Skip to content

Commit

Permalink
rm: security: reference UEFI provisioning from LUKS TPM2 test
Browse files Browse the repository at this point in the history 
Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
  • Loading branch information
@ldts
ldts committed Sep 6, 2024
1 parent 271f180 commit 080563c
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 5 deletions.
11 changes: 6 additions & 5 deletions source/reference-manual/linux/linux-disk-encryption.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,6 @@ Make sure LUKS support is enabled for your x86 target:
$ cat meta-subscriber-overrides/conf/machine/include/lmp-factory-custom.inc
DISTRO_FEATURES:append:intel-corei7-64 = " luks"
Then make sure to enroll the :ref:`UEFI Secure Boot Certificates <ref-secure-boot-uefi>`
to enable secure boot support. This is required as the LUKS2 TPM 2.0 token
leverages **PCR 7**, which tracks the secure boot state.

Now install ``swtpm`` on the host machine, and start the ``swtpm`` daemon.
This will be consumed by QEMU and act as the hardware TPM.

Expand All @@ -166,7 +162,12 @@ Run QEMU with the required extra TPM 2.0 related commands:
-chardev socket,id=chrtpm,path=/tmp/mytpm/swtpm-sock \
-tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0
You should see the following during the first boot:
On the first boot, enroll the :ref:`UEFI Secure Boot Certificates <ref-secure-boot-uefi>` to enable secure boot support. This is required as the LUKS2 TPM 2.0 token leverages **PCR 7**, which tracks the secure boot state.

Check warning on line 166 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.

Raw Output:
{"message": "[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 166, "column": 37}}}, "severity": "WARNING"}

Check warning on line 166 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.expand-acronyms] 'TPM' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.

Raw Output:
{"message": "[Fio-docs.expand-acronyms] 'TPM' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 166, "column": 152}}}, "severity": "WARNING"}

Check warning on line 166 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.expand-acronyms] 'PCR' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.

Raw Output:
{"message": "[Fio-docs.expand-acronyms] 'PCR' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 166, "column": 178}}}, "severity": "WARNING"}

To do this, simply select the UEFI Secure Boot systemd-boot menu as described in :ref:`UEFI Secure Boot Provisioning <ref-secure-boot-uefi-provisioning>`: the system will reset and you will have to run **the same command** again.

Check warning on line 168 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.sentence-length] Aim for sentences no longer than 25 words

Raw Output:
{"message": "[Fio-docs.sentence-length] Aim for sentences no longer than 25 words", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 168, "column": 1}}}, "severity": "INFO"}

Check warning on line 168 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.

Raw Output:
{"message": "[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 168, "column": 31}}}, "severity": "WARNING"}

Check warning on line 168 in source/reference-manual/linux/linux-disk-encryption.rst

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.

Raw Output:
{"message": "[Fio-docs.expand-acronyms] 'UEFI' has no definition, definition is missing capitalization, or is a variable name and should be written as a literal.", "location": {"path": "source/reference-manual/linux/linux-disk-encryption.rst", "range": {"start": {"line": 168, "column": 88}}}, "severity": "WARNING"}

You should see the following during this second boot:

.. code-block:: none
Expand Down
1 change: 1 addition & 0 deletions source/reference-manual/security/secure-boot-uefi.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ The signing process in LmP is controlled by the following Yocto Project variable
* ``UEFI_SIGN_ENABLE``
* If set to ``1`` the systemd-boot bootloader and Linux kernel binaries will be signed by with the DB key (``DB.key`` at ``UEFI_SIGN_KEYDIR``)

.. _ref-secure-boot-uefi-provisioning:

UEFI Secure Boot Provisioning
-----------------------------
Expand Down

0 comments on commit 080563c

Please sign in to comment.