msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V9.14.022.2026.06.10: Attest selected decrypted rootfs mapper

Browse Source
This commit is contained in:
André H. Zimnol
2026-06-10 23:13:23 +02:00
parent b78779e790
commit 42e2ae6b0e
3 changed files with 207 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest
+97 -18
View File
@@ -15,14 +15,11 @@
# SPDX-Security-Contact: security@coresecret.eu
# Module summary:
# - Runs after the encrypted live root filesystem has been decrypted.
# - Requires the pinned public key, attestation hash file, and detached signature to exist as readable, non-empty regular files
# inside the decrypted rootfs.
# - Verifies the attestation signature with gpgv against the pinned key material.
# - Confirms that the signature fingerprint matches the build-time expected rootfs fingerprint and panics on missing, malformed,
# or mismatched evidence.
_SAVED_SET_OPTS="$(set +o)"
# - Runs after the encrypted live root filesystem has been decrypted and selected for the SquashFS root mount.
# - Requires the pinned public key and the signed decrypted-mapper SHA-512 manifest from the mounted live medium.
# - Verifies the manifest signature and pinned signer fingerprint, then verifies the complete selected decrypted mapper against
# the manifest.
# - Panics on missing, malformed, mismatched, or unverifiable evidence.
set -eu
@@ -37,9 +34,12 @@ export CDLB_EXP_CA_FPR="@EXP_CA_FPR@"
### Name of the top-level dm-crypt mapping (e.g., cryptsetup --label): zzzz_ciss_crypt_squash.hook.binary ----------------------
export CDLB_MAPPER_NAME="${CDLB_MAPPER_NAME:-crypt_liveiso}"
### Attestation file locations inside decrypted rootfs. ------------------------------------------------------------------------
CDLB_ATTEST_FPR_SHA="${CDLB_ATTEST_FPR_SHA:-/root/root/.ciss/attestation/${CDLB_EXP_FPR}.gpg.sha512sum.txt}"
CDLB_ATTEST_FPR_SIG="${CDLB_ATTEST_FPR_SIG:-/root/root/.ciss/attestation/${CDLB_EXP_FPR}.gpg.sha512sum.txt.sig}"
### Rootfs selection and attestation file locations. ---------------------------------------------------------------------------
CDLB_LUKS_FS="${CDLB_LUKS_FS:-/live/ciss_rootfs.crypt}"
CDLB_MAPPER_DEV="${CDLB_MAPPER_DEV:-/dev/mapper/${CDLB_MAPPER_NAME}}"
CDLB_MNT_MEDIUM="${CDLB_MNT_MEDIUM:-/run/live/medium}"
CDLB_ATTEST_ROOTFS_SHA="${CDLB_ATTEST_ROOTFS_SHA:-${CDLB_MNT_MEDIUM}${CDLB_LUKS_FS}.decrypted.sha512sum.txt}"
CDLB_ATTEST_ROOTFS_SIG="${CDLB_ATTEST_ROOTFS_SIG:-${CDLB_ATTEST_ROOTFS_SHA}.sig}"
CDLB_KEY_DIR="${CDLB_KEY_DIR:-/etc/ciss/keys}"
### Declare functions ----------------------------------------------------------------------------------------------------------
@@ -91,11 +91,13 @@ require_attestation_file() {
log_er "0042() : ${artifact_label} is a broken symlink, not a regular file: [${artifact_path}]"
panic "0042() : ${artifact_label} is a broken symlink, not a regular file: [${artifact_path}]"
return 1
fi
log_er "0042() : ${artifact_label} missing: [${artifact_path}]"
panic "0042() : ${artifact_label} missing: [${artifact_path}]"
return 1
fi
@@ -103,6 +105,7 @@ require_attestation_file() {
log_er "0042() : ${artifact_label} is not a regular file: [${artifact_path}]"
panic "0042() : ${artifact_label} is not a regular file: [${artifact_path}]"
return 1
fi
@@ -110,6 +113,7 @@ require_attestation_file() {
log_er "0042() : ${artifact_label} is empty: [${artifact_path}]"
panic "0042() : ${artifact_label} is empty: [${artifact_path}]"
return 1
fi
@@ -117,23 +121,56 @@ require_attestation_file() {
log_er "0042() : ${artifact_label} is not readable: [${artifact_path}]"
panic "0042() : ${artifact_label} is not readable: [${artifact_path}]"
return 1
fi
return 0
}
HASH_FILE="${CDLB_ATTEST_FPR_SHA}"
SIGN_FILE="${CDLB_ATTEST_FPR_SIG}"
