Skip to content

Instantly share code, notes, and snippets.

@drinkcat
Last active August 29, 2015 13:59
Show Gist options
  • Save drinkcat/10843992 to your computer and use it in GitHub Desktop.
Save drinkcat/10843992 to your computer and use it in GitHub Desktop.
Test if kernel is signed
verifykernelsig() {
dev_debug_vboot -c -i "`rootdev -s -d`" | tee /tmp/dev_debug_vboot
echo "Checking output:"
cat /tmp/dev_debug_vboot | mawk '
!/^ / {
label = ""
}
/^Kernel / {
sub(/:$/, "", $2)
( "blkid -o value -s PARTLABEL " $2) | getline label
# Ignore kernel C, or any kernel whose header is not valid
if (label == "KERN-C" || $3 != "OK") {
label = ""
}
}
label && /^ Verify / && $4 ~ /^kern_subkey_[AB].vbpubk:$/ {
if ($5 == "OK") {
okkernel[label] = 1
}
}
END {
if (okkernel["KERN-A"] && okkernel["KERN-B"]) {
print "Both Kernel A or Kernel B are verified."
exit 0
} else {
print "Either Kernel A or Kernel B is not verified."
exit 1
}
}
'
return $?
}
if verifykernelsig; then
echo "RESULT: signed_boot can be enabled safely."
else
echo "RESULT: signed_boot must be kept disabled."
fi
sudo sh -e testsig.sh
Saving verbose log as /tmp/debug_vboot_vK2xkrKGi/noisy.log
Extracting BIOS components...
Pulling root and recovery keys from GBB...
Verify firmware A with root key: OK
TPM=0x00010003, this=0x00010003
Verify firmware B with root key: OK
TPM=0x00010003, this=0x00010003
Examining kernels...
Kernel /dev/mmcblk0p2: OK
Verify /dev/mmcblk0p2 with kern_subkey_A.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p2 with kern_subkey_B.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p2 with recoverykey.vbpubk: FAILED
Kernel /dev/mmcblk0p4: OK
Verify /dev/mmcblk0p4 with kern_subkey_A.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p4 with kern_subkey_B.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p4 with recoverykey.vbpubk: FAILED
Kernel /dev/mmcblk0p6: FAILED
Checking output:
Both Kernel A or Kernel B are verified.
RESULT: signed_boot can be enabled safely.
Output on a signed peppy:
sudo sh -e testsig.sh
Saving verbose log as /tmp/debug_vboot_Hvv8qTy2F/noisy.log
Extracting BIOS components...
Pulling root and recovery keys from GBB...
Verify firmware A with root key: OK
TPM=0x00010002, this=0x00010002
Verify firmware B with root key: OK
TPM=0x00010002, this=0x00010002
Examining kernels...
Kernel /dev/sda2: OK
Verify /dev/sda2 with kern_subkey_A.vbpubk: OK
TPM=0x00020001 this=0x00020001
Verify /dev/sda2 with kern_subkey_B.vbpubk: OK
TPM=0x00020001 this=0x00020001
Verify /dev/sda2 with recoverykey.vbpubk: FAILED
Kernel /dev/sda4: OK
Verify /dev/sda4 with kern_subkey_A.vbpubk: OK
TPM=0x00020001 this=0x00020001
Verify /dev/sda4 with kern_subkey_B.vbpubk: OK
TPM=0x00020001 this=0x00020001
Verify /dev/sda4 with recoverykey.vbpubk: FAILED
Kernel /dev/sda6: FAILED
Checking output:
Both Kernel A or Kernel B are verified.
RESULT: signed_boot can be enabled safely.
Output on a non-signed QEMU (no firmware, so no keys are extracted):
sudo sh -e testsig.sh
Saving verbose log as /tmp/debug_vboot_GFsNM1db4/noisy.log
Extracting BIOS components...
...individually...
Checking output:
Either Kernel A or Kernel B is not verified.
RESULT: signed_boot must be kept disabled.
@tedm
Copy link

tedm commented Apr 16, 2014

@drinkcat fyi - output from samsung arm on stable channel (crossystem usb_dev_boot=1 and crossystem dev_boot_signed_only=0 were set prior to most recent crouton update):

chronos@localhost ~/Downloads $ sudo sh -e test.sh
Saving verbose log as /tmp/debug_vboot_v90sd7AUa/noisy.log
Extracting BIOS components...
Pulling root and recovery keys from GBB...
Verify firmware A with root key: OK
TPM=0x00010003, this=0x00010003
Verify firmware B with root key: OK
TPM=0x00010003, this=0x00010003
Examining kernels...
Kernel /dev/mmcblk0p2: OK
Verify /dev/mmcblk0p2 with kern_subkey_A.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p2 with kern_subkey_B.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p2 with recoverykey.vbpubk: FAILED
Kernel /dev/mmcblk0p4: OK
Verify /dev/mmcblk0p4 with kern_subkey_A.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p4 with kern_subkey_B.vbpubk: OK
TPM=0x00030001 this=0x00030001
Verify /dev/mmcblk0p4 with recoverykey.vbpubk: FAILED
Kernel /dev/mmcblk0p6: FAILED
Checking output:
Either Kernel A or Kernel B is not verified.
RESULT: signed_boot must be kept disabled.
chronos@localhost ~/Downloads $

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment