2022-11-21 05:44:04 -05:00
|
|
|
{
|
2022-11-24 06:29:16 -05:00
|
|
|
description = "Lanzaboot Secure Boot Madness";
|
2022-11-21 05:44:04 -05:00
|
|
|
|
|
|
|
inputs = {
|
|
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
2022-11-23 05:59:54 -05:00
|
|
|
nixpkgs-test.url = "github:RaitoBezarius/nixpkgs/experimental-secureboot";
|
2022-11-21 05:44:04 -05:00
|
|
|
rust-overlay.url = "github:oxalica/rust-overlay";
|
|
|
|
naersk.url = "github:nix-community/naersk";
|
|
|
|
};
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
outputs = { self, nixpkgs, nixpkgs-test, rust-overlay, naersk }:
|
2022-11-21 05:44:04 -05:00
|
|
|
let
|
|
|
|
pkgs = import nixpkgs {
|
|
|
|
system = "x86_64-linux";
|
|
|
|
overlays = [
|
|
|
|
rust-overlay.overlays.default
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2022-11-24 06:05:46 -05:00
|
|
|
lib = pkgs.lib;
|
|
|
|
|
2022-11-21 19:53:40 -05:00
|
|
|
rust-nightly = pkgs.rust-bin.fromRustupToolchainFile ./rust/lanzaboote/rust-toolchain.toml;
|
2022-11-21 05:44:04 -05:00
|
|
|
|
2022-11-21 18:42:41 -05:00
|
|
|
naersk-nightly = pkgs.callPackage naersk {
|
|
|
|
cargo = rust-nightly;
|
|
|
|
rustc = rust-nightly;
|
2022-11-21 05:44:04 -05:00
|
|
|
};
|
2022-11-21 09:36:39 -05:00
|
|
|
|
|
|
|
qemuUefi = pkgs.writeShellScriptBin "qemu-uefi" ''
|
|
|
|
exec ${pkgs.qemu}/bin/qemu-system-x86_64 \
|
|
|
|
-machine q35,accel=kvm:tcg -bios ${pkgs.OVMF.fd}/FV/OVMF.fd \
|
|
|
|
-m 4096 -serial stdio "$@"
|
|
|
|
'';
|
|
|
|
|
2022-11-21 18:42:41 -05:00
|
|
|
uefi-run = pkgs.callPackage ./nix/uefi-run.nix {
|
2022-11-22 18:58:52 -05:00
|
|
|
naersk = naersk-nightly;
|
2022-11-21 09:36:39 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
systemd-boot-run = pkgs.writeShellScriptBin "systemd-boot-run" ''
|
|
|
|
${uefi-run}/bin/uefi-run lib/systemd/boot/efi/systemd-bootx64.efi
|
|
|
|
'';
|
|
|
|
|
|
|
|
add-sections = pkgs.writeShellScriptBin "add-sections" ''
|
|
|
|
set -eu
|
|
|
|
IN=$1
|
|
|
|
OSREL=$2
|
|
|
|
CMDLINE=$3
|
|
|
|
OUT=$4
|
|
|
|
|
|
|
|
stub_line=$(objdump -h "$1" | tail -2 | head -1)
|
|
|
|
stub_size=0x$(echo "$stub_line" | awk '{print $3}')
|
|
|
|
stub_offs=0x$(echo "$stub_line" | awk '{print $4}')
|
|
|
|
osrel_offs=$((stub_size + stub_offs))
|
|
|
|
cmdline_offs=$((osrel_offs + $(stat -c%s "$OSREL")))
|
|
|
|
objcopy \
|
|
|
|
--add-section .osrel="$OSREL" --change-section-vma .osrel=$(printf 0x%x $osrel_offs) \
|
|
|
|
--add-section .cmdline="$CMDLINE" \
|
|
|
|
--change-section-vma .cmdline=$(printf 0x%x $cmdline_offs) \
|
|
|
|
"$IN" "$OUT"
|
|
|
|
'';
|
2022-11-23 07:00:55 -05:00
|
|
|
|
|
|
|
buildRustEfiApp = src: naersk-nightly.buildPackage {
|
|
|
|
inherit src;
|
2022-11-21 09:36:39 -05:00
|
|
|
cargoBuildOptions = old: old ++ [
|
|
|
|
"--target x86_64-unknown-uefi"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2022-11-23 07:00:55 -05:00
|
|
|
buildRustLinuxApp = src: naersk-nightly.buildPackage {
|
|
|
|
inherit src;
|
2022-11-21 19:29:16 -05:00
|
|
|
};
