2022-11-21 05:44:04 -05:00
|
|
|
{
|
2022-11-24 06:29:16 -05:00
|
|
|
description = "Lanzaboot Secure Boot Madness";
|
2022-11-21 05:44:04 -05:00
|
|
|
|
|
|
|
inputs = {
|
|
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
2022-11-23 05:59:54 -05:00
|
|
|
nixpkgs-test.url = "github:RaitoBezarius/nixpkgs/experimental-secureboot";
|
2022-11-21 05:44:04 -05:00
|
|
|
rust-overlay.url = "github:oxalica/rust-overlay";
|
|
|
|
naersk.url = "github:nix-community/naersk";
|
|
|
|
};
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
outputs = { self, nixpkgs, nixpkgs-test, rust-overlay, naersk }:
|
2022-11-21 05:44:04 -05:00
|
|
|
let
|
|
|
|
pkgs = import nixpkgs {
|
|
|
|
system = "x86_64-linux";
|
|
|
|
overlays = [
|
|
|
|
rust-overlay.overlays.default
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2022-11-24 06:05:46 -05:00
|
|
|
lib = pkgs.lib;
|
|
|
|
|
2022-11-21 19:53:40 -05:00
|
|
|
rust-nightly = pkgs.rust-bin.fromRustupToolchainFile ./rust/lanzaboote/rust-toolchain.toml;
|
2022-11-21 05:44:04 -05:00
|
|
|
|
2022-11-21 18:42:41 -05:00
|
|
|
naersk-nightly = pkgs.callPackage naersk {
|
|
|
|
cargo = rust-nightly;
|
|
|
|
rustc = rust-nightly;
|
2022-11-21 05:44:04 -05:00
|
|
|
};
|
2022-11-21 09:36:39 -05:00
|
|
|
|
2022-11-21 18:42:41 -05:00
|
|
|
uefi-run = pkgs.callPackage ./nix/uefi-run.nix {
|
2022-11-22 18:58:52 -05:00
|
|
|
naersk = naersk-nightly;
|
2022-11-21 09:36:39 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
systemd-boot-run = pkgs.writeShellScriptBin "systemd-boot-run" ''
|
|
|
|
${uefi-run}/bin/uefi-run lib/systemd/boot/efi/systemd-bootx64.efi
|
|
|
|
'';
|
|
|
|
|
|
|
|
add-sections = pkgs.writeShellScriptBin "add-sections" ''
|
|
|
|
set -eu
|
|
|
|
IN=$1
|
|
|
|
OSREL=$2
|
|
|
|
CMDLINE=$3
|
|
|
|
OUT=$4
|
|
|
|
|
|
|
|
stub_line=$(objdump -h "$1" | tail -2 | head -1)
|
|
|
|
stub_size=0x$(echo "$stub_line" | awk '{print $3}')
|
|
|
|
stub_offs=0x$(echo "$stub_line" | awk '{print $4}')
|
|
|
|
osrel_offs=$((stub_size + stub_offs))
|
|
|
|
cmdline_offs=$((osrel_offs + $(stat -c%s "$OSREL")))
|
|
|
|
objcopy \
|
|
|
|
--add-section .osrel="$OSREL" --change-section-vma .osrel=$(printf 0x%x $osrel_offs) \
|
|
|
|
--add-section .cmdline="$CMDLINE" \
|
|
|
|
--change-section-vma .cmdline=$(printf 0x%x $cmdline_offs) \
|
|
|
|
"$IN" "$OUT"
|
|
|
|
'';
|
2022-11-23 07:00:55 -05:00
|
|
|
|
|
|
|
buildRustEfiApp = src: naersk-nightly.buildPackage {
|
|
|
|
inherit src;
|
2022-11-21 09:36:39 -05:00
|
|
|
cargoBuildOptions = old: old ++ [
|
|
|
|
"--target x86_64-unknown-uefi"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2022-11-23 07:00:55 -05:00
|
|
|
buildRustLinuxApp = src: naersk-nightly.buildPackage {
|
|
|
|
inherit src;
|
2022-11-21 19:29:16 -05:00
|
|
|
};
|
|
|
|
|
2022-11-23 07:00:55 -05:00
|
|
|
# This is basically an empty EFI application that we use as a
|
|
|
|
# carrier for the initrd.
|
2022-11-23 07:05:19 -05:00
|
|
|
initrd-stub = buildRustEfiApp ./rust/initrd-stub;
|
2022-11-23 07:00:55 -05:00
|
|
|
|
|
|
|
lanzaboote = buildRustEfiApp ./rust/lanzaboote;
|
|
|
|
|
2022-11-25 20:16:12 -05:00
|
|
|
lanzatool-unwrapped = naersk-nightly.buildPackage {
|
2022-11-24 05:45:09 -05:00
|
|
|
src = ./rust/lanzatool;
|
|
|
|
buildInputs = [ pkgs.binutils ];
|
|
|
|
};
|
|
|
|
|
2022-11-24 06:05:46 -05:00
|
|
|
lanzatool = pkgs.runCommand "lanzatool" {
|
|
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
|
|
} ''
