A pile of goo to support a minimal secure boot demo

build_library/disk_layout.json

@@ -125,6 +125,40 @@
         "type":"4f68bce3-e8cd-4db1-96e7-fbcaf984b709",
         "blocks":"6291456"
       }
+    },
+    "secure_demo":{
+      "1":{
+        "label":"EFI-SYSTEM",
+        "type":"efi",
+        "blocks":"2097152",
+        "fs_type":"vfat",
+        "mount":"/",
+        "features": []
+      },
+      "2":{
+        "type":"blank"
+      },
+      "3":{
+        "type":"blank"
+      },
+      "4":{
+        "type":"blank"
+      },
+      "5":{
+        "type":"blank"
+      },
+      "6":{
+        "type":"blank"
+      },
+      "7":{
+        "type":"blank"
+      },
+      "8":{
+        "type":"blank"
+      },
+      "9":{
+        "type":"blank"
+      }
     }
   }
 }

build_library/secure_demo/CoreOS-Boot-Signer.crt

@@ -0,0 +1,76 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=CA, L=SF, O=CoreOS, CN=CoreOS Boot CA/emailAddress=george.tankersley@gmail.com
+        Validity
+            Not Before: Jan  1 00:00:00 1970 GMT
+            Not After : Oct 31 06:53:45 2024 GMT
+        Subject: C=US, ST=CA, L=SF, O=CoreOS, CN=CoreOS Boot Signer/emailAddress=george.tankersley@gmail.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b4:35:c8:8c:86:8f:89:4f:d8:63:f6:a3:80:db:
+                    7e:da:dc:53:6e:66:77:0d:1a:7e:0d:b2:3e:6a:85:
+                    1c:d9:1c:f9:48:ce:80:e7:31:c2:b3:e1:e4:2b:2b:
+                    1f:45:16:0b:52:57:8a:fc:7b:fd:ba:81:8b:35:13:
+                    4a:54:2a:be:35:0f:f4:ea:26:38:50:59:0b:9b:9c:
+                    88:a3:c9:01:08:fe:43:5d:f1:ef:15:6d:6d:03:06:
+                    3c:ab:c5:b8:93:79:84:ba:6b:f6:7b:59:8b:74:c2:
+                    2b:2d:a2:e9:e9:82:3f:f5:32:b5:b9:31:f4:9c:4b:
+                    e0:84:a0:40:44:01:e1:63:4d:da:a8:c7:3f:76:8e:
+                    09:6a:ce:b9:75:32:56:9c:39:5a:44:94:b5:4d:76:
+                    64:b0:4e:42:ee:99:5f:9b:96:cb:e7:50:f1:10:2a:
+                    09:8c:49:62:5d:e4:b9:29:2b:a7:4a:77:b4:7c:d4:
+                    4b:4e:1f:84:ce:9a:be:e1:44:95:29:cd:35:09:ec:
+                    c0:cc:a2:31:91:d1:fd:a9:ce:1a:79:3f:2a:9b:94:
+                    f2:49:60:7c:ba:f0:1b:62:24:4e:35:39:bb:9b:a1:
+                    19:42:04:cb:9b:e0:5a:a5:52:3f:ec:b1:8e:2a:07:
+                    20:0f:56:6b:38:55:5e:06:59:dd:57:e5:20:16:47:
+                    dc:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Extended Key Usage: 
