Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Add notification for secure boot key check #1661

Open
wants to merge 27 commits into
base: main
Choose a base branch
from
+74 −1
Open

feat: Add notification for secure boot key check #1661

Show file tree
Hide file tree
Changes from 23 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
62e779b
feat: Add notification for secure boot key check
jardon Sep 9, 2024
4219f50
Squash: refactor to single script for motd and notify-send
jardon Sep 11, 2024
4da13af
Add quoting
jardon Sep 11, 2024
b75477f
Reverse conditional
jardon Sep 11, 2024
30c1aac
Fix grouping during quoting
jardon Sep 11, 2024
0cfbfc2
Check for file before deletion
jardon Sep 11, 2024
cfccc33
Add ~ for newline sub
jardon Sep 11, 2024
64f8a61
Clean up notify command formatting
jardon Sep 11, 2024
6517ab3
Remove fq paths to some bins
jardon Sep 11, 2024
8c3985d
Add secure boot check
jardon Sep 11, 2024
196aaa2
Add back ~ in message
jardon Sep 11, 2024
5b93743
Move motd warning outside of tips
jardon Sep 12, 2024
391e55e
Fix motd script errors
jardon Sep 12, 2024
8a49652
Bold motd warning header
jardon Sep 12, 2024
aad5db4
Fix double quoting on XDG var
jardon Sep 12, 2024
9709836
check for loginctl changes
jardon Sep 12, 2024
b2f921c
Fix linting
jardon Sep 12, 2024
1bf0a3c
Merge branch 'main' into key-dbus-notify
bsherman Sep 13, 2024
f8c31f2
Rework script check syntax
jardon Sep 13, 2024
1cc6160
Update sb key warning file location
jardon Sep 13, 2024
880d75d
Split up checking to check for sb enabled first
jardon Sep 13, 2024
edd7750
Fix json mode arg format
jardon Sep 13, 2024
3efe8f1
Merge branch 'main' into key-dbus-notify
bsherman Sep 14, 2024
87ddcf2
Rework notification to not be sent from systemd service
jardon Sep 15, 2024
bc88dc3
Update systemd service description
jardon Sep 15, 2024
306bab3
Fix execute permissions
jardon Sep 18, 2024
dbc8a65
Fix linting and update script perm
jardon Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions build_files/systemd.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,4 @@ systemctl enable brew-upgrade.timer
systemctl enable brew-update.timer
systemctl --global enable ublue-user-setup.service
systemctl --global enable podman-auto-update.timer
systemctl enable sb-key-notify.service
2 changes: 2 additions & 0 deletions system_files/kinoite/usr/share/ublue-os/motd/bluefin.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,5 @@ Let's trace the stars.
- 󰊤 [Issues](https://issues.projectbluefin.io)
- 󰈙 [Documentation](http://docs.projectbluefin.io/)
- 󰊌 [Discuss](https://community.projectbluefin.io/)

%KEY_WARN%
12 changes: 12 additions & 0 deletions system_files/shared/usr/lib/systemd/system/sb-key-notify.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[Unit]
Description=Service to check for secure boot key enrollment and send notifications

[Service]
ExecStart=/usr/libexec/sb-key-notify.sh

[Install]
WantedBy=multi-user.target

[Timer]
jardon marked this conversation as resolved.
Show resolved Hide resolved
OnBootSec=1min
OnUnitActiveSec=3h
40 changes: 40 additions & 0 deletions system_files/shared/usr/libexec/sb-key-notify.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
#!/bin/bash

if [ "$(id -u)" -ne 0 ]; then
echo "This script must be run as root." >&2
exit 1
fi

WARNING_MSG="This machine has secure boot turned on, but you haven't enrolled Universal Blue's keys. Failing to enroll these before rebooting **may cause your system to fail to boot**. Follow this link https://docs.projectbluefin.io/introduction#secure-boot ~for instructions on how to enroll the keys."
KEY_WARN_FILE="/run/user-motd-sbkey-warn.md"
KEY_DER_FILE="/etc/pki/akmods/certs/akmods-ublue.der"

mokutil --sb-state | grep -q enabled
SB_ENABLED=$?

if [ $SB_ENABLED -ne 0 ]; then
echo "Secure Boot disabled. Skipping..."
exit 0
fi

if mokutil --test-key "$KEY_DER_FILE"; then
if loginctl --help | grep -q "json=MODE"; then
JSON_ARG="--json=short"
fi
USER_ID=$(loginctl list-users --output=json ${JSON_ARG:+$JSON_ARG} | jq -r '.[] | .user')
XDG_DIR=$(loginctl show-user "$USER_ID" | grep RuntimePath | cut -c 13-)
sudo -u "$USER_ID" \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sudo notify-send doesn't work when run from a root systemd service as setup here.

