1#!/bin/bash 2# Copyright 2023 The ChromiumOS Authors 3# Use of this source code is governed by a BSD-style license that can be 4# found in the LICENSE file. 5 6# Script to replace the recovery key with a newly generated one. See usage(). 7 8# Load common constants and variables. 9# shellcheck source=common.sh 10. "$(dirname "$0")/common.sh" 11 12# Abort on errors. 13set -e 14 15usage() { 16 cat <<EOF 17Usage: $0 <keyset directory> 18 19Creates a new recovery_key (incl. dependent kernel data keys) and renames the 20old one to recovery_key.v1. This is useful when we want to prevent units 21fabricated in the future from booting current recovery or factory shim images, 22but still want future recovery and factory shim images to be able to run on 23both new units and those that had already been shipped with the old recovery 24key. 25EOF 26} 27 28# The key versions for recovery keys and dependent kernel data keys are unused, 29# since there is no rollback protection for them. Set the new key versions to 2 30# so that they can be easily told apart from the old keys (which would have been 31# built with version 1) when reading them from a device. 32# 33# (Note that for miniOS kernels, the kernel version *is* used for rollback 34# protection, but the kernel key version is not, so we are free to do this. 35# Kernel versions are set at kernel signing time, so they don't matter here.) 36VERSION="2" 37 38# Backup the key and its associated files. 39backup_key() { 40 local key="$1" 41 local ext 42 for ext in "vbpubk" "vbprivk"; do 43 mv "${key}_data_key.${ext}" "${key}_data_key.old.v1.${ext}" 44 done 45 mv "${key}.keyblock" "${key}.old.v1.keyblock" 46} 47 48# Whether this keyset supports minios. 49minios_supported() { 50 [[ -e minios_kernel.keyblock ]] 51} 52 53main() { 54 local ext 55 56 KEY_DIR=$1 57 58 if [ $# -ne 1 ]; then 59 usage 60 exit 1 61 fi 62 63 cd "${KEY_DIR}" 64 65 if [[ -e "recovery_key.v1.vbpubk" ]] || [[ -e "recovery_key.v1.vbprivk" ]]; then 66 die "recovery_key.v1 already exists!" 67 fi 68 69 info "Moving old recovery key to recovery_key.v1." 70 71 for ext in "vbpubk" "vbprivk"; do 72 mv "recovery_key.${ext}" "recovery_key.v1.${ext}" 73 done 74 75 info "Backing up old kernel data keys (no longer needed) as XXX.old.v1.YYY." 76 77 backup_key recovery_kernel 78 backup_key installer_kernel 79 if minios_supported; then 80 backup_key minios_kernel 81 fi 82 83 info "Creating new recovery key." 84 85 make_pair recovery_key "${RECOVERY_KEY_ALGOID}" "${VERSION}" 86 87 info "Creating new recovery, minios and installer kernel data keys." 88 89 make_pair recovery_kernel_data_key "${RECOVERY_KERNEL_ALGOID}" "${VERSION}" 90 make_pair installer_kernel_data_key "${INSTALLER_KERNEL_ALGOID}" "${VERSION}" 91 if minios_supported; then 92 make_pair minios_kernel_data_key "${MINIOS_KERNEL_ALGOID}" "${VERSION}" 93 fi 94 95 info "Creating new keyblocks signed with new recovery key." 96 97 make_keyblock recovery_kernel "${RECOVERY_KERNEL_KEYBLOCK_MODE}" recovery_kernel_data_key recovery_key 98 make_keyblock installer_kernel "${INSTALLER_KERNEL_KEYBLOCK_MODE}" installer_kernel_data_key recovery_key 99 if minios_supported; then 100 make_keyblock minios_kernel "${MINIOS_KERNEL_KEYBLOCK_MODE}" \ 101 minios_kernel_data_key recovery_key 102 fi 103 104 info "Creating secondary XXX.v1.keyblocks signing new kernel data keys with old recovery key." 105 106 make_keyblock recovery_kernel.v1 "${RECOVERY_KERNEL_KEYBLOCK_MODE}" recovery_kernel_data_key recovery_key.v1 107 make_keyblock installer_kernel.v1 "${INSTALLER_KERNEL_KEYBLOCK_MODE}" installer_kernel_data_key recovery_key.v1 108 if minios_supported; then 109 make_keyblock minios_kernel.v1 "${MINIOS_KERNEL_KEYBLOCK_MODE}" \ 110 minios_kernel_data_key recovery_key.v1 111 fi 112 113 info "All done." 114} 115 116main "$@" 117