From fd7d1d0d208f5857d84f1bc48577ff775a67b823 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 4 Sep 2024 21:13:49 +0200 Subject: Kernel: T861: remove superfluous architecture from Kernel string --- packages/linux-kernel/build-jool.py | 3 +-- packages/linux-kernel/build-kernel.sh | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) (limited to 'packages') diff --git a/packages/linux-kernel/build-jool.py b/packages/linux-kernel/build-jool.py index 1781a6c8..3f8fd3a5 100755 --- a/packages/linux-kernel/build-jool.py +++ b/packages/linux-kernel/build-jool.py @@ -29,9 +29,8 @@ def add_depends(package_dir: str, package_name: str, # find kernel version and source path arch: str = find_arch() defaults_file: str = Path('../../data/defaults.toml').read_text() -architecture_file: str = Path(f'../../data/architectures/{arch}.toml').read_text() KERNEL_VER: str = toml_loads(defaults_file).get('kernel_version') -KERNEL_FLAVOR: str = toml_loads(architecture_file).get('kernel_flavor') +KERNEL_FLAVOR: str = toml_loads(defaults_file).get('kernel_flavor') KERNEL_SRC: str = Path.cwd().as_posix() + '/linux' # define variables diff --git a/packages/linux-kernel/build-kernel.sh b/packages/linux-kernel/build-kernel.sh index 2c02f5c3..c0a863c6 100755 --- a/packages/linux-kernel/build-kernel.sh +++ b/packages/linux-kernel/build-kernel.sh @@ -18,7 +18,7 @@ echo "I: clean modified files" git reset --hard HEAD KERNEL_VERSION=$(make kernelversion) -KERNEL_SUFFIX=-$(dpkg --print-architecture)-vyos +KERNEL_SUFFIX=-$(awk -F "= " '/kernel_flavor/ {print $2}' ../../../data/defaults.toml | tr -d \") # VyOS requires some small Kernel Patches - apply them here # It's easier to habe them here and make use of the upstream -- cgit v1.2.3 From e4a2e22ced899fa3cedcd0c0188b4318060ab098 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 14 Sep 2024 20:57:14 +0200 Subject: mellanox: T6231: execute build script with sudo --- packages/linux-kernel/Jenkinsfile | 2 +- packages/linux-kernel/build-mellanox-ofed.sh | 68 +++++++++++++++------------- 2 files changed, 37 insertions(+), 33 deletions(-) (limited to 'packages') diff --git a/packages/linux-kernel/Jenkinsfile b/packages/linux-kernel/Jenkinsfile index 986780e0..c354200e 100644 --- a/packages/linux-kernel/Jenkinsfile +++ b/packages/linux-kernel/Jenkinsfile @@ -63,7 +63,7 @@ def pkgList = [ ['name': 'ixgbevf', 'buildCmd': 'cd ..; ./build-intel-ixgbevf.sh'], // Mellanox OFED - ['name': 'ofed', 'buildCmd': 'cd ..; ./build-mellanox-ofed.sh'], + ['name': 'ofed', 'buildCmd': 'cd ..; sudo ./build-mellanox-ofed.sh'], // Jool ['name': 'jool', 'buildCmd': 'cd ..; ./build-jool.py'], diff --git a/packages/linux-kernel/build-mellanox-ofed.sh b/packages/linux-kernel/build-mellanox-ofed.sh index 51e4d4ca..a157ee61 100755 --- a/packages/linux-kernel/build-mellanox-ofed.sh +++ b/packages/linux-kernel/build-mellanox-ofed.sh @@ -4,6 +4,11 @@ DEB_DISTRO='debian12.1' CWD=$(pwd) KERNEL_VAR_FILE=${CWD}/kernel-vars +if [ $(id -u) -ne 0 ]; then + echo "Mellanox OFED script needs to be run as root" + exit +fi + if ! dpkg-architecture -iamd64; then echo "Mellanox OFED is only buildable on amd64 platforms" exit 0 @@ -66,34 +71,33 @@ if [ -z $KERNEL_DIR ]; then exit 1 fi -rm -f SOURCES/ibarr_0.1.3.orig.tar.gz -rm -f SOURCES/ibdump_6.0.0.orig.tar.gz -rm -f SOURCES/ibsim_0.12.orig.tar.gz -rm -f SOURCES/iser_24.04.OFED.24.04.0.6.6.1.orig.tar.gz -rm -f SOURCES/isert_24.04.OFED.24.04.0.6.6.1.orig.tar.gz -rm -f SOURCES/kernel-mft_4.28.0.92.orig.tar.gz -rm -f SOURCES/knem_1.1.4.90mlnx3.orig.tar.gz -rm -f SOURCES/libvma_9.8.60.orig.tar.gz -rm -f SOURCES/libxlio_3.30.5.orig.tar.gz -rm -f SOURCES/mlnx-ethtool_6.7.orig.tar.gz -rm -f SOURCES/mlnx-iproute2_6.7.0.orig.tar.gz -rm -f SOURCES/mlnx-nfsrdma_24.04.OFED.24.04.0.6.6.1.orig.tar.gz -rm -f SOURCES/mlnx-nvme_24.04.OFED.24.04.0.6.6.1.orig.tar.gz -rm -f SOURCES/mlx-steering-dump_1.0.0.orig.tar.gz -rm -f SOURCES/mpitests_3.2.23.orig.tar.gz -rm -f SOURCES/mstflint_4.16.1.orig.tar.gz -rm -f SOURCES/ofed-scripts_24.04.OFED.24.04.0.6.6.orig.tar.gz -rm -f SOURCES/openmpi_4.1.7a1.orig.tar.gz -rm -f SOURCES/openvswitch_2.17.8.orig.tar.gz -rm -f SOURCES/perftest_24.04.0.orig.tar.gz -rm -f SOURCES/rdma-core_2404mlnx51.orig.tar.gz -rm -f SOURCES/rshim_2.0.28.orig.tar.gz -rm -f SOURCES/sockperf_3.10.orig.tar.gz -rm -f SOURCES/srp_24.04.OFED.24.04.0.6.6.1.orig.tar.gz -rm -f SOURCES/ucx_1.17.0.orig.tar.gz - - -sudo ./install.pl \ +rm -f SOURCES/ibarr_*.tar.gz +rm -f SOURCES/ibdump_*.tar.gz +rm -f SOURCES/ibsim_*.tar.gz +rm -f SOURCES/iser_*.tar.gz +rm -f SOURCES/isert_*.tar.gz +rm -f SOURCES/kernel-mft_*.tar.gz +rm -f SOURCES/knem_*.tar.gz +rm -f SOURCES/libvma_*.tar.gz +rm -f SOURCES/libxlio_*.tar.gz +rm -f SOURCES/mlnx-ethtool_*.tar.gz +rm -f SOURCES/mlnx-iproute2_*.tar.gz +rm -f SOURCES/mlnx-nfsrdma_*.tar.gz +rm -f SOURCES/mlnx-nvme_*.tar.gz +rm -f SOURCES/mlx-steering-dump_*.tar.gz +rm -f SOURCES/mpitests_*.tar.gz +rm -f SOURCES/mstflint_*.tar.gz +rm -f SOURCES/ofed-scripts_*.tar.gz +rm -f SOURCES/openmpi_*.tar.gz +rm -f SOURCES/openvswitch_*.tar.gz +rm -f SOURCES/perftest_*.tar.gz +rm -f SOURCES/rdma-core_*.tar.gz +rm -f SOURCES/rshim_*.tar.gz +rm -f SOURCES/sockperf_*.tar.gz +rm -f SOURCES/srp_*.tar.gz +rm -f SOURCES/ucx_*.tar.gz + +./install.pl \ --basic --dpdk \ --without-dkms \ --without-mlnx-nvme-modules \ @@ -106,19 +110,19 @@ sudo ./install.pl \ if [ $DROP_DEV_DBG_DEBS -eq 1 ]; then echo "I: Removing development and debug packages" - sudo rm $(find $CWD/$DRIVER_DIR/DEBS/$DEB_DISTRO -type f | grep -E '\-dev|\-dbg') + rm -f $(find $CWD/$DRIVER_DIR/DEBS/$DEB_DISTRO -type f | grep -E '\-dev|\-dbg') fi cp $(find $CWD/$DRIVER_DIR/DEBS/$DEB_DISTRO -type f | grep '\.deb$') "$CWD/" echo "I: Cleanup ${DRIVER_NAME} source" cd ${CWD} -if [ -e ${DRIVER_FILE} ]; then +if [ -f ${DRIVER_FILE} ]; then rm -f ${DRIVER_FILE} fi if [ -d ${DRIVER_DIR} ]; then - sudo rm -rf ${DRIVER_DIR} + rm -rf ${DRIVER_DIR} fi if [ -d ${DEBIAN_DIR} ]; then - sudo rm -rf ${DEBIAN_DIR} + rm -rf ${DEBIAN_DIR} fi -- cgit v1.2.3 From beb3df0733d8cf682291e19b0df0871da20ab5d4 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 14 Sep 2024 20:58:27 +0200 Subject: Kernel: T5887: cleanup Debian postinst files after package build --- packages/linux-kernel/build-intel-ixgbe.sh | 3 +++ packages/linux-kernel/build-intel-ixgbevf.sh | 4 +++- packages/linux-kernel/build-intel-qat.sh | 3 +++ packages/linux-kernel/build-nat-rtsp.sh | 4 ++++ 4 files changed, 13 insertions(+), 1 deletion(-) (limited to 'packages') diff --git a/packages/linux-kernel/build-intel-ixgbe.sh b/packages/linux-kernel/build-intel-ixgbe.sh index 5f45c62a..ab44f551 100755 --- a/packages/linux-kernel/build-intel-ixgbe.sh +++ b/packages/linux-kernel/build-intel-ixgbe.sh @@ -105,3 +105,6 @@ fi if [ -d ${DEBIAN_DIR} ]; then rm -rf ${DEBIAN_DIR} fi +if [ -f ${DEBIAN_POSTINST} ]; then + rm -f ${DEBIAN_POSTINST} +fi diff --git a/packages/linux-kernel/build-intel-ixgbevf.sh b/packages/linux-kernel/build-intel-ixgbevf.sh index a965e0de..39803852 100755 --- a/packages/linux-kernel/build-intel-ixgbevf.sh +++ b/packages/linux-kernel/build-intel-ixgbevf.sh @@ -97,4 +97,6 @@ fi if [ -d ${DEBIAN_DIR} ]; then rm -rf ${DEBIAN_DIR} fi - +if [ -f ${DEBIAN_POSTINST} ]; then + rm -f ${DEBIAN_POSTINST} +fi diff --git a/packages/linux-kernel/build-intel-qat.sh b/packages/linux-kernel/build-intel-qat.sh index 765cea3f..5b0e023f 100755 --- a/packages/linux-kernel/build-intel-qat.sh +++ b/packages/linux-kernel/build-intel-qat.sh @@ -109,3 +109,6 @@ fi if [ -d ${DEBIAN_DIR} ]; then rm -rf ${DEBIAN_DIR} fi +if [ -f ${DEBIAN_POSTINST} ]; then + rm -f ${DEBIAN_POSTINST} +fi diff --git a/packages/linux-kernel/build-nat-rtsp.sh b/packages/linux-kernel/build-nat-rtsp.sh index ec7d19a6..40018cfb 100755 --- a/packages/linux-kernel/build-nat-rtsp.sh +++ b/packages/linux-kernel/build-nat-rtsp.sh @@ -36,3 +36,7 @@ fpm --input-type dir --output-type deb --name nat-rtsp \ --license "GPL2" --chdir tmp mv *.deb .. + +if [ -f ${DEBIAN_POSTINST} ]; then + rm -f ${DEBIAN_POSTINST} +fi -- cgit v1.2.3 From fd737172f1068870fe1ededbe9b2ed4a86663acd Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Wed, 4 Sep 2024 