New EncryptionMethod using fde-tools for TPM-based unlocking #1363
Conversation
ancorgs
force-pushed
the
tpm_master
branch
6 times, most recently
from
4923764 to
3edb1c9
Compare
ancorgs
force-pushed
the
tpm_master
branch
2 times, most recently
from
aab4a57 to
8cf27f0
Compare
ancorgs
changed the title
| false | ||
| end | ||
|
|
||
| alias_method :tpm_present?, :tpm_present |
There was a problem hiding this comment.
NP: why not to directly call it #tpm_present?
There was a problem hiding this comment.
No strong reason. I just wanted to have the method names equivalent to the fdectl commands (obviously turning hyphens into underscores). Since the fdectl subcommands are tpm-present, add-secondary-password and add-secondary-key...
| # | ||
| # This is only ever needed if the available packages might have changed | ||
| # since the last use of this class. | ||
| def self.drop_cache |
There was a problem hiding this comment.
NP: maybe this could be moved to the base class.
|
Just for the records: failing tests on leap is expected. Changes in this PR require a new version of libstorage-ng which is not submitted to leap (only to Tumbleweed). In general, running unit tests on leap for the master branch is useless. Note that SLE-15-SPX branches have already diverged. |
|
❌ Internal Jenkins job #1142 failed |
|
✔️ Internal Jenkins job #1143 successfully finished |
Problem
Both ALP and openSUSE Tumbleweed include a package called
fde-toolsthat allow to setup encrypted devices (using LUKS2) to be automatically unlocked during boot without user intervention based on information stored and validated in the TPM of the system.The process has its limitations but it certainly works as proven by the preliminary (and rather hacky) support present at Agama. So it's time to move that support from Agama to the core of YaST.
Some more-or-less related links
Solution
This introduces a new encryption method (
TPM_FDE) in yast2-storage-ng. Thus, TPM unlocking based on fde-tools can be configured by both AutoYaST and Agama.For more information about the process, check the fde-tools documentation.
If the system meets all the technical requirements to use the new method, it will be used by Agama. In that regard, check below the associated pull request.
Even if the mentioned technical requirements are met, the new method will still not be available in YaST. There are several reasons for that:
Associated pull requests
agama-project/agama#826
Testing
Unit tests included.
Tested manually in Agama with fde-tools 0.7.1 in several situations:
Review
Pull request structured in several meaningful commit for easier review.