|
|
|
|
|
2022-11-23 07:00:55 -05:00
|
|
|
# This is basically an empty EFI application that we use as a
|
|
|
|
# carrier for the initrd.
|
2022-11-23 07:05:19 -05:00
|
|
|
initrd-stub = buildRustEfiApp ./rust/initrd-stub;
|
2022-11-23 07:00:55 -05:00
|
|
|
|
|
|
|
lanzaboote = buildRustEfiApp ./rust/lanzaboote;
|
|
|
|
|
2022-11-24 05:45:09 -05:00
|
|
|
lanzatoolBin = naersk-nightly.buildPackage {
|
|
|
|
src = ./rust/lanzatool;
|
|
|
|
buildInputs = [ pkgs.binutils ];
|
|
|
|
};
|
|
|
|
|
2022-11-24 06:05:46 -05:00
|
|
|
lanzatool = pkgs.runCommand "lanzatool" {
|
|
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
|
|
} ''
|
|
|
|
mkdir -p $out/bin
|
|
|
|
|
|
|
|
# Clean PATH to only contain what we need to do objcopy. Also
|
|
|
|
# tell lanzatool where to find our UEFI binaries.
|
|
|
|
makeWrapper ${lanzatoolBin}/bin/lanzatool $out/bin/lanzatool \
|
|
|
|
--set PATH ${lib.makeBinPath [ pkgs.binutils-unwrapped ]} \
|
2022-11-23 05:59:54 -05:00
|
|
|
--set RUST_BACKTRACE full \
|
2022-11-24 06:05:46 -05:00
|
|
|
--set LANZABOOTE_STUB ${lanzaboote}/bin/lanzaboote.efi \
|
2022-11-23 05:59:54 -05:00
|
|
|
--set LANZABOOTE_INITRD_STUB ${initrd-stub}/bin/initrd-stub.efi \
|
|
|
|
--set SBSIGNTOOL "${pkgs.sbsigntool}/bin/sbsign"
|
2022-11-24 05:45:09 -05:00
|
|
|
'';
|
2022-11-23 07:00:55 -05:00
|
|
|
|
2022-11-23 07:11:22 -05:00
|
|
|
# A script that takes an initrd and turns it into a PE image.
|
|
|
|
wrapInitrd = pkgs.writeShellScriptBin "wrap-initrd" ''
|
|
|
|
set -eu
|
|
|
|
|
|
|
|
STUB=${initrd-stub}/bin/initrd-stub.efi
|
|
|
|
INITRD=$1
|
|
|
|
OUT=$2
|
|
|
|
|
|
|
|
stub_line=$(objdump -h "$STUB" | tail -2 | head -1)
|
|
|
|
stub_size=0x$(echo "$stub_line" | awk '{print $3}')
|
|
|
|
stub_offs=0x$(echo "$stub_line" | awk '{print $4}')
|
|
|
|
initrd_offs=$((stub_size + stub_offs))
|
|
|
|
|
|
|
|
objcopy --add-section .initrd="$INITRD" --change-section-vma .initrd=$(printf 0x%x $initrd_offs) \
|
|
|
|
"$STUB" "$OUT"
|
|
|
|
'';
|
|
|
|
|
2022-11-21 09:36:39 -05:00
|
|
|
osrel = pkgs.writeText "lanzaboote-osrel" ''
|
|
|
|
NAME=Lanzaboote
|
2022-11-21 19:01:11 -05:00
|
|
|
VERSION="${lanzaboote.version}"
|
2022-11-21 09:36:39 -05:00
|
|
|
'';
|
|
|
|
|
2022-11-23 06:11:20 -05:00
|
|
|
cmdline = pkgs.writeText "lanzaboote-cmdline" "console=ttyS0";
|
2022-11-21 09:36:39 -05:00
|
|
|
|
|
|
|
lanzaboote-uki = pkgs.runCommand "lanzboote-uki" {
|
|
|
|
nativeBuildInputs = [
|
|
|
|
pkgs.binutils-unwrapped
|
|
|
|
add-sections
|
|
|
|
];
|
|
|
|
} ''
|
|
|
|
mkdir -p $out/bin
|
|
|
|
