forked from NixOS/nixpkgs
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request NixOS#189676 from zhaofengli/cryptenroll
systemd: Fix systemd-{cryptenroll,cryptsetup} TPM2 and FIDO2 support (attempt #3)- Loading branch information
Showing
8 changed files
with
203 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| import ./make-test-python.nix ({ lib, pkgs, ... }: { | ||
| name = "systemd-initrd-luks-fido2"; | ||
|
|
||
| nodes.machine = { pkgs, config, ... }: { | ||
| # Use systemd-boot | ||
| virtualisation = { | ||
| emptyDiskImages = [ 512 ]; | ||
| useBootLoader = true; | ||
| useEFIBoot = true; | ||
| qemu.package = lib.mkForce (pkgs.qemu_test.override { canokeySupport = true; }); | ||
| qemu.options = [ "-device canokey,file=/tmp/canokey-file" ]; | ||
| }; | ||
| boot.loader.systemd-boot.enable = true; | ||
|
|
||
| boot.initrd.systemd.enable = true; | ||
|
|
||
| environment.systemPackages = with pkgs; [ cryptsetup ]; | ||
|
|
||
| specialisation.boot-luks.configuration = { | ||
| boot.initrd.luks.devices = lib.mkVMOverride { | ||
| cryptroot = { | ||
| device = "/dev/vdc"; | ||
| crypttabExtraOpts = [ "fido2-device=auto" ]; | ||
| }; | ||
| }; | ||
| virtualisation.bootDevice = "/dev/mapper/cryptroot"; | ||
| }; | ||
| }; | ||
|
|
||
| testScript = '' | ||
| # Create encrypted volume | ||
| machine.wait_for_unit("multi-user.target") | ||
| machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -") | ||
| machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdc |& systemd-cat") | ||
| # Boot from the encrypted disk | ||
| machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf") | ||
| machine.succeed("sync") | ||
| machine.crash() | ||
| # Boot and decrypt the disk | ||
| machine.wait_for_unit("multi-user.target") | ||
| assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount") | ||
| ''; | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| import ./make-test-python.nix ({ lib, pkgs, ... }: { | ||
| name = "systemd-initrd-luks-tpm2"; | ||
|
|
||
| nodes.machine = { pkgs, ... }: { | ||
| # Use systemd-boot | ||
| virtualisation = { | ||
| emptyDiskImages = [ 512 ]; | ||
| useBootLoader = true; | ||
| useEFIBoot = true; | ||
| qemu.options = ["-chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0"]; | ||
| }; | ||
| boot.loader.systemd-boot.enable = true; | ||
|
|
||
| boot.initrd.availableKernelModules = [ "tpm_tis" ]; | ||
|
|
||
| environment.systemPackages = with pkgs; [ cryptsetup ]; | ||
| boot.initrd.systemd = { | ||
| enable = true; | ||
| }; | ||
|
|
||
| specialisation.boot-luks.configuration = { | ||
| boot.initrd.luks.devices = lib.mkVMOverride { | ||
| cryptroot = { | ||
| device = "/dev/vdc"; | ||
| crypttabExtraOpts = [ "tpm2-device=auto" ]; | ||
| }; | ||
| }; | ||
| virtualisation.bootDevice = "/dev/mapper/cryptroot"; | ||
| }; | ||
| }; | ||
|
|
||
| testScript = '' | ||
| import subprocess | ||
| import os | ||
| import time | ||
| class Tpm: | ||
| def __init__(self): | ||
| os.mkdir("/tmp/mytpm1") | ||
| self.start() | ||
| def start(self): | ||
| self.proc = subprocess.Popen(["${pkgs.swtpm}/bin/swtpm", "socket", "--tpmstate", "dir=/tmp/mytpm1", "--ctrl", "type=unixio,path=/tmp/mytpm1/swtpm-sock", "--log", "level=20", "--tpm2"]) | ||
| def wait_for_death_then_restart(self): | ||
| while self.proc.poll() is None: | ||
| print("waiting for tpm to die") | ||
| time.sleep(1) | ||
| assert self.proc.returncode == 0 | ||
| self.start() | ||
| tpm = Tpm() | ||
| # Create encrypted volume | ||
| machine.wait_for_unit("multi-user.target") | ||
| machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -") | ||
| machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdc |& systemd-cat") | ||
| # Boot from the encrypted disk | ||
| machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf") | ||
| machine.succeed("sync") | ||
| machine.crash() | ||
| tpm.wait_for_death_then_restart() | ||
| # Boot and decrypt the disk | ||
| machine.wait_for_unit("multi-user.target") | ||
| assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount") | ||
| ''; | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
pkgs/os-specific/linux/cryptsetup/relative-token-path.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| From 4f95ab1f8110a8ab9d7b0e192731ce467f6e5c26 Mon Sep 17 00:00:00 2001 | ||
| From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo> | ||
| Date: Sun, 4 Sep 2022 11:15:02 -0600 | ||
| Subject: [PATCH] Allow loading token handlers from the default search path | ||
|
|
||
| Since [1] landed in cryptsetup, token handlers (libcryptsetup-token-*.so) | ||
| are loaded from a fixed path defined at compile-time. This is | ||
| problematic with NixOS since it introduces a dependency cycle | ||
| between cryptsetup and systemd. | ||
|
|
||
| This downstream patch [2] allows loading token plugins from the | ||
| default library search path. This approach is not accepted upstream [3] | ||
| due to security concerns, but the potential attack vectors require | ||
| root access and they are sufficiently addressed: | ||
|
|
||
| * cryptsetup could be used as a setuid binary (not used in NixOS). | ||
| In this case, LD_LIBRARY_PATH is ignored because of secure-execution | ||
| mode. | ||
| * cryptsetup running as root could lead to a malicious token handler | ||
| being loaded through LD_LIBRARY_PATH. However, fixing the path | ||
| doesn't prevent the same malicious .so being loaded through LD_PRELOAD. | ||
|
|
||
| [1] https://gitlab.com/cryptsetup/cryptsetup/-/commit/5b9e98f94178d3cd179d9f6e2a0a68c7d9eb6507 | ||
| [2] https://github.com/NixOS/nixpkgs/issues/167994#issuecomment-1094249369 | ||
| [3] https://gitlab.com/cryptsetup/cryptsetup/-/issues/733 | ||
| --- | ||
| lib/luks2/luks2_token.c | 4 +--- | ||
| 1 file changed, 1 insertion(+), 3 deletions(-) | ||
|
|
||
| diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c | ||
| index 26467253..6f8329f0 100644 | ||
| --- a/lib/luks2/luks2_token.c | ||
| +++ b/lib/luks2/luks2_token.c | ||
| @@ -151,12 +151,10 @@ crypt_token_load_external(struct crypt_device *cd, const char *name, struct cryp | ||
|
|
||
| token = &ret->u.v2; | ||
|
|
||
| - r = snprintf(buf, sizeof(buf), "%s/libcryptsetup-token-%s.so", crypt_token_external_path(), name); | ||
| + r = snprintf(buf, sizeof(buf), "libcryptsetup-token-%s.so", name); | ||
| if (r < 0 || (size_t)r >= sizeof(buf)) | ||
| return -EINVAL; | ||
|
|
||
| - assert(*buf == '/'); | ||
| - | ||
| log_dbg(cd, "Trying to load %s.", buf); | ||
|
|
||
| h = dlopen(buf, RTLD_LAZY); | ||
| -- | ||
| 2.37.2 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters