tpm-enrol: inline empty-NV first-boot enrolment (host side, TODO #11)
Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.
New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
- no-op when a cert is already present in NV 0x01800001 (normal boot) or
under rd.dot1x=0 (test path has no trustworthy identity to enrol);
- on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
NV, and reboot to converge.
- Empty-NV and the secure path are mutually exclusive, so this never reorders
the load-bearing boot sequence (invariant #2).
Wiring:
- module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
alone can't sign with a handle: key); install the hook.
- diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
- extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
- fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
message line (public — states only, invariant #1).
Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).
This commit is contained in:
Audiobuzz
@@ -0,0 +1,230 @@
|
||||
#!/bin/bash
|
||||
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
|
||||
#
|
||||
# INLINE empty-NV enrolment (docs/tpm-enrolment-design.md, "inline single-UKI").
|
||||
# The production UKI auto-detects a host with NO client cert in TPM NV and, in
|
||||
# that case ONLY, branches into first-time identity enrolment:
|
||||
# 1. generate a signing key IN the TPM, persist at 0x81010001 (if absent)
|
||||
# 2. build a CSR with that key via the openssl tpm2 provider (key never leaves)
|
||||
# 3. pre-auth DHCP on the PHYSICAL NIC (plaintext L2 — same pre-auth permit the
|
||||
# firmware used to fetch the UKI; there is no macsec/identity yet)
|
||||
# 4. POST CSR + device context to the enrolment broker; show the returned
|
||||
# fingerprint on the Plymouth splash for an admin to cross-check + approve
|
||||
# 5. poll until APPROVED, write the issued cert (DER) to NV 0x01800001
|
||||
# 6. REBOOT — the next boot finds the cert present and runs the normal secure
|
||||
# path (this hook exits 0 immediately when a cert is already present).
|
||||
#
|
||||
# Empty-NV and the normal secure path are MUTUALLY EXCLUSIVE (a host with no cert
|
||||
# cannot do 802.1X→MACsec→NVMe at all), so this never interleaves with — or
|
||||
# reorders — the load-bearing secure boot sequence (invariant #2). Enrolment is
|
||||
# gated to the secure build (skipped under rd.dot1x=0) because the open/test path
|
||||
# has no trustworthy device identity to enrol (design open-question).
|
||||
|
||||
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
|
||||
|
||||
# One enrol attempt per boot. The stamp is set only once we COMMIT to enrolling
|
||||
# (NV confirmed empty) — not on entry — so the "cert present"/skip paths stay
|
||||
# re-runnable across repeated settled invocations, matching dot1x-macsec-up.sh
|
||||
# (which likewise stamps only on a terminal decision).
|
||||
STAMP=/run/dot1x/.enrol-done
|
||||
[ -e "$STAMP" ] && exit 0
|
||||
mkdir -p /run/dot1x
|
||||
|
||||
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
|
||||
|
||||
ply() { plymouth update --status="$1" 2>/dev/null || true; }
|
||||
plymsg() { plymouth message --text="$1" 2>/dev/null || true; }
|
||||
|
||||
# --- skip conditions --------------------------------------------------------
|
||||
# Test path: no real identity to enrol; leave the open-port boot untouched.
|
||||
if [ "$(getarg rd.dot1x=)" = "0" ]; then
|
||||
exit 0
|
||||
fi
|
||||
# Explicit opt-out (e.g. a provisioning-UKI variant handling enrol elsewhere).
|
||||
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
|
||||
info "tpm-enrol: disabled by rd.fleet.enrol=0"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# --- knobs (override on the kernel cmdline) ---------------------------------
