Skip to content

Commit 1336dcf

Browse files
derenvderenv
authored
Merge pull request #14 from derenv/nokeys
added correct checks+output if no keys are present
2 parents 38a0872 + 29e9d08 commit 1336dcf

File tree

2 files changed

+134
-115
lines changed

2 files changed

+134
-115
lines changed

‎bash-kernel-signer.sh‎

Lines changed: 132 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -123,69 +123,79 @@ function purge_kernel()
123123

124124
# Search for kernels
125125
mapfile -t kernels < <( find "$kernel_location" -name "vmlinuz-*" | sort -n )
126-
unsigned_kernels=()
127-
valid_signed_kernels=()
128-
invalid_signed_kernels=()
129-
valid_validity_checks=()
130-
invalid_validity_checks=()
131126

132-
# For each detected kernel
133-
for unvalidated_kernel in "${kernels[@]}"; do
134-
# Validate kernel signatures
135-
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
127+
# Only verify keys if keys exist
128+
if [[ "$valid_keys" == "True" ]]; then
129+
unsigned_kernels=()
130+
valid_signed_kernels=()
131+
invalid_signed_kernels=()
132+
valid_validity_checks=()
133+
invalid_validity_checks=()
134+
135+
# For each detected kernel
136+
for unvalidated_kernel in "${kernels[@]}"; do
137+
# Validate kernel signatures
138+
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
139+
140+
# Increment signed/unsigned kernels
141+
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
142+
# Add to valid signed kernels
143+
valid_signed_kernels+=("$unvalidated_kernel")
144+
valid_validity_checks+=("${validity_check[0]}")
145+
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
146+
# Add to invalid signed kernels
147+
invalid_signed_kernels+=("$unvalidated_kernel")
148+
invalid_validity_checks+=("${validity_check[0]}")
149+
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
150+
# Add to unsinged kernels
151+
unsigned_kernels+=("$unvalidated_kernel")
152+
else
153+
# SOME UNKNOWN ERROR?
154+
echo "??error??"
155+
fi
156+
done
136157

137-
# Increment signed/unsigned kernels
138-
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
139-
# Add to valid signed kernels
140-
valid_signed_kernels+=("$unvalidated_kernel")
141-
valid_validity_checks+=("${validity_check[0]}")
142-
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
143-
# Add to invalid signed kernels
144-
invalid_signed_kernels+=("$unvalidated_kernel")
145-
invalid_validity_checks+=("${validity_check[0]}")
146-
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
147-
# Add to unsinged kernels
148-
unsigned_kernels+=("$unvalidated_kernel")
158+
# Print all kernels
159+
declare -i counter
160+
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
161+
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
162+
echo " -none-"
149163
else
150-
# SOME UNKNOWN ERROR?
151-
echo "??error??"
164+
for kernel in "${unsigned_kernels[@]}"; do
165+
echo " $kernel"
166+
done
167+
fi
168+
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
169+
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
170+
echo " -none-"
171+
else
172+
counter=0
173+
for kernel in "${valid_signed_kernels[@]}"; do
174+
id=$(( "$counter" + 1 ))
175+
echo " $id - $kernel"
176+
echo " -> ${valid_validity_checks[$counter]}"
177+
(( counter++ ))
178+
done
179+
fi
180+
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
181+
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
182+
echo " -none-"
183+
else
184+
counter=0
185+
for kernel in "${invalid_signed_kernels[@]}"; do
186+
echo " $kernel"
187+
echo " -> ${invalid_validity_checks[$counter]}"
188+
(( counter++ ))
189+
done
152190
fi
153-
done
154-
155-
# Print all kernels
156-
declare -i counter
157-
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
158-
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
159-
echo " -none-"
160-
else
161-
for kernel in "${unsigned_kernels[@]}"; do
162-
echo " $kernel"
163-
done
164-
fi
165-
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
166-
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
167-
echo " -none-"
168-
else
169-
counter=0
170-
for kernel in "${valid_signed_kernels[@]}"; do
171-
id=$(( "$counter" + 1 ))
172-
echo " $id - $kernel"
173-
echo " -> ${valid_validity_checks[$counter]}"
174-
(( counter++ ))
175-
done
176-
fi
177-
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
178-
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
179-
echo " -none-"
180191
else
181-
counter=0
182-
for kernel in "${invalid_signed_kernels[@]}"; do
192+
echo " Kernels Present: ${#kernels[@]}"
193+
for kernel in "${kernels[@]}"; do
183194
echo " $kernel"
184-
echo " -> ${invalid_validity_checks[$counter]}"
185-
(( counter++ ))
186195
done
187-
fi
188196

