123 lines
3.2 KiB
Bash
Executable File
123 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Bootstrap the TPM 2.0 seal used by vault-tpm2-unseal.service: reads the
|
|
# Vault unseal key from 1Password via the op CLI, using the secret
|
|
# reference configured in the environment file, and seals it with the same
|
|
# PCR-policy binding as tpm-seal-password.sh.
|
|
#
|
|
# This replaces interactive password entry with an op read, but op read
|
|
# itself still requires an operator present to approve the request (device
|
|
# biometric unlock or an active `op signin` session) - this script does not
|
|
# run unattended.
|
|
#
|
|
# Requires: tpm2-tools, the 1Password CLI (op), access to /dev/tpmrm0.
|
|
|
|
set -euo pipefail
|
|
|
|
CONFIG="/etc/vault.d/tpm2.env"
|
|
HANDLE=""
|
|
PCR_LIST=""
|
|
FORCE=0
|
|
|
|
usage() {
|
|
cat <<-EOF
|
|
Usage: $(basename "$0") [-c config] [-H handle] [-l pcr-list] [-f]
|
|
|
|
-c config Environment file providing OP_SECRET_REFERENCE and,
|
|
optionally, TPM_HANDLE/TPM_PCR_LIST (default: ${CONFIG})
|
|
-H handle Persistent TPM handle to store the sealed password at,
|
|
overrides TPM_HANDLE from the config file
|
|
-l pcr-list PCR bank and indices to bind release to, overrides
|
|
TPM_PCR_LIST from the config file
|
|
-f Evict an existing object at that handle before sealing
|
|
EOF
|
|
}
|
|
|
|
while getopts "c:H:l:fh" opt; do
|
|
case "$opt" in
|
|
c) CONFIG="$OPTARG" ;;
|
|
H) HANDLE="$OPTARG" ;;
|
|
l) PCR_LIST="$OPTARG" ;;
|
|
f) FORCE=1 ;;
|
|
h) usage; exit 0 ;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
[ -r "$CONFIG" ] || {
|
|
echo "Cannot read configuration file: ${CONFIG}" >&2
|
|
exit 1
|
|
}
|
|
|
|
# shellcheck disable=SC1090
|
|
source "$CONFIG"
|
|
|
|
: "${OP_SECRET_REFERENCE:?OP_SECRET_REFERENCE must be set in ${CONFIG}}"
|
|
HANDLE="${HANDLE:-${TPM_HANDLE:-0x81010001}}"
|
|
PCR_LIST="${PCR_LIST:-${TPM_PCR_LIST:-sha256:7}}"
|
|
|
|
command -v tpm2_createprimary >/dev/null || {
|
|
echo "tpm2-tools is required (apt install tpm2-tools)" >&2
|
|
exit 1
|
|
}
|
|
|
|
command -v op >/dev/null || {
|
|
echo "1Password CLI (op) is required" >&2
|
|
exit 1
|
|
}
|
|
|
|
if tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
|
if [ "$FORCE" -eq 1 ]; then
|
|
tpm2_evictcontrol -C o -c "$HANDLE" >/dev/null
|
|
else
|
|
echo "A sealed object already exists at ${HANDLE}; rerun with -f to replace it" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
WORKDIR="$(mktemp -d)"
|
|
trap 'rm -rf "$WORKDIR"' EXIT
|
|
umask 077
|
|
|
|
echo "Reading ${OP_SECRET_REFERENCE} from 1Password; approve the request if prompted." >&2
|
|
|
|
PASSWORD="$(op read "$OP_SECRET_REFERENCE")"
|
|
|
|
[ -n "$PASSWORD" ] || {
|
|
echo "op read returned an empty value for ${OP_SECRET_REFERENCE}" >&2
|
|
exit 1
|
|
}
|
|
|
|
echo "Creating primary key..." >&2
|
|
tpm2_createprimary -C o -c "$WORKDIR/primary.ctx" -Q
|
|
|
|
echo "Creating PCR policy for ${PCR_LIST}..." >&2
|
|
tpm2_createpolicy -Q \
|
|
--policy-pcr \
|
|
-l "$PCR_LIST" \
|
|
-L "$WORKDIR/policy.digest"
|
|
|
|
echo "Sealing password..." >&2
|
|
printf '%s' "$PASSWORD" | tpm2_create \
|
|
-C "$WORKDIR/primary.ctx" \
|
|
-L "$WORKDIR/policy.digest" \
|
|
-i - \
|
|
-u "$WORKDIR/seal.pub" \
|
|
-r "$WORKDIR/seal.priv" \
|
|
-Q
|
|
|
|
unset PASSWORD
|
|
|
|
echo "Loading sealed object..." >&2
|
|
tpm2_load \
|
|
-C "$WORKDIR/primary.ctx" \
|
|
-u "$WORKDIR/seal.pub" \
|
|
-r "$WORKDIR/seal.priv" \
|
|
-c "$WORKDIR/seal.ctx" \
|
|
-Q
|
|
|
|
echo "Persisting sealed object at ${HANDLE}..." >&2
|
|
tpm2_evictcontrol -C o -c "$WORKDIR/seal.ctx" "$HANDLE" >/dev/null
|
|
|
|
echo "Password from ${OP_SECRET_REFERENCE} sealed and persisted at handle ${HANDLE}, bound to PCRs ${PCR_LIST}"
|