Skip to content

Commit

Permalink
s390x: secex: decrypt ignition config on firstboot
Browse files Browse the repository at this point in the history
  • Loading branch information
nikita-dubrovskii committed Sep 27, 2022
1 parent 359b898 commit 4c7c114
Show file tree
Hide file tree
Showing 5 changed files with 51 additions and 2 deletions.
1 change: 1 addition & 0 deletions manifests/bootable-rpm-ostree.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ packages-s390x:
- /usr/sbin/zipl
# for Secure Execution
- veritysetup
- /usr/bin/gpg
packages-x86_64:
- grub2 grub2-efi-x64 efibootmgr shim
- microcode_ctl
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[Unit]
Description=CoreOS Secex Ignition Config Decryptor
ConditionPathExists=/etc/initrd-release
ConditionPathExists=/run/coreos/secure-execution
DefaultDependencies=false

OnFailure=emergency.target
OnFailureJobMode=isolate

# Run after virtio_blk and before Ignition
After=coreos-gpt-setup.service
Before=ignition-fetch-offline.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/coreos-secex-ignition-decrypt
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
#!/bin/bash
set -euo pipefail

disk=/dev/disk/by-id/virtio-ignition_crypted
conf=/usr/lib/ignition/user.ign
pkey=/etc/ignition.asc

cleanup() {
rm -f "${pkey}"
rm -rf "${tmpd}"
}
tmpd=$(mktemp -d) && trap cleanup EXIT

if [ ! -e "${disk}" ]; then
echo "Ignition config must be encrypted"
exit 1
fi

gpg --homedir "${tmpd}" --import "${pkey}"
gpg --homedir "${tmpd}" --skip-verify --output "${conf}" --decrypt "${disk}"
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,13 @@ install() {
sgdisk \
uname

# For IBM SecureExecution
if [[ $(uname -m) = s390x ]]; then
inst_multiple \
gpg \
gpg-agent
fi

inst_simple "$moddir/coreos-diskful-generator" \
"$systemdutildir/system-generators/coreos-diskful-generator"

Expand Down Expand Up @@ -76,4 +83,8 @@ install() {

# IBM Secure Execution. Ignition config for reencryption of / and /boot
inst_simple "$moddir/01-secex.ign" /usr/lib/coreos/01-secex.ign
install_ignition_unit "coreos-secex-ignition-decrypt.service"
inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
"/usr/sbin/coreos-secex-ignition-decrypt"

}
Original file line number Diff line number Diff line change
Expand Up @@ -70,9 +70,9 @@ EOF
fi
}

# in SE case drop config before entering shell
# in SE case drop everything before entering shell
if [ -f /run/coreos/secure-execution ]; then
rm -f /run/ignition.json
rm -f /run/ignition.json /etc/ignition.asc
fi

# Print warnings/informational messages to all configured consoles on the
Expand Down

0 comments on commit 4c7c114

Please sign in to comment.