Refactor efi/preinstall

Makefile

@@ -0,0 +1,37 @@
+help:
+	# Usage:
+	# make build                  Build companion tools
+	# make check                  Run all tests
+	# make check-efi-preinstall   Run tests of package efi/preinstall
+	# make list-packages          List Go packages
+
+
+# Build command line programs
+build:
+	go build -o test_efi_fde_compat cmd/test_efi_fde_compat/main.go
+	go build -o run_argon2 cmd/run_argon2/main.go
+
+.PHONY: check check-tpm2-simulator FORCE
+FORCE:
+
+# Disable optimization and inlining (to facilitate step-by-step debugging)
+GCFLAGS = -gcflags "-N -l"
+
+check-tpm2-simulator:
+	@echo "Checking installed snap: tpm2-simulator-chrisccoulson"
+	@snap list tpm2-simulator-chrisccoulson > /dev/null
+
+check: check-tpm2-simulator
+	./run-tests --with-mssim
+
+check-efi-preinstall.bin: FORCE
+	go test -cover -c -o $@ $(GCFLAGS) ./efi/preinstall -v -ldflags '-X github.com/snapcore/secboot/internal/testenv.testBinary=enabled' -race -p 1
+
+check-efi-preinstall: check-efi-preinstall.bin check-tpm2-simulator
+	USE_MSSIM=1 ./$< -test.coverprofile=coverage.out -check.v
+	# You may now view the coverage report by executing:
+	#     go tool cover -func=coverage.out
+	# or: go tool cover -html=coverage.out
+
+list-packages:
+	go list ./...

README.md

@@ -0,0 +1,30 @@
+# secboot
+
+A Go library for managing TPM-backed encrypted disks on Linux operating systems.
+
+## Features
+
+- System installation & maintenance:
+    * Do pre-install platform compatibility checks
+    * Initialize the TPM
+    * Seal a LUKS passphrase within the TPM
+    * Update sealing policy (typically after platform or software update)
+    * Manage TPM lockout (set authValue, reset)
+    * Compute PCR profiles
+    * Manage recovery keys of LUKS containers (create, list, delete)
+
+- System boot:
+    * Unseal
+    * Attempt various unlocking paths (TPM-backed, with PIN, with passphrase,
+      recovery...)
+
+- Other useful functions
+    * Get entropy of a PIN or passphrase
+    * Access to UEFI variables PK, KEK, Db, Dbx
+
+
+## License
+
+Secboot is licensed under the GNU General Public License version 3.
+
+See the [COPYING](COPYING) file for more details.

efi/preinstall/check_host_security_amd64_test.go

@@ -42,13 +42,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecurityIntelGood(c *C) {
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000245
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusBase,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/virtual/iommu/dmar0", nil, "iommu", nil, nil),
@@ -146,13 +140,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecurityIntelErrMEI(c *C) {
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000255
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusManufacturingMode,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/pci0000:00/0000:00:16.0/mei/mei0", map[string]string{"DEVNAME": "mei0"}, "mei", meiAttrs, efitest.NewMockSysfsDevice(
@@ -198,13 +186,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecuritySecureBootPolicyFirmwareDe
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000245
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusBase,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/virtual/iommu/dmar0", nil, "iommu", nil, nil),
@@ -232,13 +214,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecurityNoIOMMU(c *C) {
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000245
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusBase,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/pci0000:00/0000:00:16.0/mei/mei0", map[string]string{"DEVNAME": "mei0"}, "mei", meiAttrs, efitest.NewMockSysfsDevice(
@@ -264,13 +240,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecuritySecureBootPolicyFirmwareDe
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000245
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusBase,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/pci0000:00/0000:00:16.0/mei/mei0", map[string]string{"DEVNAME": "mei0"}, "mei", meiAttrs, efitest.NewMockSysfsDevice(
@@ -299,13 +269,7 @@ func (s *hostSecurityAMD64Suite) TestCheckHostSecurityIntelErrCPUDebuggingUnlock
 0:16.1.27.2176
 0:16.0.15.1624
 `),
-		"fw_status": []byte(`94000245
-09F10506
-00000020
-00004000
-00041F03
-C7E003CB
-`),
+		"fw_status": fwStatusBase,
 	}
 	devices := []internal_efi.SysfsDevice{
 		efitest.NewMockSysfsDevice("/sys/devices/virtual/iommu/dmar0", nil, "iommu", nil, nil),