diff options
author | Eddie James <eajames@us.ibm.com> | 2018-02-09 20:59:18 +0300 |
---|---|---|
committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2018-03-30 20:31:20 +0300 |
commit | b2b7ff6804d128602d7db998c7b20be6821f9118 (patch) | |
tree | 6fcec77dcd2a094b43233614d33d221a352c9d30 /meta-phosphor/common/recipes-phosphor/flash | |
parent | 3b0639b35ec269e8b9fdd3635a1212206b456fb9 (diff) | |
download | openbmc-b2b7ff6804d128602d7db998c7b20be6821f9118.tar.xz |
Add image signing framework and open keys
In order to secure the BMC, we need to sign all the images and include a
public key in the package with which to verify future update images.
This commit adds a framework to sign the image files with an open
private key and generates a corresponding public key added to the image.
This isn't secure by itself (since the private key is available), but
additional changes can easily provide their own private key, creating a
secure BMC.
To use a secure private key:
export BB_ENV_EXTRAWHITE="$BB_ENV_EXTRAWHITE SIGNING_KEY"
SIGNING_KEY=/path/to/secure/key bitbake obmc-phosphor-image
Resolves openbmc/openbmc#2835
Resolves openbmc/openbmc#2836
Resolves openbmc/openbmc#2837
Change-Id: I28919b7de54e3a32e5efcbb4522fb39731e68384
Signed-off-by: Eddie James <eajames@us.ibm.com>
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'meta-phosphor/common/recipes-phosphor/flash')
3 files changed, 60 insertions, 0 deletions
diff --git a/meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv b/meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv new file mode 100644 index 000000000..223d31809 --- /dev/null +++ b/meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv @@ -0,0 +1,16 @@ +-----BEGIN PRIVATE KEY----- +MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAPvSDLu6slkP1gri +PaeQXL9ysD69J/HjbBCIQ0RPfeWBb75US1tRTjPP0Ub8CtH8ExVf8iF1ulsZA78B +zIjBYZVp9pyD6LbpZ/hjV7rIH6dTNhoVpdA+F8LzmQ7cyhHG8l2JMvdunwF2uX5k +D4WDcZt/ITKZNQNavPtmIyD5HprdAgMBAAECgYEAuQkTSi5ZNpAoWz76xtGRFSwU +zUT4wQi3Mz6tDtjKTYXasiQGa0dHC1M9F8fDu6BZ9W7W4Dc9hArRcdzEighuxoI/ +nZI/0uL89iUEywnDEIHuS6D5JlZaj86/nx9YvQnO8F/seM+MX0EAWVrd5wC7aAF1 +h6Fu7ykZB4ggUjQAWwECQQD+AUiDOEO+8btLJ135dQfSGc5VFcZiequnKWVm6uXt +rX771hEYjYMjLqWGFg9G4gE3GuABM5chMINuQQUivy8tAkEA/cxfy19XkjtqcMgE +x/UDt6Nr+Ky/tk+4Y65WxPRDas0uxFOPk/vEjgVmz1k/TAy9G4giisluTvtmltr5 +DCLocQJBAJnRHx9PiD7uVhRJz6/L/iNuOzPtTsi+Loq5F83+O6T15qsM1CeBMsOw +cM5FN5UeMcwz+yjfHAsePMkcmMaU7jUCQHlg9+N8upXuIo7Dqj2zOU7nMmkgvSNE +5yuNImRZabC3ZolwaTdd7nf5r1y1Eyec5Ag5yENV6JKPe1Xkbb1XKJECQDngA0h4 +6ATvfP1Vrx4CbP11eKXbCsZ9OGPHSgyvVjn68oY5ZP3uPsIattoN7dE2BRfuJm7m +F0nIdUAhR0yTfKM= +-----END PRIVATE KEY----- diff --git a/meta-phosphor/common/recipes-phosphor/flash/phosphor-image-signing.bb b/meta-phosphor/common/recipes-phosphor/flash/phosphor-image-signing.bb new file mode 100644 index 000000000..897bfdea4 --- /dev/null +++ b/meta-phosphor/common/recipes-phosphor/flash/phosphor-image-signing.bb @@ -0,0 +1,29 @@ +SUMMARY = "OpenBMC image signing public key" +DESCRIPTION = "Public key information to be included in images for image verification." +PR = "r1" + +inherit allarch +inherit obmc-phosphor-license + +INSECURE_KEY = "${@'${SIGNING_KEY}' == '${STAGING_DIR_NATIVE}${datadir}/OpenBMC.priv'}" + +DEPENDS += "openssl-native" +DEPENDS += "${@oe.utils.conditional('INSECURE_KEY', 'True', 'phosphor-insecure-signing-key-native', '', d)}" + +FILES_${PN} += "${sysconfdir}/activationdata/" + +SIGNING_KEY ?= "${STAGING_DIR_NATIVE}${datadir}/OpenBMC.priv" +SIGNING_KEY_TYPE = "${@os.path.splitext(os.path.basename('${SIGNING_KEY}'))[0]}" + +do_install() { + openssl pkey -in "${SIGNING_KEY}" -pubout -out ${WORKDIR}/publickey + echo HashType=RSA-SHA256 > "${WORKDIR}/hashfunc" + + idir="${D}${sysconfdir}/activationdata/${SIGNING_KEY_TYPE}" + + install -d ${idir} + install -m 644 ${WORKDIR}/publickey ${idir} + install -m 644 ${WORKDIR}/hashfunc ${idir} +} + +SYSROOT_DIRS_append = " ${sysconfdir}" diff --git a/meta-phosphor/common/recipes-phosphor/flash/phosphor-insecure-signing-key-native.bb b/meta-phosphor/common/recipes-phosphor/flash/phosphor-insecure-signing-key-native.bb new file mode 100644 index 000000000..55ebe5779 --- /dev/null +++ b/meta-phosphor/common/recipes-phosphor/flash/phosphor-insecure-signing-key-native.bb @@ -0,0 +1,15 @@ +SUMMARY = "Insecure private key for testing and development" +DESCRIPTION = "Do not use this key to sign images." +PR = "r1" + +inherit allarch +inherit native +inherit obmc-phosphor-license + +SRC_URI += "file://OpenBMC.priv" + +do_install() { + bbplain "Using an insecure image signing key!" + install -d ${D}${datadir} + install -m 400 ${WORKDIR}/OpenBMC.priv ${D}${datadir} +} |