mirror of
https://github.com/systemd/systemd-stable.git
synced 2025-01-20 14:03:39 +03:00
3776e1f2ee
Brief is sweet. (cherry picked from commit 128db0aa0098b58b415065c2955f9abc7fc967e1) (cherry picked from commit f3abd451dde25086e06c56ba0b8388f64c1d306e) (cherry picked from commit 3626aabecb8a8682caa466de711e8f6509f954ec)
49 lines
2.0 KiB
Bash
Executable File
49 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
set -ex
|
|
|
|
export SYSTEMD_LOG_LEVEL=debug
|
|
|
|
|
|
# Prepare fresh disk image
|
|
img="/var/tmp/test.img"
|
|
dd if=/dev/zero of=$img bs=1024k count=20 status=none
|
|
echo -n passphrase >/tmp/passphrase
|
|
cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-urandom $img /tmp/passphrase
|
|
|
|
# Enroll unlock with default PCR policy
|
|
env PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto $img
|
|
/usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1
|
|
/usr/lib/systemd/systemd-cryptsetup detach test-volume
|
|
|
|
# Check with wrong PCR
|
|
tpm2_pcrextend 7:sha256=0000000000000000000000000000000000000000000000000000000000000000
|
|
(! /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
|
|
|
# Enroll unlock with PCR+PIN policy
|
|
systemd-cryptenroll --wipe-slot=tpm2 $img
|
|
env PASSWORD=passphrase NEWPIN=123456 systemd-cryptenroll --tpm2-device=auto --tpm2-with-pin=true $img
|
|
env PIN=123456 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1
|
|
/usr/lib/systemd/systemd-cryptsetup detach test-volume
|
|
|
|
# Check failure with wrong PIN
|
|
(! env PIN=123457 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
|
|
|
# Check failure with wrong PCR (and correct PIN)
|
|
tpm2_pcrextend 7:sha256=0000000000000000000000000000000000000000000000000000000000000000
|
|
(! env PIN=123456 /usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1)
|
|
|
|
# Enroll unlock with PCR 0+7
|
|
systemd-cryptenroll --wipe-slot=tpm2 $img
|
|
env PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 $img
|
|
/usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1
|
|
/usr/lib/systemd/systemd-cryptsetup detach test-volume
|
|
|
|
# Check with wrong PCR 0
|
|
tpm2_pcrextend 0:sha256=0000000000000000000000000000000000000000000000000000000000000000
|
|
/usr/lib/systemd/systemd-cryptsetup attach test-volume $img - tpm2-device=auto,headless=1 && exit 1
|
|
|
|
echo OK >/testok
|
|
|
|
exit 0
|