blob: 03dc64e45887ec9377378164ba16c2009dbad9f6 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
{{- $machineRole := default "host" (index . "machineRole") -}}
{{- if eq $machineRole "host" -}}
#!/usr/bin/env dash
# Deploy system-level configs from etc/ to /etc/.
# chezmoi re-runs this script whenever any file under etc/ changes.
# etc/ content hash: {{ output "sh" "-c" (printf "cd %q && find etc -type f ! -name .ignore -exec sha256sum {} + | LC_ALL=C sort" .chezmoi.sourceDir) | sha256sum }}
# luks root uuid: {{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}
set -eu
cd "$CHEZMOI_SOURCE_DIR"
if [ -f etc/kernel/uki.conf ]; then
systemd_version=$(pacman -Q systemd | awk '{ print $2 }')
ukify_version=$(pacman -Q systemd-ukify | awk '{ print $2 }')
if [ "$systemd_version" != "$ukify_version" ] || ! command -v ukify >/dev/null 2>&1; then
echo 'Install a systemd-ukify version that matches systemd before deploying NvPCR support.' >&2
exit 1
fi
if ! command -v sbverify >/dev/null 2>&1; then
echo 'Install sbsigntools before deploying NvPCR support.' >&2
exit 1
fi
if ! sudo test -s /etc/systemd/tpm2-pcr-private-key.pem ||
! sudo test -s /etc/systemd/tpm2-pcr-public-key.pem ||
! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/etc.tar ||
! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened.efi ||
! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened-fallback.efi ||
! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts.efi ||
! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts-fallback.efi ||
! sudo test -s /boot/EFI/Linux/arch-linux-hardened.efi ||
! sudo sbverify --cert /var/lib/sbctl/keys/db/db.pem \
/boot/EFI/Linux/arch-linux-hardened.efi >/dev/null 2>&1; then
echo 'Check the PCR key pair, root-only backup, and signed main UKI. See docs/tpm-unlock.md.' >&2
exit 1
fi
if [ "$(sudo stat -c %U:%G:%a /etc/systemd/tpm2-pcr-private-key.pem)" != root:root:600 ] ||
! sudo openssl pkey -in /etc/systemd/tpm2-pcr-private-key.pem -pubout 2>/dev/null |
sudo cmp -s /etc/systemd/tpm2-pcr-public-key.pem -; then
echo 'The root-owned PCR signing key pair is invalid or has unsafe permissions.' >&2
exit 1
fi
if sudo test -e /var/lib/dotfiles/tpm-nvpcr/rollback; then
echo 'NvPCR rollback is active. Restore the previous repo revision before applying.' >&2
exit 1
fi
fi
find etc -type f ! -name .ignore | while IFS= read -r src; do
case "$src" in
*.tmpl)
dest="/${src%.tmpl}"
tmp=$(mktemp)
chezmoi execute-template <"$src" >"$tmp"
sudo install -D -m 0644 -o root -g root "$tmp" "$dest"
rm -f "$tmp"
;;
etc/sudoers-rs)
sudo install -D -m 0440 -o root -g root "$src" "/${src}"
;;
etc/systemd/system-sleep/*)
sudo install -D -m 0755 -o root -g root "$src" "/${src}"
;;
etc/initcpio/install/*)
sudo install -D -m 0755 -o root -g root "$src" "/${src}"
;;
*)
sudo install -D -m 0644 -o root -g root "$src" "/${src}"
;;
esac
done
if [ -d etc/udev/rules.d ]; then
sudo udevadm control --reload
sudo udevadm trigger --subsystem-match=usb
sudo udevadm trigger --subsystem-match=hidraw
fi
# sudo-rs: /etc/pam.d/sudo-i is a symlink to /etc/pam.d/sudo
sudo ln -sfT sudo /etc/pam.d/sudo-i
# Pick up changes to repo-managed systemd units and drop-ins under /etc.
sudo systemctl daemon-reload
# Reload systemd-logind so changes under /etc/systemd/logind.conf.d/
# (e.g. HandlePowerKey overrides) take effect without dropping sessions.
sudo systemctl kill -s HUP systemd-logind
{{- else -}}
#!/usr/bin/env dash
# /etc deployment is host-only.
set -eu
exit 0
{{- end }}
|