#######################################
# Validate the selected decrypted rootfs payload.
# Globals:
# None
# Arguments:
# 1: Absolute payload path
# Returns:
# 0: on success
#######################################
require_rootfs_payload() {
payload_path="${1}"
if [ ! -b "${payload_path}" ]; then
log_er "0042() : Selected rootfs payload is not a block device: [${payload_path}]"
panic "0042() : Selected rootfs payload is not a block device: [${payload_path}]"
return 1
fi
if [ ! -r "${payload_path}" ]; then
log_er "0042() : Selected rootfs payload is not readable: [${payload_path}]"
panic "0042() : Selected rootfs payload is not readable: [${payload_path}]"
return 1
fi
return 0
}
HASH_FILE="${CDLB_ATTEST_ROOTFS_SHA}"
SIGN_FILE="${CDLB_ATTEST_ROOTFS_SIG}"
KEYFILE="${CDLB_KEY_DIR}/${CDLB_EXP_FPR}.gpg"
require_attestation_file "Public key" "${KEYFILE}"
require_attestation_file "Attestation data" "${HASH_FILE}"
require_attestation_file "Attestation signature" "${SIGN_FILE}"
require_attestation_file "Rootfs attestation manifest" "${HASH_FILE}"
require_attestation_file "Rootfs attestation signature" "${SIGN_FILE}"
require_rootfs_payload "${CDLB_MAPPER_DEV}"
log_in "0042() : Verifying rootfs attestation with 'gpgv' and inside LUKS encrypted rootfs pinned GPG FPR."
log_in "0042() : Verifying signed rootfs attestation manifest with pinned GPG FPR."
if ! _STATUS="$(/usr/bin/gpgv --keyring "${KEYFILE}" --status-fd 1 "${SIGN_FILE}" "${HASH_FILE}" 2>&1)"; then
if ! _STATUS="$(/usr/bin/gpgv --no-default-keyring --keyring "${KEYFILE}" --status-fd 1 "${SIGN_FILE}" "${HASH_FILE}" 2>&1)"; then
log_er "0042() : gpgv verification failed for signature: [${SIGN_FILE}]"
@@ -145,6 +182,7 @@ if ! _STATUS="$(/usr/bin/gpgv --keyring "${KEYFILE}" --status-fd 1 "${SIGN_FILE}
sleep 8
panic "0042() : gpgv verification failed for signature: [${SIGN_FILE}]"
exit 1
fi
@@ -160,10 +198,51 @@ else
log_er "0042() : Signature FPR mismatch: got: [${_CDLB_SIG_FILE_FPR}] expected: [${CDLB_EXP_FPR}]"
sleep 8
panic "[FATAL] Signature FPR mismatch: got: [${_CDLB_SIG_FILE_FPR}] expected: [${CDLB_EXP_FPR}]."
exit 1
fi
eval "${_SAVED_SET_OPTS}"
_ATTEST_RECORD_COUNT="$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' "${HASH_FILE}")"
if [ "${_ATTEST_RECORD_COUNT}" -ne 1 ]; then
log_er "0042() : Rootfs attestation manifest must contain exactly one checksum record: [${HASH_FILE}]"
sleep 8
panic "0042() : Rootfs attestation manifest must contain exactly one checksum record: [${HASH_FILE}]"
exit 1
fi
_ATTESTED_PAYLOAD="$(awk 'NF && $1 !~ /^#/ { print $2; exit }' "${HASH_FILE}")"
if [ "${_ATTESTED_PAYLOAD}" != "${CDLB_MAPPER_DEV}" ]; then
log_er "0042() : Rootfs attestation manifest targets [${_ATTESTED_PAYLOAD}], expected selected payload [${CDLB_MAPPER_DEV}]"
sleep 8
panic "0042() : Rootfs attestation manifest does not target the selected rootfs payload."
exit 1
fi
log_in "0042() : Verifying selected decrypted rootfs mapper content: [${CDLB_MAPPER_DEV}]"
if ! _CHECKSUM_STATUS="$(cd / && LC_ALL=C /usr/bin/sha512sum -c --strict --quiet "${HASH_FILE}" 2>&1)"; then
log_er "0042() : Rootfs payload checksum verification failed: [${CDLB_MAPPER_DEV}]"
if [ -n "${_CHECKSUM_STATUS}" ]; then
printf '%s\n' "${_CHECKSUM_STATUS}" >&2
fi
sleep 8
panic "0042() : Rootfs payload checksum verification failed: [${CDLB_MAPPER_DEV}]"
exit 1
fi
log_ok "0042() : Rootfs payload checksum verification successful: [${CDLB_MAPPER_DEV}]"
printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] \n\e[0m"