Kristian Amlie
3 years ago
committed by
GitHub
GitHub
18 changed files with 596 additions and 69 deletions
@ -0,0 +1,169 @@ |
|||
#!/bin/bash |
|||
|
|||
set -e |
|||
|
|||
usage() { |
|||
cat 1>&2 <<EOF |
|||
Please run with either "debian" or "ubuntu" as argument. |
|||
EOF |
|||
} |
|||
|
|||
if [ "$UID" -ne 0 ]; then |
|||
echo "We'll need root for this..." 1>&2 |
|||
exec sudo "$0" "$@" |
|||
fi |
|||
|
|||
while [ -n "$1" ]; do |
|||
case "$1" in |
|||
"ubuntu") |
|||
GENERATE_VARIANT=generate_ubuntu |
|||
;; |
|||
"debian") |
|||
GENERATE_VARIANT=generate_debian |
|||
;; |
|||
*) |
|||
usage |
|||
exit 1 |
|||
;; |
|||
esac |
|||
shift |
|||
done |
|||
|
|||
cleanup_losetup() { |
|||
set +e |
|||
for dev in ${LO_DEVICE}p*; do |
|||
umount $dev |
|||
done |
|||
losetup -d $LO_DEVICE |
|||
rmdir tmp-p1 |
|||
rmdir tmp-p2 |
|||
} |
|||
|
|||
generate_debian() { |
|||
local -r image="Debian-11-x86-64.img" |
|||
|
|||
mkosi --root-size=2G --distribution=debian --release=bullseye --format=gpt_ext4 --bootable --checksum \ |
|||
--password password --package=openssh-server,dhcpcd5 --package grub-efi-amd64-signed \ |
|||
--package shim-signed --package lsb-release --output="$image" build |
|||
|
|||
post_process_image "$image" |
|||
|
|||
echo "Image successfully generated!" 1>&2 |
|||
} |
|||
|
|||
generate_ubuntu() { |
|||
local -r image="Ubuntu-Focal-x86-64.img" |
|||
|
|||
mkosi --root-size=2G --distribution=ubuntu --release=focal --format=gpt_ext4 --bootable --checksum \ |
|||
--password password --package=openssh-server,dhcpcd5 --package grub-efi-amd64-signed \ |
|||
--package shim-signed --package lsb-release --output="$image" build |
|||
|
|||
post_process_image "$image" |
|||
|
|||
echo "Image successfully generated!" 1>&2 |
|||
} |
|||
|
|||
post_process_image() { |
|||
local -r image="$1" |
|||
|
|||
mkdir -p tmp-p1 |
|||
mkdir -p tmp-p2 |
|||
|
|||
LO_DEVICE=$(losetup --find --show --partscan "$image") |
|||
trap cleanup_losetup EXIT |
|||
mount ${LO_DEVICE}p1 tmp-p1 |
|||
mount ${LO_DEVICE}p2 tmp-p2 |
|||
|
|||
pre_tweaks tmp-p1 tmp-p2 |
|||
|
|||
create_grub_regeneration_service tmp-p1 tmp-p2 |
|||
umount tmp-p1 |
|||
umount tmp-p2 |
|||
regenerate_grub_live "$image" |
|||
mount ${LO_DEVICE}p1 tmp-p1 |
|||
mount ${LO_DEVICE}p2 tmp-p2 |
|||
|
|||
post_tweaks tmp-p1 tmp-p2 |
|||
} |
|||
|
|||
pre_tweaks() { |
|||
local -r boot="$1" |
|||
local -r root="$2" |
|||
|
|||
# Fstab is missing for some reason. I'm not exactly sure why systemd-boot |
|||
# works without this, and GRUB doesn't. |
|||
cat > "$root/etc/fstab" <<EOF |
|||
/dev/root / auto defaults 0 0 |
|||
/dev/sda1 /boot/efi auto defaults 0 0 |
|||
EOF |
|||
|
|||
# Real installers create a /etc/default/grub file with a distributor in |
|||
# them. |
|||
if [ ! -e "$root/etc/default/grub" ]; then |
|||
mkdir -p $root/etc/default |
|||
echo 'GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null`' > $root/etc/default/grub |
|||
fi |
|||
|
|||
sed -E -i -e 's/^#? *PermitRootLogin .*/PermitRootLogin yes/' $root/etc/ssh/sshd_config |
|||
} |
|||
|
|||
post_tweaks() { |
|||
local -r boot="$1" |
|||
local -r root="$2" |
|||
|
|||
# Delete systemd-boot, which isn't normally present in images that were |
|||
# installed with OS installers, at least not at the time of writing. |
|||
