Update boot theme
This commit is contained in:
Audiobuzz
@@ -15,6 +15,11 @@ STAMP=/run/dot1x/.done
|
||||
[ -e "$STAMP" ] && exit 0
|
||||
mkdir -p /run/dot1x /run/wpa_supplicant
|
||||
|
||||
# Best-effort boot-splash status for the 'fleet' Plymouth theme. NEVER fatal and
|
||||
# NEVER reorders anything — a splash call must not perturb the load-bearing
|
||||
# auth -> macsec -> DHCP -> NVMe sequence below. No-op if plymouth isn't running.
|
||||
ply() { plymouth update --status="$1" 2>/dev/null || true; }
|
||||
|
||||
# --- knobs (override on the kernel cmdline) ---------------------------------
|
||||
NIC=$(getarg rd.dot1x.if=)
|
||||
if [ -z "$NIC" ]; then
|
||||
@@ -42,6 +47,7 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
|
||||
# networks only. Remove rd.dot1x=0 from the cmdline to restore full security.
|
||||
if [ "$(getarg rd.dot1x=)" = "0" ]; then
|
||||
warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
|
||||
ply mode-test # splash: mark TPM/802.1X/MACsec rows as skipped (not failed)
|
||||
# Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
|
||||
# dracut's network module brings the NIC up, gets a lease and writes
|
||||
# resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
|
||||
@@ -70,6 +76,7 @@ if [ "$(getarg rd.dot1x=)" = "0" ]; then
|
||||
fi
|
||||
|
||||
# --- 1. client certificate out of TPM NV ------------------------------------
|
||||
ply tpm-active
|
||||
if [ ! -s /run/dot1x/client.pem ]; then
|
||||
if ! tpm2_nvread -T device:/dev/tpmrm0 "$NVINDEX" -o /run/dot1x/client.der; then
|
||||
warn "dot1x-macsec: tpm2_nvread failed — cannot authenticate"
|
||||
@@ -77,6 +84,7 @@ if [ ! -s /run/dot1x/client.pem ]; then
|
||||
fi
|
||||
openssl x509 -inform DER -in /run/dot1x/client.der -out /run/dot1x/client.pem
|
||||
fi
|
||||
ply tpm-done
|
||||
|
||||
# --- 2. supplicant as a root storage daemon ---------------------------------
|
||||
ip link set "$NIC" up
|
||||
@@ -88,6 +96,7 @@ if [ ! -e /run/dot1x/wpa.pid ]; then
|
||||
-c /etc/dot1x/wpa_supplicant-dot1x.conf \
|
||||
-P /run/dot1x/wpa.pid" &
|
||||
fi
|
||||
ply dot1x-active
|
||||
|
||||
# --- 3. wait for authentication + macsec0 -----------------------------------
|
||||
i=0
|
||||
@@ -104,9 +113,13 @@ if [ "$i" -ge "$TIMEOUT" ]; then
|
||||
exit 1
|
||||
fi
|
||||
info "dot1x-macsec: port authorized, macsec0 up after ${i}s"
|
||||
ply dot1x-done
|
||||
ply macsec-active
|
||||
|
||||
# --- 4. address the secure interface; netroot rides on macsec0 --------------
|
||||
ip link set macsec0 up
|
||||
ply macsec-done
|
||||
ply net-active
|
||||
# DHCP on macsec0 via NetworkManager (NOT the old network-legacy `ifup`): NM owns
|
||||
# macsec0, so it RENEWS the lease in the running system after switch-root — the
|
||||
# whole point of the network-manager port. macsec0 was created externally by
|
||||
@@ -127,6 +140,7 @@ if [ "$i" -ge "$TIMEOUT" ]; then
|
||||
exit 1
|
||||
fi
|
||||
info "dot1x-macsec: macsec0 addressed via NetworkManager (DHCP)"
