VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=c-po-patch-2 2024-10-05T06:15:55+00:00 2024-10-05T06:15:55+00:00 Christian Breunig christian@breunig.cc 2024-10-04T05:11:21+00:00 urn:sha1:1e53e6451c3fef7599f7ab69afa9c7a59539d94d 2024-10-02T07:34:49+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2024-10-02T07:34:49+00:00 urn:sha1:7bd5496de13343a951b6376d50a24264f36a3c0c 2024-09-25T18:24:21+00:00 Christian Breunig christian@breunig.cc 2024-09-25T18:24:21+00:00 urn:sha1:d235b31a095f9b8fdb2d5c231935c8b4b4c3da6c The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key. 2024-09-22T07:31:31+00:00 Christian Breunig christian@breunig.cc 2024-09-21T18:54:30+00:00 urn:sha1:88f072df3d08c650d8ac0f5f616428fde694e0bd 2024-09-22T07:31:31+00:00 Christian Breunig christian@breunig.cc 2024-09-20T20:51:39+00:00 urn:sha1:53bd06d17be1d5c66f75b4546f006a6ed1b4675c As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all driver modules need to be cryptographically signed. This happens during build of the Kernel and it's 3rd party modules. Stripping the objects would remove said signature and the system will be unable to boot b/c of CONFIG_MODULE_SIG_FORCE. 2024-09-14T21:05:23+00:00 Christian Breunig christian@breunig.cc 2024-09-04T19:37:11+00:00 urn:sha1:fd737172f1068870fe1ededbe9b2ed4a86663acd This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux Kernel and enforces module signing. This results in an additional security layer where untrusted (unsigned) Kernel modules can no longer be loaded into the live system. NOTE: This commit will not work unless signing keys are present. Arbitrary keys can be generated using instructions found in: data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md 2024-09-14T18:58:44+00:00 Christian Breunig christian@breunig.cc 2024-09-14T18:58:05+00:00 urn:sha1:f523ae5cacfb162f2f30996777c81c0caf19a684 2024-09-07T19:31:46+00:00 Christian Breunig christian@breunig.cc 2024-09-04T19:13:49+00:00 urn:sha1:fd7d1d0d208f5857d84f1bc48577ff775a67b823 2024-09-05T05:14:43+00:00 Christian Breunig christian@breunig.cc 2024-09-04T19:19:45+00:00 urn:sha1:68671774f9161e502b99f9a2aeb63f9427a6f63c 2024-09-05T05:13:08+00:00 Christian Breunig christian@breunig.cc 2024-09-04T19:05:51+00:00 urn:sha1:f53921911efa73d53b3dc20bddac7203976219e1 Telegraf is not a full VyOS feature with a proper dependency in place via vyos-1x package. Drop this temporary dependency.