39 lines
1.2 KiB
Bash
Executable File
39 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# 95dot1x-macsec: authenticate the port with 802.1X EAP-TLS (TPM-held key,
|
|
# client cert in TPM NV) and bring up MACsec before netroot is mounted.
|
|
# The supplicant is launched as a systemd "root storage daemon"
|
|
# (argv[0] = @wpa_supplicant) so it survives switch-root and keeps the
|
|
# MKA session — and therefore the link carrying the root fs — alive.
|
|
|
|
check() {
|
|
require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
|
|
return 0
|
|
}
|
|
|
|
depends() {
|
|
echo "network-legacy bash"
|
|
return 0
|
|
}
|
|
|
|
installkernel() {
|
|
instmods macsec
|
|
# tpm_crb/tpm_tis are usually built in; assert anyway
|
|
instmods tpm_crb tpm_tis
|
|
}
|
|
|
|
install() {
|
|
inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid
|
|
|
|
# TSS libraries that tpm2_nvread dlopens
|
|
inst_libdir_file "libtss2-*"
|
|
|
|
# Fleet-generic supplicant config + RADIUS CA
|
|
inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
|
|
inst_simple /etc/dot1x/radius-ca.pem /etc/dot1x/radius-ca.pem
|
|
|
|
# Hook: runs from the initqueue once the NIC exists, before netroot
|
|
inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"
|
|
|
|
dracut_need_initqueue
|
|
}
|