mirror of
https://github.com/xcat2/confluent.git
synced 2026-09-05 12:37:56 +00:00
Jarrod Johnson
730f645dc0
If someone wants to seal to a PCR explicitly to prevent booting rescue, the PCR is likely to extend differently during install. Leave the volume sealed to the tpm without any PCRs until first boot. Then wipe the bindings without PCR specified, and seal according to user preferred values.
13 lines
495 B
Bash
13 lines
495 B
Bash
#!/bin/sh
|
|
cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//)
|
|
|
|
if [ -x /bin/systemd-cryptenroll ]; then
|
|
PASSWORD=$(cat /etc/confluent/luks.key) systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $cryptdisk
|
|
sed -e 's/ discard/ tpm2-device=auto,discard/' -i /etc/crypttab
|
|
dracut -f
|
|
else
|
|
clevis luks bind -f -d $cryptdisk -k - tpm2 "{}" < /etc/confluent/luks.key
|
|
#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey
|
|
fi
|
|
chmod 000 /etc/confluent/luks.key
|