Kristian Amlie
3 years ago
committed by
GitHub
GitHub
18 changed files with 596 additions and 69 deletions
@ -0,0 +1,169 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
set -e |
||||
|
|
||||
|
usage() { |
||||
|
cat 1>&2 <<EOF |
||||
|
Please run with either "debian" or "ubuntu" as argument. |
||||
|
EOF |
||||
|
} |
||||
|
|
||||
|
if [ "$UID" -ne 0 ]; then |
||||
|
echo "We'll need root for this..." 1>&2 |
||||
|
exec sudo "$0" "$@" |
||||
|
fi |
||||
|
|
||||
|
while [ -n "$1" ]; do |
||||
|
case "$1" in |
||||
|
"ubuntu") |
||||
|
GENERATE_VARIANT=generate_ubuntu |
||||
|
;; |
||||
|
"debian") |
||||
|
GENERATE_VARIANT=generate_debian |
||||
|
;; |
||||
|
*) |
||||
|
usage |
||||
|
exit 1 |
||||
|
;; |
||||
|
esac |
||||
|
shift |
||||
|
done |
||||
|
|
||||
|
cleanup_losetup() { |
||||
|
set +e |
||||
|
for dev in ${LO_DEVICE}p*; do |
||||
|
umount $dev |
||||
|
done |
||||
|
losetup -d $LO_DEVICE |
||||
|
rmdir tmp-p1 |
||||
|
rmdir tmp-p2 |
||||
|
} |
||||
|
|
||||
|
generate_debian() { |
||||
|
local -r image="Debian-11-x86-64.img" |
||||
|
|
||||
|
mkosi --root-size=2G --distribution=debian --release=bullseye --format=gpt_ext4 --bootable --checksum \ |
||||
|
--password password --package=openssh-server,dhcpcd5 --package grub-efi-amd64-signed \ |
||||
|
--package shim-signed --package lsb-release --output="$image" build |
||||
|
|
||||
|
post_process_image "$image" |
||||
|
|
||||
|
echo "Image successfully generated!" 1>&2 |
||||
|
} |
||||
|
|
||||
|
generate_ubuntu() { |
||||
|
local -r image="Ubuntu-Focal-x86-64.img" |
||||
|
|
||||
|
mkosi --root-size=2G --distribution=ubuntu --release=focal --format=gpt_ext4 --bootable --checksum \ |
||||
|
--password password --package=openssh-server,dhcpcd5 --package grub-efi-amd64-signed \ |
||||
|
--package shim-signed --package lsb-release --output="$image" build |
||||
|
|
||||
|
post_process_image "$image" |
||||
|
|
||||
|
echo "Image successfully generated!" 1>&2 |
||||
|
} |
||||
|
|
||||
|
post_process_image() { |
||||
|
local -r image="$1" |
||||
|
|
||||
|
mkdir -p tmp-p1 |
||||
|
mkdir -p tmp-p2 |
||||
|
|
||||
|
LO_DEVICE=$(losetup --find --show --partscan "$image") |
||||
|
trap cleanup_losetup EXIT |
||||
|
mount ${LO_DEVICE}p1 tmp-p1 |
||||
|
mount ${LO_DEVICE}p2 tmp-p2 |
||||
|
|
||||
|
pre_tweaks tmp-p1 tmp-p2 |
||||
|
|
||||
|
create_grub_regeneration_service tmp-p1 tmp-p2 |
||||
|
umount tmp-p1 |
||||
|
umount tmp-p2 |
||||
|
regenerate_grub_live "$image" |
||||
|
mount ${LO_DEVICE}p1 tmp-p1 |
||||
|
mount ${LO_DEVICE}p2 tmp-p2 |
||||
|
|
||||
|
post_tweaks tmp-p1 tmp-p2 |
||||
|
} |
||||
|
|
||||
|
pre_tweaks() { |
||||
|
local -r boot="$1" |
||||
|
local -r root="$2" |
||||
|
|
||||
|
# Fstab is missing for some reason. I'm not exactly sure why systemd-boot |
||||
|
# works without this, and GRUB doesn't. |
||||
|
cat > "$root/etc/fstab" <<EOF |
||||
|
/dev/root / auto defaults 0 0 |
||||
|
/dev/sda1 /boot/efi auto defaults 0 0 |
||||
|
EOF |
||||
|
|
||||
|
# Real installers create a /etc/default/grub file with a distributor in |
||||
|
# them. |
||||
|
if [ ! -e "$root/etc/default/grub" ]; then |
||||
|
mkdir -p $root/etc/default |
||||
|
echo 'GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null`' > $root/etc/default/grub |
||||
|
fi |
||||
|
|
||||
|
sed -E -i -e 's/^#? *PermitRootLogin .*/PermitRootLogin yes/' $root/etc/ssh/sshd_config |
||||
|
} |
||||
|
|
||||
|
post_tweaks() { |
||||
|
local -r boot="$1" |
||||
|
local -r root="$2" |
||||
|
|
||||
|
# Delete systemd-boot, which isn't normally present in images that were |
||||