|
||||
ply net-done
|
||||
|
||||
# --- 5. derive per-host NVMe identity from the TPM certificate --------------
|
||||
# Keeps the image fleet-generic: the host NQN is a function of the machine
|
||||
|
||||
@@ -29,6 +29,12 @@ _trsvcid=${_rest##*,}
|
||||
# nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
|
||||
modprobe nvme_tcp 2>/dev/null
|
||||
|
||||
# Best-effort boot-splash status for the 'fleet' Plymouth theme (never fatal). By
|
||||
# the time this runs the ip=dhcp link is up, so mark Network done and NVMe active.
|
||||
ply() { plymouth update --status="$1" 2>/dev/null || true; }
|
||||
ply net-done
|
||||
ply nvme-active
|
||||
|
||||
# Keep-alive / reconnect tuning for the ROOT device. These persist across
|
||||
# switch-root (the in-kernel nvme-tcp controller and its opts survive).
|
||||
# -k 30 keep-alive timeout (s). The 5s default means a KA every 2.5s; under
|
||||
@@ -53,6 +59,7 @@ while [ "$_i" -lt 60 ]; do
|
||||
if [ -b "$_ns" ]; then
|
||||
mkdir -p /run/dot1x
|
||||
: > /run/dot1x/.nvmf-connected
|
||||
ply nvme-done
|
||||
echo "nvmf-connect: connected ${_trtype}/${_traddr}/${_trsvcid} ($_ns)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
[Plymouth Theme]
|
||||
Name=Fleet
|
||||
Description=Cyber sci-fi secure diskless bring-up splash (TPM / 802.1X / MACsec / NVMe-oF). Driven by `plymouth update --status=` tokens from the dracut hooks.
|
||||
ModuleName=script
|
||||
|
||||
[script]
|
||||
ImageDir=/usr/share/plymouth/themes/fleet
|
||||
ScriptFile=/usr/share/plymouth/themes/fleet/fleet.script
|
||||
@@ -0,0 +1,109 @@
|
||||
# Fleet — cyber sci-fi secure-bring-up splash (Plymouth "script" plugin).
|
||||
#
|
||||
# Asset-free on purpose: everything is drawn with Image.Text, so the repo carries
|
||||
# no binary images. The dracut hooks drive it with `plymouth update --status=<tok>`
|
||||
# (see dot1x-macsec-up.sh / nvmf-connect.sh); this script maps each token to a
|
||||
# security-handshake checklist and pulses the in-progress step. Tokens are
|
||||
# best-effort and order-independent — anything not reported just stays "pending",
|
||||
# and in rd.dot1x=0 test mode the auth/MACsec rows are marked "skipped" (never
|
||||
# "failed"). No per-host data is ever shown (only states), per the no-state rule.
|
||||
|
||||
# ---- background (dark teal -> black) ----
|
||||
Window.SetBackgroundTopColor(0.00, 0.05, 0.07);
|
||||
Window.SetBackgroundBottomColor(0.00, 0.00, 0.00);
|
||||
|
||||
sw = Window.GetWidth();
|
||||
sh = Window.GetHeight();
|
||||
|
||||
# ---- title / subtitle ----
|
||||
title_img = Image.Text("F L E E T", 0.0, 1.0, 0.85, 1, "Sans Bold 36");
|
||||
title = Sprite(title_img);
|
||||
title.SetX(sw / 2 - title_img.GetWidth() / 2);
|
||||
title.SetY(sh / 2 - 150);
|
||||
|
||||
sub_img = Image.Text("secure diskless bring-up", 0.30, 0.65, 0.65, 1, "Sans 14");
|
||||
sub = Sprite(sub_img);