21:37:11 +0200 Subject: T861: add UEFI Secure Boot support This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux Kernel and enforces module signing. This results in an additional security layer where untrusted (unsigned) Kernel modules can no longer be loaded into the live system. NOTE: This commit will not work unless signing keys are present. Arbitrary keys can be generated using instructions found in: data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md --- .gitignore | 8 +- Makefile | 5 + .../hooks/live/92-strip-symbols.chroot | 76 ++++++++++ .../hooks/live/93-sign-kernel.chroot | 18 +++ .../hooks/live/99-strip-symbols.chroot | 76 ---------- .../var/lib/shim-signed/mok/README.md | 22 +++ .../linux-kernel/arch/x86/configs/vyos_defconfig | 42 +++--- packages/linux-kernel/build-kernel.sh | 23 +++ scripts/check-qemu-install | 156 +++++++++++++++++++-- scripts/image-build/build-vyos-image | 2 +- 10 files changed, 316 insertions(+), 112 deletions(-) create mode 100755 data/live-build-config/hooks/live/92-strip-symbols.chroot create mode 100755 data/live-build-config/hooks/live/93-sign-kernel.chroot delete mode 100755 data/live-build-config/hooks/live/99-strip-symbols.chroot create mode 100644 data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md (limited to 'packages') diff --git a/.gitignore b/.gitignore index 23101b27..e3724a9f 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,8 @@ packer_cache/* key/* packages/* !packages/*/ -testinstall*.img -*.qcow2 -*.tar +data/live-build-config/includes.chroot/var/lib/shim-signed/mok/* +/testinstall*.img +/testinstall*.efivars +/*.qcow2 +/*.tar diff --git a/Makefile b/Makefile index 85510131..2ff776c0 100644 --- a/Makefile +++ b/Makefile @@ -38,6 +38,11 @@ testc: checkiso testraid: checkiso scripts/check-qemu-install --debug --configd --raid build/live-image-amd64.hybrid.iso $(filter-out $@,$(MAKECMDGOALS)) +.PHONY: testsb +.ONESHELL: +testsb: checkiso + scripts/check-qemu-install --debug --uefi --sbtest build/live-image-amd64.hybrid.iso $(filter-out $@,$(MAKECMDGOALS)) + .PHONY: testtpm .ONESHELL: testtpm: checkiso diff --git a/data/live-build-config/hooks/live/92-strip-symbols.chroot b/data/live-build-config/hooks/live/92-strip-symbols.chroot new file mode 100755 index 00000000..704f9cb3 --- /dev/null +++ b/data/live-build-config/hooks/live/92-strip-symbols.chroot @@ -0,0 +1,76 @@ +#!/bin/sh + +# +# Discard symbols and other data from object files. +# +# Reference: +# https://www.linuxfromscratch.org/lfs/view/systemd/chapter08/stripping.html +# https://www.debian.org/doc/debian-policy/ch-files.html +# + +# Set variables. +STRIPCMD_REGULAR="strip --remove-section=.comment --remove-section=.note --preserve-dates" +STRIPCMD_DEBUG="strip --strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" +STRIPCMD_UNNEEDED="strip --strip-unneeded --remove-section=.comment --remove-section=.note --preserve-dates" +STRIPDIR_REGULAR=" +" +STRIPDIR_DEBUG=" +/usr/lib/modules +" +STRIPDIR_UNNEEDED=" +/etc/hsflowd/modules +/usr/bin +/usr/lib/openvpn +/usr/lib/x86_64-linux-gnu +/usr/lib32 +/usr/lib64 +/usr/libx32 +/usr/sbin +" +STRIP_EXCLUDE=`dpkg-query -L libbinutils | grep '.so'` + +# Perform stuff. +echo "Stripping symbols..." + +# List excluded files. +echo "Exclude files: ${STRIP_EXCLUDE}" + +# CMD: strip +for DIR in ${STRIPDIR_REGULAR}; do + echo "Parse dir (strip): ${DIR}" + find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do + echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" + if [ $? -ne 0 ]; then + echo "Strip file (strip): ${FILE}" + ${STRIPCMD_REGULAR} ${FILE} + fi + done +done + +# CMD: strip --strip-debug +for DIR in ${STRIPDIR_DEBUG}; do + echo "Parse dir (strip-debug): ${DIR}" + find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do + echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" + if [ $? -ne 0 ]; then + echo "Strip file (strip-debug): ${FILE}" + ${STRIPCMD_DEBUG} ${FILE} + fi + done +done + +# CMD: strip --strip-unneeded +for DIR in ${STRIPDIR_UNNEEDED}; do + echo "Parse dir (strip-unneeded: ${DIR}" + find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do + echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" + if [ $? -ne 0 ]; then + echo "Strip file (strip-unneeded): ${FILE}" + ${STRIPCMD_UNNEEDED} ${FILE} + fi + done +done + +# Remove binutils package. +apt-get -y purge --autoremove binutils + diff --git a/data/live-build-config/hooks/live/93-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sign-kernel.chroot new file mode 100755 index 00000000..031db10d --- /dev/null +++ b/data/live-build-config/hooks/live/93-sign-kernel.chroot @@ -0,0 +1,18 @@ +#!