Skip to content

Commit

Permalink
s390x: secex: decrypt ignition config on firstboot
Browse files Browse the repository at this point in the history
  • Loading branch information
nikita-dubrovskii committed Feb 14, 2023
1 parent 77295d3 commit 0b634e3
Show file tree
Hide file tree
Showing 4 changed files with 56 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[Unit]
Description=CoreOS Secex Ignition Config Decryptor
ConditionPathExists=/etc/initrd-release
ConditionPathExists=/run/coreos/secure-execution
DefaultDependencies=false

OnFailure=emergency.target
OnFailureJobMode=isolate

# Run after virtio_blk and before Ignition
After=coreos-gpt-setup.service
Before=ignition-fetch-offline.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/coreos-secex-ignition-decrypt
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
#!/bin/bash
set -euo pipefail

disk=/dev/disk/by-id/virtio-ignition_crypted
conf=/usr/lib/ignition/user.ign
pkey=/usr/lib/coreos/ignition.asc
tmpd=

cleanup() {
rm -f "${pkey}"
if [[ -n "${tmpd}" ]]; then
rm -rf "${tmpd}"
fi
}

trap cleanup EXIT

tmpd=$(mktemp -d)

if [ ! -e "${disk}" ]; then
echo "Ignition config must be encrypted"
exit 1
fi

gpg --homedir "${tmpd}" --import "${pkey}" && rm "${pkey}"
gpg --homedir "${tmpd}" --skip-verify --output "${conf}" --decrypt "${disk}"
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,13 @@ install() {
sgdisk \
uname

# For IBM SecureExecution
if [[ $(uname -m) = s390x ]]; then
inst_multiple \
gpg \
gpg-agent
fi

inst_simple "$moddir/coreos-diskful-generator" \
"$systemdutildir/system-generators/coreos-diskful-generator"

Expand Down Expand Up @@ -76,4 +83,8 @@ install() {

# IBM Secure Execution. Ignition config for reencryption of / and /boot
inst_simple "$moddir/01-secex.ign" /usr/lib/coreos/01-secex.ign
install_ignition_unit "coreos-secex-ignition-decrypt.service"
inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
"/usr/sbin/coreos-secex-ignition-decrypt"

}
Original file line number Diff line number Diff line change
Expand Up @@ -70,10 +70,11 @@ EOF
fi
}

# in SE case drop config before entering shell
# in SE case drop everything before entering shell
if [ -f /run/coreos/secure-execution ]; then
rm -f /run/ignition.json
rm -f /usr/lib/ignition/user.ign
rm -f /usr/lib/coreos/ignition.asc
fi

# Print warnings/informational messages to all configured consoles on the
Expand Down

0 comments on commit 0b634e3

Please sign in to comment.