44 lines
1.0 KiB
Bash
Executable File
44 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Retrieve a password previously sealed into the TPM 2.0 with
|
|
# tpm-seal-password.sh. The TPM only releases the password if the current
|
|
# PCR values match those recorded when it was sealed.
|
|
# Requires: tpm2-tools, access to /dev/tpmrm0 (tss group or root).
|
|
|
|
set -euo pipefail
|
|
|
|
HANDLE="0x81010001"
|
|
PCR_LIST="sha256:7"
|
|
|
|
usage() {
|
|
cat <<-EOF
|
|
Usage: $(basename "$0") [-H handle] [-l pcr-list]
|
|
|
|
-H handle Persistent TPM handle the password was sealed at
|
|
(default: ${HANDLE})
|
|
-l pcr-list PCR bank and indices the password was bound to at
|
|
seal time (default: ${PCR_LIST})
|
|
EOF
|
|
}
|
|
|
|
while getopts "H:l:h" opt; do
|
|
case "$opt" in
|
|
H) HANDLE="$OPTARG" ;;
|
|
l) PCR_LIST="$OPTARG" ;;
|
|
h) usage; exit 0 ;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
command -v tpm2_unseal >/dev/null || {
|
|
echo "tpm2-tools is required (apt install tpm2-tools)" >&2
|
|
exit 1
|
|
}
|
|
|
|
if ! tpm2_readpublic -c "$HANDLE" >/dev/null 2>&1; then
|
|
echo "No sealed object found at handle ${HANDLE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
tpm2_unseal -c "$HANDLE" -p "pcr:${PCR_LIST}"
|