+                Code Signing
+    Signature Algorithm: sha256WithRSAEncryption
+         c1:e9:22:50:29:21:26:e8:57:1e:06:ce:f5:0c:47:5f:5d:51:
+         57:e2:64:10:75:1b:ca:9b:f0:0f:38:81:91:8d:4e:c1:11:19:
+         e3:e9:db:6a:9e:36:66:f8:89:1d:7f:2e:8a:50:1d:0b:5a:c7:
+         d4:c5:60:3c:ba:0c:78:1c:40:bd:3c:80:aa:73:ce:04:4e:2c:
+         d9:da:5d:6c:19:bf:6e:9e:e5:ba:0e:3a:14:d1:e9:d0:17:0b:
+         98:00:ab:3d:18:b7:27:04:2f:15:7f:6d:57:03:11:29:c0:d4:
+         86:25:14:e4:91:06:7e:5d:59:ac:3a:67:95:e0:7d:c8:f5:08:
+         74:2e:9b:68:af:65:db:25:8b:8a:ae:33:f4:62:4c:10:7c:f4:
+         70:25:68:d1:b1:74:43:14:a7:4f:35:b7:5c:30:ca:8b:84:24:
+         3a:08:ff:f6:47:79:c6:b4:ef:cc:80:b0:52:2b:19:57:94:0e:
+         d2:cd:55:23:ee:1e:32:13:53:8e:1e:2c:46:99:23:0c:c7:2c:
+         df:81:6d:60:bd:8a:51:77:69:cf:cc:11:9f:ba:5c:f3:e2:9a:
+         0f:de:a9:f4:a5:8d:a8:86:a2:9e:00:82:24:c7:17:3c:14:1a:
+         db:04:4c:91:33:05:87:49:69:ea:b3:8d:8e:f9:3a:2c:85:65:
+         95:6b:6a:cb
+-----BEGIN CERTIFICATE-----
+MIIDoDCCAoigAwIBAgIBATANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJVUzEL
+MAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMQ8wDQYDVQQKDAZDb3JlT1MxFzAVBgNV
+BAMMDkNvcmVPUyBCb290IENBMSowKAYJKoZIhvcNAQkBFhtnZW9yZ2UudGFua2Vy
+c2xleUBnbWFpbC5jb20wIBgPMTk3MDAxMDEwMDAwMDBaFw0yNDEwMzEwNjUzNDVa
+MIGBMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExCzAJBgNVBAcMAlNGMQ8wDQYD
+VQQKDAZDb3JlT1MxGzAZBgNVBAMMEkNvcmVPUyBCb290IFNpZ25lcjEqMCgGCSqG
+SIb3DQEJARYbZ2VvcmdlLnRhbmtlcnNsZXlAZ21haWwuY29tMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtDXIjIaPiU/YY/ajgNt+2txTbmZ3DRp+DbI+
+aoUc2Rz5SM6A5zHCs+HkKysfRRYLUleK/Hv9uoGLNRNKVCq+NQ/06iY4UFkLm5yI
+o8kBCP5DXfHvFW1tAwY8q8W4k3mEumv2e1mLdMIrLaLp6YI/9TK1uTH0nEvghKBA
+RAHhY03aqMc/do4Jas65dTJWnDlaRJS1TXZksE5C7plfm5bL51DxECoJjEliXeS5
+KSunSne0fNRLTh+Ezpq+4USVKc01CezAzKIxkdH9qc4aeT8qm5TySWB8uvAbYiRO
+NTm7m6EZQgTLm+BapVI/7LGOKgcgD1ZrOFVeBlndV+UgFkfc6QIDAQABoyQwIjAL
+BgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwDQYJKoZIhvcNAQELBQAD
+ggEBAMHpIlApISboVx4GzvUMR19dUVfiZBB1G8qb8A84gZGNTsERGePp22qeNmb4
+iR1/LopQHQtax9TFYDy6DHgcQL08gKpzzgROLNnaXWwZv26e5boOOhTR6dAXC5gA
+qz0YtycELxV/bVcDESnA1IYlFOSRBn5dWaw6Z5Xgfcj1CHQum2ivZdsli4quM/Ri
+TBB89HAlaNGxdEMUp081t1wwyouEJDoI//ZHeca078yAsFIrGVeUDtLNVSPuHjIT
+U44eLEaZIwzHLN+BbWC9ilF3ac/MEZ+6XPPimg/eqfSljaiGop4AgiTHFzwUGtsE
+TJEzBYdJaeqzjY75OiyFZZVrass=
+-----END CERTIFICATE-----

