diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:07:44 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:07:44 +0200 |
| commit | 53b4043e96469fdf2ea02e8ddb06fe9083e5ab40 (patch) | |
| tree | 13c2204acc20df0f9f93cd2821411e83e618fef3 | |
| parent | b5155b113e7b624ca2b89ec6c6c2286624714cbe (diff) | |
| download | vyos-build-53b4043e96469fdf2ea02e8ddb06fe9083e5ab40.tar.gz vyos-build-53b4043e96469fdf2ea02e8ddb06fe9083e5ab40.zip | |
secure-boot: T861: detect all PEM private key types in MOK directory
Every regular file is now scanned for any PEM private key header and the
build still aborts when one is found.
| -rwxr-xr-x | data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 4fe056ef..129ca8f8 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -67,10 +67,11 @@ done echo "I: Removing Secure Boot signing tooling" apt-get -y purge libengine-pkcs11-openssl yubihsm-pkcs11 libyubihsm2 opensc opensc-pkcs11 libyubihsm-http2 -for cert in $(ls /var/lib/shim-signed/mok/); do - if grep -rq "BEGIN PRIVATE KEY" /var/lib/shim-signed/mok/${cert}; then - echo "Found private key - bailing out" - exit 1 - fi -done +# Fail if any private key found in the image chroot path +KEY_FILES=$(find /var/lib/shim-signed/mok/ -type f \ + -exec grep -lE -e '-----BEGIN ([A-Z0-9]+ )*PRIVATE KEY-----' {} + 2>/dev/null) +if [ -n "${KEY_FILES}" ]; then + echo "Found private key - bailing out: ${KEY_FILES}" + exit 1 +fi |