blob: 0c4ea43f4be2c3100e7e2e3c0672fc1bde0dd352 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
"""Remove only the old NvPCR masks owned by this repository."""
import hashlib
import os
from pathlib import Path
MASKS = [
*(
Path(f"/etc/nvpcr/{name}.nvpcr")
for name in ("cryptsetup", "hardware", "login", "verity")
),
Path("/etc/systemd/system/systemd-pcrlogin@.service"),
Path("/etc/systemd/system/systemd-pcrproduct.service"),
]
DROPIN = Path("/etc/mkinitcpio.conf.d/60-no-nvpcr.conf")
DROPIN_SHA256 = "69a242f865bbd1adee85f168f19e0f4e5b94a78b3d65e5dfa976c5e0f76deea4"
RECOVERY = Path("/boot/EFI/Linux/arch-linux-hardened-nvpcr-recovery.efi")
BACKUP = Path("/var/lib/dotfiles/tpm-nvpcr/backup")
def validate(paths: list[Path]) -> list[Path]:
removable = []
for path in paths:
if not path.exists() and not path.is_symlink():
continue
if not path.is_file() or path.is_symlink():
raise ValueError(f"Expected a regular file: {path}")
data = path.read_bytes()
if path == DROPIN:
if hashlib.sha256(data).hexdigest() != DROPIN_SHA256:
raise ValueError(f"Old mkinitcpio drop-in was changed: {path}")
elif data:
raise ValueError(f"NvPCR mask is not empty: {path}")
removable.append(path)
return removable
def main() -> None:
if os.geteuid() != 0 or Path("/etc/hostname").read_text().strip() != "halley2":
raise ValueError("Run as root on Halley2")
if not RECOVERY.is_file() or not BACKUP.is_dir():
raise ValueError("Recovery image and backup must exist before removing masks")
removable = validate([*MASKS, DROPIN])
for path in removable:
path.unlink()
print(f"removed: {path}")
if __name__ == "__main__":
try:
main()
except (OSError, ValueError) as exc:
raise SystemExit(f"NvPCR unmask failed: {exc}") from exc
|
