Audiobuzz
8e1d40a30b
Builds the host side of TPM identity enrolment — the "inline single-UKI"
vehicle from docs/tpm-enrolment-design.md. A production (secure) UKI now
auto-enrols a fresh host with no client cert, then reboots into the normal
secure path.
New dracut hook files/dracut/95dot1x-macsec/tpm-enrol.sh (initqueue/settled
prio 25, BEFORE dot1x-macsec-up at 30):
- no-op when a cert is already present in NV 0x01800001 (normal boot) or
under rd.dot1x=0 (test path has no trustworthy identity to enrol);
- on EMPTY NV: generate the signing key in the TPM @0x81010001 (openssl tpm2
provider builds the CSR; key never leaves the TPM), pre-auth DHCP on the
PHYSICAL NIC (nmcli re-manages en*, overriding the secure-mode unmanaged
drop-in), POST CSR+context to rd.fleet.enrol_url, show the broker
fingerprint on Plymouth, poll /status, write the issued leaf cert (DER) to
NV, and reboot to converge.
- Empty-NV and the secure path are mutually exclusive, so this never reorders
the load-bearing boot sequence (invariant #2).
Wiring:
- module-setup.sh: require+install the tpm2 key-gen/NV tools, curl, awk, and
the openssl tpm2 PROVIDER (ossl-modules/tpm2.so, asserted present — tpm2-tss
alone can't sign with a handle: key); install the hook.
- diskless.pkr.hcl: install tpm2-openssl + curl; assert hook/tools/provider in
the initramfs (invariant #9). New enrol_url var threaded to extract-artifacts.
- extract-artifacts.sh: bake rd.fleet.enrol_url into the cmdline.
- fleet.script: enrol-active/enrol-wait/enrol-done banner; fingerprint on the
message line (public — states only, invariant #1).
Shell JSON build/parse/cert-extract pipeline (no jq in the initramfs) verified
end-to-end against a live broker. BENCH-VERIFY list in docs/TODO.md #11 (tpm2
provider key-ref on real/swtpm, empty-NV detect, pre-auth DHCP override, Plymouth
render, NV write + reboot convergence, prod HTTPS).
111 lines
5.8 KiB
Bash
Executable File
111 lines
5.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# 95dot1x-macsec: authenticate the port with 802.1X EAP-TLS (TPM-held key,
|
|
# client cert in TPM NV) and bring up MACsec before netroot is mounted.
|
|
# The supplicant is launched as a systemd "root storage daemon"
|
|
# (argv[0] = @wpa_supplicant) so it survives switch-root and keeps the
|
|
# MKA session — and therefore the link carrying the root fs — alive.
|
|
|
|
check() {
|
|
require_binaries wpa_supplicant wpa_cli tpm2_nvread openssl || return 1
|
|
# Inline empty-NV enrolment (tpm-enrol.sh) needs the TPM key-gen + NV-write
|
|
# tools, curl (broker HTTP), and awk (JSON build). require them so a build
|
|
# that lacks tpm2-openssl / curl fails LOUDLY here rather than shipping a UKI
|
|
# that silently cannot enrol a fresh host.
|
|
require_binaries tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
|
|
tpm2_nvdefine tpm2_nvwrite tpm2_readpublic curl awk || return 1
|
|
return 0
|
|
}
|
|
|
|
depends() {
|
|
# network-manager (not network-legacy): NM renews the DHCP lease in the real
|
|
# root after switch-root (the legacy one-shot lease was never renewed). The
|
|
# secure path drives DHCP on macsec0 via nmcli instead of the old `ifup`.
|
|
echo "network-manager bash"