|
# installed with OS installers, at least not at the time of writing. |
||||
|
rm -rf "$boot/EFI/systemd" |
||||
|
|
||||
|
# Also replace bootx64.efi, which is the default bootloader. Mkosi installs |
||||
|
# systemd-bootx86.efi, but we want the shim. |
||||
|
rm -f "$boot/EFI/BOOT/*" |
||||
|
mkdir -p "$boot/EFI/BOOT" |
||||
|
cp "$root/usr/lib/shim/shimx64.efi.signed" "$boot/EFI/BOOT/BOOTX64.EFI" |
||||
|
} |
||||
|
|
||||
|
# Unfortunately installing grub scripts is something which is not really |
||||
|
# possible when offline. This is something which is easier with systemd-boot, so |
||||
|
# longterm GRUB will probably follow, or systemd-boot will take over. Anyway, |
||||
|
# let's do it by using a systemd service to perform the job, and then shut down. |
||||
|
create_grub_regeneration_service() { |
||||
|
local -r boot="$1" |
||||
|
local -r root="$2" |
||||
|
|
||||
|
cat > "$root/etc/systemd/system/mender-regenerate-grub-and-shutdown.service" <<EOF |
||||
|
[Unit] |
||||
|
Description=Regenerate grub scripts, disable itself and then shut down. |
||||
|
|
||||
|
[Service] |
||||
|
Type=oneshot |
||||
|
ExecStart=sh -c "grub-install && update-grub && systemctl disable mender-regenerate-grub-and-shutdown.service && poweroff" |
||||
|
EOF |
||||
|
|
||||
|
ln -sf "$root/etc/systemd/system/mender-regenerate-grub-and-shutdown.service" "$root/etc/systemd/system/multi-user.target.wants/" |
||||
|
} |
||||
|
|
||||
|
regenerate_grub_live() { |
||||
|
local -r image="$1" |
||||
|
|
||||
|
local -r nvvars=$(mktemp) |
||||
|
dd if=/dev/zero of="$nvvars" bs=1M count=1 |
||||
|
|
||||
|
local ret=0 |
||||
|
for maybe_kvm in -enable-kvm ""; do |
||||
|
ret=0 |
||||
|
echo "Generating GRUB boot files live..." 1>&2 |
||||
|
qemu-system-x86_64 \ |
||||
|
$maybe_kvm \ |
||||
|
-drive file="$image",if=ide,format=raw \ |
||||
|
-drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ |
||||
|
-drive file="$nvvars",if=pflash,format=raw,unit=1 \ |
||||
|
-display vnc=:23 \ |
||||
|
-m 512 \ |
||||
|
|| ret=$? |
||||
|
[ $ret -eq 0 ] && break |
||||
|
done |
||||
|
|
||||
|
return $ret |
||||
|
} |
||||
|
|
||||
|
$GENERATE_VARIANT |
||||
@ -1 +1 @@ |
|||||
Subproject commit ee1266afe8ec58efce9b4223e2489ac023b0582f |
Subproject commit 7c081c042f0024e87e9e15144b18d991fb378bcd |
||||
@ -0,0 +1,199 @@ |
|||||
|
#!/usr/bin/python |
||||
|
# Copyright 2022 Northern.tech AS |
||||
|
# |
||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
# you may not use this file except in compliance with the License. |
||||
|
# You may obtain a copy of the License at |
||||
|
# |
||||
|
# http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
# |
||||
|
# Unless required by applicable law or agreed to in writing, software |
||||
|
# distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
# See the License for the specific language governing permissions and |
||||
|
# limitations under the License. |
||||
|
|
||||
|
import pytest |
||||
|
import re |
||||
|
import os |
||||
|
import subprocess |
||||
|
|
||||
|
from utils.common import ( |
||||
|
extract_partition, |
||||
|
get_no_sftp, |
||||
|
) |
||||
|
|
||||
|
|
||||
|
@pytest.fixture(scope="function") |
||||
|
def cleanup_boot_scripts(request, connection): |
||||
|
"""Take a backup of the various grub.cfg files and restore them after the |
||||
|
test. This is recommended for tests that call `grub-install` and/or |
||||
|
`update-grub`, so that other tests can also run them from a pristine |
||||
|
state.""" |
||||
|
|
||||
|
connection.run( |
||||
|