/bin/sh +SIGN_FILE=$(find /usr/lib -name sign-file) +MOK_KEY="/var/lib/shim-signed/mok/kernel.key" +MOK_CERT="/var/lib/shim-signed/mok/kernel.pem" +kernel_elf=$(readlink /boot/vmlinuz) + +if [ ! -f ${MOK_KEY} ]; then + echo "I: Signing key for Linux Kernel not found - Secure Boot not possible" +else + echo "I: Signing Linux Kernel for Secure Boot" + + sbsign --key $MOK_KEY --cert $MOK_CERT /boot/${kernel_elf} --output /boot/${kernel_elf} + sbverify --list /boot/${kernel_elf} + + find /lib/modules -type f -name \*.ko -o -name \*.ko.xz | while read module; do + $SIGN_FILE sha512 $MOK_KEY $MOK_CERT $module + done +fi diff --git a/data/live-build-config/hooks/live/99-strip-symbols.chroot b/data/live-build-config/hooks/live/99-strip-symbols.chroot deleted file mode 100755 index 704f9cb3..00000000 --- a/data/live-build-config/hooks/live/99-strip-symbols.chroot +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/sh - -# -# Discard symbols and other data from object files. -# -# Reference: -# https://www.linuxfromscratch.org/lfs/view/systemd/chapter08/stripping.html -# https://www.debian.org/doc/debian-policy/ch-files.html -# - -# Set variables. -STRIPCMD_REGULAR="strip --remove-section=.comment --remove-section=.note --preserve-dates" -STRIPCMD_DEBUG="strip --strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" -STRIPCMD_UNNEEDED="strip --strip-unneeded --remove-section=.comment --remove-section=.note --preserve-dates" -STRIPDIR_REGULAR=" -" -STRIPDIR_DEBUG=" -/usr/lib/modules -" -STRIPDIR_UNNEEDED=" -/etc/hsflowd/modules -/usr/bin -/usr/lib/openvpn -/usr/lib/x86_64-linux-gnu -/usr/lib32 -/usr/lib64 -/usr/libx32 -/usr/sbin -" -STRIP_EXCLUDE=`dpkg-query -L libbinutils | grep '.so'` - -# Perform stuff. -echo "Stripping symbols..." - -# List excluded files. -echo "Exclude files: ${STRIP_EXCLUDE}" - -# CMD: strip -for DIR in ${STRIPDIR_REGULAR}; do - echo "Parse dir (strip): ${DIR}" - find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do - echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" - if [ $? -ne 0 ]; then - echo "Strip file (strip): ${FILE}" - ${STRIPCMD_REGULAR} ${FILE} - fi - done -done - -# CMD: strip --strip-debug -for DIR in ${STRIPDIR_DEBUG}; do - echo "Parse dir (strip-debug): ${DIR}" - find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do - echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" - if [ $? -ne 0 ]; then - echo "Strip file (strip-debug): ${FILE}" - ${STRIPCMD_DEBUG} ${FILE} - fi - done -done - -# CMD: strip --strip-unneeded -for DIR in ${STRIPDIR_UNNEEDED}; do - echo "Parse dir (strip-unneeded: ${DIR}" - find ${DIR} -type f -exec file {} \; | grep 'not stripped' | cut -d ":" -f 1 | while read FILE; do - echo "${STRIP_EXCLUDE}" | grep -F -q -w "${FILE}" - if [ $? -ne 0 ]; then - echo "Strip file (strip-unneeded): ${FILE}" - ${STRIPCMD_UNNEEDED} ${FILE} - fi - done -done - -# Remove binutils package. -apt-get -y purge --autoremove binutils - diff --git a/data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md b/data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md new file mode 100644 index 00000000..5a6edbba --- /dev/null +++ b/data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md @@ -0,0 +1,22 @@ +# Secure Boot + +## CA + +Create Certificate Authority used for Kernel signing. CA is loaded into the +Machine Owner Key store on the target system. + +```bash +openssl req -new -x509 -newkey rsa:2048 -keyout MOK.key -outform DER -out MOK.der -days 36500 -subj "/CN=VyOS Secure Boot CA/" -nodes +openssl