Add encrypted file support

In certain cases, such as network booting over an untrusted connection,
it may be useful to fully encrypt and sign the kernel files.

Enable fully encrypted boot using builtin keyring via the addition of
the string "ENCRYPTED" to the first line of the /etc/pb-lockdown file.
This disables detached (plaintext) signature verification.

Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>

1 files changed, 37 insertions, 5 deletions

diff --git a/discover/boot.c b/discover/boot.c
index c4ddfef..c25627d 100644
--- a/discover/boot.c
+++ b/discover/boot.c
@@ -51,9 +51,14 @@ static int kexec_load(struct boot_task *boot_task)
 	boot_task->local_image_override = NULL;
 
 	if ((result = gpg_validate_boot_files(boot_task))) {
-		if (result == KEXEC_LOAD_SIGNATURE_FAILURE) {
+		if (result == KEXEC_LOAD_DECRYPTION_FALURE) {
 			pb_log("%s: Aborting kexec due to"
-				" signature verification failure\n", __func__);
+				" decryption failure\n", __func__);
+			goto abort_kexec;
+		}
+		if (result == KEXEC_LOAD_SIGNATURE_FAILURE) {
+			pb_log("%s: Aborting kexec due to signature"
+				" verification failure\n", __func__);
 			goto abort_kexec;
 		}
 	}
@@ -391,7 +396,13 @@ static void boot_process(struct load_url_result *result, void *data)
 				load_pending(task->dtb_signature) ||
 				load_pending(task->cmdline_signature))
 			return;
+	}
+	if (task->decrypt_files) {
+		if (load_pending(task->cmdline_signature))
+			return;
+	}
 
+	if (task->verify_signature) {
 		if (check_load(task, "kernel image signature",
 					task->image_signature) ||
 				check_load(task, "initrd signature",
@@ -402,6 +413,14 @@ static void boot_process(struct load_url_result *result, void *data)
 					task->cmdline_signature))
 			goto no_sig_load;
 	}
+	if (task->decrypt_files) {
+		if (load_pending(task->cmdline_signature))
+			return;
+
+		if (check_load(task, "command line signature",
+					task->cmdline_signature))
+			goto no_decrypt_sig_load;
+	}
 
 	/* we make a copy of the local paths, as the boot hooks might update
 	 * and/or create these */
@@ -416,6 +435,8 @@ static void boot_process(struct load_url_result *result, void *data)
 			task->initrd_signature->local : NULL;
 		task->local_dtb_signature = task->dtb_signature ?
 			task->dtb_signature->local : NULL;
+	}
+	if (task->verify_signature || task->decrypt_files) {
 		task->local_cmdline_signature = task->cmdline_signature ?
 			task->cmdline_signature->local : NULL;
 	}
@@ -426,7 +447,11 @@ static void boot_process(struct load_url_result *result, void *data)
 			_("performing kexec_load"));
 
 	rc = kexec_load(task);
-	if (rc == KEXEC_LOAD_SIGNATURE_FAILURE) {
+	if (rc == KEXEC_LOAD_DECRYPTION_FALURE) {
+		update_status(task->status_fn, task->status_arg,
+				BOOT_STATUS_ERROR, _("decryption failed"));
+	}
+	else if (rc == KEXEC_LOAD_SIGNATURE_FAILURE) {
 		update_status(task->status_fn, task->status_arg,
 				BOOT_STATUS_ERROR,
 				_("signature verification failed"));
@@ -446,6 +471,8 @@ no_sig_load:
 	cleanup_load(task->image_signature);
 	cleanup_load(task->initrd_signature);
 	cleanup_load(task->dtb_signature);
+
+no_decrypt_sig_load:
 	cleanup_load(task->cmdline_signature);
 
 no_load:
@@ -494,6 +521,7 @@ struct boot_task *boot(void *ctx, struct discover_boot_option *opt,
 	struct boot_task *boot_task;
 	const char *boot_desc;
 	int rc;
+	int lockdown_type;
 
 	if (opt && opt->option->name)
 		boot_desc = opt->option->name;
@@ -533,7 +561,9 @@ struct boot_task *boot(void *ctx, struct discover_boot_option *opt,
 	boot_task->status_fn = status_fn;
 	boot_task->status_arg = status_arg;
 
-	boot_task->verify_signature = (lockdown_status() == PB_LOCKDOWN_SIGN);
+	lockdown_type = lockdown_status();
+	boot_task->verify_signature = (lockdown_type == PB_LOCKDOWN_SIGN);
+	boot_task->decrypt_files = (lockdown_type == PB_LOCKDOWN_DECRYPT);
 
 	if (cmd && cmd->boot_args) {
 		boot_task->args = talloc_strdup(boot_task, cmd->boot_args);
@@ -551,7 +581,7 @@ struct boot_task *boot(void *ctx, struct discover_boot_option *opt,
 		boot_task->boot_tty = config ? config->boot_tty : NULL;
 	}
 
-	if (boot_task->verify_signature) {
+	if (boot_task->verify_signature || boot_task->decrypt_files) {
 		if (cmd && cmd->args_sig_file) {
 			cmdline_sig = pb_url_parse(opt, cmd->args_sig_file);
 		} else if (opt && opt->args_sig_file) {
@@ -590,7 +620,9 @@ struct boot_task *boot(void *ctx, struct discover_boot_option *opt,
 			rc |= start_url_load(boot_task, "dtb signature",
 				dtb_sig, &boot_task->dtb_signature);
 		}
+	}
 
+	if (boot_task->verify_signature || boot_task->decrypt_files) {
 		rc |= start_url_load(boot_task,
 			"kernel command line signature", cmdline_sig,
 			&boot_task->cmdline_signature);