"cp $(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*') /data/grub-efi.cfg" |
||||
|
) |
||||
|
connection.run("cp /boot/grub/grub.cfg /data/grub-main.cfg") |
||||
|
connection.run("cp /boot/grub-mender-grubenv.cfg /data/grub-mender-grubenv.cfg") |
||||
|
|
||||
|
def cleanup(): |
||||
|
connection.run( |
||||
|
"mv /data/grub-efi.cfg $(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*')" |
||||
|
) |
||||
|
connection.run("mv /data/grub-main.cfg /boot/grub/grub.cfg") |
||||
|
connection.run("mv /data/grub-mender-grubenv.cfg /boot/grub-mender-grubenv.cfg") |
||||
|
|
||||
|
request.addfinalizer(cleanup) |
||||
|
|
||||
|
|
||||
|
def check_all_root_occurrences_valid(grub_cfg): |
||||
|
found_expected = False |
||||
|
inside_10_header = False |
||||
|
# One of the functions we define and use. |
||||
|
expected = "mender_check_and_restore_env" |
||||
|
with open(grub_cfg) as fd: |
||||
|
lineno = 0 |
||||
|
for line in fd.readlines(): |
||||
|
lineno += 1 |
||||
|
if re.match(r'^\s*root="\$\{mender_grub_storage_device\}', line): |
||||
|
continue |
||||
|
|
||||
|
if line.strip() == "### BEGIN /etc/grub.d/00_header ###": |
||||
|
# We allow root references inside the 00_header, because they |
||||
|
# are overriden by Mender later. |
||||
|
inside_10_header = True |
||||
|
elif line.strip() == "### END /etc/grub.d/00_header ###": |
||||
|
inside_10_header = False |
||||
|
if not inside_10_header and re.match(r"^\s*(set +)?root=", line): |
||||
|
pytest.fail( |
||||
|
"Found unexpected occurrence of `root=` in grub boot script\n" |
||||
|
"%d:%s" % (lineno, line) |
||||
|
) |
||||
|
|
||||
|
if line.find(expected) >= 0: |
||||
|
found_expected = True |
||||
|
|
||||
|
assert found_expected, "Expected content (%s) not found" % expected |
||||
|
|
||||
|
|
||||
|
@pytest.mark.usefixtures("setup_board", "cleanup_boot_scripts") |
||||
|
class TestGrubIntegration: |
||||
|
@pytest.mark.min_mender_version("1.0.0") |
||||
|
def test_no_root_occurrences(self, connection, latest_part_image): |
||||
|
"""Test that the generated grub scripts do not contain any occurrences of |
||||
|
`root=<something>` except for known instances that we control. This is |
||||
|
important because Mender needs to keep tight control of when this |
||||
|
variable is set, in order to boot from, and mount, the correct root |
||||
|
partition.""" |
||||
|
|
||||
|
# First, check that the offline generated scripts don't have any. |
||||
|
extract_partition(latest_part_image, 1) |
||||
|
try: |
||||
|
subprocess.check_call( |
||||
|
["mcopy", "-i", "img1.fs", "::/grub-mender-grubenv/grub.cfg", "."] |
||||
|
) |
||||
|
check_all_root_occurrences_valid("grub.cfg") |
||||
|
finally: |
||||
|
os.remove("img1.fs") |
||||
|
os.remove("grub.cfg") |
||||
|
|
||||
|
extract_partition(latest_part_image, 2) |
||||
|
try: |
||||
|
subprocess.check_call( |
||||
|
[ |
||||
|
"debugfs", |
||||
|
"-R", |
||||
|
"dump -p /boot/grub-mender-grubenv.cfg grub-mender-grubenv.cfg", |
||||
|
"img2.fs", |
||||
|
] |
||||
|
) |
||||
|
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
||||
|
finally: |
||||
|
os.remove("img2.fs") |
||||
|
os.remove("grub-mender-grubenv.cfg") |
||||
|
|
||||
|
# Then, check that the runtime generated scripts don't have any. |
||||
|
get_no_sftp("/boot/grub/grub.cfg", connection) |
||||
|
try: |
||||
|
check_all_root_occurrences_valid("grub.cfg") |
||||
|
finally: |
||||
|
os.remove("grub.cfg") |
||||
|
|
||||
|
get_no_sftp("/boot/grub-mender-grubenv.cfg", connection) |
||||
|
try: |
||||
|
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
||||
|
finally: |
