Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CM4 secure boot #3357

Merged
merged 26 commits into from May 12, 2024
Merged

CM4 secure boot #3357

merged 26 commits into from May 12, 2024

Conversation

alexgg
Copy link
Contributor

@alexgg alexgg commented Feb 8, 2024 •
edited

Depends on #3408

Contributor checklist

Reviewer Guidelines

  • When submitting a review, please pick:
    • 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
    • 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
    • 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

@alexgg alexgg marked this pull request as draft February 8, 2024 12:32
@alexgg alexgg force-pushed the alexgg/bb-signed-images branch 6 times, most recently from a398049 to 966d03a Compare February 23, 2024 12:53
@alexgg
Copy link
Contributor Author

alexgg commented Feb 24, 2024

@resin-jenkins retest this please

@alexgg alexgg force-pushed the alexgg/bb-signed-images branch 2 times, most recently from d916599 to cf278b3 Compare February 28, 2024 19:57
@alexgg alexgg changed the title [WIP] CM4 secure boot CM4 secure boot Mar 6, 2024
@alexgg alexgg requested a review from a team March 6, 2024 13:53
@alexgg alexgg marked this pull request as ready for review March 6, 2024 13:53
@flowzone-app flowzone-app bot enabled auto-merge March 6, 2024 13:57
@alexgg alexgg force-pushed the alexgg/bb-signed-images branch 2 times, most recently from 2938e7d to b6a7e77 Compare March 8, 2024 13:46
@alexgg
Copy link
Contributor Author

alexgg commented Mar 9, 2024

qemu-genericx86-64-ext HUP failure:

jenkins-leviathan-v2-template-43425-worker-1  | dnsmasq-dhcp: DHCPACK(brx44k0xyb) 10.10.10.70 52:54:00:85:ee:d4 791fc76
jenkins-leviathan-v2-template-43425-client-1  | [2024-03-08T18:17:33.386Z][worker-hup]             not ok 1 - "hostapp-update -f /mnt/data/resin-data/image-isc697dr" failed. stderr: /etc/hostapp-update-hooks.d/1-bootfiles: line 21: /usr/libexec/os-helpers-sb: No such file or directory umount: /mnt/sysroot/inactive/balena/overlay2/e080a384a92c93263c2698209daba13fa68e9b68a901d11bbbfdf867236cfa39/merged: not mo

@alexgg alexgg force-pushed the alexgg/bb-signed-images branch 2 times, most recently from 66a1790 to b1cd831 Compare March 11, 2024 10:58
@alexgg
Copy link
Contributor Author

alexgg commented Mar 14, 2024 •
edited

Passed tests:

  • qemu-generic-amd64
  • qemu-generic-amd64-sb
  • qemu-genericx86-64-ext

@alexgg
Copy link
Contributor Author

alexgg commented Mar 15, 2024

@resin-jenkins retest this please

@alexgg
Copy link
Contributor Author

alexgg commented Mar 15, 2024

lgtm

@alexgg
Copy link
Contributor Author

alexgg commented Mar 17, 2024

@resin-jenkins retest this please

2 similar comments
@alexgg
Copy link
Contributor Author

alexgg commented Mar 17, 2024

@resin-jenkins retest this please

@alexgg
Copy link
Contributor Author

alexgg commented Mar 17, 2024

@resin-jenkins retest this please

alexgg and others added 5 commits May 3, 2024 13:56
@alexgg
balena-image-bootloader-initramfs: add modules needed for secure boot
dfa88cf 
The balena bootloader needs to mount encrypted disks to kexec the final
kernel which is stored in the encrypted root partitions.

It also needs to run the data partition expander twice on boot, once in the
balena bootloader that expands the disk, and later on the final
initramfs to expand the file system.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
balena-image-bootloader-initramfs: remove kernel dependencies
43dc6e6 
Even though the balena bootloader kernel has no module support, kernel
module dependencies are pulled in via PREFERRED_PROVIDER_virtual/kernel.

This commit excludes kernel modules from the image.

Changelog-entry: exclude kernel modules from balena-bootloader initramfs image
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
resin-init-flasher: replace fatal with fail
53e995b 
The fatal() function is only defined while running in the initramfs
while fail() is provided by the OS helper logging which is available
in both the OS and flasher image.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@jakogut @alexgg
os-helpers-fs: regenerate_uuid: skip remounting
7674716 
Remounting filesystems is done on systems with a broken clock in order
to prevent tune2fs from bailing out when the last mounted time is in the
future. This resets the last mounted time to now.

