Skip to content

Commit

Permalink
s390x: secex: decrypt ignition config on firstboot
Browse files Browse the repository at this point in the history
  • Loading branch information
nikita-dubrovskii committed Sep 20, 2022
1 parent b8f6366 commit e1ab701
Show file tree
Hide file tree
Showing 4 changed files with 48 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[Unit]
Description=CoreOS Secex Ignition Config Decryptor
ConditionPathExists=/etc/initrd-release
ConditionPathExists=/run/coreos/secure-execution
DefaultDependencies=false

OnFailure=emergency.target
OnFailureJobMode=isolate

# Run after virtio_blk and before Ignition
After=coreos-gpt-setup.service
Before=ignition-fetch-offline.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/coreos-secex-ignition-decrypt
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
#!/bin/bash
set -euo pipefail

disk=/dev/disk/by-id/virtio-ignition_crypted
conf=/usr/lib/ignition/user.ign
pkey=/etc/ignition.pem

cleanup() {
rm -f "${pkey}"
rm -rf "${tmpd}"
}

tmpd=$(mktemp -d) && trap cleanup EXIT
mkdir -p /usr/lib/ignition
cd "${tmpd}"
cat "${disk}" | tar -xf -
openssl pkeyutl -decrypt -in key.crypted -out key -inkey "${pkey}"
openssl enc -pbkdf2 -aes256 -d -in config.crypted -out "${conf}" -pass file:./key
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,13 @@ install() {
sgdisk \
uname

# For IBM SecureExecution
if [[ $(uname -m) = s390x ]]; then
inst_multiple \
tar \
openssl
fi

inst_simple "$moddir/coreos-diskful-generator" \
"$systemdutildir/system-generators/coreos-diskful-generator"

Expand Down Expand Up @@ -76,4 +83,8 @@ install() {

# IBM Secure Execution. Ignition config for reencryption of / and /boot
inst_simple "$moddir/01-secex.ign" /usr/lib/coreos/01-secex.ign
install_ignition_unit "coreos-secex-ignition-decrypt.service"
inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
"/usr/sbin/coreos-secex-ignition-decrypt"

}
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,9 @@ EOF
fi
}

# in SE case drop config before entering shell
# in SE case drop everything before entering shell
if [ -f /run/coreos/secure-execution ]; then
rm -f /etc/ignition.pem
rm -f /run/ignition.json
fi

Expand Down

0 comments on commit e1ab701

Please sign in to comment.