tastytea/hashboot
1
0
Fork 1
Code Issues Pull Requests Releases 1 Wiki Activity

Parse header of ${DIGEST_FILE} to set correct hash calculator

Browse Source
This commit is contained in:
tastytea 2015-09-30 00:24:56 +02:00
parent 92dcb3e01d
commit 603033a861
1 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
hashboot.sh
View File

@ -16,6 +16,7 @@ HASHER=""
BOOT_MOUNTED=0
CONFIG_FILE="/etc/hashboot.cfg"
#Umount /boot if we mounted it, exit with given exit code
function die
{
@ -28,24 +29,12 @@ function die
exit ${1}
}
#If we're not root: exit
if [ ${UID} -ne 0 ]
then
die 4 "You have to be root"
fi
#Try different hashers, use the most secure
HASHER=$(/usr/bin/which --skip-dot sha512sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha384sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha256sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha224sum 2> /dev/null)
#It gets insecure below here, but better than nothing?
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha1sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot md5sum 2> /dev/null)
#If we found no hasher: exit
[ -z ${HASHER} ] && die 5 "No hash calculator found"
#If /boot is in fstab but not mounted: mount, mark as mounted
if grep -q '/boot.*noauto' /etc/fstab && ! grep -q /boot /etc/mtab
then
@ -53,8 +42,20 @@ then
BOOT_MOUNTED=1
fi
if [ "${1}" == "index" ]
then
#Try different hashers, use the most secure
HASHER=$(/usr/bin/which --skip-dot sha512sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha384sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha256sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha224sum 2> /dev/null)
#It gets insecure below here, but better than nothing?
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha1sum 2> /dev/null)
test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot md5sum 2> /dev/null)
#If we found no hasher: exit
[ -z ${HASHER} ] && die 5 "No hash calculator found"
#Look for config file and set ${MBR_DEVICE}.
if [ -f ${CONFIG_FILE} ]
then
@ -74,7 +75,7 @@ then
#Write MBR of MBR_DEVICE to ${DIGEST_FILE}
dd if=${MBR_DEVICE} of=${MBR_TMP} bs=1M count=1 status=none || die 8
#Write hashes of all regular files to ${DIGEST_FILE}
${HASHER} ${MBR_TMP} > ${DIGEST_FILE}
${HASHER} ${MBR_TMP} >> ${DIGEST_FILE}
find /boot -type f -exec ${HASHER} --binary {} >> ${DIGEST_FILE} +
if [ $? == 0 ]
then
@ -94,6 +95,8 @@ then
elif [ "${1}" == "check" ]
then
COUNTER=0
HASHER=$(head -n1 ${DIGEST_FILE} | awk '{print $5}')
dd if=${MBR_DEVICE} of=${MBR_TMP} bs=1M count=1 status=none || die 8
if $(grep ${MBR_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict > ${LOG_FILE})
then