diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:12:37 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:12:37 +0200 |
| commit | e55dff911c837796ef9d0161ecd3c96dcd85333a (patch) | |
| tree | 48b7e808fe001ee691af49e94b5e16ff15965da9 | |
| parent | 53b4043e96469fdf2ea02e8ddb06fe9083e5ab40 (diff) | |
| download | vyos-build-e55dff911c837796ef9d0161ecd3c96dcd85333a.tar.gz vyos-build-e55dff911c837796ef9d0161ecd3c96dcd85333a.zip | |
secure-boot: T861: verify dev Kernel signature before replacing the image
The development signing path signed the Kernel in place and never checked
the result, so a failed sbsign could leave a broken Kernel behind and a bad
signature went unnoticed (sbverify --list only prints signatures).
The Kernel is now signed to a temporary file and verified against the dev
certificate before it replaces the original. On failure the temporary file
and the private key are removed and the build aborts, matching the HSM path.
| -rwxr-xr-x | data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 129ca8f8..1a2ee141 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -50,9 +50,24 @@ if [ -f ${SB_KERNEL_CERT} ] && [ -f ${SB_OPENSSL_CONF} ]; then echo "I: Linux Kernel signed and signature verified" elif [ -f ${KERNEL_KEY} ] && [ -f ${KERNEL_CERT} ]; then echo "I: Signing Linux Kernel for Secure Boot" - sbsign --key ${KERNEL_KEY} --cert ${KERNEL_CERT} /boot/${VMLINUZ} --output /boot/${VMLINUZ} - sbverify --list /boot/${VMLINUZ} + sbsign --key ${KERNEL_KEY} --cert ${KERNEL_CERT} \ + /boot/${VMLINUZ} --output /boot/${VMLINUZ}.tmp + if [ $? -ne 0 ]; then + rm -f /boot/${VMLINUZ}.tmp ${KERNEL_KEY} + echo "E: Signing of Linux Kernel failed" + exit 1 + fi + + sbverify --cert ${KERNEL_CERT} /boot/${VMLINUZ}.tmp + if [ $? -ne 0 ]; then + rm -f /boot/${VMLINUZ}.tmp ${KERNEL_KEY} + echo "E: Signature verification failed - keeping the unsigned Linux Kernel" + exit 1 + fi + + mv /boot/${VMLINUZ}.tmp /boot/${VMLINUZ} rm -f ${KERNEL_KEY} + echo "I: Linux Kernel signed and signature verified" else echo "I: Signing key for Linux Kernel not found - Secure Boot not possible" fi |