|
||||
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
|
||||
HANDLE=$(getarg rd.fleet.enrol.handle=); [ -n "$HANDLE" ] || HANDLE=0x81010001
|
||||
CN=$(getarg rd.fleet.enrol.cn=); [ -n "$CN" ] || CN=fleet-host
|
||||
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
|
||||
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
|
||||
# Human-approval wait. Generous but bounded: an abandoned enrol must not hang the
|
||||
# box forever (it drops to emergency, where the missing cert is diagnosable).
|
||||
WAITTMO=$(getarg rd.fleet.enrol.timeout=); [ -n "$WAITTMO" ] || WAITTMO=1800
|
||||
|
||||
# Wait briefly for the TPM resource-manager device so an early settle (before the
|
||||
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
|
||||
i=0
|
||||
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
|
||||
if [ ! -e /dev/tpmrm0 ]; then
|
||||
warn "tpm-enrol: /dev/tpmrm0 absent — no TPM; leaving to the secure path"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# --- 0. already enrolled? then this is a normal boot — get out of the way ----
|
||||
# A present, non-empty NV cert means identity exists; dot1x-macsec-up.sh (next
|
||||
# hook) reads it and runs the secure path. Only an EMPTY/undefined NV enrols.
|
||||
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
|
||||
&& [ -s /run/dot1x/nvprobe.der ]; then
|
||||
info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
|
||||
rm -f /run/dot1x/nvprobe.der
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Committed to enrolling — set the once-per-boot lock now.
|
||||
: > "$STAMP"
|
||||
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
|
||||
ply enrol-active
|
||||
plymsg "TPM enrolment: contacting fleet…"
|
||||
|
||||
# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
|
||||
NIC=$(getarg rd.dot1x.if=)
|
||||
if [ -z "$NIC" ]; then
|
||||
for _dev in /sys/class/net/*; do
|
||||
_name=${_dev##*/}
|
||||
case "$_name" in lo|macsec*) continue ;; esac
|
||||
NIC=$_name; break
|
||||
done
|
||||
fi
|
||||
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
|
||||
|
||||
# --- 1. persistent TPM signing key (create only if absent) ------------------
|
||||
if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
||||
info "tpm-enrol: creating TPM signing key, persisting at $HANDLE"
|
||||
if ! { tpm2_createprimary -C o -G ecc -g sha256 -c /run/dot1x/primary.ctx >/dev/null \
|
||||
&& tpm2_create -C /run/dot1x/primary.ctx -G ecc256:ecdsa-sha256 \
|
||||
-u /run/dot1x/key.pub -r /run/dot1x/key.priv >/dev/null \
|
||||
&& tpm2_load -C /run/dot1x/primary.ctx -u /run/dot1x/key.pub \
|
||||
-r /run/dot1x/key.priv -c /run/dot1x/key.ctx >/dev/null \
|
||||
&& tpm2_evictcontrol -C o -c /run/dot1x/key.ctx "$HANDLE" >/dev/null; }; then
|
||||
warn "tpm-enrol: failed to create/persist TPM key at $HANDLE"
|
||||
plymsg "TPM enrolment FAILED (key generation)"; exit 1
|
||||
fi
|
||||
else
|
||||
info "tpm-enrol: reusing existing persistent key at $HANDLE"
|
||||
fi
|
||||
|
||||
# --- 2. CSR with the TPM key (private key never leaves the TPM) -------------
|
||||
if ! openssl req -new -provider tpm2 -provider default \
|
||||
-key "handle:$HANDLE" -subj "/O=fleet/CN=$CN" \
|
||||
-out /run/dot1x/enrol.csr 2>/run/dot1x/enrol.err; then
