Audiobuzz
4d6f038e3c
Bench (Proxmox vTPM, host cygnus-cruiser-99) confirmed via tpm2_readpublic that
0x81010001 — the handle our design used for the fleet signing key — is the
TCG-standard RSA Endorsement Key slot: the object there is the swtpm-provisioned
EK (restricted|decrypt|adminwithpolicy, RSA-2048/AES128CFB, canonical EK
authPolicy 837197…, EK cert at NV 0x1c00002). Most firmware/swtpm TPMs occupy
that slot, so EnsureKey could never create our key there — it errored reading
the EK as ECC and enrolment died before the CSR/POST.
Move the fleet signing key to 0x81000100, a non-reserved owner persistent
handle (clear of EK 0x81010001/2 and SRK 0x81000001/2). Threaded through:
- fleet-enrol -handle default + new rd.dot1x.handle= cmdline knob (baked by
extract-artifacts.sh, overridable via SMBIOS)
- files/etc/dot1x/wpa_supplicant-dot1x.conf private_key handle
- the dracut hook, bench tpm-provision.sh / tpm-selftest.sh
- CLAUDE.md invariant #1 + design/SSP docs + TODO #11
NV index 0x01800001 (owner range) is unchanged.
EnsureKey hardening: refuse to evict any restricted-decrypt object (EK/SRK) as
a safety net — never clobber the TPM endorsement/storage identity (also
protects the future EK/AK attestation path). Still self-heals a genuine stale
signing key. New regression TestEnsureKeyRefusesToEvictProtectedKey; the
stale-key regression and handle constants moved to 0x81000100.
Design note records the IDevID (0x81020001) option for the later EK/AK
attestation work. Follow-up items logged: content-aware NV presence check
(verify the cert chains to the fleet CA, so leftover/foreign NV can't suppress
enrolment) and a de-enrol/TPM-reset procedure.
127 lines
6.0 KiB
Bash
127 lines
6.0 KiB
Bash
#!/bin/bash
|
|
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
|
|
#
|
|
# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
|
|
# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
|
|
# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
|
|
# which generates the key/CSR, talks to the broker, shows the Plymouth
|
|
# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS.
|
|
# It is a no-op when a cert is already present (normal boot — dot1x-macsec-up.sh
|
|
# reads NV) or when disabled via rd.fleet.enrol=0.
|
|
#
|
|
# The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
|
|
# owns only the boot-environment concerns: the empty-NV gate, networking, and the
|
|
# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so this
|
|
# never reorders the load-bearing boot sequence (invariant #2).
|
|
#
|
|
# TEST-MODE ENROLMENT (rd.dot1x=0): enrolment ALSO runs on the open/test path so
|
|
# the flow can be exercised on a host with a TPM + a reachable broker WITHOUT
|
|
# standing up 802.1X/MACsec/RADIUS. In test mode `ip=dhcp` already owns the NIC,
|
|
# so this hook must NOT re-DHCP it (that races dracut → "address already
|
|
# assigned"); it just uses the existing lease. Production still gates real
|
|
# enrolment to the secure path; use rd.fleet.enrol=0 to disable it in either mode.
|
|
|
|
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
|
|
|
|
STAMP=/run/dot1x/.enrol-done
|
|
[ -e "$STAMP" ] && exit 0
|
|
mkdir -p /run/dot1x
|
|
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
|
|
|
|
# --- skip conditions --------------------------------------------------------
|
|
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
|
|
info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
|
|
fi
|
|
# Test mode (rd.dot1x=0): enrolment still runs, but ip=dhcp owns the NIC, so we
|
|
# must not reconfigure it below.
|
|
TESTMODE=0
|
|
[ "$(getarg rd.dot1x=)" = "0" ] && TESTMODE=1
|
|
|
|
# --- knobs (override on the kernel cmdline) ---------------------------------
|
|
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
|
|
# Persistent handle for the signing key: a NON-reserved owner handle. NOT the EK
|
|
# slot 0x81010001 (which most firmware/swtpm provisioning already occupies) nor
|
|
# the SRK 0x81000001 — see EnsureKey / CLAUDE.md invariant #1.
|
|
HANDLE=$(getarg rd.dot1x.handle=); [ -n "$HANDLE" ] || HANDLE=0x81000100
|
|
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
|
|
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
|
|
|
|
# Wait briefly for the TPM resource-manager device so an early settle (before the
|
|
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
|
|
i=0
|
|
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
|
|
[ -e /dev/tpmrm0 ] || { warn "tpm-enrol: no TPM (/dev/tpmrm0) — leaving to the secure path"; exit 0; }
|
|
|
|
# --- already enrolled? then this is a normal boot — do NOT touch the network -
|
|
# (Bringing up en* here would fight the secure path, which needs it UNMANAGED for
|
|
# wpa_supplicant. So gate on NV BEFORE any network action.)
|
|
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
|
|
&& [ -s /run/dot1x/nvprobe.der ]; then
|
|
info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
|
|
rm -f /run/dot1x/nvprobe.der
|
|
exit 0
|
|
fi
|
|
|
|
# Committed to enrolling — one attempt per boot.
|
|
: > "$STAMP"
|
|
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
|
|
|
|
# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
|
|
NIC=$(getarg rd.dot1x.if=)
|
|
if [ -z "$NIC" ]; then
|
|
for _dev in /sys/class/net/*; do
|
|
_name=${_dev##*/}
|
|
case "$_name" in lo|macsec*) continue ;; esac
|
|
NIC=$_name; break
|
|
done
|
|
fi
|
|
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
|
|
|
|
# --- network on the PHYSICAL NIC --------------------------------------------
|
|
if [ "$TESTMODE" = "1" ]; then
|
|
# Test mode: ip=dhcp already brought the NIC up + wrote resolv.conf. Do NOT
|
|
# reconfigure it (a second config races dracut → "address already assigned").
|
|
info "tpm-enrol: test mode (rd.dot1x=0) — using the ip=dhcp NIC as-is"
|
|
ip link set "$NIC" up 2>/dev/null || true
|
|
else
|
|
# Secure mode: nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own
|
|
# it), but there is no supplicant yet — so explicitly hand the NIC to NM for a
|
|
# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
|
|
# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
|
|
ip link set "$NIC" up 2>/dev/null || true
|
|
nmcli device set "$NIC" managed yes 2>/dev/null || true
|
|
nmcli -w 0 device connect "$NIC" 2>/dev/null || true
|
|
fi
|
|
i=0
|
|
while [ "$i" -lt "$NETTMO" ]; do
|
|
ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
|
|
sleep 1; i=$((i + 1))
|
|
done
|
|
if [ "$i" -ge "$NETTMO" ]; then
|
|
warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
|
|
plymouth message --text="TPM enrolment FAILED (no network)" 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)"
|
|
|
|
# --- hand off to the enrolment binary ---------------------------------------
|
|
# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
|
|
# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
|
|
# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
|
|
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX" -handle "$HANDLE"
|
|
rc=$?
|
|
case "$rc" in
|
|
0)
|
|
info "tpm-enrol: enrolled — rebooting into the secure path"
|
|
sleep 2
|
|
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
|
|
{ echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
|
|
exit 0 ;;
|
|
10)
|
|
info "tpm-enrol: fleet-enrol reports cert already present — normal boot"
|
|
exit 0 ;;
|
|
*)
|
|
warn "tpm-enrol: fleet-enrol failed (rc=$rc) — reboot to retry"
|
|
exit 1 ;;
|
|
esac
|