rm -rf "$boot/EFI/systemd" |
|||
|
|||
# Also replace bootx64.efi, which is the default bootloader. Mkosi installs |
|||
# systemd-bootx86.efi, but we want the shim. |
|||
rm -f "$boot/EFI/BOOT/*" |
|||
mkdir -p "$boot/EFI/BOOT" |
|||
cp "$root/usr/lib/shim/shimx64.efi.signed" "$boot/EFI/BOOT/BOOTX64.EFI" |
|||
} |
|||
|
|||
# Unfortunately installing grub scripts is something which is not really |
|||
# possible when offline. This is something which is easier with systemd-boot, so |
|||
# longterm GRUB will probably follow, or systemd-boot will take over. Anyway, |
|||
# let's do it by using a systemd service to perform the job, and then shut down. |
|||
create_grub_regeneration_service() { |
|||
local -r boot="$1" |
|||
local -r root="$2" |
|||
|
|||
cat > "$root/etc/systemd/system/mender-regenerate-grub-and-shutdown.service" <<EOF |
|||
[Unit] |
|||
Description=Regenerate grub scripts, disable itself and then shut down. |
|||
|
|||
[Service] |
|||
Type=oneshot |
|||
ExecStart=sh -c "grub-install && update-grub && systemctl disable mender-regenerate-grub-and-shutdown.service && poweroff" |
|||
EOF |
|||
|
|||
ln -sf "$root/etc/systemd/system/mender-regenerate-grub-and-shutdown.service" "$root/etc/systemd/system/multi-user.target.wants/" |
|||
} |
|||
|
|||
regenerate_grub_live() { |
|||
local -r image="$1" |
|||
|
|||
local -r nvvars=$(mktemp) |
|||
dd if=/dev/zero of="$nvvars" bs=1M count=1 |
|||
|
|||
local ret=0 |
|||
for maybe_kvm in -enable-kvm ""; do |
|||
ret=0 |
|||
echo "Generating GRUB boot files live..." 1>&2 |
|||
qemu-system-x86_64 \ |
|||
$maybe_kvm \ |
|||
-drive file="$image",if=ide,format=raw \ |
|||
-drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ |
|||
-drive file="$nvvars",if=pflash,format=raw,unit=1 \ |
|||
-display vnc=:23 \ |
|||
-m 512 \ |
|||
|| ret=$? |
|||
[ $ret -eq 0 ] && break |
|||
done |
|||
|
|||
return $ret |
|||
} |
|||
|
|||
$GENERATE_VARIANT |
|||
@ -1 +1 @@ |
|||
Subproject commit ee1266afe8ec58efce9b4223e2489ac023b0582f |
|||
Subproject commit 7c081c042f0024e87e9e15144b18d991fb378bcd |
|||
@ -0,0 +1,199 @@ |
|||
#!/usr/bin/python |
|||
# Copyright 2022 Northern.tech AS |
|||
# |
|||
# Licensed under the Apache License, Version 2.0 (the "License"); |
|||
# you may not use this file except in compliance with the License. |
|||
# You may obtain a copy of the License at |
|||
# |
|||
# http://www.apache.org/licenses/LICENSE-2.0 |
|||
# |
|||
# Unless required by applicable law or agreed to in writing, software |
|||
# distributed under the License is distributed on an "AS IS" BASIS, |
|||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
# See the License for the specific language governing permissions and |
|||
# limitations under the License. |
|||
|
|||
import pytest |
|||
import re |
|||
import os |
|||
import subprocess |
|||
|
|||
from utils.common import ( |
|||
extract_partition, |
|||
get_no_sftp, |
|||
) |
|||
|
|||
|
|||
@pytest.fixture(scope="function") |
|||
def cleanup_boot_scripts(request, connection): |
|||
"""Take a backup of the various grub.cfg files and restore them after the |
|||
test. This is recommended for tests that call `grub-install` and/or |
|||
`update-grub`, so that other tests can also run them from a pristine |
|||
state.""" |
|||
|
|||
connection.run( |
|||