build_library/secure_demo/CoreOS-Boot-Signer.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC0NciMho+JT9hj
+9qOA237a3FNuZncNGn4Nsj5qhRzZHPlIzoDnMcKz4eQrKx9FFgtSV4r8e/26gYs1
+E0pUKr41D/TqJjhQWQubnIijyQEI/kNd8e8VbW0DBjyrxbiTeYS6a/Z7WYt0wist
+ounpgj/1MrW5MfScS+CEoEBEAeFjTdqoxz92jglqzrl1MlacOVpElLVNdmSwTkLu
+mV+blsvnUPEQKgmMSWJd5LkpK6dKd7R81EtOH4TOmr7hRJUpzTUJ7MDMojGR0f2p
+zhp5PyqblPJJYHy68BtiJE41ObuboRlCBMub4FqlUj/ssY4qByAPVms4VV4GWd1X
+5SAWR9zpAgMBAAECggEAZgmeCJOYanNfXxqj8a5W4a2nP/ecqTq67R5j4QSGFRkm
+vWbP7hhq2lepThgYmJGmz3TqKZQ7UoNPQzos+ANLt9fVIU+Ky1PgErhLVhHWGDWA
+B42ZhlRzSSca61gE7tv7n2LKKYXGRNI8iJaaQ7GQbVHNO5Nhoa4E7pOeT+OQrxzO
+vSTuXJMCDzvZTCV0quvaSNE+nWQYda6X/Gthhpy4Qp1M7iKxoOekP88v1IVMBLzP
+Zj6ExMEiK/SZQcnRx0CeCIOayht8YVwtsFTzWZgcgcxQZMVoBYA5DRdKF8PDy0N3
+PhTxfIWurJf9PUR/gF4tOyaAoBI0N6MkRoKYmT3QAQKBgQDddASBIIC32DRVi4jy
+9i433b3JVTuLnGCjDtGflGiXM2mf58oFFPhua8Mh29F9FKWHj+B/yn47HF/bikoh
+OeB8RaZClj+EFXeSmjjZF3QEg2GDMHZB0yvytgb9mr5lNcNF3JsosUQuLY7+VVSR
+UPjnhjcnKkzQv7fK18E2+aoagQKBgQDQUq0VsSJT9T4UtvpgFhN8xWlKTJjaDxsI
+2lIgUkBX+VJ41+kHZNioZOc61TkMCOPyIHyeUYEQbcZmkNL3nR9uxr9kXyC1ShIu
+Q+mrzIHzuGKNJBQdMWNrm+nwOF5IafSoQRievU35gvKt+evJg9SJNvIYGwnt+/AA
+YwHyd7f+aQKBgExIPZD5UD2D1SsugIMot+z4jfp/SJ6jxEoGvcCZj5md1SGG53ju
+q1Dl//Z20OekKAzVS8DZULgt4vst3LErTZ+hIk9HkCOAfYrbYv+s64LuerWFCQdN
+pZLajvfmyPT2GwjCoBPZVCIQAXSskg/oc4TVH8R29rTlhXry7RRx1d2BAoGAVw1V
+Wq0shR0EFi/oLGLNPeRYfT3I2cZaK7bffrYgQSLkfa7rp7VSe/u+TG1xa0AD0NgW
+eynf3vegYpe+MM6tpeLTc6P0zQzo0AB9EtdgrnGsbQJYjWJoAz2h4koLzALKw8x/
+90Vv4gYAVwcKqqi2FaiqPbx+x73xqpe05pd0gZECgYEAh8vSHk3w7Od0AKOsfn4q
+vVy1MjNBzX3p1+2IHJLDeM9ibTUmfWP+Y7cL5+m0eNasq/gvgBKMNAA+C9h6lEiZ
+Soe27lfYBY3ro0ksdYeNGx7rKgBLIi/YRmxvTTlDcUrEkaunfuGCXzLy6X6USI+c
+jsLjKF+tu3r+iYx4OU3xWpI=
+-----END PRIVATE KEY-----

build_library/secure_demo/cloud-config.yaml

@@ -0,0 +1,7 @@
+#cloud-config
+
+hostname: secure_demo
+
+users:
+  - name: core
+    coreos-ssh-import-github: marineam

build_library/secure_demo/grub.cfg

@@ -0,0 +1,20 @@
+# Load any and all video drivers.
+# Required under UEFI to boot Linux with a working console.
+insmod all_video
+
+# Use both default text console and ttyS0
+serial --unit=0 --speed=115200 --word=8 --parity=no --stop=1
+terminal_input console serial
+terminal_output console serial
+
+# Find the UEFI system partition
+insmod part_gpt
+search --set=root --label EFI-SYSTEM
+
+# Do that thing!
+echo "Loading /coreos/vmlinuz ..."
+linuxefi /coreos/vmlinuz module.sig_enforce=1 console=tty0 console=ttyS0,115200n8 rootfstype=btrfs cloud-config-url=https://storage.googleapis.com/users.developer.core-os.net/marineam/cloud-config.yaml
+echo "Loading /coreos/initrd ..."
+initrdefi /coreos/initrd
+echo "Booting..."
+boot

build_library/vm_image_util.sh

@@ -30,6 +30,7 @@ VALID_IMG_TYPES=(
     exoscale
     azure
     hyperv
+    secure_demo
 )
 