|
||||
sub.SetX(sw / 2 - sub_img.GetWidth() / 2);
|
||||
sub.SetY(sh / 2 - 102);
|
||||
|
||||
# ---- handshake stages ----
|
||||
# state per stage: 0 pending, 1 active, 2 done, 3 skipped
|
||||
n = 5;
|
||||
label[0] = "TPM identity";
|
||||
label[1] = "802.1X EAP-TLS";
|
||||
label[2] = "MACsec link";
|
||||
label[3] = "Network (DHCP)";
|
||||
label[4] = "NVMe-oF root";
|
||||
|
||||
col_x = sw / 2 - 150;
|
||||
row_y = sh / 2 - 36;
|
||||
row_h = 34;
|
||||
|
||||
fun draw(i) {
|
||||
glyph = "[ ]"; r = 0.22; g = 0.42; b = 0.42; # pending (dim teal)
|
||||
if (state[i] == 1) { glyph = "[>>]"; r = 1.00; g = 0.72; b = 0.10; } # active (amber)
|
||||
if (state[i] == 2) { glyph = "[OK]"; r = 0.10; g = 1.00; b = 0.50; } # done (neon green)
|
||||
if (state[i] == 3) { glyph = "[--]"; r = 0.30; g = 0.30; b = 0.36; } # skipped (grey)
|
||||
img = Image.Text(glyph + " " + label[i], r, g, b, 1, "Sans 16");
|
||||
row[i].SetImage(img);
|
||||
row[i].SetX(col_x);
|
||||
row[i].SetY(row_y + i * row_h);
|
||||
row[i].SetOpacity(1.0);
|
||||
}
|
||||
|
||||
i = 0;
|
||||
while (i < n) {
|
||||
state[i] = 0;
|
||||
row[i] = Sprite();
|
||||
draw(i);
|
||||
i = i + 1;
|
||||
}
|
||||
|
||||
# ---- footer ----
|
||||
foot_img = Image.Text("erofs + dm-verity • NVMe/TCP • no per-host state",
|
||||
0.25, 0.45, 0.45, 1, "Sans 11");
|
||||
foot = Sprite(foot_img);
|
||||
foot.SetX(sw / 2 - foot_img.GetWidth() / 2);
|
||||
foot.SetY(sh / 2 + 150);
|
||||
|
||||
# ---- status tokens from the boot hooks ----
|
||||
fun set(i, s) { state[i] = s; draw(i); }
|
||||
|
||||
fun on_status(t) {
|
||||
if (t == "mode-test") { set(0, 3); set(1, 3); set(2, 3); }
|
||||
if (t == "tpm-active") set(0, 1);
|
||||
if (t == "tpm-done") set(0, 2);
|
||||
if (t == "dot1x-active") set(1, 1);
|
||||
if (t == "dot1x-done") set(1, 2);
|
||||
if (t == "macsec-active") set(2, 1);
|
||||
if (t == "macsec-done") set(2, 2);
|
||||
if (t == "net-active") set(3, 1);
|
||||
if (t == "net-done") set(3, 2);
|
||||
if (t == "nvme-active") set(4, 1);
|
||||
if (t == "nvme-done") set(4, 2);
|
||||
}
|
||||
Plymouth.SetUpdateStatusFunction(on_status);
|
||||
|
||||
# ---- optional free-text line (e.g. warnings via `plymouth message`) ----
|
||||
msg = Sprite();
|
||||
fun on_message(text) {
|
||||
img = Image.Text(text, 0.55, 0.80, 0.80, 1, "Sans 12");
|
||||
msg.SetImage(img);
|
||||
msg.SetX(sw / 2 - img.GetWidth() / 2);
|
||||
msg.SetY(sh / 2 + 182);
|
||||
}
|
||||
Plymouth.SetMessageFunction(on_message);
|
||||
|
||||
# ---- pulse the in-progress row ----
|
||||
tick = 0;
|
||||
fun on_refresh() {
|
||||
tick = tick + 1;
|
||||
o = 1.0;
|
||||
if (tick % 24 < 12) o = 0.45;
|
||||
i = 0;
|
||||
while (i < n) {
|
||||
if (state[i] == 1) row[i].SetOpacity(o);
|
||||
i = i + 1;
|
||||
}
|
||||
}
|
||||
Plymouth.SetRefreshFunction(on_refresh);
|
||||
Reference in New Issue
Block a user