"cp $(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*') /data/grub-efi.cfg" |
|||
) |
|||
connection.run("cp /boot/grub/grub.cfg /data/grub-main.cfg") |
|||
connection.run("cp /boot/grub-mender-grubenv.cfg /data/grub-mender-grubenv.cfg") |
|||
|
|||
def cleanup(): |
|||
connection.run( |
|||
"mv /data/grub-efi.cfg $(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*')" |
|||
) |
|||
connection.run("mv /data/grub-main.cfg /boot/grub/grub.cfg") |
|||
connection.run("mv /data/grub-mender-grubenv.cfg /boot/grub-mender-grubenv.cfg") |
|||
|
|||
request.addfinalizer(cleanup) |
|||
|
|||
|
|||
def check_all_root_occurrences_valid(grub_cfg): |
|||
found_expected = False |
|||
inside_10_header = False |
|||
# One of the functions we define and use. |
|||
expected = "mender_check_and_restore_env" |
|||
with open(grub_cfg) as fd: |
|||
lineno = 0 |
|||
for line in fd.readlines(): |
|||
lineno += 1 |
|||
if re.match(r'^\s*root="\$\{mender_grub_storage_device\}', line): |
|||
continue |
|||
|
|||
if line.strip() == "### BEGIN /etc/grub.d/00_header ###": |
|||
# We allow root references inside the 00_header, because they |
|||
# are overriden by Mender later. |
|||
inside_10_header = True |
|||
elif line.strip() == "### END /etc/grub.d/00_header ###": |
|||
inside_10_header = False |
|||
if not inside_10_header and re.match(r"^\s*(set +)?root=", line): |
|||
pytest.fail( |
|||
"Found unexpected occurrence of `root=` in grub boot script\n" |
|||
"%d:%s" % (lineno, line) |
|||
) |
|||
|
|||
if line.find(expected) >= 0: |
|||
found_expected = True |
|||
|
|||
assert found_expected, "Expected content (%s) not found" % expected |
|||
|
|||
|
|||
@pytest.mark.usefixtures("setup_board", "cleanup_boot_scripts") |
|||
class TestGrubIntegration: |
|||
@pytest.mark.min_mender_version("1.0.0") |
|||
def test_no_root_occurrences(self, connection, latest_part_image): |
|||
"""Test that the generated grub scripts do not contain any occurrences of |
|||
`root=<something>` except for known instances that we control. This is |
|||
important because Mender needs to keep tight control of when this |
|||
variable is set, in order to boot from, and mount, the correct root |
|||
partition.""" |
|||
|
|||
# First, check that the offline generated scripts don't have any. |
|||
extract_partition(latest_part_image, 1) |
|||
try: |
|||
subprocess.check_call( |
|||
["mcopy", "-i", "img1.fs", "::/grub-mender-grubenv/grub.cfg", "."] |
|||
) |
|||
check_all_root_occurrences_valid("grub.cfg") |
|||
finally: |
|||
os.remove("img1.fs") |
|||
os.remove("grub.cfg") |
|||
|
|||
extract_partition(latest_part_image, 2) |
|||
try: |
|||
subprocess.check_call( |
|||
[ |
|||
"debugfs", |
|||
"-R", |
|||
"dump -p /boot/grub-mender-grubenv.cfg grub-mender-grubenv.cfg", |
|||
"img2.fs", |
|||
] |
|||
) |
|||
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
|||
finally: |
|||
os.remove("img2.fs") |
|||
os.remove("grub-mender-grubenv.cfg") |
|||
|
|||
# Then, check that the runtime generated scripts don't have any. |
|||
get_no_sftp("/boot/grub/grub.cfg", connection) |
|||
try: |
|||
check_all_root_occurrences_valid("grub.cfg") |
|||
finally: |
|||
os.remove("grub.cfg") |
|||
|
|||
get_no_sftp("/boot/grub-mender-grubenv.cfg", connection) |
|||
try: |
|||
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
|||
finally: |
|||