x509 -inform der -in MOK.der -out MOK.pem +``` + +## Kernel Module Signing Key + +We do not make use of ephemeral keys for Kernel module signing. Instead a key +is generated and signed by the VyOS Secure Boot CA which signs all the Kernel +modules during ISO assembly if present. + +```bash +openssl req -newkey rsa:2048 -keyout kernel.key -out kernel.csr -subj "/CN=VyOS Secure Boot Signer 2024 - linux/" -nodes +openssl x509 -req -in kernel.csr -CA MOK.pem -CAkey MOK.key -CAcreateserial -out kernel.pem -days 730 -sha256 +``` diff --git a/packages/linux-kernel/arch/x86/configs/vyos_defconfig b/packages/linux-kernel/arch/x86/configs/vyos_defconfig index 7f513878..12538a9e 100644 --- a/packages/linux-kernel/arch/x86/configs/vyos_defconfig +++ b/packages/linux-kernel/arch/x86/configs/vyos_defconfig @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.6.16 Kernel Configuration +# Linux/x86 6.6.48 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (Debian 12.2.0-14) 12.2.0" CONFIG_CC_IS_GCC=y @@ -15,6 +15,7 @@ CONFIG_CC_CAN_LINK=y CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y @@ -181,7 +182,7 @@ CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y CONFIG_CC_HAS_INT128=y CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" -CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_GCC10_NO_ARRAY_BOUNDS=y CONFIG_CC_NO_ARRAY_BOUNDS=y CONFIG_ARCH_SUPPORTS_INT128=y CONFIG_NUMA_BALANCING=y @@ -193,13 +194,16 @@ CONFIG_MEMCG=y CONFIG_MEMCG_KMEM=y # CONFIG_BLK_CGROUP is not set CONFIG_CGROUP_SCHED=y +CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y +# CONFIG_RT_GROUP_SCHED is not set CONFIG_SCHED_MM_CID=y CONFIG_CGROUP_PIDS=y # CONFIG_CGROUP_RDMA is not set # CONFIG_CGROUP_FREEZER is not set # CONFIG_CGROUP_HUGETLB is not set CONFIG_CPUSETS=y +CONFIG_PROC_PID_CPUSET=y # CONFIG_CGROUP_DEVICE is not set CONFIG_CGROUP_CPUACCT=y # CONFIG_CGROUP_PERF is not set @@ -439,7 +443,6 @@ CONFIG_X86_64_ACPI_NUMA=y CONFIG_NODES_SHIFT=6 CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_ARCH_SPARSEMEM_DEFAULT=y -# CONFIG_ARCH_MEMORY_PROBE is not set CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_X86_PMEM_LEGACY_DEVICE=y @@ -509,7 +512,7 @@ CONFIG_CALL_PADDING=y CONFIG_HAVE_CALL_THUNKS=y CONFIG_CALL_THUNKS=y CONFIG_PREFIX_SYMBOLS=y -CONFIG_SPECULATION_MITIGATIONS=y +CONFIG_CPU_MITIGATIONS=y CONFIG_PAGE_TABLE_ISOLATION=y CONFIG_RETPOLINE=y CONFIG_RETHUNK=y @@ -521,6 +524,8 @@ CONFIG_CPU_IBRS_ENTRY=y CONFIG_CPU_SRSO=y # CONFIG_SLS is not set # CONFIG_GDS_FORCE_MITIGATION is not set +CONFIG_MITIGATION_RFDS=y +CONFIG_MITIGATION_SPECTRE_BHI=y CONFIG_ARCH_HAS_ADD_PAGES=y # @@ -573,7 +578,6 @@ CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set CONFIG_ACPI_PCI_SLOT=y CONFIG_ACPI_CONTAINER=y -CONFIG_ACPI_HOTPLUG_MEMORY=y CONFIG_ACPI_HOTPLUG_IOAPIC=y # CONFIG_ACPI_SBS is not set CONFIG_ACPI_HED=y @@ -686,6 +690,7 @@ CONFIG_AS_SHA256_NI=y CONFIG_AS_TPAUSE=y CONFIG_AS_GFNI=y CONFIG_AS_WRUSS=y +CONFIG_ARCH_CONFIGURES_CPU_MITIGATIONS=y # # General architecture-dependent options @@ -970,13 +975,8 @@ CONFIG_HAVE_FAST_GUP=y CONFIG_NUMA_KEEP_MEMINFO=y CONFIG_MEMORY_ISOLATION=y CONFIG_EXCLUSIVE_SYSTEM_RAM=y -CONFIG_HAVE_BOOTMEM_INFO_NODE=y CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y -CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y -CONFIG_MEMORY_HOTPLUG=y -# CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE is not set -CONFIG_MEMORY_HOTREMOVE=y -CONFIG_MHP_MEMMAP_ON_MEMORY=y +# CONFIG_MEMORY_HOTPLUG is not set CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y CONFIG_SPLIT_PTLOCK_CPUS=4 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y @@ -989,6 +989,7 @@ CONFIG_MIGRATION=y CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y CONFIG_ARCH_ENABLE_THP_MIGRATION=y CONFIG_CONTIG_ALLOC=y +CONFIG_PCP_BATCH_SCALE_MAX=5 CONFIG_PHYS_ADDR_T_64BIT=y CONFIG_MMU_NOTIFIER=y CONFIG_KSM=y @@ -1020,7 +1021,6 @@ CONFIG_ARCH_HAS_PTE_DEVMAP=y CONFIG_ARCH_HAS_ZONE_DMA_SET=y CONFIG_ZONE_DMA=y CONFIG_ZONE_DMA32=y -# CONFIG_ZONE_DEVICE is not set CONFIG_HMM_MIRROR=y CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y