File aeon-check-1.0.4.obscpio of Package aeon-check

07070100000000000081A40000000000000000000000016824678B0000042C000000000000000000000000000000000000001900000000aeon-check-1.0.4/LICENSEMIT License

Copyright (c) 2024 AeonDesktop

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
07070100000001000081A40000000000000000000000016824678B000001DF000000000000000000000000000000000000001B00000000aeon-check-1.0.4/README.md# aeon-check

Initial design thoughts https://en.opensuse.org/Portal:Aeon/DevelopmentThoughts#aeon-check. This should be considered this project's long term goal.

Short term goal - Local checks only directly executing fixes for resolving specific bugs in Aeon RC3 and later

## Bugs Addressed
- Check existing Aeon Default Mode installations and confirm the TPM enrolment is using pcrlock not PCR hashes after incase enrolment steps occurred in an imperfect order (boo#1228416)
07070100000002000081ED0000000000000000000000016824678B00000CC7000000000000000000000000000000000000001C00000000aeon-check-1.0.4/aeon-check#!/bin/bash
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: Copyright 2024 SUSE LLC
# SPDX-FileCopyrightText: Copyright 2024 Richard Brown

set -euo pipefail

# Setup logging
exec 3>&1 4>&2
trap 'exec 2>&4 1>&3' 0 1 2 3
exec 1>>/var/log/aeon-check.log 2>&1

boo1228416() {
    # Problem: boo1228416. TPM2 using pcr hashes not pcrlock
    # Solution: Configure and enrol pcrlock for FDE

    # Determine root device
    rootdev=/dev/$(dmsetup deps -o devname /dev/mapper/aeon_root | cut -d '(' -f2 | cut -d ')' -f1)
    # Check for failure conditions
    tpm2hashpcrs=$(cryptsetup luksDump ${rootdev} | grep 'tpm2-hash-pcrs:' | tr -d ' \t' | cut -d ':' -f2)
    tpm2pcrlock=$(cryptsetup luksDump ${rootdev} | grep 'tpm2-pcrlock:' | tr -d ' \t' | cut -d ':' -f2)
    # For boo1228416 to be an issue hashpcrs must be 7 and pcrlock must be false. Be paranoid, only match on both
    if [ "${tpm2hashpcrs}" == "7" ] && [ "${tpm2pcrlock}" == "false" ]; then
        echo "boo1228416 detected - TPM2 using pcr hashes not pcrlock - correcting"

        # Need a keyfile to avoid requesting the recovery key when re-enrolling
        keyfile=$(mktemp /tmp/aeon-check.XXXXXXXXXX)
        dd bs=512 count=4 if=/dev/urandom of=${keyfile} iflag=fullblock
        chmod 400 ${keyfile}

        # Should be slot 2, but better to check and be sure
        tpm2slot=$(systemd-cryptenroll ${rootdev} | grep tpm2 | xargs | cut -d ' ' -f1)

        # Writing keyfile to slot 31 (end of the LUKS2 space) to avoid clashes with any customisation/extra keys
        cryptsetup luksAddKey --token-only --batch-mode --new-key-slot=31 ${rootdev} ${keyfile}

        # Drop existing enrollment and re enroll
        systemd-cryptenroll --wipe-slot=${tpm2slot} ${rootdev}
        systemd-cryptenroll --unlock-key-file=${keyfile} --tpm2-device=auto ${rootdev}

        # Wipe out keyfile and keyfile keyslot
        systemd-cryptenroll --wipe-slot=31 ${rootdev}
        rm ${keyfile}

        echo "boo1228416 corrected"
    fi
}

boo1234234() {
    # Problem: boo1234234 and related bugs. TPM2 enrolments failing because PCR0 invalidated by firmware updates.
    # Solution: Stop measuring PCR0 and update-predictions with the reduced PCR list

    # Only run if fde-tools is configured
    if test -e /etc/sysconfig/fde-tools ; then
        . /etc/sysconfig/fde-tools

        if [ "${FDE_SEAL_PCR_LIST}" = "0,4,5,7,9" ]; then
            echo "boo1234234 detected - PCR0 measured for TPM FDE sealing - correcting"
            echo "FDE_SEAL_PCR_LIST=4,5,7,9" > /etc/sysconfig/fde-tools
            sdbootutil -v update-predictions
            echo "boo1234234 corrected"
        fi
    fi
}

boo1243182() {
    # Problem: Aeon should be using Zypp's single RPM transaction backend
    # Solution: Add 'techpreview.ZYPP_SINGLE_RPMTRANS=1' to zypp.conf 

    if ! grep -xF 'techpreview.ZYPP_SINGLE_RPMTRANS=1' /etc/zypp/zypp.conf ; then
         echo 'boo1243182 detected - Not using ZYPP_SINGLE_RPMTRANS - correcting'
         echo 'techpreview.ZYPP_SINGLE_RPMTRANS=1' >> /etc/zypp/zypp.conf
         echo 'boo1243182 corrected'
    fi
}

# Active fixes executed in order of importance
boo1243182
boo1234234

# Deprecated fixes likely to be dropped in future aeon-check releases
boo1228416
07070100000003000081A40000000000000000000000016824678B0000007C000000000000000000000000000000000000002400000000aeon-check-1.0.4/aeon-check.service[Unit]
Description=Aeon Check Tool

[Service]
Type=oneshot
ExecStart=/usr/sbin/aeon-check

[Install]
WantedBy=default.target07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!11 blocks