However, the filesystem is immediately unmounted again without being
utilized, and the mount and unmount process is time consuming. Instead,
use `-e continue` to tell tune2fs to continue after an error, which
achieves the same result with less time and complexity.

Change-type: patch
Signed-off-by: Joseph Kogut <joseph@balena.io>
@alexgg
os-helpers: extend filesystem helper with wait4rm
bb77f62 
This function waits until a file is removed or times out - useful to
implement basic file based mutexes.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
Copy link
Contributor Author

alexgg commented May 3, 2024

@resin-jenkins retest this please

2 similar comments
@alexgg
Copy link
Contributor Author

alexgg commented May 9, 2024

@resin-jenkins retest this please

@alexgg
Copy link
Contributor Author

alexgg commented May 9, 2024

@resin-jenkins retest this please

@alexgg
Copy link
Contributor Author

alexgg commented May 9, 2024 •
edited

Passed local tests:

  • qemu-generic-amd64
  • qemu-generic-aarch64
  • qemu-generic-amd64-sb (except hup/rollbacks due to a known issue independent of this PR)

Passed tests:

  • qemu-generic-amd64
  • qemu-genericx86-64-ext
  • qemu-generic-aarch64

alexgg added 15 commits May 11, 2024 17:44
@alexgg
systemd: update_state_probe: Use a file mutex to avoid race condition
ef51b29 
As soon as the UUID is modified udev re-runs the rules for the partition.
However, the rule expects the new root UUID to be cached in a file, and
if the udev rule gets there before the file is created it fails.

This commit waits on a lock file mutex before accessing said file.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
initrdscripts: fsuuidinit: use file based mutex to avoid race condition
3f6a302 
As soon as the UUID is regenerated udev runs the correspondign rules.

However, the rules expect the new UUID to be cached in a file, so there
is a race condition between the creation of the file and the udev rule.

This commit avoid the race condition by using a file mutex that the
udev rule can wait on.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
docs: add secure boot abstractions details
91dad6c 
Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
hostapp-update-hooks: 1-bootfiles: Check for os-helpers-sb before inc…
55ea286 
…luding

The `os-helpers-sb` file is only included for signed builds.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
hostapp-update-hooks: only include os-helpers-sb for signed builds
bfe9204 
Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
classes: kernel-balena: selectively include dmcrypt for signed images
1bdb0d2 
Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
initrdscripts: abroot: add missing dependency
593ce8d 
The abroot script sources balena-config-defaults so let's make sure
it's included in the build.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
classes: image-balena: provide board configuration hook
cda7d24 
Add a hook for boards to initialize boot partition configuration.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
initrdscripts: migrate: allow command line argument configuration
c8de15a 
The migrate module is currently only enabled if specified in config.json.
This commit introduces a command line argument override for board
integration layers to use. This allows for example for non-flasher device
types to force the migration.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
classes: sign-rsa: add dependencies
eafbc41 
Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
os-helpers: add a helper function to generate fingerprint files
487b4f4 
This function will be re-used as it's called from the HUP hooks and
from the flasher image for secure boot devices that split boot
partitions.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
hostapp-update-hooks: regenerate fingerprint file
109f4d7 
On secure boot devices with split partitions we cannot just deploy
the fingerprint generated for resin-boot as it does not take the split
into account.

Make the hook script re-generate the fingerprint files instead as this
will work both for split and non-split boot partitions.

Also, boot partition fingerprint files use relatvie path so change the
script to take that into account.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>

SQ 1-bootfiles
@alexgg
classes: image-balena: use relative path to generate boot fingerprint
b30ce23 
Ideally we would re-use the function is the target os-helpers-fs file,
but Yocto's recipe bash support is not completely compatible with POSIX syntax.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
hostapp-update-hooks: fix linter warnings
a35ae93 
Remove some of the low-risk linter warnings.

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg
hostapp-update-hooks: 99-balena-bootloader: Adapt to secure boot
241caa3 
Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>
@alexgg alexgg disabled auto-merge May 12, 2024 17:52
@alexgg
Copy link
Contributor Author

alexgg commented May 12, 2024

Ran qemu-generic-amd64-sb locally disabling hup/rollbacks as there is currently a known issue that prevents this test from passing and is being worked on.

Manually merged.

@alexgg alexgg merged commit 0306bab into master May 12, 2024
50 checks passed
@alexgg alexgg deleted the alexgg/bb-signed-images branch May 12, 2024 17:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@alexgg @jakogut