enrol-active
|
||||
plymsg "TPM enrolment: contacting fleet…"
|
||||
|
||||
# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
|
||||
NIC=$(getarg rd.dot1x.if=)
|
||||
@@ -92,31 +64,7 @@ if [ -z "$NIC" ]; then
|
||||
fi
|
||||
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
|
||||
|
||||
# --- 1. persistent TPM signing key (create only if absent) ------------------
|
||||
if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
||||
info "tpm-enrol: creating TPM signing key, persisting at $HANDLE"
|
||||
if ! { tpm2_createprimary -C o -G ecc -g sha256 -c /run/dot1x/primary.ctx >/dev/null \
|
||||
&& tpm2_create -C /run/dot1x/primary.ctx -G ecc256:ecdsa-sha256 \
|
||||
-u /run/dot1x/key.pub -r /run/dot1x/key.priv >/dev/null \
|
||||
&& tpm2_load -C /run/dot1x/primary.ctx -u /run/dot1x/key.pub \
|
||||
-r /run/dot1x/key.priv -c /run/dot1x/key.ctx >/dev/null \
|
||||
&& tpm2_evictcontrol -C o -c /run/dot1x/key.ctx "$HANDLE" >/dev/null; }; then
|
||||
warn "tpm-enrol: failed to create/persist TPM key at $HANDLE"
|
||||
plymsg "TPM enrolment FAILED (key generation)"; exit 1
|
||||
fi
|
||||
else
|
||||
info "tpm-enrol: reusing existing persistent key at $HANDLE"
|
||||
fi
|
||||
|
||||
# --- 2. CSR with the TPM key (private key never leaves the TPM) -------------
|
||||
if ! openssl req -new -provider tpm2 -provider default \
|
||||
-key "handle:$HANDLE" -subj "/O=fleet/CN=$CN" \
|
||||
-out /run/dot1x/enrol.csr 2>/run/dot1x/enrol.err; then
|
||||
warn "tpm-enrol: CSR generation failed (openssl tpm2 provider?): $(cat /run/dot1x/enrol.err 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (CSR / tpm2 provider)"; exit 1
|
||||
fi
|
||||
|
||||
# --- 3. pre-auth network on the PHYSICAL NIC --------------------------------
|
||||
# --- pre-auth network on the PHYSICAL NIC -----------------------------------
|
||||
# Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
|
||||
# but there is no supplicant yet — so explicitly hand the NIC to NM for a
|
||||
# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
|
||||
@@ -131,100 +79,28 @@ while [ "$i" -lt "$NETTMO" ]; do
|
||||
done
|
||||
if [ "$i" -ge "$NETTMO" ]; then
|
||||
warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
|
||||
plymsg "TPM enrolment FAILED (no network)"; exit 1
|
||||
plymouth message --text="TPM enrolment FAILED (no network)" 2>/dev/null || true
|
||||
exit 1
|
||||
fi
|
||||
info "tpm-enrol: pre-auth lease on $NIC; reaching broker at $ENROL_URL"
|
||||
info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)"
|
||||
|
||||
# --- device context (advisory; helps the admin recognise the device) --------
|
||||
MAC=$(cat "/sys/class/net/$NIC/address" 2>/dev/null)
|
||||
DMI_UUID=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null)
|
||||
DMI_SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null)
|
||||
EK_HASH=""
|
||||
if tpm2_createek -G ecc -u /run/dot1x/ek.pub -c /run/dot1x/ek.ctx >/dev/null 2>&1; then
|
||||
EK_HASH=$(sha256sum /run/dot1x/ek.pub 2>/dev/null | cut -d' ' -f1)
|
||||
tpm2_flushcontext /run/dot1x/ek.ctx >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
# --- 4. POST the CSR + context ----------------------------------------------
|
||||
# JSON body, no jq in the initramfs: escape the PEM (newlines -> \n, quotes) with
|
||||
# awk and interpolate. curl uses the fleet CA for an https endpoint.
|
||||
CSR_ESC=$(awk 'BEGIN{ORS=""}{gsub(/\\/,"\\\\");gsub(/"/,"\\\"");printf "%s\\n",$0}' /run/dot1x/enrol.csr)
|
||||
printf '{"csr":"%s","context":{"mac":"%s","dmi_uuid":"%s","dmi_serial":"%s","ek_hash":"%s"}}' \
|
||||
"$CSR_ESC" "$MAC" "$DMI_UUID" "$DMI_SERIAL" "$EK_HASH" > /run/dot1x/enrol-req.json
|
||||
|
||||
CURL_TLS=()
|
||||
case "$ENROL_URL" in https:*) CURL_TLS=(--cacert /etc/dot1x/radius-ca.pem) ;; esac
|
||||
|
||||
if ! curl -fsS "${CURL_TLS[@]}" -X POST "$ENROL_URL/request" \
|
||||
-H 'Content-Type: application/json' --data @/run/dot1x/enrol-req.json \
|
||||
-o /run/dot1x/enrol-resp.json 2>/run/dot1x/enrol.err; then
|
||||
warn "tpm-enrol: broker /request failed: $(cat /run/dot1x/enrol.err 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (broker unreachable)"; exit 1
|
||||
fi
|
||||
ENROL_ID=$(sed -n 's/.*"enrol_id":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
|
||||
FP=$(sed -n 's/.*"fingerprint":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
|
||||
if [ -z "$ENROL_ID" ]; then
|
||||
warn "tpm-enrol: broker did not return an enrol_id: $(cat /run/dot1x/enrol-resp.json 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (bad broker response)"; exit 1
|
||||
fi
|
||||
info "tpm-enrol: enrol_id=$ENROL_ID fingerprint=$FP"
