[isar-cip-core,00/10] Various initramfs hook improvements

Message

Jan Kiszka Dec. 2, 2024, 2:51 p.m. UTC

This uses the new initramfs hook generator of isar to simplify our own
hook recipes.

It furthermore brings support for expanding the last partition before
encrypting it. This needs to be done as part of the initramfs-crypt-hook
because we only know there which device and which partition to use.

Finally, this improves the security of the disk encryption keys by
preventing access to them after initramfs usage. Thus, the main Linux is
now no longer able to leak the keys during an attack.

Jan

Jan Kiszka (10):
  Update isar revision
  initramfs-abrootfs-hook: Convert to hook.inc
  initramfs-crypt-hook: Convert awk statement into simple variable
    evaluation
  initramfs-crypt-hook: Convert to hook.inc
  initramfs-erofs/squashfs-hook: Convert to hook.inc
  initramfs-overlay-hook: Convert to hook.inc
  initramfs-verity-hook: Drop dead verity.conf-hook artifact
  initramfs-verity-hook: Convert to hook.inc
  initramfs-crypt-hook: Add support for expanding encrypted partition
  initramfs-crypt-hook: invalidate PCR7 after unlocking partitions

 kas-cip.yml                                   |   2 +-
 kas/opt/expand-on-first-boot.yml              |   3 +
 .../files/abrootfs.hook                       |  24 -----
 .../initramfs-abrootfs-hook/files/hook        |   5 +
 .../{abrootfs.script => local-top-complete}   |   0
 ..._0.1.bb => initramfs-abrootfs-hook_0.2.bb} |  25 ++---
 ...pt_partition.clevis.bullseye_or_later.hook |  34 ------
 .../encrypt_partition.clevis.buster.hook      |  29 -----
 .../files/encrypt_partition.clevis.hook       |  88 ---------------
 .../files/encrypt_partition.systemd.hook      |  68 ------------
 .../initramfs-crypt-hook/files/hook           |  11 ++
 ...artitions.script => local-bottom-complete} |   0
 ...pt_partition.script => local-top-complete} |  68 +++++++++++-
 .../initramfs-crypt-hook_0.4.bb               |  96 -----------------
 .../initramfs-crypt-hook_0.5.bb               | 101 ++++++++++++++++++
 .../initramfs-erofs-hook/files/erofs.hook     |  25 -----
 .../initramfs-erofs-hook_0.1.bb               |  24 -----
 .../initramfs-erofs-hook_0.2.bb               |  14 +++
 ...{overlay.script.tmpl => local-bottom.tmpl} |  23 +---
 .../initramfs-overlay-hook/files/overlay.hook |  34 ------
 ...k_0.1.bb => initramfs-overlay-hook_0.2.bb} |  20 ++--
 .../initramfs-squashfs-hook_0.1.bb            |  24 -----
 .../initramfs-squashfs-hook_0.2.bb            |  14 +++
 .../initramfs-verity-hook/files/hook          |   5 +
 ...ty.script.tmpl => local-top-complete.tmpl} |   0
 .../files/verity.conf-hook                    |   1 -
 .../initramfs-verity-hook/files/verity.hook   |  23 ----
 ...ok_0.1.bb => initramfs-verity-hook_0.2.bb} |  24 ++---
 28 files changed, 250 insertions(+), 535 deletions(-)
 delete mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/abrootfs.hook
 create mode 100644 recipes-initramfs/initramfs-abrootfs-hook/files/hook
 rename recipes-initramfs/initramfs-abrootfs-hook/files/{abrootfs.script => local-top-complete} (100%)
 rename recipes-initramfs/initramfs-abrootfs-hook/{initramfs-abrootfs-hook_0.1.bb => initramfs-abrootfs-hook_0.2.bb} (61%)
 delete mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.bullseye_or_later.hook
 delete mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.buster.hook
 delete mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.hook
 delete mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.hook
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/hook
 rename recipes-initramfs/initramfs-crypt-hook/files/{mount_crypt_partitions.script => local-bottom-complete} (100%)
 rename recipes-initramfs/initramfs-crypt-hook/files/{encrypt_partition.script => local-top-complete} (71%)
 delete mode 100644 recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.4.bb
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb
 delete mode 100644 recipes-initramfs/initramfs-erofs-hook/files/erofs.hook
 delete mode 100644 recipes-initramfs/initramfs-erofs-hook/initramfs-erofs-hook_0.1.bb
 create mode 100644 recipes-initramfs/initramfs-erofs-hook/initramfs-erofs-hook_0.2.bb
 rename recipes-initramfs/initramfs-overlay-hook/files/{overlay.script.tmpl => local-bottom.tmpl} (91%)
 delete mode 100644 recipes-initramfs/initramfs-overlay-hook/files/overlay.hook
 rename recipes-initramfs/initramfs-overlay-hook/{initramfs-overlay-hook_0.1.bb => initramfs-overlay-hook_0.2.bb} (71%)
 delete mode 100644 recipes-initramfs/initramfs-squashfs-hook/initramfs-squashfs-hook_0.1.bb
 create mode 100644 recipes-initramfs/initramfs-squashfs-hook/initramfs-squashfs-hook_0.2.bb
 create mode 100644 recipes-initramfs/initramfs-verity-hook/files/hook
 rename recipes-initramfs/initramfs-verity-hook/files/{verity.script.tmpl => local-top-complete.tmpl} (100%)
 delete mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.conf-hook
 delete mode 100644 recipes-initramfs/initramfs-verity-hook/files/verity.hook
 rename recipes-initramfs/initramfs-verity-hook/{initramfs-verity-hook_0.1.bb => initramfs-verity-hook_0.2.bb} (65%)