From b37af50c3fcab83d3ce092b7ced752919271198d Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 12 Aug 2026 13:51:29 -0400 Subject: [PATCH] Use other TPM PCR banks Some TPMs are configured to use other pcr banks. For now, prefer the sha256 for compatibility. --- .../hooks/cmdline/10-confluentdiskless.sh | 28 +++++++++++++++--- .../hooks/cmdline/10-confluentdiskless.sh | 28 +++++++++++++++--- .../hooks/cmdline/10-confluentdiskless.sh | 27 ++++++++++++++--- .../hooks/cmdline/10-confluentdiskless.sh | 28 +++++++++++++++--- .../initramfs/opt/confluent/bin/rungenesis | 27 ++++++++++++++--- .../hooks/cmdline/10-confluentdiskless.sh | 27 ++++++++++++++--- .../initramfs/scripts/init-premount/confluent | 29 ++++++++++++++++--- 7 files changed, 166 insertions(+), 28 deletions(-) diff --git a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 36c34960..07e1ea93 100644 --- a/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el10-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -14,9 +14,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -25,6 +26,24 @@ get_remote_apikey() { fi done } + +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + root=1 rootok=1 netroot=confluent @@ -80,7 +99,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -155,7 +175,7 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 1dfa4180..2c2e6930 100644 --- a/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el7-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -13,9 +13,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -24,6 +25,24 @@ get_remote_apikey() { fi done } + +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + root=1 rootok=1 netroot=confluent @@ -77,7 +96,8 @@ lasthdl="" if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_getcap ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -138,7 +158,7 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 -a -x /usr/bin/tpm2_pcrextend ]; then - tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 fi umask $oldumask autoconfigmethod=$(grep ^ipv4_method: /etc/confluent/confluent.deploycfg |awk '{print $2}') diff --git a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index 4f129d08..bece01cc 100644 --- a/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el8-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -14,9 +14,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm2_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -25,6 +26,23 @@ get_remote_apikey() { fi done } + +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} . /lib/dracut-lib.sh root=1 rootok=1 @@ -80,7 +98,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -186,7 +205,7 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index a2867f1d..fbf390b1 100644 --- a/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/el9-diskless/initramfs/usr/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -1,3 +1,21 @@ +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + + get_remote_apikey() { while [ -z "$confluent_apikey" ]; do /opt/confluent/bin/clortho $nodename $confluent_mgr > /etc/confluent/confluent.apikey @@ -14,9 +32,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -80,7 +99,8 @@ lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=${get_tpm_hashalgo} + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -155,7 +175,7 @@ while [ $ready = "0" ]; do done if [ ! -z "$autocons" ] && grep "textconsole: true" /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 fi umask $oldumask mkdir -p /run/NetworkManager/system-connections diff --git a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis index 4304ce4a..2b80285f 100644 --- a/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis +++ b/confluent_osdeploy/genesis/initramfs/opt/confluent/bin/rungenesis @@ -8,6 +8,23 @@ export LANG=en_US.utf8 (while :; do TERM=linux tmux a <> /dev/tty1 >&0 2>&1; done) & +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + mkdir -p /etc/confluent if ! grep console= /proc/cmdline >& /dev/null; then @@ -113,7 +130,8 @@ oldumask=$(umask) umask 0077 for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm2_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -140,16 +158,17 @@ if [ "$new_apikey" != "$confluent_apikey" ]; then tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm2_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm2_pcrbank}:15" --policy=pcr15.