|
|
|
|
mkdir -p $out/bin
|
|
|
|
|
|
|
|
# Clean PATH to only contain what we need to do objcopy. Also
|
|
|
|
# tell lanzatool where to find our UEFI binaries.
|
2022-11-25 20:16:12 -05:00
|
|
|
makeWrapper ${lanzatool-unwrapped}/bin/lanzatool $out/bin/lanzatool \
|
2022-11-25 07:07:04 -05:00
|
|
|
--set PATH ${lib.makeBinPath [ pkgs.binutils-unwrapped pkgs.sbsigntool ]} \
|
2022-11-23 05:59:54 -05:00
|
|
|
--set RUST_BACKTRACE full \
|
2022-11-24 06:05:46 -05:00
|
|
|
--set LANZABOOTE_STUB ${lanzaboote}/bin/lanzaboote.efi \
|
2022-11-23 05:59:54 -05:00
|
|
|
--set LANZABOOTE_INITRD_STUB ${initrd-stub}/bin/initrd-stub.efi \
|
2022-11-24 05:45:09 -05:00
|
|
|
'';
|
2022-11-23 07:00:55 -05:00
|
|
|
|
2022-11-21 09:36:39 -05:00
|
|
|
osrel = pkgs.writeText "lanzaboote-osrel" ''
|
|
|
|
NAME=Lanzaboote
|
2022-11-21 19:01:11 -05:00
|
|
|
VERSION="${lanzaboote.version}"
|
2022-11-21 09:36:39 -05:00
|
|
|
'';
|
|
|
|
|
2022-11-23 06:11:20 -05:00
|
|
|
cmdline = pkgs.writeText "lanzaboote-cmdline" "console=ttyS0";
|
2022-11-21 09:36:39 -05:00
|
|
|
|
|
|
|
lanzaboote-uki = pkgs.runCommand "lanzboote-uki" {
|
|
|
|
nativeBuildInputs = [
|
|
|
|
pkgs.binutils-unwrapped
|
|
|
|
add-sections
|
|
|
|
];
|
|
|
|
} ''
|
|
|
|
mkdir -p $out/bin
|
|
|
|
add-sections ${lanzaboote}/bin/lanzaboote.efi ${osrel} ${cmdline} $out/bin/lanzaboote.efi
|
|
|
|
'';
|
2022-11-21 18:45:18 -05:00
|
|
|
in {
|
2022-11-23 05:59:54 -05:00
|
|
|
overlays.default = final: prev: {
|
2022-11-25 17:42:34 -05:00
|
|
|
inherit lanzatool;
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
nixosModules.lanzaboote = import ./nix/lanzaboote.nix;
|
|
|
|
|
2022-11-21 18:45:18 -05:00
|
|
|
packages.x86_64-linux = {
|
2022-11-25 20:21:05 -05:00
|
|
|
inherit uefi-run initrd-stub lanzaboote lanzaboote-uki lanzatool;
|
2022-11-21 18:45:18 -05:00
|
|
|
default = lanzaboote-uki;
|
|
|
|
};
|
2022-11-21 09:36:39 -05:00
|
|
|
|
2022-11-21 18:45:18 -05:00
|
|
|
devShells.x86_64-linux.default = pkgs.mkShell {
|
2022-11-22 18:26:00 -05:00
|
|
|
packages = [
|
2022-11-21 18:45:18 -05:00
|
|
|
uefi-run
|
2022-11-21 19:48:53 -05:00
|
|
|
lanzatool
|
2022-11-21 20:08:35 -05:00
|
|
|
pkgs.openssl
|
2022-11-23 05:59:54 -05:00
|
|
|
(pkgs.sbctl.override {
|
|
|
|
databasePath = "pki";
|
|
|
|
})
|
|
|
|
pkgs.sbsigntool
|
2022-11-24 10:59:16 -05:00
|
|
|
pkgs.efitools
|
2022-11-24 21:04:44 -05:00
|
|
|
pkgs.python39Packages.ovmfvartool
|
|
|
|
pkgs.qemu
|
2022-11-21 18:45:18 -05:00
|
|
|
];
|
2022-11-22 18:26:00 -05:00
|
|
|
|
|
|
|
inputsFrom = [
|
|
|
|
lanzaboote
|
|
|
|
];
|
2022-11-21 05:44:04 -05:00
|
|
|
};
|
2022-11-23 05:59:54 -05:00
|
|
|
|
2022-11-25 12:42:37 -05:00
|
|
|
checks.x86_64-linux = let
|
|
|
|
mkSecureBootTest = { name, machine ? {}, testScript }: nixpkgs-test.legacyPackages.x86_64-linux.nixosTest {
|
|
|
|
inherit name testScript;
|
|
|
|
nodes.machine = { lib, ... }: {
|
|
|
|
imports = [
|
|
|
|
self.nixosModules.lanzaboote
|
|
|
|
machine
|
|
|
|
];
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
nixpkgs.overlays = [ self.overlays.default ];
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
virtualisation = {
|
|
|
|
useBootLoader = true;
|
|
|
|
useEFIBoot = true;
|
2022-11-24 21:04:44 -05:00
|
|
|
useSecureBoot = true;
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
boot.loader.efi = {
|
|
|
|
enable = true;
|
|
|
|