|
||||
warn "tpm-enrol: CSR generation failed (openssl tpm2 provider?): $(cat /run/dot1x/enrol.err 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (CSR / tpm2 provider)"; exit 1
|
||||
fi
|
||||
|
||||
# --- 3. pre-auth network on the PHYSICAL NIC --------------------------------
|
||||
# Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
|
||||
# but there is no supplicant yet — so explicitly hand the NIC to NM for a
|
||||
# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
|
||||
# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
|
||||
ip link set "$NIC" up 2>/dev/null || true
|
||||
nmcli device set "$NIC" managed yes 2>/dev/null || true
|
||||
nmcli -w 0 device connect "$NIC" 2>/dev/null || true
|
||||
i=0
|
||||
while [ "$i" -lt "$NETTMO" ]; do
|
||||
ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
|
||||
sleep 1; i=$((i + 1))
|
||||
done
|
||||
if [ "$i" -ge "$NETTMO" ]; then
|
||||
warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
|
||||
plymsg "TPM enrolment FAILED (no network)"; exit 1
|
||||
fi
|
||||
info "tpm-enrol: pre-auth lease on $NIC; reaching broker at $ENROL_URL"
|
||||
|
||||
# --- device context (advisory; helps the admin recognise the device) --------
|
||||
MAC=$(cat "/sys/class/net/$NIC/address" 2>/dev/null)
|
||||
DMI_UUID=$(cat /sys/class/dmi/id/product_uuid 2>/dev/null)
|
||||
DMI_SERIAL=$(cat /sys/class/dmi/id/product_serial 2>/dev/null)
|
||||
EK_HASH=""
|
||||
if tpm2_createek -G ecc -u /run/dot1x/ek.pub -c /run/dot1x/ek.ctx >/dev/null 2>&1; then
|
||||
EK_HASH=$(sha256sum /run/dot1x/ek.pub 2>/dev/null | cut -d' ' -f1)
|
||||
tpm2_flushcontext /run/dot1x/ek.ctx >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
# --- 4. POST the CSR + context ----------------------------------------------
|
||||
# JSON body, no jq in the initramfs: escape the PEM (newlines -> \n, quotes) with
|
||||
# awk and interpolate. curl uses the fleet CA for an https endpoint.
|
||||
CSR_ESC=$(awk 'BEGIN{ORS=""}{gsub(/\\/,"\\\\");gsub(/"/,"\\\"");printf "%s\\n",$0}' /run/dot1x/enrol.csr)
|
||||
printf '{"csr":"%s","context":{"mac":"%s","dmi_uuid":"%s","dmi_serial":"%s","ek_hash":"%s"}}' \
|
||||
"$CSR_ESC" "$MAC" "$DMI_UUID" "$DMI_SERIAL" "$EK_HASH" > /run/dot1x/enrol-req.json
|
||||
|
||||
CURL_TLS=()
|
||||
case "$ENROL_URL" in https:*) CURL_TLS=(--cacert /etc/dot1x/radius-ca.pem) ;; esac
|
||||
|
||||
if ! curl -fsS "${CURL_TLS[@]}" -X POST "$ENROL_URL/request" \
|
||||
-H 'Content-Type: application/json' --data @/run/dot1x/enrol-req.json \
|
||||
-o /run/dot1x/enrol-resp.json 2>/run/dot1x/enrol.err; then
|
||||
warn "tpm-enrol: broker /request failed: $(cat /run/dot1x/enrol.err 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (broker unreachable)"; exit 1
|
||||
fi
|
||||
ENROL_ID=$(sed -n 's/.*"enrol_id":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
|
||||
FP=$(sed -n 's/.*"fingerprint":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-resp.json)
|
||||
if [ -z "$ENROL_ID" ]; then
|
||||
warn "tpm-enrol: broker did not return an enrol_id: $(cat /run/dot1x/enrol-resp.json 2>/dev/null)"
|
||||
plymsg "TPM enrolment FAILED (bad broker response)"; exit 1
|
||||
fi
|
||||
info "tpm-enrol: enrol_id=$ENROL_ID fingerprint=$FP"
