2022-11-23 09:26:26 -05:00
|
|
|
use std::fs;
|
2022-11-25 11:47:24 -05:00
|
|
|
use std::os::unix::prelude::PermissionsExt;
|
2022-11-25 07:07:04 -05:00
|
|
|
use std::path::{Path, PathBuf};
|
2022-11-26 08:55:15 -05:00
|
|
|
use std::process::Command;
|
2022-11-23 09:26:26 -05:00
|
|
|
|
2022-11-24 07:33:01 -05:00
|
|
|
use anyhow::{Context, Result};
|
2022-11-26 08:55:15 -05:00
|
|
|
use nix::unistd::sync;
|
|
|
|
use tempfile::tempdir;
|
2022-11-23 09:26:26 -05:00
|
|
|
|
|
|
|
use crate::esp::EspPaths;
|
2022-11-26 08:55:15 -05:00
|
|
|
use crate::generation::Generation;
|
2022-11-23 14:40:01 -05:00
|
|
|
use crate::pe;
|
2022-11-26 17:19:08 -05:00
|
|
|
use crate::signature::KeyPair;
|
2022-11-23 05:59:54 -05:00
|
|
|
|
2022-11-26 08:55:15 -05:00
|
|
|
pub struct Installer {
|
|
|
|
lanzaboote_stub: PathBuf,
|
|
|
|
initrd_stub: PathBuf,
|
2022-11-26 17:19:08 -05:00
|
|
|
key_pair: KeyPair,
|
2022-11-26 08:55:15 -05:00
|
|
|
_pki_bundle: Option<PathBuf>,
|
|
|
|
_auto_enroll: bool,
|
2022-11-26 16:23:00 -05:00
|
|
|
esp: PathBuf,
|
2022-11-25 21:14:21 -05:00
|
|
|
generations: Vec<PathBuf>,
|
2022-11-26 08:55:15 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
impl Installer {
|
|
|
|
pub fn new(
|
|
|
|
lanzaboote_stub: PathBuf,
|
|
|
|
initrd_stub: PathBuf,
|
2022-11-26 17:19:08 -05:00
|
|
|
key_pair: KeyPair,
|
2022-11-26 08:55:15 -05:00
|
|
|
_pki_bundle: Option<PathBuf>,
|
|
|
|
_auto_enroll: bool,
|
2022-11-26 16:23:00 -05:00
|
|
|
esp: PathBuf,
|
2022-11-26 08:55:15 -05:00
|
|
|
generations: Vec<PathBuf>,
|
|
|
|
) -> Self {
|
|
|
|
Self {
|
|
|
|
lanzaboote_stub,
|
|
|
|
initrd_stub,
|
2022-11-26 17:19:08 -05:00
|
|
|
key_pair,
|
2022-11-26 08:55:15 -05:00
|
|
|
_pki_bundle,
|
|
|
|
_auto_enroll,
|
2022-11-26 16:23:00 -05:00
|
|
|
esp,
|
2022-11-26 08:55:15 -05:00
|
|
|
generations,
|
|
|
|
}
|
2022-11-25 19:50:51 -05:00
|
|
|
}
|
2022-11-25 19:24:33 -05:00
|
|
|
|
2022-11-26 08:55:15 -05:00
|
|
|
pub fn install(&self) -> Result<()> {
|
|
|
|
for toplevel in &self.generations {
|
|
|
|
let generation = Generation::from_toplevel(toplevel).with_context(|| {
|
2022-11-26 16:23:00 -05:00
|
|
|
format!("Failed to build generation from toplevel: {toplevel:?}")
|
2022-11-26 08:55:15 -05:00
|
|
|
})?;
|
2022-11-25 07:07:04 -05:00
|
|
|
|
2022-11-26 08:55:15 -05:00
|
|
|
println!("Installing generation {generation}");
|
2022-11-25 07:07:04 -05:00
|
|
|
|
2022-11-27 05:19:02 -05:00
|
|
|
self.install_generation(&generation)
|
|
|
|
.context("Failed to install generation")?;
|
|
|
|
|
|
|
|
for (name, bootspec) in &generation.bootspec.specialisation {
|
|
|
|
let specialised_generation = generation.specialise(name, bootspec);
|
|
|
|
|
|
|
|
println!("Installing specialisation: {name} of generation: {generation}");
|
|
|
|
|
|
|
|
self.install_generation(&specialised_generation)
|
|
|
|
.context("Failed to install specialisation")?;
|
|
|
|
}
|
2022-11-26 08:55:15 -05:00