${tpm2_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:$new_apikey") | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:$new_apikey") | tpm2_create -Q --policy=pcr15.${tpm2_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx cd - > /dev/null rm -rf $tmpdir fi -tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 2> /dev/null +tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 2> /dev/null ifidx=$(cat /tmp/confluent.ifidx) ifname=$(ip link |grep ^$ifidx:|awk '{print $2}') ifname=${ifname%:} diff --git a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh index fb01312f..698ad8e0 100644 --- a/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh +++ b/confluent_osdeploy/suse15-diskless/initramfs/lib/dracut/hooks/cmdline/10-confluentdiskless.sh @@ -12,10 +12,11 @@ get_remote_apikey() { else tmpdir=$(mktemp -d) cd $tmpdir + tpm_algo=$(get_tpm_hashalgo) tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_algo}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -24,6 +25,23 @@ get_remote_apikey() { fi done } + +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} root=1 rootok=1 netroot=confluent @@ -77,7 +95,8 @@ cd $tpmdir lasthdl="" for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_algo=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_algo}:15" --policy=pcr15.${tpm_algo}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if [[ $unsealeddata == "CONFLUENT_APIKEY:"* ]]; then @@ -136,7 +155,7 @@ while [ $ready = "0" ]; do rm $tmperr done if [ ! -z "$autocons" ] && grep textconsole: true /etc/confluent/confluent.deploycfg > /dev/null; then /opt/confluent/bin/autocons -c > /dev/null; fi -tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 +tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 umask $oldumask autoconfigmethod=$(grep ipv4_method /etc/confluent/confluent.deploycfg |awk '{print $2}') if [ "$autoconfigmethod" = "dhcp" ]; then diff --git a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent index 0ce73368..1ad852cc 100644 --- a/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent +++ b/confluent_osdeploy/ubuntu20.04-diskless/initramfs/scripts/init-premount/confluent @@ -1,10 +1,30 @@ #!/bin/sh + +get_tpm_hashalgo() { + if [ -n "$confluent_tpm_hashalgo" ]; then + echo "$confluent_tpm_hashalgo" + return 0 + fi + tpm_pcrbanks=$(tpm2_getcap pcrs 2>/dev/null) + for algo in sha256 sha512 sha384; do + # Match only banks that actually have PCRs allocated (a digit in [ ... ]). + if echo "$tpm_pcrbanks" | grep -Eq "$algo:[[:space:]]*\[[^]]*[0-9]"; then + confluent_tpm_hashalgo="$algo" + echo "$confluent_tpm_hashalgo" + return 0 + fi + done + return 1 +} + + get_tpm_apikey() { lasthdl="" if [ -c /dev/tpmrm0 ]; then for hdl in $(tpm2_getcap handles-persistent|awk '{print $2}'); do tpm2_startauthsession --policy-session --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy unsealeddata=$(tpm2_unseal --auth=session:session.ctx -Q -c $hdl 2>/dev/null) tpm2_flushcontext session.ctx if echo $unsealeddata | grep "^CONFLUENT_APIKEY:" > /dev/null; then @@ -40,9 +60,10 @@ get_remote_apikey() { tmpdir=$(mktemp -d) cd $tmpdir tpm2_startauthsession --session=session.ctx - tpm2_policypcr -Q --session=session.ctx --pcr-list="sha256:15" --policy=pcr15.sha256.policy + tpm_pcrbank=$(get_tpm_hashalgo) + tpm2_policypcr -Q --session=session.ctx --pcr-list="${tpm_pcrbank}:15" --policy=pcr15.${tpm_pcrbank}.policy tpm2_createprimary -G ecc -Q --key-context=prim.ctx - (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.sha256.policy --public=data.pub --private=data.priv -i - -C prim.ctx + (echo -n "CONFLUENT_APIKEY:";cat /etc/confluent/confluent.apikey) | tpm2_create -Q --policy=pcr15.${tpm_pcrbank}.policy --public=data.pub --private=data.priv -i - -C prim.ctx tpm2_load -Q --parent-context=prim.ctx --public=data.pub --private=data.priv --name=confluent.apikey --key-context=data.ctx tpm2_evictcontrol -Q -c data.ctx tpm2_flushcontext session.ctx @@ -144,7 +165,7 @@ done mkdir -p /root/.ssh cat /ssh/*pubkey > /root/.ssh/authorized_keys if [ -c /dev/tpmrm0 ]; then - tpm2_pcrextend 15:sha256=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 + tpm2_pcrextend 15:$(get_tpm_hashalgo)=2fbe96c50dde38ce9cd2764ddb79c216cfbcd3499568b1125450e60c45dd19f2 fi confluent_profile=$(grep ^profile: /etc/confluent/confluent.deploycfg| awk '{print $2}') confluent_proto=$(grep ^protocol: /etc/confluent/confluent.deploycfg| awk '{print $2}')