secboot,fdestate: use boot mode for FDE hooks #15049
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Mon Feb 17 16:49:57 UTC 2025 Failures:Preparing:
Executing:
Restoring:
|
valentindavid
force-pushed
the
valentindavid/fde-boot-modes
branch
from
084f35b to
49b1aa8
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #15049 +/- ##
=========================================
Coverage ? 78.08%
=========================================
Files ? 1179
Lines ? 157485
Branches ? 0
=========================================
Hits ? 122970
Misses ? 26880
Partials ? 7635
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
valentindavid
force-pushed
the
valentindavid/fde-boot-modes
branch
2 times, most recently
from
e804c4e to
12e6592
Compare
valentindavid
force-pushed
the
valentindavid/fde-boot-modes
branch
3 times, most recently
from
b08f0b7 to
33ba6bf
Compare
valentindavid
changed the title
pedronis
previously approved these changes
Feb 11, 2025
|
I removed the 2.68 milestone, we do not strictly need it, just #15057 |
valentindavid
force-pushed
the
valentindavid/fde-boot-modes
branch
3 times, most recently
from
7a1855b to
331f02c
Compare
Set the authorized boot modes for FDE hook keys. For now the run+recover key allows "run" and "recover", while the recover key allows "recover" and "factory-reset".
There should be 3 different keys for FDE hooks. The run+recover key should be allowed for boot modes "run" and "recover". While recover key on data disk should be allowed on "recover". And finally recovery on save disk should be allowed in "recover" and "factory-reset". Here we split the profiles for "recover" for disks "data" and "save", so that we can set different authorized boot modes.
valentindavid
force-pushed
the
valentindavid/fde-boot-modes
branch
from
331f02c to
6cff916
Compare
pedronis
reviewed
Feb 17, 2025
| @@ -87,6 +87,8 @@ type SealKeyRequest struct { | |||
| // The file to store the key data. If empty, the key data will | |||
| // be saved to the token. | |||
| KeyFile string | |||
| // The boot modes allow (i.e. snapd_recovery_mode kernel parameter) | |||
There was a problem hiding this comment.
typo: "allowed" or "to allow"
| @@ -1793,7 +1793,7 @@ func (s *resealTestSuite) TestHooksResealHappy(c *C) { | |||
| } | |||
|
|
|||
| resealCalls := 0 | |||
| restore := fdeBackend.MockSecbootResealKeysWithFDESetupHook(func(keys []secboot.KeyDataLocation, primaryKeyFile string, models []secboot.ModelForSealing) error { | |||
| restore := fdeBackend.MockSecbootResealKeysWithFDESetupHook(func(keys []secboot.KeyDataLocation, primaryKeyFile string, models []secboot.ModelForSealing, bootModes []string) error { | |||
There was a problem hiding this comment.
do we need to check what gets passed in?
| func doReseal(manager FDEStateManager, method device.SealingMethod, rootdir string) error { | ||
| runParams, err := manager.Get("run+recover", "all") | ||
| runParamsData, err := manager.Get("run+recover", "system-data") |
There was a problem hiding this comment.
this will fallback with to containerRole all anyway on the transition?
| @@ -186,6 +186,11 @@ type ResealKeysParams struct { | |||
| TPMPolicyAuthKeyFile string | |||
| } | |||
|
|
|||
| type ResealKeysParamsForHooks struct { | |||
There was a problem hiding this comment.
does this need a doc comment? can you explain why it is not used here but only defined?
|
@valentindavid also do we need somehow to clean up the entries for |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
2 commits:
Set the authorized boot modes for FDE hook keys. For now the run+recover key allows "run" and "recover", while the recover key allows "recover" and "factory-reset".
There should be 3 different keys for FDE hooks. The run+recover key should be allowed for boot modes "run" and "recover". While recover key on data disk should be allowed on "recover". And finally recovery on save disk should be allowed in "recover" and "factory-reset". Here we split the profiles for "recover" for disks "data" and "save", so that we can set different authorized boot modes.