os.remove("grub-mender-grubenv.cfg") |
|||
|
|||
# Check again after running `update-grub`. |
|||
connection.run("grub-install && update-grub") |
|||
get_no_sftp("/boot/grub/grub.cfg", connection) |
|||
try: |
|||
check_all_root_occurrences_valid("grub.cfg") |
|||
finally: |
|||
os.remove("grub.cfg") |
|||
|
|||
get_no_sftp("/boot/grub-mender-grubenv.cfg", connection) |
|||
try: |
|||
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
|||
finally: |
|||
os.remove("grub-mender-grubenv.cfg") |
|||
|
|||
@pytest.mark.min_mender_version("1.0.0") |
|||
def test_offline_and_runtime_boot_scripts_identical(self, connection): |
|||
# Update scripts at runtime. |
|||
connection.run("grub-install && update-grub") |
|||
|
|||
# Take advantage of the copies already made by cleanup_boot_scripts |
|||
# fixture above, and use the copies in /data. |
|||
|
|||
# Take into account some known, but harmless differences. The "hd0,gpt1" |
|||
# style location is missing from the offline generated grub-efi.cfg |
|||
# file, but it is harmless because the filesystem UUID is being used |
|||
# instead. |
|||
connection.run( |
|||
r"sed -Ee 's/ *hd[0-9]+,gpt[0-9]+//' " |
|||
"$(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*') " |
|||
"> /data/new-grub-efi-modified.cfg" |
|||
) |
|||
try: |
|||
connection.run("diff -u /data/grub-efi.cfg /data/new-grub-efi-modified.cfg") |
|||
finally: |
|||
connection.run("rm -f /data/new-grub-efi-modified.cfg") |
|||
|
|||
# Another few differences we work around in the main grub files: |
|||
# * `--hint` parameters are not generated in offline copy. |
|||
# * `root` variable is not set in offline copy. |
|||
# * `fwsetup` is added somewhat randomly depending on availability both |
|||
# on build host and device. |
|||
try: |
|||
connection.run("cp /data/grub-main.cfg /data/old-grub-modified.cfg") |
|||
connection.run("cp /boot/grub/grub.cfg /data/new-grub-modified.cfg") |
|||
connection.run( |
|||
r"sed -i -En -e '/\bsearch\b/{s/ --hint[^ ]*//g;}' " |
|||
"-e \"/^set root='hd0,gpt1'$/d\" " |
|||
r"-e '\,### BEGIN /etc/grub.d/30_uefi-firmware ###,{p; n; :loop; \,### END /etc/grub.d/30_uefi-firmware ###,b end; n; b loop; :end;}' " |
|||
"-e p " |
|||
"/data/old-grub-modified.cfg /data/new-grub-modified.cfg" |
|||
) |
|||
connection.run("diff -u /data/old-grub-modified.cfg /data/new-grub-modified.cfg") |
|||
finally: |
|||
connection.run("rm -f /data/old-grub-modified.cfg /data/new-grub-modified.cfg") |
|||
|
|||
# Same differences as in previous check. |
|||
try: |
|||
connection.run("cp /data/grub-mender-grubenv.cfg /data/old-grub-mender-grubenv-modified.cfg") |
|||
connection.run("cp /boot/grub-mender-grubenv.cfg /data/new-grub-mender-grubenv-modified.cfg") |
|||
connection.run( |
|||
r"sed -i -En -e '/\bsearch\b/{s/ --hint[^ ]*//g;}' " |
|||
"-e \"/^set root='hd0,gpt1'$/d\" " |
|||
r"-e '\,### BEGIN /etc/grub.d/30_uefi-firmware ###,{p; n; :loop; \,### END /etc/grub.d/30_uefi-firmware ###,b end; n; b loop; :end;}' " |
|||
"-e p " |
|||
"/data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg" |
|||
) |
|||
connection.run( |
|||
"diff -u /data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg" |
|||
) |
|||
finally: |
|||
connection.run("rm -f /data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg") |
|||
Binary file not shown.
