Audiobuzz
545d459c3d
Removes the hard no-op on the test path so the enrolment flow can be exercised on a host with a TPM + a reachable broker WITHOUT standing up 802.1X/MACsec/ RADIUS. Networking is now mode-aware: in test mode ip=dhcp already owns the NIC (and wrote resolv.conf), so the hook uses the existing lease instead of running its own nmcli DHCP — avoiding the dracut "address already assigned" race (CLAUDE.md "don't double-configure the NIC in test mode"). Secure mode still does the nm-unmanaged override for the pre-auth lease. rd.fleet.enrol=0 disables enrolment in either mode; production intent stays secure-path-only.
123 lines
5.7 KiB
Bash
123 lines
5.7 KiB
Bash
#!/bin/bash
|
|
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
|
|
#
|
|
# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
|
|
# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
|
|
# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
|
|
# which generates the key/CSR, talks to the broker, shows the Plymouth
|
|
# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS.
|
|
# It is a no-op when a cert is already present (normal boot — dot1x-macsec-up.sh
|
|
# reads NV) or when disabled via rd.fleet.enrol=0.
|
|
#
|
|
# The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
|
|
# owns only the boot-environment concerns: the empty-NV gate, networking, and the
|
|
# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so this
|
|
# never reorders the load-bearing boot sequence (invariant #2).
|
|
#
|
|
# TEST-MODE ENROLMENT (rd.dot1x=0): enrolment ALSO runs on the open/test path so
|
|
# the flow can be exercised on a host with a TPM + a reachable broker WITHOUT
|
|
# standing up 802.1X/MACsec/RADIUS. In test mode `ip=dhcp` already owns the NIC,
|
|
# so this hook must NOT re-DHCP it (that races dracut → "address already
|
|
# assigned"); it just uses the existing lease. Production still gates real
|
|
# enrolment to the secure path; use rd.fleet.enrol=0 to disable it in either mode.
|
|
|
|
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
|
|
|
|
STAMP=/run/dot1x/.enrol-done
|
|
[ -e "$STAMP" ] && exit 0
|
|
mkdir -p /run/dot1x
|
|
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
|
|
|
|
# --- skip conditions --------------------------------------------------------
|
|
if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
|
|
info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
|
|
fi
|
|
# Test mode (rd.dot1x=0): enrolment still runs, but ip=dhcp owns the NIC, so we
|
|
# must not reconfigure it below.
|
|
TESTMODE=0
|
|
[ "$(getarg rd.dot1x=)" = "0" ] && TESTMODE=1
|
|
|
|
# --- knobs (override on the kernel cmdline) ---------------------------------
|
|
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
|
|
ENROL_URL=$(getarg rd.fleet.enrol_url=); [ -n "$ENROL_URL" ] || ENROL_URL=http://boot.fleet.lab/enrol
|
|
NETTMO=$(getarg rd.dot1x.timeout=); [ -n "$NETTMO" ] || NETTMO=60
|
|
|
|
# Wait briefly for the TPM resource-manager device so an early settle (before the
|
|
# TPM driver is up) doesn't misread NV as empty and wrongly trigger enrolment.
|
|
i=0
|
|
while [ ! -e /dev/tpmrm0 ] && [ "$i" -lt 10 ]; do sleep 1; i=$((i + 1)); done
|
|
[ -e /dev/tpmrm0 ] || { warn "tpm-enrol: no TPM (/dev/tpmrm0) — leaving to the secure path"; exit 0; }
|
|
|
|
# --- already enrolled? then this is a normal boot — do NOT touch the network -
|
|
# (Bringing up en* here would fight the secure path, which needs it UNMANAGED for
|
|
# wpa_supplicant. So gate on NV BEFORE any network action.)
|
|
if tpm2_nvread "$NVINDEX" -o /run/dot1x/nvprobe.der >/dev/null 2>&1 \
|
|
&& [ -s /run/dot1x/nvprobe.der ]; then
|
|
info "tpm-enrol: client cert present at NV $NVINDEX — normal boot"
|
|
rm -f /run/dot1x/nvprobe.der
|
|
exit 0
|
|
fi
|
|
|
|
# Committed to enrolling — one attempt per boot.
|
|
: > "$STAMP"
|
|
warn "tpm-enrol: NV $NVINDEX empty — starting FIRST-TIME TPM enrolment"
|
|
|
|
# NIC: explicit rd.dot1x.if=, else first non-loopback, non-macsec interface.
|
|
NIC=$(getarg rd.dot1x.if=)
|
|
if [ -z "$NIC" ]; then
|
|
for _dev in /sys/class/net/*; do
|
|
_name=${_dev##*/}
|
|
case "$_name" in lo|macsec*) continue ;; esac
|
|
NIC=$_name; break
|
|
done
|
|
fi
|
|
[ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
|
|
|
|
# --- network on the PHYSICAL NIC --------------------------------------------
|
|
if [ "$TESTMODE" = "1" ]; then
|
|
# Test mode: ip=dhcp already brought the NIC up + wrote resolv.conf. Do NOT
|
|
# reconfigure it (a second config races dracut → "address already assigned").
|
|
info "tpm-enrol: test mode (rd.dot1x=0) — using the ip=dhcp NIC as-is"
|
|
ip link set "$NIC" up 2>/dev/null || true
|
|
else
|
|
# Secure mode: nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own
|
|
# it), but there is no supplicant yet — so explicitly hand the NIC to NM for a
|
|
# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
|
|
# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
|
|
ip link set "$NIC" up 2>/dev/null || true
|
|
nmcli device set "$NIC" managed yes 2>/dev/null || true
|
|
nmcli -w 0 device connect "$NIC" 2>/dev/null || true
|
|
fi
|
|
i=0
|
|
while [ "$i" -lt "$NETTMO" ]; do
|
|
ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break
|
|
sleep 1; i=$((i + 1))
|
|
done
|
|
if [ "$i" -ge "$NETTMO" ]; then
|
|
warn "tpm-enrol: no pre-auth DHCP lease on $NIC after ${NETTMO}s"
|
|
plymouth message --text="TPM enrolment FAILED (no network)" 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
info "tpm-enrol: pre-auth lease on $NIC; handing off to fleet-enrol ($ENROL_URL)"
|
|
|
|
# --- hand off to the enrolment binary ---------------------------------------
|
|
# It drives the TPM (key/CSR/NV), the broker exchange, and the Plymouth
|
|
# fingerprint. Exit 0 = enrolled (reboot to converge); 10 = already enrolled
|
|
# (shouldn't reach here after the NV gate, but treat as normal boot); else fail.
|
|
/usr/sbin/fleet-enrol -url "$ENROL_URL" -iface "$NIC" -nvindex "$NVINDEX"
|
|
rc=$?
|
|
case "$rc" in
|
|
0)
|
|
info "tpm-enrol: enrolled — rebooting into the secure path"
|
|
sleep 2
|
|
systemctl --no-block reboot 2>/dev/null || reboot -f 2>/dev/null || \
|
|
{ echo 1 > /proc/sys/kernel/sysrq 2>/dev/null; echo b > /proc/sysrq-trigger 2>/dev/null; }
|
|
exit 0 ;;
|
|
10)
|
|
info "tpm-enrol: fleet-enrol reports cert already present — normal boot"
|
|
exit 0 ;;
|
|
*)
|
|
warn "tpm-enrol: fleet-enrol failed (rc=$rc) — reboot to retry"
|
|
exit 1 ;;
|
|
esac
|