197+
echo "Signature Database key and/or certificate not detected.."
198+
fi
189199
echo "=============================================="
190200
echo "$prev_out"
191201
echo "=============================================="
@@ -195,6 +205,8 @@ function purge_kernel()
195205
if [[ "$user_input" == "0" ]]; then
196206
ERROR_MSG="cancelled.."
197207
return 1
208+
elif [[ ! "$valid_keys" == "True" ]]; then
209+
prev_out="missing/invalid keys, cannot check kernels.."
198210
elif [[ "$user_input" =~ ^[0-9]+$ ]] && test "$user_input" -le "${#valid_signed_kernels[@]}"; then
199211
# Purge signed kernel
200212
selection=$(( user_input - 1 ))
@@ -321,71 +333,78 @@ while [[ "$stop" == "False" ]]; do
321333

322334
# Search for kernels
323335
mapfile -t kernels < <( find "$kernel_location" -name "vmlinuz-*" | sort -n )
324-
unsigned_kernels=()
325-
valid_signed_kernels=()
326-
invalid_signed_kernels=()
327-
valid_validity_checks=()
328-
invalid_validity_checks=()
329-
330-
# For each detected kernel
331-
for unvalidated_kernel in "${kernels[@]}"; do
332-
# Validate kernel signatures
333-
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
334-
335-
# Increment signed/unsigned kernels
336-
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
337-
# Add to valid signed kernels
338-
valid_signed_kernels+=("$unvalidated_kernel")
339-
valid_validity_checks+=("${validity_check[0]}")
340-
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
341-
# Add to invalid signed kernels
342-
invalid_signed_kernels+=("$unvalidated_kernel")
343-
invalid_validity_checks+=("${validity_check[0]}")
344-
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
345-
# Add to unsiged kernels
346-
unsigned_kernels+=("$unvalidated_kernel")
336+
337+
# Only verify keys if keys exist
338+
if [[ "$valid_keys" == "True" ]]; then
339+
unsigned_kernels=()
340+
valid_signed_kernels=()
341+
invalid_signed_kernels=()
342+
valid_validity_checks=()
343+
invalid_validity_checks=()
344+
345+
# For each detected kernel
346+
for unvalidated_kernel in "${kernels[@]}"; do
347+
# Validate kernel signatures
348+
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
349+
350+
# Increment signed/unsigned kernels
351+
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
352+
# Add to valid signed kernels
353+
valid_signed_kernels+=("$unvalidated_kernel")
354+
valid_validity_checks+=("${validity_check[0]}")
355+
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
356+
# Add to invalid signed kernels
357+
invalid_signed_kernels+=("$unvalidated_kernel")
358+
invalid_validity_checks+=("${validity_check[0]}")
359+
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
360+
# Add to unsiged kernels
361+
unsigned_kernels+=("$unvalidated_kernel")
362+
else
363+
# SOME UNKNOWN ERROR?
364+
echo "??error??"
365+
fi
366+
done
367+
368+
# Print all kernels
369+
declare -i counter
370+
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
371+
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
372+
echo " -none-"
347373
else
348-
# SOME UNKNOWN ERROR?
349-
echo "??error??"
374+
for kernel in "${unsigned_kernels[@]}"; do
375+
echo " $kernel"
376+
done
377+
fi
378+
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
379+
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
380+
echo " -none-"
381+
else
382+
counter=0
383+
for kernel in "${valid_signed_kernels[@]}"; do
384+
echo " $kernel"
385+
echo " -> ${valid_validity_checks[$counter]}"
386+
(( counter++ ))
387+
done
388+
fi
389+
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
390+
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
391+
echo " -none-"
392+
else
393+
counter=0
394+
for kernel in "${invalid_signed_kernels[@]}"; do
395+
echo " $kernel"
396+
echo " -> ${invalid_validity_checks[$counter]}"
397+
(( counter++ ))
398+
done
350399
fi
351-
done
352400

353-
# Print all kernels
354-
declare -i counter
355-
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
356-
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
357-
echo " -none-"
358-
else
359-
for kernel in "${unsigned_kernels[@]}"; do
360-
echo " $kernel"
361-
done
362-
fi
363-
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
364-
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
365-
echo " -none-"
366-
else
367-
counter=0
368-
for kernel in "${valid_signed_kernels[@]}"; do
369-
echo " $kernel"
370-
echo " -> ${valid_validity_checks[$counter]}"
371-
(( counter++ ))
372-
done
373-
fi
374-
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
375-
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
376-
echo " -none-"
401+
echo "Signature Database key & certificate detected.."
377402
else
378-
counter=0
379-
for kernel in "${invalid_signed_kernels[@]}"; do
403+
echo " Kernels Present: ${#kernels[@]}"
404+
for kernel in "${kernels[@]}"; do
380405
echo " $kernel"
381-
echo " -> ${invalid_validity_checks[$counter]}"
382-
(( counter++ ))
383406
done
384-
fi
385407

386-
if [[ "$valid_keys" == "True" ]]; then
387-
echo "Signature Database key & certificate detected.."
388-
else
389408
echo "Signature Database key and/or certificate not detected.."
390409
fi
391410
echo "=============================================="

‎keylocations.cfg‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
key_location="/etc/efikeys/db.key"
2-
cert_location="/etc/efikeys/db.crt"
1+
key_location=""
2+
cert_location=""
33
kernel_location="/boot"

0 commit comments

Comments
 (0)