CONFIG_ARCH_HAS_PKEYS=y @@ -3075,6 +3075,7 @@ CONFIG_XEN_NETDEV_FRONTEND=m CONFIG_XEN_NETDEV_BACKEND=m CONFIG_VMXNET3=m # CONFIG_FUJITSU_ES is not set +CONFIG_USB4_NET=m CONFIG_HYPERV_NET=m # CONFIG_NETDEVSIM is not set CONFIG_NET_FAILOVER=m @@ -4201,6 +4202,7 @@ CONFIG_REGULATOR_TPS65132=m # Graphics support # CONFIG_APERTURE_HELPERS=y +CONFIG_SCREEN_INFO=y CONFIG_VIDEO_CMDLINE=y # CONFIG_AUXDISPLAY is not set # CONFIG_PANEL is not set @@ -4268,6 +4270,7 @@ CONFIG_FB_CFB_FILLRECT=y CONFIG_FB_CFB_COPYAREA=y CONFIG_FB_CFB_IMAGEBLIT=y # CONFIG_FB_FOREIGN_ENDIAN is not set +CONFIG_FB_IOMEM_FOPS=y CONFIG_FB_IOMEM_HELPERS=y # CONFIG_FB_MODE_HELPERS is not set # CONFIG_FB_TILEBLITTING is not set @@ -5008,7 +5011,6 @@ CONFIG_VIRTIO_PCI=m CONFIG_VIRTIO_PCI_LEGACY=y # CONFIG_VIRTIO_PMEM is not set CONFIG_VIRTIO_BALLOON=m -CONFIG_VIRTIO_MEM=m CONFIG_VIRTIO_INPUT=m CONFIG_VIRTIO_MMIO=m CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y @@ -5035,8 +5037,6 @@ CONFIG_HYPERV_BALLOON=m # Xen driver support # CONFIG_XEN_BALLOON=y -CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y -CONFIG_XEN_MEMORY_HOTPLUG_LIMIT=512 CONFIG_XEN_SCRUB_PAGES_DEFAULT=y CONFIG_XEN_DEV_EVTCHN=m CONFIG_XEN_BACKEND=y @@ -5316,7 +5316,8 @@ CONFIG_IDLE_INJECT=y CONFIG_RAS=y # CONFIG_RAS_CEC is not set CONFIG_USB4=m -CONFIG_USB4_NET=m +# CONFIG_USB4_DEBUGFS_WRITE is not set +# CONFIG_USB4_DMA_TEST is not set # # Android @@ -5638,6 +5639,7 @@ CONFIG_CRYPTO_ALGAPI=y CONFIG_CRYPTO_ALGAPI2=y CONFIG_CRYPTO_AEAD=y CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_SIG=y CONFIG_CRYPTO_SIG2=y CONFIG_CRYPTO_SKCIPHER=y CONFIG_CRYPTO_SKCIPHER2=y @@ -5750,7 +5752,7 @@ CONFIG_CRYPTO_POLY1305=m CONFIG_CRYPTO_RMD160=m CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_SHA256=y -CONFIG_CRYPTO_SHA512=m +CONFIG_CRYPTO_SHA512=y CONFIG_CRYPTO_SHA3=m # CONFIG_CRYPTO_SM3_GENERIC is not set CONFIG_CRYPTO_STREEBOG=m @@ -6007,7 +6009,6 @@ CONFIG_SWIOTLB=y CONFIG_SGL_ALLOC=y CONFIG_IOMMU_HELPER=y CONFIG_CHECK_SIGNATURE=y -# CONFIG_FORCE_NR_CPUS is not set CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y @@ -6033,7 +6034,6 @@ CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y CONFIG_ARCH_HAS_COPY_MC=y CONFIG_ARCH_STACKWALK=y -CONFIG_STACKDEPOT=y CONFIG_SBITMAP=y CONFIG_PARMAN=m CONFIG_OBJAGG=m @@ -6117,8 +6117,7 @@ CONFIG_HAVE_KCSAN_COMPILER=y # CONFIG_PAGE_EXTENSION=y # CONFIG_DEBUG_PAGEALLOC is not set -CONFIG_SLUB_DEBUG=y -# CONFIG_SLUB_DEBUG_ON is not set +# CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set # CONFIG_PAGE_TABLE_CHECK is not set CONFIG_PAGE_POISONING=y @@ -6331,6 +6330,7 @@ CONFIG_X86_DEBUG_FPU=y # CONFIG_PUNIT_ATOM_DEBUG is not set CONFIG_UNWINDER_ORC=y # CONFIG_UNWINDER_FRAME_POINTER is not set +# CONFIG_UNWINDER_GUESS is not set # end of x86 Debugging # diff --git a/packages/linux-kernel/build-kernel.sh b/packages/linux-kernel/build-kernel.sh index c0a863c6..3ccb15e9 100755 --- a/packages/linux-kernel/build-kernel.sh +++ b/packages/linux-kernel/build-kernel.sh @@ -19,6 +19,7 @@ git reset --hard HEAD KERNEL_VERSION=$(make kernelversion) KERNEL_SUFFIX=-$(awk -F "= " '/kernel_flavor/ {print $2}' ../../../data/defaults.toml | tr -d \") +KERNEL_CONFIG=arch/x86/configs/vyos_defconfig # VyOS requires some small Kernel Patches - apply them here # It's easier to habe them here and make use of the upstream @@ -31,6 +32,28 @@ do patch -p1 < ${PATCH_DIR}/${patch} done +TRUSTED_KEYS_FILE=trusted_keys.pem +# start with empty key file +echo -n "" > $TRUSTED_KEYS_FILE +CERTS=$(ls ../../../data/live-build-config/includes.chroot/var/lib/shim-signed/mok/*.pem) +if [ ! -z "${CERTS}" ]; then + # add known public keys to Kernel certificate chain + for file in $CERTS; do + cat $file >> $TRUSTED_KEYS_FILE + done + + # Force Kernel module signing and embed public keys + echo "CONFIG_MODULE_SIG_FORMAT=y" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG=y" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG_FORCE=y" >> $KERNEL_CONFIG + echo "# CONFIG_MODULE_SIG_ALL is not set" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG_SHA512=y" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG_HASH=\"sha512\"" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG_KEY=\"\"" >> $KERNEL_CONFIG + echo "CONFIG_MODULE_SIG_KEY_TYPE_RSA=y" >> $KERNEL_CONFIG + echo "CONFIG_SYSTEM_TRUSTED_KEYS=\"$TRUSTED_KEYS_FILE\"" >> $KERNEL_CONFIG +fi + echo "I: make vyos_defconfig" # Select Kernel configuration - currently there is only one make vyos_defconfig diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 921384cc..e1fd45f1 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -43,6 +43,7 @@ import traceback import logging import re import tomli +import shutil from io import BytesIO from datetime import datetime @@ -52,6 +53,17 @@ now = datetime.now() tpm_folder = '/tmp/vyos_tpm_test' qemu_name = 'VyOS-QEMU' +# getch.py +KEY_F2 = chr(27) + chr(91) + chr(49) + chr(50) + chr(126) +KEY_F10 = chr(27) + chr(91) + chr(50) + chr(49) + chr(126) +KEY_DOWN = chr(27) + chr(91) + chr(66) +KEY_SPACE = chr(32) +KEY_RETURN = chr(13) +KEY_ESC = chr(27) +KEY_Y = chr(121) + +mok_password = '1234' + parser = argparse.ArgumentParser(description='Install and start a test VyOS vm.') parser.add_argument('iso', help='ISO file to install') parser.add_argument('disk', help='name of disk image file', nargs='?', @@ -78,6 +90,8 @@ parser.add_argument('--configtest', help='Execute load/commit config tests', action='store_true', default=False) parser.add_argument('--tpmtest', help='Execute TPM encrypted config tests', action='store_true', default=False) +parser.add_argument('--sbtest', help='Execute Secure Boot tests', + action='store_true', default=False) parser.add_argument('--qemu-cmd', help='Only generate QEMU launch command', action='store_true', default=False) @@ -114,17 +128,33 @@ def get_half_cpus(): cpu /= 2 return int(cpu) -def get_qemu_cmd(name, enable_uefi, disk_img, raid=None, iso_img=None, tpm=False, vnc_enabled=False): +OVMF_CODE = '/usr/share/OVMF/OVMF_CODE_4M.secboot.fd' +OVMF_VARS_TMP = args.disk.replace('.img', '.efivars') +if args.sbtest: + shutil.copy('/usr/share/OVMF/OVMF_VARS_4M.ms.fd', OVMF_VARS_TMP) + +def get_qemu_cmd(name, enable_uefi, disk_img, raid=None, iso_img=None, tpm=False, vnc_enabled=False, secure_boot=False): uefi = "" uuid = "f48b60b2-e6ad-49ef-9d09-4245d0585e52" + machine = 'pc' + vga = '-vga none' + vnc = '' + if vnc_enabled: + vga = '-vga virtio' + vnc = '-vnc :0' + if enable_uefi: uefi = '-bios /usr/share/OVMF/OVMF_CODE.fd' name = f'{name}-UEFI' - uuid = 'd27cf29e-4419-4407-8f82-dc73d1acd184' - vga = '-vga none' - if vnc_enabled: - vga = ' -vga virtio -vnc :0' + if secure_boot: + name = f'{name}-SECURE-BOOT' + machine = 'q35,smm=on' + + uefi = f'-drive "if=pflash,unit=0,format=raw,readonly=on,file={OVMF_CODE}" ' \ + f'-drive "if=pflash,unit=1,format=raw,file={OVMF_VARS_TMP}"' + # Changing UEFI settings require a display + vga = '-vga virtio' cdrom = "" if iso_img: @@ -140,12 +170,12 @@ def get_qemu_cmd(name, enable_uefi, disk_img, raid=None, iso_img=None, tpm=False -name "{name}" \ -smp {cpucount},sockets=1,cores={cpucount},threads=1 \ -cpu host \ + -machine {machine},accel=kvm \ {uefi} \ -m 4G \ -vga none \ -nographic \ - {vga} \ - -machine accel=kvm \ + {vga} {vnc}\ -uuid {uuid} \ -cpu host \ {cdrom} \ @@ -280,8 +310,50 @@ def start_swtpm(): tpm_process.start() return tpm_process +def toggleUEFISecureBoot(c): + def UEFIKeyPress(c, key): + UEFI_SLEEP = 1 + c.send(key) + time.sleep(UEFI_SLEEP) + + # Enter UEFI + for ii in range(1, 10): + c.send(KEY_F2) + time.sleep(0.250) + + time.sleep(10) + + # Device Manager + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_RETURN) + + # Secure Boot Configuration + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_RETURN) + + # Attempt Secure Boot Toggle + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_RETURN) + UEFIKeyPress(c, KEY_RETURN) + + # Save Secure Boot + UEFIKeyPress(c, KEY_F10) + UEFIKeyPress(c, KEY_Y) + + # Go Back to Menu + UEFIKeyPress(c, KEY_ESC) + UEFIKeyPress(c, KEY_ESC) + + # Go Down for reset + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_DOWN) + UEFIKeyPress(c, KEY_RETURN) + if