|
||||
|
||||
# --- 5. show the fingerprint + poll for approval ----------------------------
|
||||
# The fingerprint is PUBLIC (derived from the CSR public key) — displaying it is
|
||||
# allowed under invariant #1 (state, not a secret). An admin cross-checks it
|
||||
# against the broker's pending queue and approves.
|
||||
ply enrol-wait
|
||||
plymsg "APPROVE THIS DEVICE — code: $FP"
|
||||
|
||||
i=0
|
||||
while [ "$i" -lt "$WAITTMO" ]; do
|
||||
if curl -fsS "${CURL_TLS[@]}" "$ENROL_URL/status/$ENROL_ID" \
|
||||
-o /run/dot1x/enrol-status.json 2>/dev/null; then
|
||||
STATE=$(sed -n 's/.*"state":"\([^"]*\)".*/\1/p' /run/dot1x/enrol-status.json)
|
||||
case "$STATE" in
|
||||
approved) break ;;
|
||||
denied) warn "tpm-enrol: enrolment DENIED by admin"
|
||||
plymsg "TPM enrolment DENIED"; exit 1 ;;
|
||||
expired) warn "tpm-enrol: enrolment request expired"
|
||||
plymsg "TPM enrolment EXPIRED — reboot to retry"; exit 1 ;;
|
||||
esac
|
||||
fi
|
||||
sleep 5; i=$((i + 5))
|
||||
done
|
||||
if [ "${STATE:-}" != "approved" ]; then
|
||||
warn "tpm-enrol: no approval within ${WAITTMO}s"
|
||||
plymsg "TPM enrolment TIMED OUT"; exit 1
|
||||
fi
|
||||
|
||||
# --- 6. write the issued cert to NV + reboot into the secure path -----------
|
||||
ply enrol-done
|
||||
plymsg "Enrolment approved — installing identity"
|
||||
# Extract the cert PEM (leaf first if a chain was returned), unescape \n.
|
||||
CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)","hostnqn":.*/\1/p' /run/dot1x/enrol-status.json)
|
||||
[ -n "$CERT_ESC" ] || CERT_ESC=$(sed -n 's/.*"cert":"\(.*\)".*/\1/p' /run/dot1x/enrol-status.json)
|
||||
printf '%b' "$CERT_ESC" > /run/dot1x/enrol-cert.pem
|
||||
# Keep only the FIRST certificate (the leaf) for NV — the hostnqn/EAP identity.
|
||||
awk 'BEGIN{n=0} /BEGIN CERTIFICATE/{n++} n==1{print} /END CERTIFICATE/{if(n==1)exit}' \
|
||||
/run/dot1x/enrol-cert.pem > /run/dot1x/enrol-leaf.pem
|
||||
if ! openssl x509 -in /run/dot1x/enrol-leaf.pem -outform DER \
|
||||
-out /run/dot1x/enrol-leaf.der 2>/dev/null; then
|
||||
warn "tpm-enrol: issued cert is not valid PEM"; plymsg "TPM enrolment FAILED (bad cert)"; exit 1
|
||||
fi
|
||||
SZ=$(wc -c < /run/dot1x/enrol-leaf.der)
|
||||
info "tpm-enrol: writing ${SZ}-byte cert to NV $NVINDEX"
|
||||
tpm2_nvundefine "$NVINDEX" -C o >/dev/null 2>&1 || true
|
||||
if ! { tpm2_nvdefine "$NVINDEX" -C o -s "$SZ" \
|
||||
-a 'ownerread|ownerwrite|authread|authwrite' >/dev/null \
|
||||
&& tpm2_nvwrite "$NVINDEX" -C o -i /run/dot1x/enrol-leaf.der >/dev/null; }; then
|
||||
warn "tpm-enrol: failed to write cert to NV $NVINDEX (TPM owner auth?)"
|
||||
plymsg "TPM enrolment FAILED (NV write)"; exit 1
|
||||
fi
|
||||
|
||||
SERIAL=$(openssl x509 -in /run/dot1x/enrol-leaf.pem -serial -noout 2>/dev/null | cut -d= -f2 | tr 'A-F' 'a-f')
|
||||
info "tpm-enrol: ENROLLED (cert serial $SERIAL). Rebooting into the secure path."
|
||||
plymsg "Enrolment complete — rebooting"
|
||||
sleep 2
|
||||
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
|
||||
{ echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
|
||||
# Do not fall through to the secure path in this (pre-reboot) boot.
|
||||
exit 0
|
||||
Reference in New Issue
Block a user