 #list of oem package names, minus the oem- prefix
@@ -225,6 +226,11 @@ IMG_hyperv_BOOT_KERNEL=0
 IMG_hyperv_DISK_FORMAT=vhd
 IMG_hyperv_OEM_PACKAGE=oem-hyperv
 
+## secure boot demo
+IMG_secure_demo_PARTITIONED_IMG=0
+IMG_secure_demo_DISK_FORMAT=secure_demo
+IMG_secure_demo_CONF_FORMAT=qemu_uefi
+
 ###########################################################
 
 # Validate and set the vm type to use for the rest of the functions
@@ -320,6 +326,7 @@ _disk_ext() {
         cpio) echo cpio.gz;;
         vmdk_ide) echo vmdk;;
         vmdk_scsi) echo vmdk;;
+        secure_demo) echo bin;;
         *) echo "${disk_format}";;
     esac
 }
@@ -879,6 +886,54 @@ EOF
     VM_GENERATED_FILES+=( "${box}" "${json}" )
 }
 
+_write_secure_demo_disk() {
+    local dst_img="$2"
+    local tmp_esp="${VM_TMP_DIR}/esp"
+
+    grub-mkstandalone \
+        --output="${VM_TMP_DIR}/grub.efi" \
+        --format=x86_64-efi \
+        --modules=verify \
+        --pubkey="${BUILD_LIBRARY_DIR}/secure_demo/CoreOS-Grub-Singing-Key.gpg" \
+        "/boot/grub/grub.cfg=${BUILD_LIBRARY_DIR}/secure_demo/grub.cfg"
+    sbsign --key "${BUILD_LIBRARY_DIR}/secure_demo/CoreOS-Boot-Signer.key" \
+        --cert "${BUILD_LIBRARY_DIR}/secure_demo/CoreOS-Boot-Signer.crt" \
+        "${VM_TMP_DIR}/grub.efi"
+
+    cp "${VM_TMP_ROOT}/usr/boot/vmlinuz" "${VM_TMP_DIR}/vmlinuz"
+    sbsign --key "${BUILD_LIBRARY_DIR}/secure_demo/CoreOS-Boot-Signer.key" \
+        --cert "${BUILD_LIBRARY_DIR}/secure_demo/CoreOS-Boot-Signer.crt" \
+        "${VM_TMP_DIR}/vmlinuz"
+    gpg --detach-sign --local-user BA076BAA \
+        --output "${VM_TMP_DIR}/vmlinuz.sig" \
+        "${VM_TMP_DIR}/vmlinuz.signed"
+
+    _write_cpio_common "ignored" "${VM_TMP_DIR}/initrd"
+    gpg --detach-sign --local-user BA076BAA "${VM_TMP_DIR}/initrd"
+
+    "${BUILD_LIBRARY_DIR}/disk_util" \
+        --disk_layout="secure_demo" format "${dst_img}"
+    "${BUILD_LIBRARY_DIR}/disk_util" \
+        --disk_layout="secure_demo" mount "${dst_img}" "${tmp_esp}"
+
+    sudo mkdir -p "${tmp_esp}/EFI/boot"
+    sudo cp "${BUILD_LIBRARY_DIR}/secure_demo/bootx64.efi" \
+            "${BUILD_LIBRARY_DIR}/secure_demo/lockdown.efi" \
+            "${tmp_esp}/EFI/boot"
+    sudo cp "${VM_TMP_DIR}/grub.efi.signed" "${tmp_esp}/EFI/boot/grub.efi"
+
+    sudo mkdir -p "${tmp_esp}/coreos"
+    sudo cp "${VM_TMP_DIR}/vmlinuz.signed" "${tmp_esp}/coreos/vmlinuz"
+    sudo cp "${VM_TMP_DIR}/initrd"{,.sig} \
+        "${VM_TMP_DIR}/vmlinuz.sig" \
+        "${tmp_esp}/coreos"
+
+    "${BUILD_LIBRARY_DIR}/disk_util" \
+        --disk_layout="secure_demo" umount "${tmp_esp}"
+
+    VM_GENERATED_FILES+=( "${dst_img}" )
+}
+
 vm_cleanup() {
     info "Cleaning up temporary files"
     if mountpoint -q "${VM_TMP_ROOT}"; then