|
|
return 0
|
|
}
|
|
|
|
installkernel() {
|
|
instmods macsec
|
|
# tpm_crb/tpm_tis are usually built in; assert anyway
|
|
instmods tpm_crb tpm_tis
|
|
}
|
|
|
|
install() {
|
|
# wpa stack + tpm + openssl, plus the coreutils the hook calls. dracut on
|
|
# RHEL only bundles binaries a module requests — head/ls/grep/etc. are NOT
|
|
# present by default, so list everything the hook uses.
|
|
# nvme: the rd.dot1x=0 test path drives `nvme connect-all` itself (this
|
|
# distro's dracut nvmf module populates discovery.conf but never registers
|
|
# an initqueue/online autoconnect hook). The nvmf module installs nvme too,
|
|
# but list it here so the hook's dependency is explicit and load-order-safe.
|
|
# nmcli: the secure path brings macsec0 up via NetworkManager (DHCP+renewal)
|
|
# instead of the old network-legacy `ifup`.
|
|
inst_multiple wpa_supplicant wpa_cli tpm2_nvread openssl ip setsid nmcli \
|
|
grep sed cut tr sha256sum sleep mkdir nvme
|
|
|
|
# Inline empty-NV enrolment (tpm-enrol.sh): TPM key-gen + NV-write tools, the
|
|
# EK read (device context), curl (broker HTTP), awk (JSON), wc, and reboot.
|
|
inst_multiple tpm2_createprimary tpm2_create tpm2_load tpm2_evictcontrol \
|
|
tpm2_nvdefine tpm2_nvundefine tpm2_nvwrite tpm2_readpublic \
|
|
tpm2_createek tpm2_flushcontext curl awk wc reboot systemctl
|
|
|
|
# TSS libraries that the tpm2 tools + the openssl tpm2 provider dlopen.
|
|
inst_libdir_file "libtss2-*"
|
|
# openssl tpm2 PROVIDER (tpm2-openssl): openssl req signs the CSR with the
|
|
# TPM key via `-provider tpm2 -key handle:0x…`. tpm2-tss alone is NOT enough
|
|
# — the provider .so is what exposes the handle: key ref. require_binaries
|
|
# can't see a provider, so assert the .so landed (else enrolment CSR fails).
|
|
inst_libdir_file "ossl-modules/tpm2.so"
|
|
if [ -z "$(find "${initdir}" -name 'tpm2.so' -path '*ossl-modules*' 2>/dev/null)" ]; then
|
|
derror "95dot1x-macsec: openssl tpm2 provider (ossl-modules/tpm2.so) missing — install tpm2-openssl"
|
|
return 1
|
|
fi
|
|
|
|
# Fleet-generic supplicant config + RADIUS CA
|
|
inst_simple /etc/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf
|
|
inst_simple /etc/dot1x/radius-ca.pem /etc/dot1x/radius-ca.pem
|
|
|
|
# cmdline-stage hook (runs BEFORE NetworkManager starts): in secure mode it
|
|
# drops /run/NetworkManager/conf.d/10-dot1x-unmanaged.conf so NM never grabs
|
|
# the physical EAPOL NIC (wpa_supplicant owns it). No-op in rd.dot1x=0 test
|
|
# mode, so NM manages+renews the boot NIC. Replaces the old static
|
|
# 99-dot1x-unmanaged.conf, which couldn't be mode-aware.
|
|
inst_hook cmdline 10 "$moddir/nm-unmanaged.sh"
|
|
|
|
# Inline empty-NV enrolment: runs BEFORE dot1x-macsec-up.sh (priority 25 < 30).
|
|
# No-op when a cert is already present (normal boot) or under rd.dot1x=0; on a
|
|
# fresh host it enrols an identity into NV then reboots into the secure path.
|
|
inst_hook initqueue/settled 25 "$moddir/tpm-enrol.sh"
|
|
|
|
# Hook: runs from the initqueue once the NIC exists, before netroot
|
|
inst_hook initqueue/settled 30 "$moddir/dot1x-macsec-up.sh"
|
|
|
|
# Test-mode (rd.dot1x=0) NVMe-oF connect as a systemd unit. This initramfs
|
|
# is systemd-driven and does NOT source dracut initqueue/online hooks when
|
|
# the ip=dhcp link comes up (verified: the hook installs but never fires),
|
|
# and the nvmf module registers no autoconnect — so a dracut hook never
|
|
# runs. A oneshot unit ordered Before=initrd-root-device.target, with its
|
|
# own wait-for-network + connect loop, connects the namespace
|
|
# deterministically. ConditionKernelCommandLine=rd.dot1x=0 makes it a no-op
|
|
# on the secure path.
|
|
inst_simple "$moddir/nvmf-connect.sh" /usr/sbin/nvmf-connect
|
|
|
|
# systemdsystemunitdir is normally /usr/lib/systemd/system, but dracut does
|
|
# not reliably export it into module-setup context here — when empty,
|
|
# inst_simple's dir handling silently DROPS the unit (the bug that left the
|
|
# initramfs without nvmf-connect.service). Fall back to the canonical path.
|
|
local _unitdir="${systemdsystemunitdir:-/usr/lib/systemd/system}"
|
|
inst_simple "$moddir/nvmf-connect.service" "${_unitdir}/nvmf-connect.service"
|
|
mkdir -p "${initdir}${_unitdir}/initrd-root-device.target.wants"
|
|
ln -sf ../nvmf-connect.service \
|
|
"${initdir}${_unitdir}/initrd-root-device.target.wants/nvmf-connect.service"
|
|
# Hard-fail the dracut build if the unit didn't land — never ship a UKI that
|
|
# silently can't connect its NVMe-oF root in test mode.
|
|
if [ ! -e "${initdir}${_unitdir}/nvmf-connect.service" ]; then
|
|
derror "95dot1x-macsec: nvmf-connect.service not installed into ${_unitdir}"
|
|
return 1
|
|
fi
|
|
|
|
dracut_need_initqueue
|
|
}
|