genasys-config

Manual Changes

Bind LUKS volume to TPM

# For each root disk
doas clevis luks bind -d /dev/... tpm2 '{"pcr_bank":"sha256","pcr_ids":"7,15"}'

Make sure to do this for all root disks after configuring secure boot keys and before booting into the new slot, otherwise the PCR values may not be correct.

Generate PAM U2F mappings

# For first mapping
pamu2fcfg -i "pam://$(hostname)" >generate/files/etc/u2f_mappings
# For subsequent mappings
pamu2fcfg -i "pam://$(hostname)" -n >>generate/files/etc/u2f_mappings

Note that the /etc/pam.d/doas patch must contain the same pam://<hostname> entry.

Generate & install secure boot keys

Ensure the UEFI has been configured to "Setup Mode" for installing keys.

# Add temporary dependencies
doas apk add efi-mkkeys sbsigntool

# Create a directory & backup existing EFI vars
mkdir backup/
for var in PK KEK db dbx; do
    efi-readvar -v $var -o backup/$var-orig.esl
done

# In the directory where the keys should be stored
efi-mkkeys -s 'Galen Abell' -o .
for key in *.key; do
    mv $key $key.enc
    sops -i -e $key.enc
done

# Create temporary directory for installing keys
mkdir -p efi/db efi/KEK efi/PK
cp db.auth efi/db/
cp KEK.auth efi/KEK/
cp PK.auth efi/PK/

# Verify installation
doas sbkeysync --keystore ./efi --pk --dry-run --verbose

# Enroll keys
doas sbkeysync --keystore ./efi --verbose
doas sbkeysync --keystore ./efi --verbose --pk

# If sbkeysync returns write errors, try chattr
chattr -i /sys/firmware/efi/efivars/db*
chattr -i /sys/firmware/efi/efivars/KEK*
chattr -i /sys/firmware/efi/efivars/PK*

# If sbkeysync returns permission denied for PK.auth, manually write it
doas efi-updatevar -f ./efi/PK.auth PK