Skip to content

Commit 38a0872

Browse files
derenvderenv
authored
Merge pull request #12 from derenv/sign-check
Sign check
2 parents 09db014 + 06035b4 commit 38a0872

1 file changed

Lines changed: 190 additions & 38 deletions

File tree

‎bash-kernel-signer.sh‎

Lines changed: 190 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,72 @@ function sign_kernel()
2424
echo "=========BASH KERNEL SIGNING UTILITY=========="
2525

2626
# Search for kernels
27-
mapfile -t ukernels < <( find "$kernel_location" -name "vmlinuz-*-generic" | sort -n )
28-
mapfile -t skernels < <( find "$kernel_location" -name "vmlinuz-*-signed" | sort -n )
27+
mapfile -t kernels < <( find "$kernel_location" -name "vmlinuz-*" | sort -n )
28+
unsigned_kernels=()
29+
valid_signed_kernels=()
30+
invalid_signed_kernels=()
31+
valid_validity_checks=()
32+
invalid_validity_checks=()
2933

30-
# Print all kernels
31-
echo " Number of kernels available for signing: ${#ukernels[@]}"
32-
counter=1
33-
for k in "${ukernels[@]}"; do
34-
echo " $counter - $k"
35-
(( counter++ ))
36-
done
37-
echo " Number of signed kernels: ${#skernels[@]}"
38-
for k in "${skernels[@]}"; do
39-
echo " $k"
34+
# For each detected kernel
35+
for unvalidated_kernel in "${kernels[@]}"; do
36+
# Validate kernel signatures
37+
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
38+
39+
# Increment signed/unsigned kernels
40+
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
41+
# Add to valid signed kernels
42+
valid_signed_kernels+=("$unvalidated_kernel")
43+
valid_validity_checks+=("${validity_check[0]}")
44+
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
45+
# Add to invalid signed kernels
46+
invalid_signed_kernels+=("$unvalidated_kernel")
47+
invalid_validity_checks+=("${validity_check[0]}")
48+
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
49+
# Add to unsiged kernels
50+
unsigned_kernels+=("$unvalidated_kernel")
51+
else
52+
# SOME UNKNOWN ERROR?
53+
echo "??error??"
54+
fi
4055
done
4156

57+
# Print all kernels
58+
declare -i counter
59+
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
60+
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
61+
echo " -none-"
62+
else
63+
counter=0
64+
id=$(( "$counter" + 1 ))
65+
for kernel in "${unsigned_kernels[@]}"; do
66+
echo " $id - $kernel"
67+
(( counter++ ))
68+
done
69+
fi
70+
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
71+
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
72+
echo " -none-"
73+
else
74+
counter=0
75+
for kernel in "${valid_signed_kernels[@]}"; do
76+
echo " $kernel"
77+
echo " -> ${valid_validity_checks[$counter]}"
78+
(( counter++ ))
79+
done
80+
fi
81+
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
82+
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
83+
echo " -none-"
84+
else
85+
counter=0
86+
for kernel in "${invalid_signed_kernels[@]}"; do
87+
echo " $kernel"
88+
echo " -> ${invalid_validity_checks[$counter]}"
89+
(( counter++ ))
90+
done
91+
fi
92+
4293
echo "=============================================="
4394
echo "$prev_out"
4495
echo "=============================================="
@@ -48,10 +99,11 @@ function sign_kernel()
4899
if [[ "$user_input" == "0" ]]; then
49100
ERROR_MSG="cancelled.."
50101
return 1
51-
elif [[ "$user_input" =~ ^[0-9]+$ ]] && test "$user_input" -le "${#ukernels[@]}"; then
102+
elif [[ "$user_input" =~ ^[0-9]+$ ]] && test "$user_input" -le "${#unsigned_kernels[@]}"; then
52103
# Sign kernel
53104
selection=$(( user_input - 1 ))
54-
sbsign --key "$key_location" --cert "$cert_location" --output "${ukernels[$selection]}-signed" "${ukernels[$selection]}"
105+
datetime=$(date +"%Y-%m-%d+%T")
106+
sbsign --key "$key_location" --cert "$cert_location" --output "${unsigned_kernels[$selection]}-signed$datetime" "${unsigned_kernels[$selection]}"
55107
prev_out="$?"
56108
else
57109
prev_out="invalid input.."
@@ -70,21 +122,70 @@ function purge_kernel()
70122
echo "=========BASH KERNEL SIGNING UTILITY=========="
71123

72124
# Search for kernels
73-
mapfile -t ukernels < <( find "$kernel_location" -name "vmlinuz-*-generic" | sort -n )
74-
mapfile -t skernels < <( find "$kernel_location" -name "vmlinuz-*-signed" | sort -n )
125+
mapfile -t kernels < <( find "$kernel_location" -name "vmlinuz-*" | sort -n )
126+
unsigned_kernels=()
127+
valid_signed_kernels=()
128+
invalid_signed_kernels=()
129+
valid_validity_checks=()
130+
invalid_validity_checks=()
75131

