mirror of
https://github.com/vyos/vyos-build.git
synced 2025-10-01 20:28:40 +02:00
fd737172f1
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux Kernel and enforces module signing. This results in an additional security layer where untrusted (unsigned) Kernel modules can no longer be loaded into the live system. NOTE: This commit will not work unless signing keys are present. Arbitrary keys can be generated using instructions found in: data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
19 lines
630 B
Bash
Executable File
19 lines
630 B
Bash
Executable File
#!/bin/sh
|
|
SIGN_FILE=$(find /usr/lib -name sign-file)
|
|
MOK_KEY="/var/lib/shim-signed/mok/kernel.key"
|
|
MOK_CERT="/var/lib/shim-signed/mok/kernel.pem"
|
|
kernel_elf=$(readlink /boot/vmlinuz)
|
|
|
|
if [ ! -f ${MOK_KEY} ]; then
|
|
echo "I: Signing key for Linux Kernel not found - Secure Boot not possible"
|
|
else
|
|
echo "I: Signing Linux Kernel for Secure Boot"
|
|
|
|
sbsign --key $MOK_KEY --cert $MOK_CERT /boot/${kernel_elf} --output /boot/${kernel_elf}
|
|
sbverify --list /boot/${kernel_elf}
|
|
|
|
find /lib/modules -type f -name \*.ko -o -name \*.ko.xz | while read module; do
|
|
$SIGN_FILE sha512 $MOK_KEY $MOK_CERT $module
|
|
done
|
|
fi
|