|
|
|
}
|
2022-11-25 07:07:04 -05:00
|
|
|
|
2022-11-26 08:55:15 -05:00
|
|
|
Ok(())
|
2022-11-25 07:07:04 -05:00
|
|
|
}
|
2022-11-23 05:59:54 -05:00
|
|
|
|
2022-11-27 05:19:02 -05:00
|
|
|
fn install_generation(&self, generation: &Generation) -> Result<()> {
|
2022-11-26 08:55:15 -05:00
|
|
|
println!("Reading bootspec...");
|
|
|
|
|
2022-11-26 16:23:00 -05:00
|
|
|
let bootspec = &generation.bootspec;
|
2022-11-26 08:55:15 -05:00
|
|
|
|
2022-11-27 05:19:02 -05:00
|
|
|
let esp_paths = EspPaths::new(&self.esp, generation)?;
|
2022-11-26 08:55:15 -05:00
|
|
|
|
|
|
|
println!("Assembling lanzaboote image...");
|
|
|
|
|
2022-11-26 16:23:00 -05:00
|
|
|
let kernel_cmdline =
|
|
|
|
assemble_kernel_cmdline(&bootspec.init, bootspec.kernel_params.clone());
|
2022-11-26 08:55:15 -05:00
|
|
|
|
|
|
|
// prepare a secure temporary directory
|
|
|
|
// permission bits are not set, because when files below
|
|
|
|
// are opened, they are opened with 600 mode bits.
|
|
|
|
// hence, they cannot be read except by the current user
|
|
|
|
// which is assumed to be root in most cases.
|
|
|
|
// TODO(Raito): prove to niksnur this is actually acceptable.
|
|
|
|
let secure_temp_dir = tempdir()?;
|
|
|
|
|
|
|
|
let lanzaboote_image = pe::lanzaboote_image(
|
|
|
|
&secure_temp_dir,
|
|
|
|
&self.lanzaboote_stub,
|
2022-11-26 16:23:00 -05:00
|
|
|
&bootspec.extension.os_release,
|
2022-11-26 08:55:15 -05:00
|
|
|
&kernel_cmdline,
|
|
|
|
&esp_paths.kernel,
|
|
|
|
&esp_paths.initrd,
|
|
|
|
&esp_paths.esp,
|
|
|
|
)
|
|
|
|
.context("Failed to assemble stub")?;
|
|
|
|
|
|
|
|
println!("Wrapping initrd into a PE binary...");
|
|
|
|
|
|
|
|
let initrd_location = secure_temp_dir.path().join("initrd");
|
2022-11-26 16:23:00 -05:00
|
|
|
copy(&bootspec.initrd, &initrd_location)?;
|
|
|
|
if let Some(initrd_secrets_script) = &bootspec.initrd_secrets {
|
2022-11-26 17:19:08 -05:00
|
|
|
append_initrd_secrets(initrd_secrets_script, &initrd_location)?;
|
2022-11-26 08:55:15 -05:00
|
|
|
}
|
|
|
|
let wrapped_initrd = pe::wrap_initrd(&secure_temp_dir, &self.initrd_stub, &initrd_location)
|
|
|
|
.context("Failed to assemble stub")?;
|
|
|
|
|
2022-11-26 09:32:43 -05:00
|
|
|
println!("Sign and copy files to EFI system partition...");
|
|
|
|
|
2022-11-26 16:23:00 -05:00
|
|
|
let systemd_boot = bootspec
|
|
|
|
.toplevel
|
|
|
|
.join("systemd/lib/systemd/boot/efi/systemd-bootx64.efi");
|
2022-11-26 08:55:15 -05:00
|
|
|
|
2022-11-26 09:32:43 -05:00
|
|
|
let files_to_copy_and_sign = [
|
|
|
|
(&systemd_boot, &esp_paths.efi_fallback),
|
|
|
|
(&systemd_boot, &esp_paths.systemd_boot),
|
|
|
|
(&lanzaboote_image, &esp_paths.lanzaboote_image),
|
2022-11-26 16:23:00 -05:00
|
|
|
(&bootspec.kernel, &esp_paths.kernel),
|
2022-11-26 09:32:43 -05:00
|
|
|
(&wrapped_initrd, &esp_paths.initrd),
|
2022-11-26 08:55:15 -05:00
|
|
|
];
|
|
|
|
|
2022-11-26 09:32:43 -05:00
|
|
|
for (from, to) in files_to_copy_and_sign {