You can test this in a VM by writing the script to /usr/local/sbin/sb-key-notify.sh and the service to /etc/systemd/system/sb-key-notify.service and make sure you change the path for the script in the service file..

Then, systemctl daemon-reload and systemctl enable sb-key-notify ... reboot and/or simply systemctl start sb-key-notify... nothing happens.

I haven't dug deep into why this fails, but there's a more direct approach which is more what I meant to suggest when I suggested a service.

What I'd do is keep all the testing for if secure boot is enabled and if the key is enrolled or not in a script like this... but the script would be sbkey-missing-check.sh or something... and if the conditions warrant a notification, write a file to /run/sbkey-missing-notify.

Then we need this notify-send command NOT with the sudo, to run as the user, and that should get setup with a profile.d/skel combo of script and .desktop file, similar to how we do for the bluefin-firstboot feature.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious why it doesnt work for you. I've tested it in my environment and it works great. Could you check the output of the service?

I had things more split up beforehand. I'm open to seeing what that looks like to implement it using a desktop file, but I'm a little puzzled how we got here.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

more specificially:

bash -x /path/to/script

Copy link
Contributor

@bsherman bsherman Sep 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious why it doesnt work for you. I've tested it in my environment and it works great. Could you check the output of the service?

I set this up again on Bluefin:GTS (like i referenced in my comment on the Timer section). My sb-key-notify.service is installed in /etc and the sb-key-notify.sh is in /usr/local/sbin

I did see the notification popup when running systemctl start sb-key-notify on this setup, however... upon a reboot.

This is the output from the service:

 journalctl --boot -u sb-key-notify
Sep 15 13:07:53 fedora systemd[1]: Started sb-key-notify.service - Service to check for secure boot key enrollment and send notifications.
Sep 15 13:07:53 fedora sb-key-notify.sh[2952]: /etc/pki/akmods/certs/akmods-ublue.der is not enrolled
Sep 15 13:07:53 fedora loginctl[3023]: Failed to look up user : No such process
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]: usage: sudo -h | -K | -k | -V
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]: usage: sudo -v [-ABkNnS] [-g group] [-h host] [-p prompt] [-u user]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]: usage: sudo -l [-ABkNnS] [-g group] [-h host] [-p prompt] [-U user]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]:             [-u user] [command [arg ...]]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]: usage: sudo [-ABbEHkNnPS] [-r role] [-t type] [-C num] [-D directory]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]:             [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]:             [-u user] [VAR=value] [-i | -s] [command [arg ...]]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]: usage: sudo -e [-ABkNnS] [-r role] [-t type] [-C num] [-D directory]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]:             [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
Sep 15 13:07:53 fedora sb-key-notify.sh[3051]:             [-u user] file ...
Sep 15 13:07:53 fedora systemd[1]: sb-key-notify.service: Deactivated successfully.

Edit: for the record, i get the same behavior when testing on bluefin:stable (Fedora 40)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

more context:

❯ systemctl cat sb-key-notify.service 
# /etc/systemd/system/sb-key-notify.service
[Unit]
Description=Service to check for secure boot key enrollment and send notifications

[Service]
ExecStart=/usr/local/sbin/sb-key-notify.sh

[Install]
WantedBy=multi-user.target

[Timer]
OnBootSec=1min
OnUnitActiveSec=3h

# /usr/lib/systemd/system/service.d/10-timeout-abort.conf
# This file is part of the systemd package.
# See https://fedoraproject.org/wiki/Changes/Shorter_Shutdown_Timer.
#
# To facilitate debugging when a service fails to stop cleanly,
# TimeoutStopFailureMode=abort is set to "crash" services that fail to stop in
# the time allotted. This will cause the service to be terminated with SIGABRT
# and a coredump to be generated.
#
# To undo this configuration change, create a mask file:
#   sudo mkdir -p /etc/systemd/system/service.d
#   sudo ln -sv /dev/null /etc/systemd/system/service.d/10-timeout-abort.conf

[Service]
TimeoutStopFailureMode=abort

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you post the output of bash -x /usr/local/sbin/sb-key-notify.sh, please?

I can, and I will, but I've told you your script works, I do get a notification if running systemctl start sb-key-notify while already logged in.

