116 lines
4.0 KiB
YAML
116 lines
4.0 KiB
YAML
---
|
|
- name: Configure sbctl Secure Boot
|
|
block:
|
|
- name: Create Secure Boot signing keys
|
|
ansible.builtin.command: "{{ chroot_command }} sbctl create-keys"
|
|
register: _sbctl_create_keys
|
|
changed_when: _sbctl_create_keys.rc == 0
|
|
failed_when:
|
|
- _sbctl_create_keys.rc != 0
|
|
- "'already exists' not in (_sbctl_create_keys.stderr | default(''))"
|
|
|
|
- name: Enroll Secure Boot keys in firmware
|
|
ansible.builtin.command: "{{ chroot_command }} sbctl enroll-keys --microsoft"
|
|
register: _sbctl_enroll
|
|
changed_when: _sbctl_enroll.rc == 0
|
|
failed_when: false
|
|
|
|
- name: Install first-boot enrollment service if chroot enrollment failed
|
|
when: _sbctl_enroll.rc | default(1) != 0
|
|
block:
|
|
- name: Create first-boot sbctl enrollment service
|
|
ansible.builtin.copy:
|
|
dest: /mnt/etc/systemd/system/sbctl-enroll.service
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Enroll Secure Boot keys via sbctl
|
|
ConditionPathExists=!/var/lib/sbctl/.enrolled
|
|
After=local-fs.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/sbctl enroll-keys --microsoft
|
|
ExecStartPost=/usr/bin/touch /var/lib/sbctl/.enrolled
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
- name: Enable first-boot enrollment service
|
|
ansible.builtin.command: "{{ chroot_command }} systemctl enable sbctl-enroll.service"
|
|
register: _sbctl_service_enable
|
|
changed_when: _sbctl_service_enable.rc == 0
|
|
|
|
- name: Find kernel images to sign
|
|
ansible.builtin.find:
|
|
paths: /mnt/boot
|
|
patterns: "vmlinuz-*"
|
|
file_type: file
|
|
register: _sbctl_kernel_images
|
|
|
|
- name: Sign kernel images
|
|
ansible.builtin.command: >-
|
|
{{ chroot_command }} sbctl sign -s {{ item.path | regex_replace('^/mnt', '') }}
|
|
loop: "{{ _sbctl_kernel_images.files }}"
|
|
loop_control:
|
|
label: "{{ item.path | basename }}"
|
|
register: _sbctl_sign_kernel
|
|
changed_when: _sbctl_sign_kernel.rc == 0
|
|
failed_when: false
|
|
|
|
- name: Sign GRUB EFI binary
|
|
vars:
|
|
_grub_efi_path: "{{ partitioning_efi_mountpoint }}/EFI/archlinux/grubx64.efi"
|
|
ansible.builtin.command: >-
|
|
{{ chroot_command }} sbctl sign -s {{ _grub_efi_path }}
|
|
register: _sbctl_sign_grub
|
|
changed_when: _sbctl_sign_grub.rc == 0
|
|
failed_when: false
|
|
|
|
- name: Ensure pacman hooks directory exists
|
|
ansible.builtin.file:
|
|
path: /mnt/etc/pacman.d/hooks
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Install sbctl auto-signing pacman hook
|
|
ansible.builtin.copy:
|
|
dest: /mnt/etc/pacman.d/hooks/99-sbctl-sign.hook
|
|
mode: "0644"
|
|
content: |
|
|
[Trigger]
|
|
Operation = Install
|
|
Operation = Upgrade
|
|
Type = Path
|
|
Target = boot/vmlinuz-*
|
|
Target = usr/lib/modules/*/vmlinuz
|
|
|
|
[Action]
|
|
Description = Signing kernel images for Secure Boot...
|
|
When = PostTransaction
|
|
Exec = /usr/bin/sbctl sign-all
|
|
Depends = sbctl
|
|
|
|
- name: Verify sbctl signing status
|
|
ansible.builtin.command: "{{ chroot_command }} sbctl verify"
|
|
register: _sbctl_verify
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Report sbctl Secure Boot status
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
Secure Boot (sbctl):
|
|
Enrollment={{ 'done' if (_sbctl_enroll.rc | default(1)) == 0 else 'deferred to first boot' }}.
|
|
{{ _sbctl_verify.stdout | default('Verify not available') }}
|
|
|
|
rescue:
|
|
- name: Secure Boot setup failed
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
sbctl Secure Boot setup failed.
|
|
On VMs make sure the OVMF firmware is in Setup Mode (fresh NVRAM).
|
|
On bare metal enter the firmware setup and switch to Setup Mode first.
|
|
To recover manually: sbctl create-keys && sbctl enroll-keys --microsoft && sbctl sign-all
|