From e1e23b48187fab25c3b4adadb483bbec84f6f5d0 Mon Sep 17 00:00:00 2001 From: teldra Date: Sun, 24 Feb 2019 13:55:10 +0100 Subject: [PATCH 1/2] Cleanup cfg, fix bios check --- hashboot | 83 +++++++++++++++++++++++++------------------------------- 1 file changed, 37 insertions(+), 46 deletions(-) diff --git a/hashboot b/hashboot index ef7cc2b..26cfb65 100755 --- a/hashboot +++ b/hashboot @@ -28,7 +28,6 @@ BOOT_MOUNTED=0 CONFIG_FILE="/etc/hashboot.cfg" COUNTER=0 DD_STATUS="none" -PROGRAMMER="no" #standard change enables bios mode #bitmask: # 001=mbr # 010=files @@ -62,14 +61,12 @@ write_hashes () #Write hashes of all regular files to ${1} find /boot -type f -exec ${HASHER} --binary {} >> ${1} + fi - if [ $((${CKMODES} & 100)) != 0 ]; then - #if we set an programmer chip in config - if [ ! "${PROGRAMMER}" == "no" ]; then - #read bios to file - flashrom --programmer ${PROGRAMMER} -r ${BIOS_TMP} > /dev/null 2>&1 - #and write hashes of bios files to ${1} - ${HASHER} ${BIOS_TMP} >> ${1} - fi + if [ $((${CKMODES} & 100)) -ne 0 ]; then + #read bios to file + flashrom --programmer internal -r ${BIOS_TMP} > /dev/null 2>&1 + #and write hashes of bios files to ${1} + ${HASHER} ${BIOS_TMP} >> ${1} + fi } @@ -109,6 +106,7 @@ then sed -i '/BACKUP_FILE/d' ${CONFIG_FILE} echo "The backup und the digests have been moved to ${SAVEDIR}" fi + # here we extrapolate pathes from savedir. DIGEST_FILE="${SAVEDIR}/hashboot.digest" BACKUP_FILE="${SAVEDIR}/boot-backup.tar" #If not found, create one and ask for ${MBR_DEVICE} @@ -116,52 +114,46 @@ else #Create ${CONFIG_FILE} with defaults if noninterctive if [ -t "0" ] then - echo -n "Which device contains the MBR? [/dev/sda] " - read -r MBR_DEVICE - [ -z "${MBR_DEVICE}" ] && MBR_DEVICE="/dev/sda" - echo "#Device with the MBR on it" > ${CONFIG_FILE} - echo "MBR_DEVICE=${MBR_DEVICE}" >> ${CONFIG_FILE} - echo -n "Where should backup file and digestfile be stored? [/var/lib/hashboot] " read -r SAVEDIR [ -z "${SAVEDIR}" ] && SAVEDIR="/var/lib/hashboot" - echo "#Where the Backup files are stored" >> ${CONFIG_FILE} + echo "#Where the Backup files are stored" > ${CONFIG_FILE} echo "SAVEDIR=${SAVEDIR}" >> ${CONFIG_FILE} DIGEST_FILE="${SAVEDIR}/hashboot.digest" BACKUP_FILE="${SAVEDIR}/boot-backup.tar" mkdir -p ${SAVEDIR} - echo -n "Include BIOS check? (y/n)" - read prompt - while ! [[ $prompt == "y" || $prompt == "Y" || $prompt == "n" || $prompt == "N" ]]; do - read prompt - done - if [[ "${prompt}" == "y" || "${prompt}" == "Y" ]]; then - if which flashrom; then - flashrom - echo -n "Which programmer? (eg. internal) " - read p - echo "PROGRAMMER=${p}" >> ${CONFIG_FILE} - else - echo "No flashrom found. You need to install it." - echo "PROGRAMMER=${PROGRAMMER}" >> ${CONFIG_FILE} - fi - else - echo "PROGRAMMER=no" >> ${CONFIG_FILE} - fi + echo "What do we check?" echo "001=mbr" echo "010=files" - echo "100=bios" + echo "100=core-/libreboot bios" echo "eg. 101 for mbr and bios: " read CKMODES + echo "#001=mbr,010=files,100=bios" >> ${CONFIG_FILE} echo "CKMODES=$CKMODES" >> ${CONFIG_FILE} + + if [ $((${CKMODES} & 001)) -ne 0 ]; then + echo -n "Which device contains the MBR? [/dev/sda] " + read -r MBR_DEVICE + [ -z "${MBR_DEVICE}" ] && MBR_DEVICE="/dev/sda" + echo "#Device with the MBR on it" >> ${CONFIG_FILE} + echo "MBR_DEVICE=${MBR_DEVICE}" >> ${CONFIG_FILE} + fi + + if [ $((${CKMODES} & 100)) -ne 0 ]; then + if ! which flashrom; then + echo "You need to have flashrom installed!" + echo "Currently it is not installed, don't reboot" + fi + fi + else echo "#Device with the MBR on it" > ${CONFIG_FILE} echo "MBR_DEVICE=${MBR_DEVICE}" >> ${CONFIG_FILE} echo "#Where the Backup files are stored" >> ${CONFIG_FILE} - echo "BACKUP_FILE=${BACKUP_FILE}" >> ${CONFIG_FILE} + echo "SAVEDIR=/var/lib/hashboot" >> ${CONFIG_FILE} + echo "#001=mbr,010=files,100=bios" >> ${CONFIG_FILE} echo "CKMODES=$CKMODES" >> ${CONFIG_FILE} - echo "PROGRAMMER=${PROGRAMMER}" >> ${CONFIG_FILE} fi fi @@ -227,7 +219,7 @@ then mv ${DIGEST_FILE_TMP} ${DIGEST_FILE} else write_hashes $DIGEST_FILE - tar -cpPf ${BACKUP_FILE} ${BIOS} ${MBR_TMP} /boot ${DIGEST_FILE} || die 7 "Error writing ${BACKUP_FILE}" + tar -cpPf ${BACKUP_FILE} ${BIOS_TMP} ${MBR_TMP} /boot ${DIGEST_FILE} || die 7 "Error writing ${BACKUP_FILE}" echo "Backup written to ${BACKUP_FILE}" fi @@ -253,16 +245,15 @@ then fi fi if [ $((${CKMODES} & 100)) -ne 0 ]; then - flashrom --programmer ${PROGRAMMER} -r ${BIOS_TMP} > /dev/null 2>&1 + flashrom --programmer internal -r ${BIOS_TMP} > /dev/null 2>&1 #if we set an programmer chip in config, find line with hash for bios and compare. if smthg wrong, panic - if [ ! ${PROGRAMMER} == "no" ]; then - grep ${BIOS_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict | tee -a ${LOG_FILE} - if [ ${PIPESTATUS[2]} -ne 0 ] - then - echo " !! TIME TO PANIK: BIOS WAS MODIFIED !!" - COUNTER=$((COUNTER + 10)) - fi + grep ${BIOS_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict | tee -a ${LOG_FILE} + if [ ${PIPESTATUS[2]} -ne 0 ] + then + echo " !! TIME TO PANIK: BIOS WAS MODIFIED !!" + COUNTER=$((COUNTER + 10)) fi + fi if [ ${COUNTER} -gt 0 ]; then From 9867a6b49ca22be981d1c3381e4bb0dcfa2ec50a Mon Sep 17 00:00:00 2001 From: Teldra Date: Sun, 24 Feb 2019 14:35:14 +0100 Subject: [PATCH 2/2] Update hashboot --- hashboot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hashboot b/hashboot index 26cfb65..7ac7d24 100755 --- a/hashboot +++ b/hashboot @@ -106,7 +106,7 @@ then sed -i '/BACKUP_FILE/d' ${CONFIG_FILE} echo "The backup und the digests have been moved to ${SAVEDIR}" fi - # here we extrapolate pathes from savedir. + # here we extrapolate paths from savedir. DIGEST_FILE="${SAVEDIR}/hashboot.digest" BACKUP_FILE="${SAVEDIR}/boot-backup.tar" #If not found, create one and ask for ${MBR_DEVICE}