sbu-generate-user-keys.sh.in

#!/usr/bin/env bash

usage () {
	local old_xtrace
	old_xtrace="$(shopt -po xtrace || :)"
	set +o xtrace
	{
		echo "${script_name} - Generate user keys for EFI secure boot."
		echo "Usage: ${script_name} [flags]"
		echo "Option flags:"
		echo "  -f --force        - Overwrite existing keys."
		echo "  -o --out-dir      - Output directory. Default: '${out_dir}'."
		echo "  -s --cert-subject - Certificate subject. Default: '${cert_subject}'."
		echo "  -l --key-length   - Key length. Default: '${key_length}'."
		echo "  -h --help         - Show this help and exit."
		echo "  -v --verbose      - Verbose execution."
		echo "  -g --debug        - Extra verbose execution."
		echo 'Common X.509 Subject Attributes:'
		echo '  CN  = Common Name'
		echo '  O   = Organization'
		echo '  OU  = Organizational Unit'
		echo '  L   = Locality'
		echo '  S   = State or Province Name'
		echo '  C   = Country Name'
		echo '  UID = User ID'
		echo "Info:"
		echo '  @PACKAGE_NAME@ v@PACKAGE_VERSION@'
		echo '  @PACKAGE_URL@'
		echo "  Send bug reports to: Geoff Levand <geoff@infradead.org>."
	} >&2
	eval "${old_xtrace}"
}

process_opts() {
	local short_opts="fo:s:l:hvg"
	local long_opts="force,out-dir:,cert-subject:,key-length:,help,verbose,debug"

	local opts
	opts=$(getopt --options ${short_opts} --long ${long_opts} -n "${script_name}" -- "$@")

	eval set -- "${opts}"

	while true ; do
		# echo "${FUNCNAME[0]}: (${#}) '${*}'"
		case "${1}" in
		-f | --force)
			force=1
			shift
			;;
		-o | --out-dir)
			out_dir="${2}"
			shift 2
			;;
		-s | --cert-subject)
			cert_subject="${2}"
			shift 2
			;;
		-l | --key-length)
			key_length="${2}"
			shift 2
			;;
		-h | --help)
			usage=1
			shift
			;;
		-v | --verbose)
			verbose=1
			shift
			;;
		-g | --debug)
			verbose=1
			debug=1
			set -x
			shift
			;;
		--)
			shift
			extra_args="${*}"
			break
			;;
		*)
			echo "${script_name}: ERROR: Internal opts: '${*}'" >&2
			exit 1
			;;
		esac
	done
}

generate_user_keys() {
	local owner_id="${1}"
	local subject="${2}"
	local key_len="${3}"
	local keys_dir="${4}"
	local log_file="${5}"

	mkdir -p "${keys_dir}"
	{
		local key
		for key in pk kek mok db; do
			local keys_prefix="${keys_dir}/${key}"

			local sub
			sub="${subject//@key-name@/${key^^}-KEY}"

			"${openssl}" req -new -x509 -newkey rsa:2048 \
				-days 730 -nodes -sha256 \
				-subj "${sub}" \
				-keyout "${keys_prefix}_key.pem" \
				-out "${keys_prefix}_cert.pem" 2>&1

			"${openssl}" x509 \
				-inform PEM \
				-in "${keys_prefix}_cert.pem" \
				-outform DER \
				-out "${keys_prefix}_cert.der" 2>&1
		done
		echo ''

	} | tee --append "${log_file}"
}

generate_keystore() {
	local owner_id="${1}"
	local keys_dir="${2}"
	local keystore_dir="${3}"
	local log_file="${4}"

	mkdir -p "${keystore_dir}"

	declare -A efi_vars=(
		[pk]="PK"
		[kek]="KEK"
		[db]="db"
	)

	declare -A efi_parent_key=(
		[pk]="pk"
		[kek]="pk"
		[db]="kek"
	)

	{
		local key
		for key in pk kek mok db; do
			local keys_prefix="${keys_dir}/${key}"

			if [[ ${efi_vars[${key}]:-} ]]; then
				local keystore_out="${keystore_dir}/${efi_vars[${key}]}"
				local keystore_prefix="${keystore_out}/${key}"
				local parent_prefix="${keys_dir}/${efi_parent_key[${key}]}"

				mkdir -p "${keystore_out}"

				cp -v "${keys_prefix}_cert.pem" "${keystore_out}/"
				cp -v "${keys_prefix}_cert.der" "${keystore_out}/"

				"${cert_to_sig_list}" -g "${owner_id}" \
					"${keys_prefix}_cert.pem" \
					"${keystore_prefix}_efi.esl" 2>&1

				"${sign_sig_list}" -g "${owner_id}" \
					-c "${parent_prefix}_cert.pem" \
					-k "${parent_prefix}_key.pem" \
					"${efi_vars[${key}]}" \
					"${keystore_prefix}_efi.esl" \
					"${keystore_prefix}_efi.auth" 2>&1
			fi
			echo ''
		done
	} | tee --append "${log_file}"
}

print_header() {
	local owner_id="${1}"
	local subject="${2}"
	local key_len="${3}"
	local log_file="${4}"

