Initial commit

files/dracut/95dot1x-macsec/module-setup.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# 95dot1x-macsec: authenticate the port with 802.1X EAP-TLS (TPM-held key,
+# client cert in TPM NV) and bring up MACsec before netroot is mounted.
+# The supplicant is launched as a systemd "root storage daemon"
+# (argv[0] = @wpa_supplicant) so it survives switch-root and keeps the
+# MKA session — and therefore the link carrying the root fs — alive.
+
+check() {
+    require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
+    return 0
+}
+
+depends() {
+    echo "network-legacy bash"
+    return 0
+}
+
+installkernel() {
+    instmods macsec
+    # tpm_crb/tpm_tis are usually built in; assert anyway
+    instmods tpm_crb tpm_tis
+}
+
+install() {
+    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid
+
+    # TSS libraries that tpm2_nvread dlopens
+    inst_libdir_file "libtss2-*"
+
+    # Fleet-generic supplicant config + RADIUS CA
+    inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
+    inst_simple /etc/dot1x/radius-ca.pem             /etc/dot1x/radius-ca.pem
+
+    # Hook: runs from the initqueue once the NIC exists, before netroot
+    inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"
+
+    dracut_need_initqueue
+}