-
Notifications
You must be signed in to change notification settings - Fork 458
/
security_state.go
136 lines (112 loc) · 3.47 KB
/
security_state.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
package runtime
import (
"bytes"
"context"
"crypto/sha256"
"crypto/x509"
"encoding/hex"
"encoding/pem"
"errors"
"fmt"
"os"
"strings"
"github.com/cosi-project/runtime/pkg/controller"
"github.com/cosi-project/runtime/pkg/safe"
"github.com/cosi-project/runtime/pkg/state"
"github.com/foxboron/go-uefi/efi"
"go.uber.org/zap"
machineruntime "github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
"github.com/siderolabs/talos/pkg/machinery/constants"
runtimeres "github.com/siderolabs/talos/pkg/machinery/resources/runtime"
"github.com/siderolabs/talos/pkg/machinery/resources/v1alpha1"
)
// SecurityStateController is a controller that updates the security state of Talos.
type SecurityStateController struct {
V1Alpha1Mode machineruntime.Mode
}
// Name implements controller.Controller interface.
func (ctrl *SecurityStateController) Name() string {
return "runtime.SecurityStateController"
}
// Inputs implements controller.Controller interface.
func (ctrl *SecurityStateController) Inputs() []controller.Input {
return []controller.Input{
{
Namespace: v1alpha1.NamespaceName,
Type: v1alpha1.ServiceType,
Kind: controller.OutputExclusive,
},
}
}
// Outputs implements controller.Controller interface.
func (ctrl *SecurityStateController) Outputs() []controller.Output {
return []controller.Output{
{
Type: runtimeres.SecurityStateType,
Kind: controller.OutputExclusive,
},
}
}
// Run implements controller.Controller interface.
//
//nolint:gocyclo
func (ctrl *SecurityStateController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
for {
select {
case <-ctx.Done():
return nil
case <-r.EventCh():
}
// wait for the `machined` service to start, as by that time initial mounts will be done
_, err := safe.ReaderGetByID[*v1alpha1.Service](ctx, r, "machined")
if err != nil {
if state.IsNotFoundError(err) {
continue
}
return fmt.Errorf("failed to get machined state: %w", err)
}
var (
secureBootState bool
pcrSigningKeyFingerprint string
)
// in container mode, never populate the fields
if ctrl.V1Alpha1Mode != machineruntime.ModeContainer {
if efi.GetSecureBoot() && !efi.GetSetupMode() {
secureBootState = true
}
if pcrPublicKeyData, err := os.ReadFile(constants.PCRPublicKey); err == nil {
block, _ := pem.Decode(pcrPublicKeyData)
if block == nil {
return errors.New("failed to decode PEM block for PCR public key")
}
cert := x509.Certificate{
Raw: block.Bytes,
}
pcrSigningKeyFingerprint = x509CertFingerprint(cert)
}
}
if err := safe.WriterModify(ctx, r, runtimeres.NewSecurityStateSpec(runtimeres.NamespaceName), func(state *runtimeres.SecurityState) error {
state.TypedSpec().SecureBoot = secureBootState
state.TypedSpec().PCRSigningKeyFingerprint = pcrSigningKeyFingerprint
return nil
}); err != nil {
return err
}
// terminating the controller here, as we need to only populate securitystate once
return nil
}
}
func x509CertFingerprint(cert x509.Certificate) string {
hash := sha256.Sum256(cert.Raw)
var buf bytes.Buffer
for i, b := range hex.EncodeToString(hash[:]) {
if i > 0 && i%2 == 0 {
buf.WriteByte(':')
}
buf.WriteString(strings.ToUpper(string(b)))
}
return buf.String()
}