add-sections ${lanzaboote}/bin/lanzaboote.efi ${osrel} ${cmdline} $out/bin/lanzaboote.efi
|
|
|
|
'';
|
2022-11-21 18:45:18 -05:00
|
|
|
in {
|
2022-11-23 05:59:54 -05:00
|
|
|
overlays.default = final: prev: {
|
2022-11-23 05:59:54 -05:00
|
|
|
inherit lanzaboote;
|
|
|
|
lanzatool = lanzatoolBin;
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
nixosModules.lanzaboote = import ./nix/lanzaboote.nix;
|
|
|
|
|
2022-11-21 18:45:18 -05:00
|
|
|
packages.x86_64-linux = {
|
2022-11-23 07:11:22 -05:00
|
|
|
inherit qemuUefi uefi-run initrd-stub lanzaboote lanzaboote-uki lanzatool wrapInitrd;
|
2022-11-21 18:45:18 -05:00
|
|
|
default = lanzaboote-uki;
|
|
|
|
};
|
2022-11-21 09:36:39 -05:00
|
|
|
|
2022-11-21 18:45:18 -05:00
|
|
|
devShells.x86_64-linux.default = pkgs.mkShell {
|
2022-11-22 18:26:00 -05:00
|
|
|
packages = [
|
2022-11-21 18:45:18 -05:00
|
|
|
qemuUefi
|
|
|
|
uefi-run
|
2022-11-21 19:48:53 -05:00
|
|
|
lanzatool
|
2022-11-21 20:08:35 -05:00
|
|
|
pkgs.openssl
|
2022-11-23 07:11:22 -05:00
|
|
|
wrapInitrd
|
2022-11-23 05:59:54 -05:00
|
|
|
(pkgs.sbctl.override {
|
|
|
|
databasePath = "pki";
|
|
|
|
})
|
|
|
|
pkgs.sbsigntool
|
2022-11-24 10:59:16 -05:00
|
|
|
pkgs.efitools
|
2022-11-21 18:45:18 -05:00
|
|
|
];
|
2022-11-22 18:26:00 -05:00
|
|
|
|
|
|
|
inputsFrom = [
|
|
|
|
lanzatool
|
|
|
|
lanzaboote
|
|
|
|
];
|
2022-11-21 05:44:04 -05:00
|
|
|
};
|
2022-11-23 05:59:54 -05:00
|
|
|
|
|
|
|
checks.x86_64-linux = {
|
|
|
|
lanzaboote-boot =
|
|
|
|
let test = import ("${nixpkgs-test}/nixos/lib/testing-python.nix") { system = "x86_64-linux"; };
|
|
|
|
in
|
|
|
|
test.makeTest
|
|
|
|
{
|
|
|
|
name = "stub-boot";
|
|
|
|
nodes.machine = { ... }: {
|
|
|
|
imports = [ self.nixosModules.lanzaboote ];
|
|
|
|
nixpkgs.overlays = [ self.overlays.default ];
|
|
|
|
|
2022-11-23 05:59:54 -05:00
|
|
|
virtualisation = {
|
|
|
|
useBootLoader = true;
|
|
|
|
useEFIBoot = true;
|
2022-11-24 11:09:51 -05:00
|
|
|
useSecureBoot = false;
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
boot.loader.efi = {
|
|
|
|
enable = true;
|
|
|
|
canTouchEfiVariables = true;
|
|
|
|
};
|
|
|
|
boot.lanzaboote = {
|
|
|
|
enable = true;
|
|
|
|
enrollKeys = true;
|
2022-11-24 10:59:16 -05:00
|
|
|
pkiBundle = ./pki;
|
2022-11-23 05:59:54 -05:00
|
|
|
package = lanzatool;
|
|
|
|
};
|
2022-11-23 05:59:54 -05:00
|
|
|
};
|
|
|
|
testScript = ''
|
2022-11-23 05:59:54 -05:00
|
|
|
machine.start()
|
|
|
|
machine.shutdown()
|
2022-11-23 05:59:54 -05:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
2022-11-21 18:45:18 -05:00
|
|
|
};
|
2022-11-21 05:44:04 -05:00
|
|
|
}
|