WIP: Add TCG Opal disk unlock support - #2196
Conversation
Add a kernel-ioctl-backed helper and an immutable gate before every normal, basic, or network boot script. Unlock each locked TCG Opal disk as Admin1. Keep credentials out of arguments, the environment, and production Bash variables. Retain them only in anonymous file descriptors until every disk is ready so failures can relock earlier disks before recovery. Optionally compile in coreboot's OPAL S3 APMC v1 service, and fail closed if setup or rollback cannot be completed. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Overlay deterministic prompt and disk backends for the pre-boot unlock gate, retries, failure rollback, S3 handoff requests, post-unlock verification, and secret transport without requiring an emulated Opal device. Run the host fixture and build the QEMU board in CI. QEMU covers the Heads control flow; production OPAL ioctls, NVMe security commands, SMI handling, and S3 resume remain hardware-only paths. Signed-off-by: Sean Rhodes <sean@starlabs.systems>
| $(INSTALL)/include/linux/limits.h \ | ||
| $(build)/$(musl-cross-make_dir)/.build | ||
| @mkdir -p "$(dir $@)" | ||
| $(heads_cc) -Os -Wall -Wextra -Werror \ |
There was a problem hiding this comment.
Can this be built with Oz?
There was a problem hiding this comment.
Ideally, this would be into a modules/* where this project evolves on its own?
tlaurion
left a comment
tlaurion
left a comment
There was a problem hiding this comment.
First quick review, will try to review thoroughly in the next days.
Will also need to update threat model, TCG had its bypasses before, so "trusting trust" kinda issues here
|
Having a hard time figuring out when/where the user types passphrase and attestation done prior of such here. What is the workflow? Will need to repro if not supported on qemu (won't) on real hardware myself somehow to understand it more clearly outside of theoritically.
|
2 participants
Summary
The prompt completes before the backend starts. Heads opens and unlinks its mode-0600 password file before passing the anonymous file descriptor to the C helper, so credentials are not placed in command arguments, the environment, or a production Bash variable. Credential buffers and anonymous storage are cleared after use.
If a later disk, status check, or S3 handoff fails, Heads relocks disks already unlocked during that attempt. A rollback failure powers off instead of exposing an unlocked disk through recovery.
Functional validation
The host fixture exercised no-device and already-unlocked paths, successful unlock, wrong-password retry and exhaustion, cancellation, prompt failure after producing output, empty and oversized input, backend and S3 pre/post-unlock failures, rollback failure, malformed scan output, multiple disks, partial multi-disk rollback, post-unlock verification, and argv/environment/path secret checks.
The exact committed QEMU ROM completed the overlaid mock scan, mocked unlock and S3 handoff, confirmed the unlocked state, and entered
detect_boot_devicein that order. The fixture password and linked-password-file failure marker were absent from serial output.QEMU does not emulate a TCG Opal device or the coreboot SMM service. Production OPAL ioctls, NVMe Security Receive, physical-address lookup, SMI handling, and S3 resume remain hardware validation. This PR remains Draft for that reason.
Board requirements
Production boards must use Linux 6.1 or later and enable
CONFIG_BLK_SED_OPAL=y. Boards selectingCONFIG_HEADS_OPAL_S3_APMC_V1=ymust also enableCONFIG_PROC_PAGE_MONITOR=yand run coreboot with the ABI merged through coreboot change 91045.