||||
|
os.remove("grub-mender-grubenv.cfg") |
||||
|
|
||||
|
# Check again after running `update-grub`. |
||||
|
connection.run("grub-install && update-grub") |
||||
|
get_no_sftp("/boot/grub/grub.cfg", connection) |
||||
|
try: |
||||
|
check_all_root_occurrences_valid("grub.cfg") |
||||
|
finally: |
||||
|
os.remove("grub.cfg") |
||||
|
|
||||
|
get_no_sftp("/boot/grub-mender-grubenv.cfg", connection) |
||||
|
try: |
||||
|
check_all_root_occurrences_valid("grub-mender-grubenv.cfg") |
||||
|
finally: |
||||
|
os.remove("grub-mender-grubenv.cfg") |
||||
|
|
||||
|
@pytest.mark.min_mender_version("1.0.0") |
||||
|
def test_offline_and_runtime_boot_scripts_identical(self, connection): |
||||
|
# Update scripts at runtime. |
||||
|
connection.run("grub-install && update-grub") |
||||
|
|
||||
|
# Take advantage of the copies already made by cleanup_boot_scripts |
||||
|
# fixture above, and use the copies in /data. |
||||
|
|
||||
|
# Take into account some known, but harmless differences. The "hd0,gpt1" |
||||
|
# style location is missing from the offline generated grub-efi.cfg |
||||
|
# file, but it is harmless because the filesystem UUID is being used |
||||
|
# instead. |
||||
|
connection.run( |
||||
|
r"sed -Ee 's/ *hd[0-9]+,gpt[0-9]+//' " |
||||
|
"$(find /boot/efi/EFI/ -name grub.cfg -not -path '*/EFI/BOOT/*') " |
||||
|
"> /data/new-grub-efi-modified.cfg" |
||||
|
) |
||||
|
try: |
||||
|
connection.run("diff -u /data/grub-efi.cfg /data/new-grub-efi-modified.cfg") |
||||
|
finally: |
||||
|
connection.run("rm -f /data/new-grub-efi-modified.cfg") |
||||
|
|
||||
|
# Another few differences we work around in the main grub files: |
||||
|
# * `--hint` parameters are not generated in offline copy. |
||||
|
# * `root` variable is not set in offline copy. |
||||
|
# * `fwsetup` is added somewhat randomly depending on availability both |
||||
|
# on build host and device. |
||||
|
try: |
||||
|
connection.run("cp /data/grub-main.cfg /data/old-grub-modified.cfg") |
||||
|
connection.run("cp /boot/grub/grub.cfg /data/new-grub-modified.cfg") |
||||
|
connection.run( |
||||
|
r"sed -i -En -e '/\bsearch\b/{s/ --hint[^ ]*//g;}' " |
||||
|
"-e \"/^set root='hd0,gpt1'$/d\" " |
||||
|
r"-e '\,### BEGIN /etc/grub.d/30_uefi-firmware ###,{p; n; :loop; \,### END /etc/grub.d/30_uefi-firmware ###,b end; n; b loop; :end;}' " |
||||
|
"-e p " |
||||
|
"/data/old-grub-modified.cfg /data/new-grub-modified.cfg" |
||||
|
) |
||||
|
connection.run("diff -u /data/old-grub-modified.cfg /data/new-grub-modified.cfg") |
||||
|
finally: |
||||
|
connection.run("rm -f /data/old-grub-modified.cfg /data/new-grub-modified.cfg") |
||||
|
|
||||
|
# Same differences as in previous check. |
||||
|
try: |
||||
|
connection.run("cp /data/grub-mender-grubenv.cfg /data/old-grub-mender-grubenv-modified.cfg") |
||||
|
connection.run("cp /boot/grub-mender-grubenv.cfg /data/new-grub-mender-grubenv-modified.cfg") |
||||
|
connection.run( |
||||
|
r"sed -i -En -e '/\bsearch\b/{s/ --hint[^ ]*//g;}' " |
||||
|
"-e \"/^set root='hd0,gpt1'$/d\" " |
||||
|
r"-e '\,### BEGIN /etc/grub.d/30_uefi-firmware ###,{p; n; :loop; \,### END /etc/grub.d/30_uefi-firmware ###,b end; n; b loop; :end;}' " |
||||
|
"-e p " |
||||
|
"/data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg" |
||||
|
) |
||||
|
connection.run( |
||||
|
"diff -u /data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg" |
||||
|
) |
||||
|
finally: |
||||
|
connection.run("rm -f /data/old-grub-mender-grubenv-modified.cfg /data/new-grub-mender-grubenv-modified.cfg") |
||||
Binary file not shown.