|
|
|
|
println!("Signing {}...", to.display());
|
2022-11-26 08:55:15 -05:00
|
|
|
|
2022-11-26 09:32:43 -05:00
|
|
|
ensure_parent_dir(to);
|
2022-11-26 17:19:08 -05:00
|
|
|
self.key_pair.sign_and_copy(from, to).with_context(|| {
|
2022-11-26 09:32:43 -05:00
|
|
|
format!("Failed to copy and sign file from {:?} to {:?}", from, to)
|
|
|
|
})?;
|
|
|
|
// Call sync to improve the likelihood that file is actually written to disk
|
2022-11-26 08:55:15 -05:00
|
|
|
sync();
|
|
|
|
}
|
|
|
|
|
|
|
|
println!(
|
|
|
|
"Successfully installed lanzaboote to '{}'",
|
|
|
|
esp_paths.esp.display()
|
|
|
|
);
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
2022-11-24 07:33:01 -05:00
|
|
|
}
|
2022-11-23 09:26:26 -05:00
|
|
|
|
2022-11-26 08:55:15 -05:00
|
|
|
pub fn append_initrd_secrets(
|
|
|
|
append_initrd_secrets_path: &Path,
|
|
|
|
initrd_path: &PathBuf,
|
|
|
|
) -> Result<()> {
|
2022-11-25 19:50:51 -05:00
|
|
|
let status = Command::new(append_initrd_secrets_path)
|
2022-11-26 08:55:15 -05:00
|
|
|
.args(vec![initrd_path])
|
2022-11-25 19:50:51 -05:00
|
|
|
.status()
|
|
|
|
.context("Failed to append initrd secrets")?;
|
|
|
|
if !status.success() {
|
2022-11-26 08:55:15 -05:00
|
|
|
return Err(anyhow::anyhow!(
|
|
|
|
"Failed to append initrd secrets with args `{:?}`",
|
|
|
|
vec![append_initrd_secrets_path, initrd_path]
|
2022-11-26 17:19:08 -05:00
|
|
|
));
|
2022-11-25 19:50:51 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
2022-11-26 16:23:00 -05:00
|
|
|
fn assemble_kernel_cmdline(init: &Path, kernel_params: Vec<String>) -> Vec<String> {
|
|
|
|
let init_string = String::from(
|
|
|
|
init.to_str()
|
|
|
|
.expect("Failed to convert init path to string"),
|
|
|
|
);
|
2022-11-25 07:07:04 -05:00
|
|
|
let mut kernel_cmdline: Vec<String> = vec![format!("init={}", init_string)];
|
|
|
|
kernel_cmdline.extend(kernel_params);
|
|
|
|
kernel_cmdline
|
|
|
|
}
|
|
|
|
|
2022-11-24 07:33:01 -05:00
|
|
|
fn copy(from: &Path, to: &Path) -> Result<()> {
|
2022-11-26 09:32:43 -05:00
|
|
|
ensure_parent_dir(to);
|
2022-11-24 07:33:01 -05:00
|
|
|
fs::copy(from, to)
|
|
|
|
.with_context(|| format!("Failed to copy from {} to {}", from.display(), to.display()))?;
|
2022-11-25 11:47:24 -05:00
|
|
|
|
|
|
|
// Set permission of all files copied to 0o755
|
|
|
|
let mut perms = fs::metadata(to)
|
|
|
|
.with_context(|| format!("File {} doesn't have metadata", to.display()))?
|
|
|
|
.permissions();
|
|
|
|
perms.set_mode(0o755);
|
|
|
|
fs::set_permissions(to, perms)
|
|
|
|
.with_context(|| format!("Failed to set permissions to: {}", to.display()))?;
|
|
|
|
|
2022-11-23 09:26:26 -05:00
|
|
|
Ok(())
|
|
|
|
}
|
2022-11-26 09:32:43 -05:00
|
|
|
|
|
|
|
// Ensures the parent directory of an arbitrary path exists
|
|
|
|
fn ensure_parent_dir(path: &Path) {
|
|
|
|
if let Some(parent) = path.parent() {
|
|
|
|
fs::create_dir_all(parent).ok();
|
|
|
|
}
|
|
|
|
}
|