shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-28 02:50:16 +03:00
Code

test: update TEST-70 with systemd-cryptenroll calculated TPM2 enrollment

Browse Source 
Update test to check systemd-cryptenroll --tpm2-device-key= enrollment.
This commit is contained in:
Dan Streetman 2023-07-24 20:04:28 -04:00
parent 57f0786ee0
commit 803e95932f
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
test/TEST-70-TPM2/test.sh
View File

@ -11,7 +11,7 @@ TEST_REQUIRE_INSTALL_TESTS=0
# shellcheck source=test/test-functions
. "${TEST_BASE_DIR:?}/test-functions"
test_require_bin openssl swtpm tpm2_createprimary tpm2_dictionarylockout tpm2_evictcontrol tpm2_flushcontext tpm2_pcrextend tpm2_pcrread
test_require_bin openssl swtpm tpm2_createprimary tpm2_dictionarylockout tpm2_evictcontrol tpm2_flushcontext tpm2_pcrextend tpm2_pcrread tpm2_readpublic
test_append_files() {
local workspace="${1:?}"
@ -31,6 +31,7 @@ test_append_files() {
inst_binary tpm2_flushcontext
inst_binary tpm2_pcrextend
inst_binary tpm2_pcrread
inst_binary tpm2_readpublic
}
do_test "$@"

10
test/units/testsuite-70.cryptsetup.sh
View File

@ -131,7 +131,15 @@ if tpm_has_pcr sha256 12; then
systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1
systemd-cryptsetup detach test-volume
rm -f /tmp/pcr.dat
# enroll TPM using device key instead of direct access, then verify unlock using TPM
tpm2_pcrread -Q -o /tmp/pcr.dat sha256:12
CURRENT_PCR_VALUE=$(cat /sys/class/tpm/tpm0/pcr-sha256/12)
tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub
PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE"
systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1
systemd-cryptsetup detach test-volume
rm -f /tmp/pcr.dat /tmp/srk.pub
fi
# Use default (0) seal key handle