Add TPM 2.0 support

90anti-evil-maid/anti-evil-maid-unseal

@@ -17,6 +17,14 @@ LUKS_PCR=13
 PLYMOUTH_MESSAGES=()
 
 plymouth_message() {
+    if [ "${#PLYMOUTH_MESSAGES[@]}" -eq 0 ]; then
+        # add vertical "padding" to avoid printing messages over plymouth's
+        # prompt help
+        plymouth message --text=""
+        plymouth message --text=""
+        plymouth message --text=""
+    fi
+
     plymouth message --text="$*"
     PLYMOUTH_MESSAGES+=("$*")
 }
@@ -111,7 +119,7 @@ done
 mkdir -p "$CACHE_DIR"
 echo "${LABEL##"$LABEL_PREFIX"}" >"$SUFFIX_CACHE"
 
-Z=$(tpm_z_srk)
+Z=$(tpmzsrk)
 
 if [ -n "$Z" ]; then
     true >"$SRK_PASSWORD_CACHE"
@@ -134,7 +142,8 @@ fi
 # check freshness token
 
 log "Unsealing freshness token..."
-if tpmunsealdata "$Z" "$SEALED_SECRET_FRE" "$UNSEALED_SECRET"; then
+if tpmunsealdata "$Z" "$SEALED_SECRET_FRE" "$UNSEALED_SECRET" \
+                 "$TPM_DIR/$LABEL"; then
     log "Freshness token unsealed."
     true >"$CACHE_DIR/unseal-success"
 else
@@ -164,7 +173,8 @@ fi
 
 if otp; then
     log "Unsealing TOTP shared secret seed..."
-    if tpmunsealdata "$Z" "$SEALED_SECRET_OTP" "$UNSEALED_SECRET"; then
+    if tpmunsealdata "$Z" "$SEALED_SECRET_OTP" "$UNSEALED_SECRET" \
+                     "$TPM_DIR/$LABEL"; then
         log "TOTP secret unsealed."
 
         message ""
@@ -188,7 +198,8 @@ if otp; then
         } &
         totp_loop_pid=$!
 
-        if tpmunsealdata "$Z" "$SEALED_SECRET_KEY" "$UNSEALED_SECRET"; then
+        if tpmunsealdata "$Z" "$SEALED_SECRET_KEY" "$UNSEALED_SECRET" \
+                         "$TPM_DIR/$LABEL"; then
             for _ in 1 2 3; do
                 pass=$(systemd-ask-password --timeout=0 \
                        'LUKS key file password (or "t" to show text secret)')
@@ -222,7 +233,8 @@ fi
 
 if ! otp; then
     log "Unsealing text secret..."
-    if tpmunsealdata "$Z" "$SEALED_SECRET_TXT" "$UNSEALED_SECRET"; then
+    if tpmunsealdata "$Z" "$SEALED_SECRET_TXT" "$UNSEALED_SECRET" \
+                     "$TPM_DIR/$LABEL"; then
         {
             message ""
             message "$(cat "$UNSEALED_SECRET" 2>/dev/null)"

90anti-evil-maid/module-setup.sh

@@ -43,16 +43,18 @@ install() {
         sort \
         tail \
         tcsd \
-        tcsd_changer_identify \
+        trousers_changer_identify \
         tee \
         tpm_id \
+        tpm2_id \
         tpm_nvinfo \
         tpm_nvread \
         tpm_nvread_stdout \
         tpm_pcr_extend \
         tpm_sealdata \
         tpm_unsealdata \
         tpm_z_srk \
+        tpm2_z_srk \
         tr \
         uniq \
         wc \
@@ -66,7 +68,6 @@ install() {
         tpm2_create \
         tpm2_createprimary \
         tpm2_evictcontrol \
-        tpm2_encryptdecrypt \
         tpm2_flushcontext \
         tpm2_load \
         tpm2_nvdefine \
@@ -80,6 +81,11 @@ install() {
         tpm2_policycommandcode \
         tpm2_startauthsession \
         tpm2_unseal
+    # other utilities
+    dracut_install \
+        mktemp \
+        openssl \
+        sha256sum
     # such tpm2-tss libraries must be listed explicitly because they are
     # discovered at runtime instead of being linked to during build
     dracut_install \