canTouchEfiVariables = true;
|
|
|
|
};
|
|
|
|
boot.lanzaboote = {
|
|
|
|
enable = true;
|
2022-11-25 12:42:37 -05:00
|
|
|
enrollKeys = lib.mkDefault true;
|
2022-11-24 10:59:16 -05:00
|
|
|
pkiBundle = ./pki;
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
2022-11-25 12:42:37 -05:00
|
|
|
};
|
|
|
|
mkUnsignedTest = { name, path }: mkSecureBootTest {
|
|
|
|
inherit name;
|
2022-11-23 05:59:54 -05:00
|
|
|
testScript = ''
|
2022-11-25 12:42:37 -05:00
|
|
|
import json
|
|
|
|
import os.path
|
|
|
|
bootspec = None
|
|
|
|
def extract_bspec_attr(attr):
|
|
|
|
return bootspec.get(attr)
|
|
|
|
def convert_to_esp(store_file_path):
|
|
|
|
store_dir = os.path.basename(os.path.dirname(store_file_path))
|
|
|
|
filename = os.path.basename(store_file_path)
|
|
|
|
return f'/boot/EFI/nixos/{store_dir}-{filename}.efi'
|
|
|
|
|
|
|
|
machine.start()
|
|
|
|
bootspec = json.loads(machine.succeed("cat /run/current-system/bootspec/boot.v1.json"))
|
|
|
|
print(machine.succeed("ls /boot/EFI/nixos"))
|
|
|
|
src_path = ${path.src}
|
|
|
|
dst_path = ${path.dst}
|
|
|
|
machine.succeed(f"cp -rf {src_path} {dst_path}")
|
|
|
|
machine.succeed("sync")
|
|
|
|
machine.crash()
|
2022-11-23 05:59:54 -05:00
|
|
|
machine.start()
|
2022-11-25 12:42:37 -05:00
|
|
|
machine.wait_for_console_text("panicked")
|
2022-11-23 05:59:54 -05:00
|
|
|
'';
|
|
|
|
};
|
2022-11-25 12:42:37 -05:00
|
|
|
in
|
|
|
|
{
|
|
|
|
# TODO: user mode: OK
|
|
|
|
# TODO: how to get in: {deployed, audited} mode ?
|
|
|
|
lanzaboote-boot = mkSecureBootTest {
|
|
|
|
name = "signed-files-boot-under-secureboot";
|
|
|
|
testScript = ''
|
|
|
|
machine.start()
|
|
|
|
assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
|
|
|
|
'';
|
|
|
|
};
|
2022-11-25 19:50:51 -05:00
|
|
|
# So, this is the responsibility of the lanzatool install
|
|
|
|
# to run the append-initrd-secret script
|
|
|
|
# This test assert that lanzatool still do the right thing
|
|
|
|
# preDeviceCommands should not have any root filesystem mounted
|
|
|
|
# so it should not be able to find /etc/iamasecret, other than the
|
|
|
|
# initrd's one.
|
|
|
|
# which should exist IF lanzatool do the right thing.
|
|
|
|
lanzaboote-with-initrd-secrets = mkSecureBootTest {
|
|
|
|
name = "signed-files-boot-with-secrets-under-secureboot";
|
|
|
|
machine = { ... }: {
|
|
|
|
boot.initrd.secrets = {
|
|
|
|
"/etc/iamasecret" = (pkgs.writeText "iamsecret" "this is a very secure secret");
|
|
|
|
};
|
|
|
|
|
|
|
|
boot.initrd.preDeviceCommands = ''
|
|
|
|
grep "this is a very secure secret" /etc/iamasecret
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
testScript = ''
|
|
|
|
machine.start()
|
|
|
|
assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
|
|
|
|
'';
|
|
|
|
};
|
2022-11-25 12:42:37 -05:00
|
|
|
is-initrd-secured = mkUnsignedTest {
|
|
|
|
name = "unsigned-initrd-do-not-boot-under-secureboot";
|
|
|
|
path = {
|
|
|
|
src = "extract_bspec_attr('initrd')";
|
|
|
|
dst = "\"/boot/EFI/nixos/initrd\"";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
is-kernel-secured = mkUnsignedTest {
|
|
|
|
name = "unsigned-kernel-do-not-boot-under-secureboot";
|
|
|
|
path = {
|
|
|
|
src = "extract_bspec_attr('kernel')";
|
|
|
|
dst = "\"/boot/EFI/nixos/kernel\"";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
2022-11-21 18:45:18 -05:00
|
|
|
};
|
2022-11-21 05:44:04 -05:00
|
|
|
}
|