sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tpm-enrol: inline empty-NV first-boot enrolment (host side, TODO #11)

Browse Source 
Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.

New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
  - no-op when a cert is already present in NV 0x01800001 (normal boot) or
    under rd.dot1x=0 (test path has no trustworthy identity to enrol);
  - on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
    provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
    PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
    drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
    fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
    NV, and reboot to converge.
  - Empty-NV and the secure path are mutually exclusive, so this never reorders
    the load-bearing boot sequence (invariant #2).

Wiring:
  - module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
    the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
    alone can't sign with a handle: key); install the hook.
  - diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
    the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
  - extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
  - fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
    message line (public — states only, invariant #1).

Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).
This commit is contained in:
Audiobuzz
2026-07-02 09:00:18 +00:00
parent a370f80332
commit 8e1d40a30b
7 changed files with 333 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/plymouth/themes/fleet/fleet.script
+15
View File
@@ -66,11 +66,26 @@ foot = Sprite(foot_img);
foot.SetX(sw / 2 - foot_img.GetWidth() / 2);
foot.SetY(sh / 2 + 150);
# ---- first-boot TPM enrolment banner (only shown on an empty-NV host) ----
# tpm-enrol.sh drives enrol-active/enrol-wait/enrol-done; the public fingerprint
# rides the message line (on_message) below. States only, no per-host secret.
enrol_b = Sprite(); enrol_b.SetOpacity(0);
fun enrol_banner(text, r, g, b) {
eimg = Image.Text(text, r, g, b, 1, "Sans Bold 16");
enrol_b.SetImage(eimg);
enrol_b.SetX(sw / 2 - eimg.GetWidth() / 2);
enrol_b.SetY(sh / 2 - 70);
enrol_b.SetOpacity(1.0);
}
# ---- status tokens from the boot hooks ----
fun set(i, s) { state[i] = s; draw(i); }
fun on_status(t) {
if (t == "mode-test") { set(0, 3); set(1, 3); set(2, 3); }
if (t == "enrol-active") { set(0, 1); enrol_banner("FIRST-BOOT TPM ENROLMENT", 1.00, 0.72, 0.10); }
if (t == "enrol-wait") enrol_banner("AWAITING ADMIN APPROVAL — verify the code below", 1.00, 0.72, 0.10);
if (t == "enrol-done") { enrol_banner("IDENTITY ENROLLED — rebooting", 0.10, 1.00, 0.50); set(0, 2); }
if (t == "tpm-active") set(0, 1);
if (t == "tpm-done") set(0, 2);
if (t == "dot1x-active") set(1, 1);