anti-evil-maid.spec.in

@@ -8,7 +8,7 @@ Requires:	trousers-changer >= 4.0.0
 Requires:	systemd >= 227
 Requires:	coreutils >= 8.25-2
 Requires:	scrypt qrencode oathtool
-Requires:	tpm2-tools
+Requires:	tpm2-tools openssl
 Requires(post):	dracut grub2-tools tboot systemd
 Obsoletes:	anti-evil-maid-dracut
 Vendor:		Invisible Things Lab
@@ -45,6 +45,7 @@ cp -r systemd $RPM_BUILD_ROOT/usr/lib
 /usr/sbin/anti-evil-maid-install
 /usr/sbin/anti-evil-maid-lib
 /usr/sbin/anti-evil-maid-lib-tpm1
+/usr/sbin/anti-evil-maid-lib-tpm2
 /usr/sbin/anti-evil-maid-seal
 /usr/sbin/anti-evil-maid-tpm-setup
 /usr/share/doc/anti-evil-maid/README

sbin/anti-evil-maid-install

@@ -1,5 +1,6 @@
 #!/bin/bash
 set -euo pipefail
+shopt -s expand_aliases
 . anti-evil-maid-lib
 LABEL_SUFFIX_CHARS=0-9a-zA-Z=.-
 BOOT_DIR=/boot

sbin/anti-evil-maid-lib

@@ -174,6 +174,7 @@ removable() {
 }
 
 validatetpm() {
+    # makes sure TPM is there and can be used, determines TPM version
     if [ ! -d "$SYSFS_TPM_DIR" ]; then
         message "$SYSFS_TPM_DIR isn't present"
         return 1
@@ -184,13 +185,19 @@ validatetpm() {
         message "Failed to determine the version of the TPM"
         return 1
     fi
+
+    if [ "$_tpm_version" -eq 1 ]; then
+        # shellcheck source=../sbin/anti-evil-maid-lib-tpm1
+        source /sbin/anti-evil-maid-lib-tpm1
+        return 0
+    fi
+
     if [ "$_tpm_version" -eq 2 ]; then
-        message "TPM 2.0 detected. TPM 2.0 is currently unsupported"
-        message "Note: some TPM 2.0 devices can be configured to act as TPM 1.2"
-        return 1
+        # shellcheck source=../sbin/anti-evil-maid-lib-tpm2
+        source /sbin/anti-evil-maid-lib-tpm2
+        return 0
     fi
 
-    # shellcheck source=../sbin/anti-evil-maid-lib-tpm1
-    source /sbin/anti-evil-maid-lib-tpm1
-    return 0
+    message "Unexpected TPM version: $_tpm_version"
+    return 1
 }

sbin/anti-evil-maid-lib-tpm1

@@ -1,3 +1,11 @@
+tpmid() {
+    tpm_id
+}
+
+tpmzsrk() {
+    tpm_z_srk
+}
+
 checktpmnvram() {
     # checks whether the TPM NVRAM area is defined
     # NOTE: tpm_nvinfo does not return non-zero if requested index
@@ -156,9 +164,16 @@ tpmpcrextend() {
     tpm_pcr_extend "$_pcr" "$_hash"
 }
 
+tpmsealprepare() {
+    # does necessary preparations before the use of tpmsealdata, accepts path
+    # to media-specific storage of sealed data
+    true # nothing to do for TPM1
+}
+
 tpmsealdata() {
     # seals source specified by second argument into destination specified by
-    # the third one, non-empty first argument signifies empty SRK password
+    # the third one, non-empty first argument signifies empty SRK password, the
+    # forth argument specifies path to AEM media-specific storage
     _nosrkpass=()
     if [ -n "$1" ]; then
         _nosrkpass=( -z )
@@ -172,7 +187,8 @@ tpmsealdata() {
 
 tpmunsealdata() {
     # unseals source specified by second argument into destination specified by
-    # the third one, non-empty first argument signifies empty SRK password
+    # the third one, non-empty first argument signifies empty SRK password, the
+    # forth argument specifies path to AEM media-specific storage
     _nosrkpass=()
     if [ -n "$1" ]; then
         _nosrkpass=( -z )
@@ -210,7 +226,7 @@ tpmstartservices() {
 }
 
 tpmstartinitrdservices() {
-    tcsd_changer_identify
+    trousers_changer_identify
     # it forks
     tcsd
 }