mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-08 05:26:58 +02:00
127c3bfa2b
After discussing with drewry, we can't come up with a better way to inject these root certs. We considered putting them on the stateful partition, but that opens up an avenue of attack (if you can get a root cert into the magic directory, then you can MITM login). Thus, we put it on the rootfs instead. The script that sets up the hashes for vboot will verify that this directory is not present in production images. That work is tracked here: http://code.google.com/p/chromium-os/issues/detail?id=2693 Review URL: http://codereview.chromium.org/1566055
30 lines
1.1 KiB
Bash
Executable File
30 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
echo "Adding mock Google Accounts server certs."
|
|
|
|
# TODO(cmasone): Generate certs/keys on the fly from a CSR?
|
|
CERT_DIR="${GCLIENT_ROOT}/src/platform/login_manager"
|
|
CERT_NAME="mock_server"
|
|
FAKE_CA_DIR="${ROOT_FS_DIR}/etc/fake_root_ca"
|
|
FAKE_NSSDB="${FAKE_CA_DIR}/nssdb"
|
|
|
|
mkdir -p "${FAKE_NSSDB}"
|
|
cat "${CERT_DIR}/${CERT_NAME}.key" > "${FAKE_CA_DIR}/${CERT_NAME}.key"
|
|
echo "DO NOT MOVE THIS DATA OFF OF THE ROOTFS!" > "${FAKE_CA_DIR}/README"
|
|
nsscertutil -A -n FakeCA -t "C,C,C" -a -i "${CERT_DIR}/${CERT_NAME}.pem" \
|
|
-d "${FAKE_NSSDB}"
|
|
chmod -R 0644 "${FAKE_NSSDB}"
|
|
|
|
# TODO(cmasone): get rid of this once we're off pam_google for good.
|
|
# Sadly, our fake cert HAS to be first in this file.
|
|
TMPFILE=$(mktemp)
|
|
CERT_FILE="${ROOT_FS_DIR}/etc/login_trust_root.pem"
|
|
PERMS=$(stat --printf="%a" "${CERT_FILE}")
|
|
cat "${CERT_DIR}/${CERT_NAME}.pem" "${CERT_FILE}" > "${TMPFILE}"
|
|
mv -f "${TMPFILE}" "${CERT_FILE}"
|
|
chmod "${PERMS}" "${CERT_FILE}"
|