#!/bin/bash set -x if [ ! -e /bootcount ]; then echo -n 1 > /bootcount fi bootcount="$(cat /bootcount)" bootcount_next="$(expr "$bootcount" + 1)" echo -n "$bootcount_next" > /bootcount tpm_version_major="$(cat /sys/class/tpm/tpm0/tpm_version_major)" if [ -e /sys/firmware/efi ]; then efi="1" else efi="0" fi mkdir output/$bootcount date +%s > output/$bootcount/timestamp apt update if [ "$tpm_version_major" = "2" ]; then apt -y install tpm2-tools tpm2_nvreadpublic > output/$bootcount/tpm2_nvreadpublic tpm2_pcrread > output/$bootcount/tpm2_pcrread elif [ "$tpm_version_major" = "1" ]; then apt -y install tpm-tools if [ "$bootcount" = "0" ]; then cp /usr/share/doc/trousers/examples/system.data.auth /var/lib/tpm/system.data fi systemctl restart tcsd sleep 4 # wait for tcsd tpm_version > output/$bootcount/tpm_version cat $(find /sys/devices -name pcrs | head -n1) > output/$bootcount/pcrs fi if [ "$efi" = "1" ]; then apt -y install efibootmgr efibootmgr -v > output/$bootcount/efibootmgr fi dmesg > output/$bootcount/dmesg cp /proc/cpuinfo output/$bootcount/cpuinfo lspci -nn > output/$bootcount/lspci-nn uname -r > output/$bootcount/uname if [ -e /boot/tboot.gz.hg ]; then cat /boot/tboot.gz.hg > output/$bootcount/tboot_version else dpkg-query -W tboot > output/$bootcount/tboot_version fi txt-stat > output/$bootcount/txt-stat baremetal keepalive case "$bootcount" in "1") # install tboot echo "after booting vanilla image" > output/$bootcount/comment efibootmgr -v apt -y install curl curl -o acm.tar.gz https://lindi.iki.fi/lindi/tboot/acm.tar.gz tar -xf acm.tar.gz cp acm/6th_7th_gen_i5_i7-SINIT_79.bin /boot cp acm/3rd_gen_i5_i7_SINIT_67.BIN /boot # i5-3320M apt -y install tboot sed -i "s@GRUB_DEFAULT=0@GRUB_DEFAULT=2@" /etc/default/grub update-grub2 efibootmgr -v baremetal keepalive # baremetal upload-output shutdown -r now ;; "2") # upgrade to testing echo "after installing tboot" > output/$bootcount/comment echo deb http://deb.debian.org/debian/ testing main > /etc/apt/sources.list apt update baremetal keepalive apt-get -y --download-only dist-upgrade baremetal keepalive env APT_LISTCHANGES_FRONTEND=none DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef" dist-upgrade -q -y --allow-downgrades --allow-remove-essential --allow-change-held-packages baremetal keepalive baremetal upload-output shutdown -r now ;; "3") # upgrade to unstable echo "after upgrading to debian testing" > output/$bootcount/comment echo deb http://deb.debian.org/debian/ unstable main > /etc/apt/sources.list apt update baremetal keepalive apt-get -y --download-only dist-upgrade baremetal keepalive echo "grub-pc grub-pc/install_devices string /dev/sda" | debconf-set-selections env APT_LISTCHANGES_FRONTEND=none DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef" dist-upgrade -q -y --allow-downgrades --allow-remove-essential --allow-change-held-packages baremetal keepalive baremetal upload-output shutdown -r now ;; "4") # upgrade to experimental echo "after upgrading to debian unstable" > output/$bootcount/comment echo deb http://deb.debian.org/debian/ experimental main >> /etc/apt/sources.list apt update baremetal keepalive apt-get -y -t experimental install linux-image-amd64 baremetal keepalive baremetal upload-output shutdown -r now ;; "5") # build tboot from mercurial echo "after upgrading kernel from experimental" > output/$bootcount/comment echo deb-src http://deb.debian.org/debian/ unstable main >> /etc/apt/sources.list apt update apt -y install mercurial build-essential apt-get -y build-dep tboot # test patch cp -av acm/* /boot wget -O grub.tar https://lindi.iki.fi/lindi/tboot/grub.tar tar xvf grub.tar dpkg -iO grub*.deb hg clone http://hg.code.sf.net/p/tboot/code tboot-code cd tboot-code wget -O Use_multiboot2_module_load_preference_tag.patch https://sourceforge.net/p/tboot/mailman/attachment/31ae0c949efdc5698b075920af53c63f1cd1ce83.camel%40hawrylko.pl/2/ patch -p1 < Use_multiboot2_module_load_preference_tag.patch rm Use_multiboot2_module_load_preference_tag.patch make if [ ! -e tboot/tboot.gz ]; then baremetal keepalive baremetal upload-output baremetal exit 1 fi update-grub2 cp tboot/tboot.gz /boot echo "tboot hg:$(hg identify | cut -d' ' -f1)" > /boot/tboot.gz.hg baremetal keepalive baremetal upload-output shutdown -r now ;; # "6") # # install intel-acm # echo "after building tboot from mercurial" > output/$bootcount/comment # echo deb http://deb.debian.org/debian/ unstable main contrib non-free > /etc/apt/sources.list # apt update # apt-get -y install intel-acm # modprobe msr # for i in /boot/*SINIT* /boot/*sinit*; do # tboot-code/utils/txt-acminfo "$i" # done # update-grub2 # baremetal keepalive # baremetal upload-output # shutdown -r now # ;; "6") # test S3 echo "after building tboot from mercurial" > output/$bootcount/comment baremetal keepalive baremetal upload-output baremetal exit 0 ;; # "7") # echo "after S5" > output/$bootcount/comment # baremetal keepalive # baremetal upload-output # # baremetal schedule_poweron 30 # # date # # time rtcwake --mode mem --seconds 60 # # date # # baremetal keepalive # # baremetal upload-output # baremetal exit 0 # ;; # "7") # # exit # #echo "after installing intel-acm" > output/$bootcount/comment # echo "after S5 and RTC wakeup" > output/$bootcount/comment # if [ ! -e tboot.deb ]; then # baremetal keepalive # baremetal upload-output # baremetal exit 0 # fi # apt -y install ./tboot.deb # baremetal keepalive # baremetal upload-output # shutdown -r now # ;; # "8") # echo "after installing unreleased tboot.deb" > output/$bootcount/comment # baremetal upload-output # baremetal exit 0 # ;; esac # todo: test from mercurial # todo: test intel-acm package # todo: test predict-pcr # todo: test: txt-acminfo