args.qemu_cmd: - tmp = get_qemu_cmd(qemu_name, args.uefi, args.disk, raid=diskname_raid, iso_img=args.iso, vnc_enabled=args.vnc) + tmp = get_qemu_cmd(qemu_name, args.uefi, args.disk, raid=diskname_raid, iso_img=args.iso, vnc_enabled=args.vnc, secure_boot=args.sbtest) os.system(tmp) exit(0) @@ -292,7 +364,7 @@ try: # Installing image to disk ################################################# log.info('Installing system') - cmd = get_qemu_cmd(qemu_name, args.uefi, args.disk, raid=diskname_raid, iso_img=args.iso, vnc_enabled=args.vnc) + cmd = get_qemu_cmd(qemu_name, args.uefi, args.disk, raid=diskname_raid, iso_img=args.iso, vnc_enabled=args.vnc, secure_boot=args.sbtest) log.debug(f'Executing command: {cmd}') c = pexpect.spawn(cmd, logfile=stl, timeout=60) @@ -304,6 +376,10 @@ try: default_user = 'vyos' default_password = 'vyos' + if args.sbtest: + log.info('Disable UEFI Secure Boot for initial installation') + toggleUEFISecureBoot(c) + try: c.expect('Automatic boot in', timeout=10) c.sendline('') @@ -348,9 +424,63 @@ try: c.sendline('') c.expect(op_mode_prompt) + + if args.sbtest: + c.sendline('install mok') + c.expect('input password:.*') + c.sendline(mok_password) + c.expect('input password again:.*') + c.sendline(mok_password) + c.expect(op_mode_prompt) + log.info('system installed, rebooting') c.sendline('reboot now') + ################################################# + # SHIM Mok Manager + ################################################# + if args.sbtest: + log.info('Install Secure Boot Machine Owner Key') + MOK_SLEEP = 0.5 + c.expect('BdsDxe: starting Boot00.*') + time.sleep(3) + # press any key + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + # Enroll MOK + c.send(KEY_DOWN) + time.sleep(MOK_SLEEP) + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + # Continue + c.send(KEY_DOWN) + time.sleep(MOK_SLEEP) + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + # Enroll Keys + c.send(KEY_DOWN) + time.sleep(MOK_SLEEP) + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + c.sendline(mok_password) + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + # Reboot + c.send(KEY_RETURN) + time.sleep(MOK_SLEEP) + + ################################################# + # Re-Enable Secure Boot + ################################################# + if args.sbtest: + log.info('Enable UEFI Secure Boot for initial installation') + toggleUEFISecureBoot(c) + ################################################# # Removing CD installation media ################################################# @@ -588,7 +718,6 @@ try: log.debug(f'Executing command: {cmd}') c = pexpect.spawn(cmd, logfile=stl) - ################################################# # Logging into VyOS system ################################################# @@ -710,7 +839,10 @@ try: tmp = 'Configtest failed :/ - check debug output' log.error(tmp) raise Exception(tmp) - + elif args.sbtest: + c.sendline('show secure-boot') + c.expect('SecureBoot enabled') + c.expect(op_mode_prompt) else: log.info('No testcase selected!') @@ -748,6 +880,8 @@ if not args.keep: os.remove(args.disk) if diskname_raid: os.remove(diskname_raid) + if args.sbtest: + os.remove(OVMF_VARS_TMP) except Exception: log.error('Exception while removing diskimage!') log.error(traceback.format_exc()) diff --git a/scripts/image-build/build-vyos-image b/scripts/image-build/build-vyos-image index a0acd184..566c6a8b 100755 --- a/scripts/image-build/build-vyos-image +++ b/scripts/image-build/build-vyos-image @@ -571,7 +571,7 @@ if __name__ == "__main__": --checksums 'sha256 md5' \ --chroot-squashfs-compression-type "{{squashfs_compression_type}}" \ --debian-installer none \ - --debootstrap-options "--variant=minbase --exclude=isc-dhcp-client,isc-dhcp-common,ifupdown --include=apt-utils,ca-certificates,gnupg2" \ + --debootstrap-options "--variant=minbase --exclude=isc-dhcp-client,isc-dhcp-common,ifupdown --include=apt-utils,ca-certificates,gnupg2,linux-kbuild-6.1" \ --distribution {{debian_distribution}} \ --firmware-binary false \ --firmware-chroot false \ -- cgit v1.2.3