From 8ec8ce52893017a4659e8645b99be65a585403ba Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 12 Aug 2026 15:36:49 -0400 Subject: [PATCH] Fix pcr extend Using the subshell prevented variable from being set. No longer use a subshell. --- .../hooks/cmdline/10-confluentdiskless.sh | 68 ++++++++++--------- .../hooks/cmdline/10-confluentdiskless.sh | 19 +++--- .../hooks/cmdline/10-confluentdiskless.sh | 19 +++--- .../hooks/cmdline/10-confluentdiskless.sh | 20 +++--- .../initramfs/opt/confluent/bin/rungenesis | 17 ++--- .../hooks/cmdline/10-confluentdiskless.sh | 20 +++--- .../initramfs/scripts/init-premount/confluent | 19 +++--- 7 files changed, 98 insertions(+), 84 deletions(-) diff --git a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 20cf1d76..b87ccbf0 100644 --- a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,3 +1,32 @@ + +pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 + +set_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" + if [[ "$algo" == "sha256" ]]; then + pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + elif [[ "$algo" == "sha384" ]]; then + pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9 + elif [[ "$algo" == "sha512" ]]; then + pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb + fi + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + + get_remote_apikey() { while [ -z "$confluent_apikey" ]; do /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey @@ -14,10 +43,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -27,32 +56,6 @@ get_remote_apikey() { done } -pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 - -get_tpm_hashalgo() { - if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" - return 0 - fi - tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) - for algo in sha256 sha512 sha384; do - # Match only banks that actually have PCRs allocated (a digit in [ ... ]). - if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then - confluent_tpm_hashalgo="$algo" - if [[ "$algo" == "sha256" ]]; then - pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 - elif [[ "$algo" == "sha384" ]]; then - pcrextendvalue=20aaa1073c215c8bc97ff8dc509dd63ff09eef9d2dfa4d8ef224ce372d80e5417e53840ef2fb72924c195f69396a27b9 - elif [[ "$algo" == "sha512" ]]; then - pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb - fi - echo "$confluent_tpm_hashalgo" - return 0 - fi - done - return 1 -} - root=1 rootok=1 netroot=confluent @@ -108,8 +111,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -184,7 +187,8 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} + set_tpm_hashalgo + tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 269e2285..bec6e648 100644 --- a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,8 +1,8 @@ pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrchashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -10,6 +10,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -17,7 +18,6 @@ get_tpm_hashalgo() { elif [[ "$algo" == "sha512" ]]; then pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb fi - echo "$confluent_tpm_hashalgo" return 0 fi done @@ -39,10 +39,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -105,8 +105,8 @@ lasthdl="" if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_getcap ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -167,7 +167,8 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_pcrextend ]; then - tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} + set_tpm_hashalgo + tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} fi umask $oldumask autoconfigmethod=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg |awk '{print $2}') diff --git a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 54eed8e5..e83c6c29 100644 --- a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,8 +1,8 @@ pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -10,6 +10,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -17,7 +18,6 @@ get_tpm_hashalgo() { elif [[ "$algo" == "sha512" ]]; then pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb fi - echo "$confluent_tpm_hashalgo" return 0 fi done @@ -40,10 +40,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -109,8 +109,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -216,7 +216,8 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} + set_tpm_hashalgo + tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 95e14289..d0847c3b 100644 --- a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,8 +1,9 @@ pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" + pcrhashalgo="$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -10,6 +11,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -23,6 +25,7 @@ get_tpm_hashalgo() { done return 1 } + get_remote_apikey() { while [ -z "$confluent_apikey" ]; do /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey @@ -39,10 +42,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -106,8 +109,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_pcrbank=${get_tpm_hashalgo} - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -182,7 +185,8 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} + set_tpm_hashalgo + tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis index 21493c9c..051cff15 100644 --- a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis +++ b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis @@ -8,10 +8,10 @@ export LANG=en_US.utf8 (while :; do TERM=linux tmux a <> /dev/tty1 >&0 2>&1; done) & pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -19,6 +19,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -26,7 +27,6 @@ get_tpm_hashalgo() { elif [[ "$algo" == "sha512" ]]; then pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb fi - echo "$confluent_tpm_hashalgo" return 0 fi done @@ -137,8 +137,8 @@ oldumask=$(umask) umask 0077 for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -165,8 +165,8 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx (echo -n "CONFLUENT_APIKEY:$new_apikey") | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx @@ -175,7 +175,8 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then cd - > /dev/null rm -rf $tmpdir fi -tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} 2> /dev/null +set_tpm_hashalgo +tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} 2> /dev/null ifidx=$(cat /tmp/confluent.ifidx) ifname=$(ip link |grep ^$ifidx:|awk '{print $2}') ifname=${ifname%:} diff --git a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 1724fa26..4892a185 100644 --- a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,8 +1,9 @@ pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" + pcrhashalgo="$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -10,6 +11,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -17,7 +19,6 @@ get_tpm_hashalgo() { elif [[ "$algo" == "sha512" ]]; then pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb fi - echo "$confluent_tpm_hashalgo" return 0 fi done @@ -38,11 +39,11 @@ get_remote_apikey() { else tmpdir=$(mktemp -d) cd $tmpdir - tpm_algo=$(get_tpm_hashalgo) + set_tpm_hashalgo tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_algo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -105,8 +106,8 @@ cd $tpmdir lasthdl="" for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_algo=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -165,7 +166,8 @@ while [ $ready = "0" ]; do rm $tmperr done if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi -tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} +set_tpm_hashalgo +tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} umask $oldumask autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}') if [ "$autoconfigmethod" = "dhcp" ]; then diff --git a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent index ffc846eb..118f2ba7 100644 --- a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent +++ b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent @@ -1,10 +1,10 @@ #!/bin/sh pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +pcrhashalgo=sha256 -get_tpm_hashalgo() { +set_tpm_hashalgo() { if [ -n "$confluent_tpm_hashalgo" ]; then - echo "$confluent_tpm_hashalgo" return 0 fi tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) @@ -12,6 +12,7 @@ get_tpm_hashalgo() { # Match only banks that actually have PCRs allocated (a digit in [ ... ]). if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then confluent_tpm_hashalgo="$algo" + pcrhashalgo="$algo" if [[ "$algo" == "sha256" ]]; then pcrextendvalue=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 elif [[ "$algo" == "sha384" ]]; then @@ -19,7 +20,6 @@ get_tpm_hashalgo() { elif [[ "$algo" == "sha512" ]]; then pcrextendvalue=77113aa32ac249789c0cdcf24e78efdb81d5be0d878e9a9a750446ecf9b9b3b1c084194eb6187cfd890b8f61a7f2e79eb4d33f6f27827b862367897c8123bceb fi - echo "$confluent_tpm_hashalgo" return 0 fi done @@ -32,8 +32,8 @@ get_tpm_apikey() { if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if echo $unsealeddata | grep "^CONFLUENT_APIKEY:" > /dev/null; then @@ -69,10 +69,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm_pcrbank=$(get_tpm_hashalgo) - tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy + set_tpm_hashalgo + tpm2_policypcr -Q --session=session.ctx --pcr-list="${pcrhashalgo}:15" --policy=pcr15.${pcrhashalgo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${pcrhashalgo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -174,7 +174,8 @@ done mkdir -p /root/.ssh cat /ssh/*pubkey > /root/.ssh/authorized_keys if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:$(get_tpm_hashalgo)=${pcrextendvalue} + set_tpm_hashalgo + tpm2_pcrextend 15:${pcrhashalgo}=${pcrextendvalue} fi confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg| awk '{print $2}') confluent_proto=$(grep ^protocol: /etc/confluent/confluent.deploycfg| awk '{print $2}')