Skip to content

Draft: Add experimental sysupdate image with secure boot

Valentin David requested to merge valentindavid/secure-boot-sysupdate into master

This is the previous approach not using sysext for devel tree. Please see !2220 (merged) instead

Depends on:

Building and running a VM

To test you need qemu-system-x86_64, swtpm, bst2:

./utils/run-secure-vm.sh

Updating with sysupdate

If you want to reset the VM with a fresh image, use --reset. If you want to clear the TPM and the secure boot keys, use --reset-secure-state.

In order to test and update:

./utils/run-sysupdate-repo.sh

This will rebuild a new version and service through HTTP. In the VM type:

sudo /usr/lib/systemd/systemd-sysupdate update

Then reboot.

You can call run-sysupdate-repo.sh with --same-version if you do not want to bump the version and rebuild.

On bare-metal

Set your machine with secure boot, but in "setup mode". When the systemd-boot menu appears, sometimes the keys are not enrolled automatically. If it shows in the menu an option to enroll keys, choose that option before running.

If you want to use sysupdate, edit files in files/sysupdate/*.conf to change the address to point to the machine you will serve the updates from.

Switching to development tree

  • Run run-sysupdate-repo.sh with --devel (and eventually also --user).
  • In a console type sudo /usr/lib/systemd/systemd-sysupdate --component=devel
  • It will find a candidate, for example su-devel-l.2.
  • Run sudo /usr/lib/systemd/systemd-sysupdate --component=devel update su-devel-l.2
  • Reboot, select the right boot entry.

After a successful boot, you can set it as the default boot with sudo bootctl set-default gnomeos_su-devel-l.2.efi. Note that this does not work before a successful boot due to naming scheme for counting boot tries.

Note, for now we use a component to provide sysupdate definitions. It might be the wrong way. We can change it to use --definitions=<path> instead.

Non-secure boot

It is possible to run run-sysupdate-repo.sh with --notpm to test without TPM2 device.

In order to disable the secure boot, in the systemd-boot menu, select Reboot Into Firmware Interface. Then select Device Manager, Secure Boot Configuration. And deselect Attempt Secure Boot. Exit and continue.

Expected behavior:

  • Secure boot + TPM2: Encryption
  • Secure boot + no TPM2: Failure
  • No secure boot + TPM2: No encryption (TPM2 ignored) (We could enable encryption)
  • No secure boot + no TPM2: No encryption

Discoverable Disk Image

systemd-dissect output gives:

      Name: disk.img
      Size: 10.5G

OS Release: NAME=GNOME OS
            VERSION=Nightly
            VERSION_ID=Nightly
            ID=org.gnome.gnomeos
            PRETTY_NAME=GNOME OS (Nightly)
            BUG_REPORT_URL=https://gitlab.gnome.org/GNOME/gnome-build-meta/-/issues/new
            HOME_URL=https://www.gnome.org/
            VARIANT=User (sysupdate)
            VARIANT_ID=su-user
            IMAGE_VERSION=l.1
            IMAGE_ID=user
            DEFAULT_HOSTNAME=gnomeos

    Use As: ✓ bootable system for UEFI
            ✓ bootable system for container
            ✗ portable service
            ✗ extension for system
            ✗ extension for initrd
            ✗ extension for portable service

RW DESIGNATOR PARTITION UUID                       PARTITION LABEL           FSTYPE         ARCHITECTURE VERITY GROWFS NODE          PARTNO
ro usr        cdf7145a-57ab-8da5-6bc1-f754cc485881 gnomeos_usr_su-user-l.1   squashfs       x86-64       no         no /dev/loop11p2 2
rw esp        e7edaab9-5aee-57c8-95bd-dbcaf44d138d efi                       vfat           -            -          no /dev/loop11p1 1
ro usr-verity 43f8e6c4-320f-b2d9-b472-f288dba8133e gnomeos_usr_v_su-user-l.1 DM_verity_hash x86-64       -          no /dev/loop11p3 3
Edited by Valentin David

Merge request reports