diskless-workstation/files/dracut/95dot1x-macsec/module-setup.sh

#!/bin/bash
# 95dot1x-macsec: authenticate the port with 802.1X EAP-TLS (TPM-held key,
# client cert in TPM NV) and bring up MACsec before netroot is mounted.
# The supplicant is launched as a systemd "root storage daemon"
# (argv[0] = @wpa_supplicant) so it survives switch-root and keeps the
# MKA session — and therefore the link carrying the root fs — alive.

check() {
    require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
    # First-boot ENROLMENT is the out-of-VM fleet-enrol Go binary (bundled in
    # install()), which does key-gen/CSR/NV directly via go-tpm — so no tpm2-tools
    # key-gen / openssl provider / curl are required in the initramfs here.
    return 0
}

depends() {
    # network-manager (not network-legacy): NM renews the DHCP lease in the real
    # root after switch-root (the legacy one-shot lease was never renewed). The
    # secure path drives DHCP on macsec0 via nmcli instead of the old `ifup`.
    echo "network-manager bash"
    return 0
}

installkernel() {
    instmods macsec
    # tpm_crb/tpm_tis are usually built in; assert anyway
    instmods tpm_crb tpm_tis
}

install() {
    # wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
    # RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
    # present by default, so list everything the hook uses.
    # nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
    # distro's dracut nvmf module populates discovery.conf but never registers
    # an initqueue/online autoconnect hook). The nvmf module installs nvme too,
    # but list it here so the hook's dependency is explicit and load-order-safe.
    # nmcli: the secure path brings macsec0 up via NetworkManager (DHCP+renewal)
    # instead of the old network-legacy `ifup`.
    inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid nmcli \
        grep sed cut tr sha256sum sleep mkdir nvme

    # Inline empty-NV enrolment: the gate hook (tpm-enrol.sh) drives networking +
    # reboot; the actual key-gen/CSR/broker/NV work is the out-of-VM fleet-enrol
    # binary (Go + go-tpm, static — talks to /dev/tpmrm0 directly, no tpm2-tools /
    # openssl provider / curl needed). reboot: the hook reboots to converge into
    # the secure path after writing the cert to NV.
    inst_multiple reboot
    if [ -x /usr/sbin/fleet-enrol ]; then
        inst_simple /usr/sbin/fleet-enrol /usr/sbin/fleet-enrol
    else
        derror "95dot1x-macsec: /usr/sbin/fleet-enrol missing — build it out-of-VM (CI 'Build host Go binaries') before the initramfs build"
        return 1
    fi

    # TSS libraries that tpm2_nvread (secure-path NV read) dlopens.
    inst_libdir_file "libtss2-*"

    # Fleet-generic supplicant config + RADIUS CA
    inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
    inst_simple /etc/dot1x/radius-ca.pem             /etc/dot1x/radius-ca.pem

    # cmdline-stage hook (runs BEFORE NetworkManager starts): in secure mode it
    # drops /run/NetworkManager/conf.d/10-dot1x-unmanaged.conf so NM never grabs
    # the physical EAPOL NIC (wpa_supplicant owns it). No-op in rd.dot1x=0 test
    # mode, so NM manages+renews the boot NIC. Replaces the old static
    # 99-dot1x-unmanaged.conf, which couldn't be mode-aware.
    inst_hook cmdline 10 "$moddir/nm-unmanaged.sh"

    # Inline empty-NV enrolment: runs BEFORE dot1x-macsec-up.sh (priority 25 < 30).
    # No-op when a cert is already present (normal boot) or under rd.dot1x=0; on a
    # fresh host it enrols an identity into NV then reboots into the secure path.
    inst_hook initqueue/settled 25 "$moddir/tpm-enrol.sh"

    # Hook: runs from the initqueue once the NIC exists, before netroot
    inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"

    # Test-mode (rd.dot1x=0) NVMe-oF connect as a systemd unit. This initramfs
    # is systemd-driven and does NOT source dracut initqueue/online hooks when
    # the ip=dhcp link comes up (verified: the hook installs but never fires),
    # and the nvmf module registers no autoconnect — so a dracut hook never
    # runs. A oneshot unit ordered Before=initrd-root-device.target, with its
    # own wait-for-network + connect loop, connects the namespace
    # deterministically. ConditionKernelCommandLine=rd.dot1x=0 makes it a no-op
    # on the secure path.
    inst_simple "$moddir/nvmf-connect.sh" /usr/sbin/nvmf-connect

    # systemdsystemunitdir is normally /usr/lib/systemd/system, but dracut does
    # not reliably export it into module-setup context here — when empty,
    # inst_simple's dir handling silently DROPS the unit (the bug that left the
    # initramfs without nvmf-connect.service). Fall back to the canonical path.
    local _unitdir="${systemdsystemunitdir:-/usr/lib/systemd/system}"
    inst_simple "$moddir/nvmf-connect.service" "${_unitdir}/nvmf-connect.service"
    mkdir -p "${initdir}${_unitdir}/initrd-root-device.target.wants"
    ln -sf ../nvmf-connect.service \
        "${initdir}${_unitdir}/initrd-root-device.target.wants/nvmf-connect.service"
    # Hard-fail the dracut build if the unit didn't land — never ship a UKI that
    # silently can't connect its NVMe-oF root in test mode.
    if [ ! -e "${initdir}${_unitdir}/nvmf-connect.service" ]; then
        derror "95dot1x-macsec: nvmf-connect.service not installed into ${_unitdir}"
        return 1
    fi

    dracut_need_initqueue
}