	{
		echo "Generated by ${script_name}"
		echo '@PACKAGE_NAME@ v@PACKAGE_VERSION@'
		echo '@PACKAGE_URL@'
		echo "${start_time}"
		echo ''
		echo "Owner ID = '${owner_id}'"
		echo "Key Subject = '${subject}'"
		echo "Key Length = ${key_len}"
		echo ''
		echo 'PK = Platform Key'
		echo 'KEK = Key Exchange Key'
		echo 'MOK = Machine Owner Key'
		echo 'DB = Whitelist Database Key'
		echo ''
	} >&1
}

print_key_summary() {
	local owner_id="${1}"
	local subject="${2}"
	local key_len="${3}"
	local keys_dir="${4}"
	local keystore_dir="${5}"
	local log_file="${6}"

	{
		echo '======================================================='
		echo 'Key Summary'
		echo '======================================================='
		echo ''

		print_header "${owner_id}" "${subject}" "${key_len}" "${log_file}"

		local key
		for key in pk kek mok db; do
			local keys_prefix="${keys_dir}/${key}"

			echo '============='
			echo "${key^^} key info:"
			echo '============='
			print_cert_pem "${keys_prefix}_cert.pem"
			echo ''
		done

		echo 'key md5sums:'
		"${md5sum}" $(find "${keys_dir}" -type f -name '*.der' -o -name '*.pem' | sort)
		echo ''
		echo 'keystore md5sums:'
		"${md5sum}" $(find "${keystore_dir}" -type f -name '*.esl' -o -name '*.auth' | sort)
		echo ''

		echo '======================================================='
	} | tee --append "${log_file}"
}

#===============================================================================
export PS4='\[\e[0;33m\]+ ${BASH_SOURCE##*/}:${LINENO}:(${FUNCNAME[0]:-main}):\[\e[0m\] '

script_name="${0##*/}"
base_name="${script_name##*/%}"
base_name="${base_name%.sh*}"

real_source="$(realpath "${BASH_SOURCE}")"
SCRIPT_TOP="$(realpath "${SCRIPT_TOP:-${real_source%/*}}")"

start_time="$(date +%Y.%m.%d-%H.%M.%S)"
SECONDS=0

trap "on_exit 'Failed'" EXIT
trap 'on_err ${FUNCNAME[0]:-main} ${LINENO} ${?}' ERR
set -eE
set -o pipefail
set -o nounset

source "${SCRIPT_TOP}/sbu-lib.sh"
source "${SCRIPT_TOP}/tdd-lib/util.sh"

force=''
out_dir="/tmp/${base_name}-${start_time}"
cert_subject="/CN=@key-name@/UID=${start_time}/OU=Boot Keys/O=Secure Boot Utils"
key_length="2048"
usage=''
verbose=''
debug=''

process_opts "${@}"

if [[ ${usage} ]]; then
	usage
	trap - EXIT
	exit 0
fi

if [[ ${extra_args} ]]; then
	set +o xtrace
	echo "${script_name}: ERROR: Got extra args: '${extra_args}'" >&2
	usage
	exit 1
fi

md5sum=${md5sum:-"md5sum"}
openssl=${openssl:-"openssl"}
uuidgen=${uuidgen:-"uuidgen"}
cert_to_sig_list=${cert_to_sig_list:-"cert-to-efi-sig-list"}
sign_sig_list=${sign_sig_list:-"sign-efi-sig-list"}

if ! check_progs "${md5sum} ${openssl} ${uuidgen} ${cert_to_sig_list} ${sign_sig_list}"; then
	exit 1
fi

if [[ -d "${out_dir}" ]]; then
	if [[ ! ${force} ]]; then
		echo "${script_name}: ERROR: Output directory '${out_dir}' exists.  Will not overwrite." >&2
		usage
		exit 1
	else
		bak_dir="${out_dir}-${start_time}"
		mv "${out_dir}" "${bak_dir}"
		{
			echo "${script_name}: INFO: Old keys saved to '${bak_dir}'."
			echo ''
		} >&2
	fi
fi

mkdir -p "${out_dir}"

owner_id="$(${uuidgen} --random)"
printf "${owner_id}" > "${out_dir}/sbu-keys.owner-id"

keys_dir="${out_dir}/keys"
keystore_dir="${out_dir}/efi-keystore"
log_file="${out_dir}/sbu-keys.log"

generate_user_keys "${owner_id}" "${cert_subject}" "${key_length}" "${keys_dir}" "${log_file}"
generate_keystore "${owner_id}" "${keys_dir}" "${keystore_dir}" "${log_file}"

print_key_summary "${owner_id}" "${cert_subject}" "${key_length}" "${keys_dir}" \
	"${keystore_dir}" "${log_file}"

echo "INFO: Generated keys in '${out_dir}'" >&2

trap "on_exit 'Success.'" EXIT
exit 0