diff options
author | tpearson@raptorengineering.com <tpearson@raptorengineering.com> | 2016-08-18 04:45:47 -0500 |
---|---|---|
committer | Samuel Mendoza-Jonas <sam@mendozajonas.com> | 2016-08-26 13:23:01 +1000 |
commit | 86c9d34380b0074dab1ba89a569a94280d6999c4 (patch) | |
tree | 22cf0cccbd4022d150e231adcb360b3bcf528cda /discover/device-handler.c | |
parent | 5496eee36f70631ae45403f90ed7b4dc143f27c0 (diff) | |
download | talos-petitboot-86c9d34380b0074dab1ba89a569a94280d6999c4.tar.gz talos-petitboot-86c9d34380b0074dab1ba89a569a94280d6999c4.zip |
Add support for GPG signature enforcement on booted
kernels and related blobs
This can be used to implement a form of organization-controlled secure boot,
whereby kernels may be loaded from a variety of sources but they will only
boot if a valid signature file is found for each component, and only if the
signature is listed in the /etc/pb-lockdown file.
Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
(Minor build fixes and gpgme.m4, comment on secure boot in gpg.c)
Diffstat (limited to 'discover/device-handler.c')
-rw-r--r-- | discover/device-handler.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/discover/device-handler.c b/discover/device-handler.c index c31fcea..f6b6d22 100644 --- a/discover/device-handler.c +++ b/discover/device-handler.c @@ -613,6 +613,7 @@ static bool __attribute__((used)) boot_option_is_resolved( return resource_is_resolved(opt->boot_image) && resource_is_resolved(opt->initrd) && resource_is_resolved(opt->dtb) && + resource_is_resolved(opt->args_sig_file) && resource_is_resolved(opt->icon); } @@ -638,6 +639,8 @@ static bool boot_option_resolve(struct discover_boot_option *opt, return resource_resolve(opt->boot_image, "boot_image", opt, handler) && resource_resolve(opt->initrd, "initrd", opt, handler) && resource_resolve(opt->dtb, "dtb", opt, handler) && + resource_resolve(opt->args_sig_file, "args_sig_file", opt, + handler) && resource_resolve(opt->icon, "icon", opt, handler); } @@ -652,6 +655,7 @@ static void boot_option_finalise(struct device_handler *handler, assert(!opt->option->dtb_file); assert(!opt->option->icon_file); assert(!opt->option->device_id); + assert(!opt->option->args_sig_file); if (opt->boot_image) opt->option->boot_image_file = opt->boot_image->url->full; @@ -661,6 +665,8 @@ static void boot_option_finalise(struct device_handler *handler, opt->option->dtb_file = opt->dtb->url->full; if (opt->icon) opt->option->icon_file = opt->icon->url->full; + if (opt->args_sig_file) + opt->option->args_sig_file = opt->args_sig_file->url->full; opt->option->device_id = opt->device->device->id; |