|
||||
|
||||
# --- 5. show the fingerprint + poll for approval ----------------------------
|
||||
# The fingerprint is PUBLIC (derived from the CSR public key) — displaying it is
|
||||
# allowed under invariant #1 (state, not a secret). An admin cross-checks it
|
||||
# against the broker's pending queue and approves.
|
||||
ply enrol-wait
|
||||
plymsg "APPROVE THIS DEVICE — code: $FP"
|
||||
|
||||
i=0
|
||||
while [ "$i" -lt "$WAITTMO" ]; do
|
||||
if curl -fsS "${CURL_TLS[@]}" "$ENROL_URL/status/$ENROL_ID" \
|
||||
-o /run/dot1x/enrol-status.json 2>/dev/null; then
|
||||
STATE=$(sed -n 's/.*"state":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-status.json)
|
||||
case "$STATE" in
|
||||
approved) break ;;
|
||||
denied) warn "tpm-enrol: enrolment DENIED by admin"
|
||||
plymsg "TPM enrolment DENIED"; exit 1 ;;
|
||||
expired) warn "tpm-enrol: enrolment request expired"
|
||||
plymsg "TPM enrolment EXPIRED — reboot to retry"; exit 1 ;;
|
||||
esac
|
||||
fi
|
||||
sleep 5; i=$((i + 5))
|
||||
done
|
||||
if [ "${STATE:-}" != "approved" ]; then
|
||||
warn "tpm-enrol: no approval within ${WAITTMO}s"
|
||||
plymsg "TPM enrolment TIMED OUT"; exit 1
|
||||
fi
|
||||
|
||||
# --- 6. write the issued cert to NV + reboot into the secure path -----------
|
||||
ply enrol-done
|
||||
plymsg "Enrolment approved — installing identity"
|
||||
# Extract the cert PEM (leaf first if a chain was returned), unescape \n.
|
||||
CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)","hostnqn":.*/\1/p' /run/dot1x/enrol-status.json)
|
||||
[ -n "$CERT_ESC" ] || CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)".*/\1/p' /run/dot1x/enrol-status.json)
|
||||
printf '%b' "$CERT_ESC" > /run/dot1x/enrol-cert.pem
|
||||
# Keep only the FIRST certificate (the leaf) for NV — the hostnqn/EAP identity.
|
||||
awk 'BEGIN{n=0} /BEGIN CERTIFICATE/{n++} n==1{print} /END CERTIFICATE/{if(n==1)exit}' \
|
||||
/run/dot1x/enrol-cert.pem > /run/dot1x/enrol-leaf.pem
|
||||
if ! openssl x509 -in /run/dot1x/enrol-leaf.pem -outform DER \
|
||||
-out /run/dot1x/enrol-leaf.der 2>/dev/null; then
|
||||
warn "tpm-enrol: issued cert is not valid PEM"; plymsg "TPM enrolment FAILED (bad cert)"; exit 1
|
||||
fi
|
||||
SZ=$(wc -c < /run/dot1x/enrol-leaf.der)
|
||||
info "tpm-enrol: writing ${SZ}-byte cert to NV $NVINDEX"
|
||||
tpm2_nvundefine "$NVINDEX" -C o >/dev/null 2>&1 || true
|
||||
if ! { tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" \
|
||||
-a 'ownerread|ownerwrite|authread|authwrite' >/dev/null \
|
||||
&& tpm2_nvwrite "$NVINDEX" -C o -i /run/dot1x/enrol-leaf.der >/dev/null; }; then
|
||||
warn "tpm-enrol: failed to write cert to NV $NVINDEX (TPM owner auth?)"
|
||||
plymsg "TPM enrolment FAILED (NV write)"; exit 1
|
||||
fi
|
||||
|
||||
SERIAL=$(openssl x509 -in /run/dot1x/enrol-leaf.pem -serial -noout 2>/dev/null | cut -d= -f2 | tr 'A-F' 'a-f')
|
||||
info "tpm-enrol: ENROLLED (cert serial $SERIAL). Rebooting into the secure path."
|
||||
plymsg "Enrolment complete — rebooting"
|
||||
sleep 2
|
||||
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
|
||||
{ echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
|
||||
# Do not fall through to the secure path in this (pre-reboot) boot.
|
||||
exit 0
|
||||
# --- hand off to the enrolment binary ---------------------------------------
|
||||
# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
|
||||
# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
|
||||
# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
|
||||
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX"
|
||||
rc=$?
|
||||
case "$rc" in
|
||||
0)
|
||||
info "tpm-enrol: enrolled — rebooting into the secure path"
|
||||
sleep 2
|
||||
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
|
||||
{ echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
|
||||
exit 0 ;;
|
||||
10)
|
||||
info "tpm-enrol: fleet-enrol reports cert already present — normal boot"
|
||||
exit 0 ;;
|
||||
*)
|
||||
warn "tpm-enrol: fleet-enrol failed (rc=$rc) — reboot to retry"
|
||||
exit 1 ;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user