Binary file not shown.
@ -0,0 +1,71 @@ |
|||
UEFI NVRAM |
|||
========== |
|||
|
|||
This directory holds the NVRAM file which is used as the firmware memory of the UEFI software which |
|||
runs under QEMU. It's main purpose is to start the UEFI software with certificates pre-loaded into |
|||
the firmware memory, and Secure Boot enabled. |
|||
|
|||
How to recreate the `OVMF_VARS.fd` file |
|||
-------------------------------- |
|||
|
|||
1. Create the `OVMF_VARS.fd` file: |
|||
```bash |
|||
cp /usr/share/OVMF/OVMF_VARS.fd OVMF_VARS.fd |
|||
``` |
|||
|
|||
2. Create a filesystem which contains the UEFI certificates: |
|||
```bash |
|||
dd if=/dev/zero of=/tmp/cert-filesystem.fs bs=1M count=10; \ |
|||
mkfs.vfat /tmp/cert-filesystem.fs; \ |
|||
mkdir cert-filesystem; \ |
|||
sudo mount /tmp/cert-filesystem.fs cert-filesystem -o loop,uid=$UID; \ |
|||
cp *.crt cert-filesystem; \ |
|||
sudo umount cert-filesystem; \ |
|||
rmdir cert-filesystem |
|||
``` |
|||
|
|||
Tip: If you ever need to re-fetch the certificate files, run `mokutil --db` on your own |
|||
computer. This lists your installed certificates, and they come with URLs which say where you can |
|||
download them. Make sure you download the `.crt`, not the `.crl`. |
|||
|
|||
3. Launch QEMU with the NVRAM and the filesystem containing the certificates. *Make sure to press F2 |
|||
quickly after the window appears to enter the firmware menu*: |
|||
```bash |
|||
qemu-system-x86_64 \ |
|||
-drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ |
|||
-drive file=./OVMF_VARS.fd,if=pflash,format=raw,unit=1 \ |
|||
-drive file=/tmp/cert-filesystem.fs,if=ide,format=raw |
|||
``` |
|||
|
|||
4. After having entered the firmware menu, perform the following steps: |
|||
|
|||
1. Enter "Device Manager". |
|||
|
|||
2. Enter "Secure Boot Configuration". |
|||
|
|||
3. Switch "Secure Boot Mode" to "Custom Mode". |
|||
|
|||
4. Enter "Custom Secure Boot Options". |
|||
|
|||
5. Enter "PK Options". |
|||
|
|||
6. Enter "Enroll OK". |
|||
|
|||
7. Enter "Enroll PK Using File". |
|||
|
|||
8. Locate the certificate file in the filesystem that you created in main step 2, and add it. |
|||
|
|||
9. Make sure to select "Commit Changes". |
|||
|
|||
10. Repeat the same process starting from sub step 5, except for "DB Options" instead. |
|||
|
|||
11. Go back to the "Secure Boot Configuration" screen. "Attempt Secure Boot" should now have |
|||
been auto-selected. If it's not, enable it and save the change. |
|||
|
|||
12. Go back to the main manu and select "Reset". After the setup has been exited, you can kill |
|||
QEMU. |
|||
|
|||
5. Clean up: |
|||
```bash |
|||
rm -f /tmp/cert-filesystem.fs |
|||
``` |
|||
Loading…
Reference in new issue