The problem is notification from the script upon a boot. I'm not sure if you missed where i showed journal output with the failure.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

root in ~ 
❯ bash -x /usr/local/sbin/sb-key-notify.sh
++ id -u
+ '[' 0 -ne 0 ']'
+ WARNING_MSG='This machine has secure boot turned on, but you haven'\''t enrolled Universal Blue'\''s keys. Failing to enroll these before rebooting **may cause your system to fail to boot**. Follow this link https://docs.projectbluefin.io/introduction#secure-boot ~for instructions on how to enroll the keys.'
+ KEY_WARN_FILE=/run/user-motd-sbkey-warn.md
+ KEY_DER_FILE=/etc/pki/akmods/certs/akmods-ublue.der
+ mokutil --sb-state
+ grep -q enabled
+ SB_ENABLED=0
+ '[' 0 -ne 0 ']'
+ mokutil --test-key /etc/pki/akmods/certs/akmods-ublue.der
/etc/pki/akmods/certs/akmods-ublue.der is not enrolled
+ loginctl --help
+ grep -q json=MODE
++ loginctl list-users --output=json
++ jq -r '.[] | .user'
+ USER_ID=bsherman
++ loginctl show-user bsherman
++ grep RuntimePath
++ cut -c 13-
+ XDG_DIR=/run/user/1000
++ echo 'This machine has secure boot turned on, but you haven'\''t enrolled Universal Blue'\''s keys. Failing to enroll these before rebooting **may cause your system to fail to boot**. Follow this link https://docs.projectbluefin.io/introduction#secure-boot ~for instructions on how to enroll the keys.'
++ tr -d '*~'
+ sudo -u bsherman DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus notify-send WARNING 'This machine has secure boot turned on, but you haven'\''t enrolled Universal Blue'\''s keys. Failing to enroll these before rebooting may cause your system to fail to boot. Follow this link https://docs.projectbluefin.io/introduction#secure-boot for instructions on how to enroll the keys.' -i dialog-warning -u critical -a mokutil --wait
+ echo '**WARNING**: This machine has secure boot turned on, but you haven'\''t enrolled Universal Blue'\''s keys. Failing to enroll these before rebooting **may cause your system to fail to boot**. Follow this link https://docs.projectbluefin.io/introduction#secure-boot ~for instructions on how to enroll the keys.'

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh i misunderstood. ya so on boot, there is no user logged in so loginctl doesn't list a user to pass to the sudo command. ill look into another solution then

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh i misunderstood. ya so on boot, there is no user logged in so loginctl doesn't list a user to pass to the sudo command. ill look into another solution then

yes, sorry it wasn't more clear.

Copy link
Contributor

@bsherman bsherman Sep 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh i misunderstood. ya so on boot, there is no user logged in so loginctl doesn't list a user to pass to the sudo command. ill look into another solution then

This is why I proposed writing a state file from the service, and then having the user's login process (eg, autostart .desktop file) look for that file and run the notification. Then it would work for ANY user who logs in.

"DISPLAY=:0" \
"DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_DIR/bus" \
notify-send \
"WARNING" \
"$(echo "$WARNING_MSG" | tr -d '*~')" \
-i dialog-warning \
-u critical \
-a mokutil \
--wait

echo "**WARNING**: $WARNING_MSG" > $KEY_WARN_FILE
else
[ -e $KEY_WARN_FILE ] && rm $KEY_WARN_FILE
fi
11 changes: 10 additions & 1 deletion system_files/shared/usr/libexec/ublue-motd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,5 +24,14 @@ if [[ -f "$TIP_FILE" ]]; then

TIP_ESCAPED=$(escape "$TIP")

sed -e "s/%IMAGE_NAME%/$IMAGE_NAME_ESCAPED/g" -e "s/%IMAGE_TAG%/$IMAGE_TAG_ESCAPED/g" -e "s/%TIP%/$TIP_ESCAPED/g" /usr/share/ublue-os/motd/bluefin.md | tr '~' '\n' | /usr/bin/glow -s auto -w 78 -
fi

KEY_WARN_FILE="/run/user-motd-sbkey-warn.md"
[ -e $KEY_WARN_FILE ] && KEY_WARN="$(cat $KEY_WARN_FILE)"
KEY_WARN_ESCAPED=$(escape "$KEY_WARN")

sed -e "s/%IMAGE_NAME%/$IMAGE_NAME_ESCAPED/g" \
-e "s/%IMAGE_TAG%/$IMAGE_TAG_ESCAPED/g" \
-e "s/%TIP%/$TIP_ESCAPED/g" \
-e "s/%KEY_WARN%/$KEY_WARN_ESCAPED/g" \
/usr/share/ublue-os/motd/bluefin.md | tr '~' '\n' | /usr/bin/glow -s auto -w 78 -
2 changes: 2 additions & 0 deletions system_files/silverblue/usr/share/ublue-os/motd/bluefin.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,5 @@
- 󰈙 [Documentation](http://docs.projectbluefin.io/)
- 󰊌 [Discuss](https://community.projectbluefin.io/)
- 󰊌 [Leave Feedback](https://feedback.projectbluefin.io)

%KEY_WARN%
Loading