Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

systemd: TPM and debug shell #24499

Closed
wants to merge 2 commits into from
Closed

Conversation

peterhoeg
Copy link
Member

Motivation for this change
  1. Specify the debug shell instead of depending on the impure /bin/sh

  2. Enable TPM support - systemd-boot provides a measured boot facility by
    hashing boot loader, kernel and kernel commandline in the TPM's PCR

As I don't have hardware with TPM support, I cannot verify the TPM part.

@dezgeg and @aszlig , any comments?

Things done
  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@mention-bot
Copy link

@peterhoeg, thanks for your PR! By analyzing the history of the files in this pull request, we identified @joachifm, @edolstra and @vcunat to be potential reviewers.

@peterhoeg
Copy link
Member Author

ping @abbradar

@abbradar abbradar changed the base branch from master to staging April 10, 2017 22:54
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
"--with-kbd-loadkeys=${kbd}/bin/loadkeys"
"--with-kbd-setfont=${kbd}/bin/setfont"
"--with-rootprefix=$(out)"
"--with-debug-shell=${bashInteractive}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be ${bashInteractive}/bin/bash?

@peterhoeg
Copy link
Member Author

Indeed @abbradar , thanks and fixed.

@Mic92
Copy link
Member

Mic92 commented Apr 11, 2017

systemd is a mass-rebuild due utillinux, right?

@peterhoeg
Copy link
Member Author

I'm not sure if it is due to utillinux, but it's definitely mass-rebuild.

Assuming everybody is OK with this change, maybe we should introduce a "mass-rebuild-ready-to-merge" label for stuff that's not urgent.

@edolstra
Copy link
Member

  • Adding bashInteractive increases systemd's closure size, which is undesirable given the number of packages that depend (indirectly) on systemd.

  • I'm not sure it's very useful to enable an untested feature. Also, wouldn't TPM require support from lots of other parts in the stack? (E.g. boot loader, kernel, etc.) So just enabling it in systemd won't do very much.

Since this PR is for the staging branch, it's not a problem if it causes lots of rebuilds btw.

@abbradar
Copy link
Member

bashInteractive will only be a dependency of systemd.out, not systemd.lib, which should be okay for most packages (I don't think there are many situations when one has systemd.out but not bashInteractive -- most likely he/she is on NixOS).

I don't have an opinion on TPM however -- it's indeed an untested feature. Maybe we can save ourselves one mass rebuild in the future when one puts some work to it, but maybe it breaks something...

@soredake
Copy link

Any progress?

@peterhoeg
Copy link
Member Author

None from here, no.

@mmahut
Copy link
Member

mmahut commented Aug 19, 2019

Are there any updates on this pull request, please?

Instead of referencing the impure /bin/sh, use a proper bash from the store.
@peterhoeg
Copy link
Member Author

If would be great if somebody with TPM hardware could test this out.

@Mic92
Copy link
Member

Mic92 commented Sep 22, 2019

@peterhoeg I would drop the TPM support for now until somebody tested it.

@peterhoeg
Copy link
Member Author

I'd argue that adding TPM doesn't break anything as we are not changing existing behaviour or removing functionality, so why not just get it in there and see if it works for whoever has the hardware?

@flokli
Copy link
Contributor

flokli commented Sep 23, 2019

If we don't know it works, there's not much value in adding a untested and potentially broken feature.

@Mic92
Copy link
Member

Mic92 commented Sep 23, 2019

@peterhoeg it is not so useful without further integration and if nobody cares enough to add this support then why should we bloat systemd more than necessary.

@abbradar
Copy link
Member

Let's cherry-pick debug shell patch and leave TPM patch for now. I'd like to play with it (my laptop has a TPM) later.

@ttuegel ttuegel removed their request for review September 28, 2019 11:57
@flokli
Copy link
Contributor

flokli commented Oct 5, 2019

@abbradar was the debug shell patch moved into a separate PR already?

@abbradar
Copy link
Member

abbradar commented Oct 5, 2019

@flokli Nope, sorry, forgot about it. I built a VM with it and it appears to work so I'll cherry-pick it to staging-next.

EDIT: Done.

@flokli
Copy link
Contributor

flokli commented Oct 7, 2019

Thanks. As the TPM patch is really trivial (-Dtpm=true), let's close this PR for now.

@flokli flokli closed this Oct 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

10 participants