Everbrent/cis
8
0 Fork 0
mirror of https://github.com/m8tin/cis.git synced 2026-11-02 14:17:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improvments for secrets.sh

Browse Source
This commit is contained in:
m8in committed 2026-09-16 21:14:07 +02:00
1 parent 03b2fac155
commit fa9fa635b5
1 file changed
+16 -12
Download Patch File Download Diff File Expand all files Collapse all files
script/host/tpm/secrets.sh
+16 -12
View File
@@ -67,8 +67,8 @@ function checkOrCreateSafe() {
printf -- "%s" 'Creating TPM derived safe ... ' >&2 printf -- "%s" 'Creating TPM derived safe ... ' >&2
mkdir -p "$(dirname "${AES_STORE_FILE}")" mkdir -p "$(dirname "${AES_STORE_FILE}")"
[ -f /tmp/primary.ctx ] || tpm2_createprimary -C o -Q -c /tmp/primary.ctx tpm2_createprimary -C o -Q -c "${TMPDIR%/}/primary.ctx"
openssl rand 32 | tpm2_create -C /tmp/primary.ctx -Q -i - -r "${AES_STORE_FILE}" -u "${AES_STORE_FILE}.pub" \ openssl rand 32 | tpm2_create -C "${TMPDIR%/}/primary.ctx" -Q -i - -r "${AES_STORE_FILE}" -u "${AES_STORE_FILE}.pub" \
&& checkSafe \ && checkSafe \
&& return 0 && return 0
@@ -81,16 +81,16 @@ function seal() {
! chmod -R go-rwx "${SECRETS_PLAIN_PATH}" \ ! chmod -R go-rwx "${SECRETS_PLAIN_PATH}" \
&& return 1 && return 1
[ -f /tmp/primary.ctx ] || tpm2_createprimary -C o -Q -c /tmp/primary.ctx tpm2_createprimary -C o -Q -c "${TMPDIR%/}/primary.ctx"
[ -f /tmp/safe.ctx ] || tpm2_load \ tpm2_load \
-C /tmp/primary.ctx -Q \ -C "${TMPDIR%/}/primary.ctx" -Q \
-r "${AES_STORE_FILE}" \ -r "${AES_STORE_FILE}" \
-u "${AES_STORE_FILE}.pub" \ -u "${AES_STORE_FILE}.pub" \
-c /tmp/safe.ctx -c "${TMPDIR%/}/safe.ctx"
openssl enc -aes-256-cbc -salt -pbkdf2 \ openssl enc -aes-256-cbc -salt -pbkdf2 \
-in <(tar -czvf - "${SECRETS_PLAIN_PATH%/}/"*) \ -in <(tar -czvf - "${SECRETS_PLAIN_PATH%/}/"*) \
-out "${SECRETS_STORE_FILE}.tar.gz.aes" \ -out "${SECRETS_STORE_FILE}.tar.gz.aes" \
-pass file:<(tpm2_unseal -c /tmp/safe.ctx) -pass file:<(tpm2_unseal -c "${TMPDIR%/}/safe.ctx")
} }
function unseal() { function unseal() {
@@ -100,16 +100,16 @@ function unseal() {
! mkdir -m 1700 -p "${SECRETS_PLAIN_PATH}" \ ! mkdir -m 1700 -p "${SECRETS_PLAIN_PATH}" \
&& return 1 && return 1
[ -f /tmp/primary.ctx ] || tpm2_createprimary -C o -Q -c /tmp/primary.ctx tpm2_createprimary -C o -Q -c "${TMPDIR%/}/primary.ctx"
[ -f /tmp/safe.ctx ] || tpm2_load \ tpm2_load \
-C /tmp/primary.ctx -Q \ -C "${TMPDIR%/}/primary.ctx" -Q \
-r "${AES_STORE_FILE}" \ -r "${AES_STORE_FILE}" \
-u "${AES_STORE_FILE}.pub" \ -u "${AES_STORE_FILE}.pub" \
-c /tmp/safe.ctx -c "${TMPDIR%/}/safe.ctx"
openssl enc -d -aes-256-cbc -pbkdf2 \ openssl enc -d -aes-256-cbc -pbkdf2 \
-in "${SECRETS_STORE_FILE}.tar.gz.aes" \ -in "${SECRETS_STORE_FILE}.tar.gz.aes" \
-out - \ -out - \
-pass file:<(tpm2_unseal -c /tmp/safe.ctx) | tar -xzvf - -C / -pass file:<(tpm2_unseal -c "${TMPDIR%/}/safe.ctx") | tar -xzvf - -C /
} }
function usage() { function usage() {
@@ -130,11 +130,15 @@ checkPreconditions || exit 1
case "${1}" in case "${1}" in
--seal) --seal)
TMPDIR=$(mktemp -d --suffix .tpm.context)
trap 'rm -rf "${TMPDIR:?"Missing TMPDIR"}"; echo "Sealing finished, TMPDIR removed: ${TMPDIR}"' EXIT
checkOrCreateSafe \ checkOrCreateSafe \
&& seal \ && seal \
&& exit 0 && exit 0
;; ;;
--unseal) --unseal)
TMPDIR=$(mktemp -d --suffix .tpm.context)
trap 'rm -rf "${TMPDIR:?"Missing TMPDIR"}"; echo "Unsealing finished, TMPDIR removed: ${TMPDIR}"' EXIT
checkSafe \ checkSafe \
&& unseal \ && unseal \
&& exit 0 && exit 0