kairos/kairos-agent
1
0
Fork 0
mirror of https://github.com/kairos-io/kairos-agent.git synced 2025-08-16 23:37:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expose pcrs for uki encryption (#603)

Browse Source
This commit is contained in:
Itxaka 2024-11-20 10:41:52 +01:00 committed by GitHub
parent 800b7a0246
commit 895e571bb3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/agent/hooks/kcrypt_uki.go
View File

@ -92,7 +92,7 @@ func (k KcryptUKI) Run(c config.Config, spec v1.Spec) error {
for _, p := range append([]string{constants.OEMLabel, constants.PersistentLabel}, c.Install.Encrypt...) { for _, p := range append([]string{constants.OEMLabel, constants.PersistentLabel}, c.Install.Encrypt...) {
c.Logger.Infof("Encrypting %s", p) c.Logger.Infof("Encrypting %s", p)
_ = os.Setenv("SYSTEMD_LOG_LEVEL", "debug") _ = os.Setenv("SYSTEMD_LOG_LEVEL", "debug")
err := kcrypt.LuksifyMeasurements(p, []string{"11"}, []string{}, c.Logger.Logger) err := kcrypt.LuksifyMeasurements(p, c.BindPublicPCRs, c.BindPCRs, c.Logger.Logger)
_ = os.Unsetenv("SYSTEMD_LOG_LEVEL") _ = os.Unsetenv("SYSTEMD_LOG_LEVEL")
if err != nil { if err != nil {
c.Logger.Errorf("could not encrypt partition: %s", err) c.Logger.Errorf("could not encrypt partition: %s", err)

2
pkg/config/config.go
View File

@ -155,6 +155,8 @@ type Config struct {
SquashFsCompressionConfig []string `yaml:"squash-compression,omitempty" mapstructure:"squash-compression"` SquashFsCompressionConfig []string `yaml:"squash-compression,omitempty" mapstructure:"squash-compression"`
SquashFsNoCompression bool `yaml:"squash-no-compression,omitempty" mapstructure:"squash-no-compression"` SquashFsNoCompression bool `yaml:"squash-no-compression,omitempty" mapstructure:"squash-no-compression"`
UkiMaxEntries int `yaml:"uki-max-entries,omitempty" mapstructure:"uki-max-entries"` UkiMaxEntries int `yaml:"uki-max-entries,omitempty" mapstructure:"uki-max-entries"`
BindPCRs []string `yaml:"bind-pcrs,omitempty" mapstructure:"bind-pcrs"`
BindPublicPCRs []string `yaml:"bind-public-pcrs,omitempty" mapstructure:"bind-public-pcrs"`
} }
// WriteInstallState writes the state.yaml file to the given state and recovery paths // WriteInstallState writes the state.yaml file to the given state and recovery paths

2
pkg/config/config_test.go
View File

@ -94,7 +94,7 @@ func structFieldsContainedInOtherStruct(left, right interface{}) {
leftFieldName := leftTypes.Field(i).Name leftFieldName := leftTypes.Field(i).Name
if leftTypes.Field(i).IsExported() { if leftTypes.Field(i).IsExported() {
It(fmt.Sprintf("Checks that the new schema contians the field %s", leftFieldName), func() { It(fmt.Sprintf("Checks that the new schema contians the field %s", leftFieldName), func() {
if leftFieldName == "Source" || leftFieldName == "NoUsers" { if leftFieldName == "Source" || leftFieldName == "NoUsers" || leftFieldName == "BindPublicPCRs" || leftFieldName == "BindPCRs" {
Skip("Schema not updated yet") Skip("Schema not updated yet")
} }
Expect( Expect(