Binary file not shown.
@ -0,0 +1,71 @@ |
|||||
|
UEFI NVRAM |
||||
|
========== |
||||
|
|
||||
|
This directory holds the NVRAM file which is used as the firmware memory of the UEFI software which |
||||
|
runs under QEMU. It's main purpose is to start the UEFI software with certificates pre-loaded into |
||||
|
the firmware memory, and Secure Boot enabled. |
||||
|
|
||||
|
How to recreate the `OVMF_VARS.fd` file |
||||
|
-------------------------------- |
||||
|
|
||||
|
1. Create the `OVMF_VARS.fd` file: |
||||
|
```bash |
||||
|
cp /usr/share/OVMF/OVMF_VARS.fd OVMF_VARS.fd |
||||
|
``` |
||||
|
|
||||
|
2. Create a filesystem which contains the UEFI certificates: |
||||
|
```bash |
||||
|
dd if=/dev/zero of=/tmp/cert-filesystem.fs bs=1M count=10; \ |
||||
|
mkfs.vfat /tmp/cert-filesystem.fs; \ |
||||
|
mkdir cert-filesystem; \ |
||||
|
sudo mount /tmp/cert-filesystem.fs cert-filesystem -o loop,uid=$UID; \ |
||||
|
cp *.crt cert-filesystem; \ |
||||
|
sudo umount cert-filesystem; \ |
||||
|
rmdir cert-filesystem |
||||
|
``` |
||||
|
|
||||
|
Tip: If you ever need to re-fetch the certificate files, run `mokutil --db` on your own |
||||
|
computer. This lists your installed certificates, and they come with URLs which say where you can |
||||
|
download them. Make sure you download the `.crt`, not the `.crl`. |
||||
|
|
||||
|
3. Launch QEMU with the NVRAM and the filesystem containing the certificates. *Make sure to press F2 |
||||
|
quickly after the window appears to enter the firmware menu*: |
||||
|
```bash |
||||
|
qemu-system-x86_64 \ |
||||
|
-drive file=/usr/share/OVMF/OVMF_CODE.fd,if=pflash,format=raw,unit=0,readonly=on \ |
||||
|
-drive file=./OVMF_VARS.fd,if=pflash,format=raw,unit=1 \ |
||||
|
-drive file=/tmp/cert-filesystem.fs,if=ide,format=raw |
||||
|
``` |
||||
|
|
||||
|
4. After having entered the firmware menu, perform the following steps: |
||||
|
|
||||
|
1. Enter "Device Manager". |
||||
|
|
||||
|
2. Enter "Secure Boot Configuration". |
||||
|
|
||||
|
3. Switch "Secure Boot Mode" to "Custom Mode". |
||||
|
|
||||
|
4. Enter "Custom Secure Boot Options". |
||||
|
|
||||
|
5. Enter "PK Options". |
||||
|
|
||||
|
6. Enter "Enroll OK". |
||||
|
|
||||
|
7. Enter "Enroll PK Using File". |
||||
|
|
||||
|
8. Locate the certificate file in the filesystem that you created in main step 2, and add it. |
||||
|
|
||||
|
9. Make sure to select "Commit Changes". |
||||
|
|
||||
|
10. Repeat the same process starting from sub step 5, except for "DB Options" instead. |
||||
|
|
||||
|
11. Go back to the "Secure Boot Configuration" screen. "Attempt Secure Boot" should now have |
||||
|
been auto-selected. If it's not, enable it and save the change. |
||||
|
|
||||
|
12. Go back to the main manu and select "Reset". After the setup has been exited, you can kill |
||||
|
QEMU. |
||||
|
|
||||
|
5. Clean up: |
||||
|
```bash |
||||
|
rm -f /tmp/cert-filesystem.fs |
||||
|
``` |
||||
Loading…
Reference in new issue