[PATCH 06/10] add example to generated and distribute MOK data

[Felix Moessbauer <felix.moessbauer@siemens.com>]

This patch adds two recipes to easily handle a Machine Owner Key (MOK)
that can be used to sign kernel modules or other components.

The sb-mok-keys package generates a x509 certificate at build time and
adds both the certificate and the private key to a binary package.
This is implemented in a way that the source package does not contain
any keys, but only the binary package does. While this breaks
reproducability, this ensures that the keys never end up in a src
repository.

A second package sb-mok-public is provided to distribute the generated
key into the target image (to inject into EFI at runtime). This package
build-depends on the sb-mok-keys, but conflicts at runtime to make sure
that the private key cannot be installed into the target image (given
that the -public package is installed).

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 .../sb-mok-keys/files/Makefile.tmpl           | 27 +++++++++++++++++++
 .../sb-mok-keys/sb-mok-keys.bb                | 23 ++++++++++++++++
 .../sb-mok-public/files/rules                 | 12 +++++++++
 .../sb-mok-public/sb-mok-public.bb            | 17 ++++++++++++
 4 files changed, 79 insertions(+)
 create mode 100644 meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
 create mode 100644 meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
 create mode 100644 meta-isar/recipes-secureboot/sb-mok-public/files/rules
 create mode 100644 meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb

diff --git a/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl b/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
new file mode 100644
index 0000000..b377c51
--- /dev/null
+++ b/meta-isar/recipes-secureboot/sb-mok-keys/files/Makefile.tmpl
@@ -0,0 +1,27 @@
+# Base image recipe for ISAR
+#
+# This software is a part of ISAR.
+# Copyright (C) 2022 Siemens AG
+
+CN=${COMMON_NAME}
+
+all: create_key
+
+create_key:
+	mkdir MOK
+	openssl req -new -x509 -newkey rsa:2048 -keyout MOK/MOK.priv -outform DER -out MOK/MOK.der -nodes -days 36500 -subj "/CN=$(CN)/"
+	chmod 600 MOK/MOK.priv
+
+install:
+	install -d $(DESTDIR)/etc/sb-mok-keys/MOK
+	# note that this will later be changed by dh_fixperms
+	# this is also required so that the non-privileged sbuild
+	# user can read the file
+	install -m 644 MOK/MOK.priv $(DESTDIR)/etc/sb-mok-keys/MOK/
+	install -m 644 MOK/MOK.der  $(DESTDIR)/etc/sb-mok-keys/MOK/
+
+clean:
+ifneq (,$(wildcard ./MOK/MOK.priv))
+	shred MOK/MOK.priv
+endif
+	rm -rf MOK
diff --git a/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb b/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
new file mode 100644
index 0000000..6137834
--- /dev/null
+++ b/meta-isar/recipes-secureboot/sb-mok-keys/sb-mok-keys.bb
@@ -0,0 +1,23 @@
+# Base image recipe for ISAR
+#
+# This software is a part of ISAR.
+# Copyright (C) 2022 Siemens AG
+
+inherit dpkg
+
+
+SRC_URI = "file://Makefile.tmpl"
+S = "${WORKDIR}/src"
+
+TEMPLATE_VARS = "COMMON_NAME"
+TEMPLATE_FILES = "Makefile.tmpl"
+
+DEBIAN_BUILD_DEPENDS .= ",openssl"
+# common name of x509 certificate used for signing
+COMMON_NAME = "ISAR Builder"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+    cp ${WORKDIR}/Makefile ${S}
+    deb_debianize
+}
diff --git a/meta-isar/recipes-secureboot/sb-mok-public/files/rules b/meta-isar/recipes-secureboot/sb-mok-public/files/rules
new file mode 100644
index 0000000..305b443
--- /dev/null
+++ b/meta-isar/recipes-secureboot/sb-mok-public/files/rules
@@ -0,0 +1,12 @@
+#!/usr/bin/make -f
+# Base image recipe for ISAR
+#
+# This software is a part of ISAR.
+# Copyright (C) 2022 Siemens AG
+
+%:
+	dh $@
+
+override_dh_install:
+	install -d debian/sb-mok-public/etc/sb-mok-keys/MOK/
+	install -m 644 /etc/sb-mok-keys/MOK/MOK.der debian/sb-mok-public/etc/sb-mok-keys/MOK/MOK.der
diff --git a/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb b/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb
new file mode 100644
index 0000000..46fdeed
--- /dev/null
+++ b/meta-isar/recipes-secureboot/sb-mok-public/sb-mok-public.bb
@@ -0,0 +1,17 @@
+# Base image recipe for ISAR
+#
+# This software is a part of ISAR.
+# Copyright (C) 2022 Siemens AG
+
+inherit dpkg
+
+DEPENDS += "sb-mok-keys"
+DEBIAN_BUILD_DEPENDS .= ",sb-mok-keys"
+DEBIAN_CONFLICTS .= ",sb-mok-keys"
+
+SRC_URI = "file://rules"
+
+do_prepare_build[cleandirs] += "${S}/debian"
+do_prepare_build() {
+    deb_debianize
+}
-- 
2.34.1