mk_certs

#!/bin/bash
#
# Copyright (c) 2020, Advanced Micro Devices, Inc. All rights reserved.
#
# Use of this software is subject to the terms and conditions of the written
# software license agreement between you and AMD (the "License"),
# including, without limitation, the following (as further elaborated in the
# License):  (i) THIS SOFTWARE IS PROVIDED "AS IS", AND AMD DISCLAIMS
# ANY AND ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY,
# BY CONDUCT, OR OTHERWISE; (ii) this software may be used only in connection
# with the integrated circuit product and storage software with which it was
# designed to be used; (iii) this source code is the confidential information
# of AMD and may not be disclosed to any third party; and (iv) you may not
# make any modification or take any action that would cause this software,
# or any other Advanced Micro Devices software, to fall under any GPL license
# or any other open source license.
#
# Script to create local machine signing certificate for use with AMD RAID
# and Secure Boot when rebuilding the rcraid.ko module after initial OS install.
#
SIGN_TOOL=$1
RCMODULE=$2
RCCERT=$3
KVERS=$4
sha_arr="SHA512 SHA256"
config_file="/boot/config-$KVERS"
SIGNFAIL="0"

if [ ! -e $config_file ]; then
    echo "#"
    echo "# Config file does not exist for the specified kernel."
    echo "# Using config file of running kernel"
    echo "#"
    config_file="/boot/config-$(uname -r)"
fi

if [ `id -u` -ne 0 ]; then
    echo "#"
    echo "# ERROR:"
    echo "#"
    echo "# Signing certificates must be created as root."
    echo "# Please rerun last command as root."
    echo "#"
    exit 1;
fi

if [ ! -d "$RCCERT" ]; then
    mkdir -pm 0700 $RCCERT
fi

if [ ! -f $RCCERT/x509.genkey ]; then
    echo "[ req ]" > $RCCERT/x509.genkey
    echo "default_bits = 4096" >> $RCCERT/x509.genkey
    echo "distinguished_name = req_distinguished_name" >> $RCCERT/x509.genkey
    echo "prompt = no" >> $RCCERT/x509.genkey
    echo "string_mask = utf8only" >> $RCCERT/x509.genkey
    echo "x509_extensions = myexts" >> $RCCERT/x509.genkey
    echo "" >> $RCCERT/x509.genkey
    echo "[ req_distinguished_name ]" >> $RCCERT/x509.genkey
    echo "O = Local Machine Owner" >> $RCCERT/x509.genkey
    echo "CN = Build time autogenerated module signing key for rcraid module" >> $RCCERT/x509.genkey
    echo "emailAddress = root@localhost" >> $RCCERT/x509.genkey
    echo "" >> $RCCERT/x509.genkey
    echo "[ myexts ]" >> $RCCERT/x509.genkey
    echo "basicConstraints=critical,CA:FALSE" >> $RCCERT/x509.genkey
    echo "keyUsage=digitalSignature" >> $RCCERT/x509.genkey
    echo "subjectKeyIdentifier=hash" >> $RCCERT/x509.genkey
    echo "authorityKeyIdentifier=keyid" >> $RCCERT/x509.genkey
fi

if [ ! -f $RCCERT/module_signing_key.der ]; then
    echo "#"
    echo "# When prompted for 'Password', please enter a"
    echo "# password to be used when installing signing"
    echo "# certificate. Do NOT use login password or root"
    echo "# password!"
    echo "#"
    echo "# You may be prompted to enter this password the"
    echo "# next time your system reboots in order to enroll"
    echo "# the signing certificate in the BIOS key table."
    echo "#"
    openssl req -new -x509 -batch -config $RCCERT/x509.genkey \
	-outform DEV -keyout $RCCERT/module_signing_key.priv \
	-out $RCCERT/module_signing_key.der -days 3650 -nodes -sha256

    if [ $? -ne 0 ]; then
	echo "Key Generation Failed"
	/usr/bin/rm $RCCERT/module_signing_key.der
    else
    	mokutil --import $RCCERT/module_signing_key.der
    	if [ $? -ne 0 ]; then
		echo "Import key Failed"
    	fi
    fi
fi
if [ -f $RCMODULE ]; then
    echo "$sha_arr" | tr ' ' '\n' | while read i; do
        if grep -xq "CONFIG_CRYPTO_$i=y" $config_file; then
            SHA=$(echo "$i" | tr '[:upper:]' '[:lower:]')
            echo "Chosen "$SHA" for signing"
	    if [ -f "/usr/src/linux-headers-$KVERS/scripts/sign-file" ]; then
		SIGN_TOOL=/usr/src/linux-headers-$KVERS/scripts/sign-file
	    elif [ -f "/target/usr/src/linux-headers-$KVERS/scripts/sign-file" ]; then
		SIGN_TOOL=/target/usr/src/linux-headers-$KVERS/scripts/sign-file
	    elif [ -f "/usr/lib/modules/$KVERS/build/scripts/sign-file" ]; then
		SIGN_TOOL=/usr/lib/modules/$KVERS/build/scripts/sign-file
	    fi
            $SIGN_TOOL $SHA $RCCERT/module_signing_key.priv $RCCERT/module_signing_key.der $RCMODULE
            if [ $? -ne 0 ]; then
                echo "#"
                echo "# ERROR:"
                echo "#"
                echo "# Signing certificate ../certs/module_signing_key.der does not exist!"
                echo "# Module NOT signed -- installing unsigned module will cause reboot to fail!"
                echo "#"
            else
                echo "Signing $RCMODULE Success"
                SIGNFAIL="1"
            fi
            break
        fi
    done
	if [ "$SIGNFAIL" = "0" ]; then
	   echo "RETRYING WITH sha256"
	   if [ -f "/usr/src/linux-headers-$KVERS/scripts/sign-file" ]; then
	       SIGN_TOOL=/usr/src/linux-headers-$KVERS/scripts/sign-file
	   elif [ -f "/target/usr/src/linux-headers-$KVERS/scripts/sign-file" ]; then
	       SIGN_TOOL=/target/usr/src/linux-headers-$KVERS/scripts/sign-file
	   elif [ -f "/usr/lib/modules/$KVERS/build/scripts/sign-file" ]; then
	       SIGN_TOOL=/usr/lib/modules/$KVERS/build/scripts/sign-file
	   fi
	   $SIGN_TOOL sha256 $RCCERT/module_signing_key.priv $RCCERT/module_signing_key.der $RCMODULE
	   if [ $? -ne 0 ]; then
                echo "#"
                echo "# RETRY ERROR:"
                echo "#"
                echo "# Signing certificate ../certs/module_signing_key.der does not exist!"
                echo "# Module NOT signed -- installing unsigned module will cause reboot to fail!"
                echo "#"
        else
                echo "RETRY Signing $RCMODULE Success"
        fi
	fi
else
	echo "FAILED in Signing Module $RCMODULE Not Present"
fi
exit 0