76-
# Print all kernels
77-
echo " Number of kernels available for signing: ${#ukernels[@]}"
78-
for k in "${ukernels[@]}"; do
79-
echo " $k"
80-
done
81-
echo " Number of signed kernels: ${#skernels[@]}"
82-
counter=1
83-
for k in "${skernels[@]}"; do
84-
echo " $counter - $k"
85-
(( counter++ ))
132+
# For each detected kernel
133+
for unvalidated_kernel in "${kernels[@]}"; do
134+
# Validate kernel signatures
135+
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
136+
137+
# Increment signed/unsigned kernels
138+
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
139+
# Add to valid signed kernels
140+
valid_signed_kernels+=("$unvalidated_kernel")
141+
valid_validity_checks+=("${validity_check[0]}")
142+
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
143+
# Add to invalid signed kernels
144+
invalid_signed_kernels+=("$unvalidated_kernel")
145+
invalid_validity_checks+=("${validity_check[0]}")
146+
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
147+
# Add to unsinged kernels
148+
unsigned_kernels+=("$unvalidated_kernel")
149+
else
150+
# SOME UNKNOWN ERROR?
151+
echo "??error??"
152+
fi
86153
done
87154

155+
# Print all kernels
156+
declare -i counter
157+
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
158+
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
159+
echo " -none-"
160+
else
161+
for kernel in "${unsigned_kernels[@]}"; do
162+
echo " $kernel"
163+
done
164+
fi
165+
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
166+
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
167+
echo " -none-"
168+
else
169+
counter=0
170+
for kernel in "${valid_signed_kernels[@]}"; do
171+
id=$(( "$counter" + 1 ))
172+
echo " $id - $kernel"
173+
echo " -> ${valid_validity_checks[$counter]}"
174+
(( counter++ ))
175+
done
176+
fi
177+
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
178+
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
179+
echo " -none-"
180+
else
181+
counter=0
182+
for kernel in "${invalid_signed_kernels[@]}"; do
183+
echo " $kernel"
184+
echo " -> ${invalid_validity_checks[$counter]}"
185+
(( counter++ ))
186+
done
187+
fi
188+
88189
echo "=============================================="
89190
echo "$prev_out"
90191
echo "=============================================="
@@ -94,10 +195,10 @@ function purge_kernel()
94195
if [[ "$user_input" == "0" ]]; then
95196
ERROR_MSG="cancelled.."
96197
return 1
97-
elif [[ "$user_input" =~ ^[0-9]+$ ]] && test "$user_input" -le "${#skernels[@]}"; then
198+
elif [[ "$user_input" =~ ^[0-9]+$ ]] && test "$user_input" -le "${#valid_signed_kernels[@]}"; then
98199
# Purge signed kernel
99200
selection=$(( user_input - 1 ))
100-
rm "${skernels[$selection]}"
201+
sudo rm -f "${valid_signed_kernels[$selection]}"
101202
prev_out="$?"
102203
else
103204
prev_out="invalid input.."
@@ -219,18 +320,69 @@ while [[ "$stop" == "False" ]]; do
219320
echo "=========BASH KERNEL SIGNING UTILITY=========="
220321

221322
# Search for kernels
222-
mapfile -t ukernels < <( find "$kernel_location" -name "vmlinuz-*-generic" | sort -n )
223-
mapfile -t skernels < <( find "$kernel_location" -name "vmlinuz-*-signed" | sort -n )
323+
mapfile -t kernels < <( find "$kernel_location" -name "vmlinuz-*" | sort -n )
324+
unsigned_kernels=()
325+
valid_signed_kernels=()
326+
invalid_signed_kernels=()
327+
valid_validity_checks=()
328+
invalid_validity_checks=()
224329

225-
# Print all kernels
226-
echo " Number of kernels available for signing: ${#ukernels[@]}"
227-
for k in "${ukernels[@]}"; do
228-
echo " $k"
229-
done
230-
echo " Number of signed kernels: ${#skernels[@]}"
231-
for k in "${skernels[@]}"; do
232-
echo " $k"
330+
# For each detected kernel
331+
for unvalidated_kernel in "${kernels[@]}"; do
332+
# Validate kernel signatures
333+
mapfile -t validity_check < <(sbverify --cert "$cert_location" "${unvalidated_kernel}" 2>&1)
334+
335+
# Increment signed/unsigned kernels
336+
if [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification OK" ]]; then
337+
# Add to valid signed kernels
338+
valid_signed_kernels+=("$unvalidated_kernel")
339+
valid_validity_checks+=("${validity_check[0]}")
340+
elif [[ "${#validity_check[@]}" = 1 && "${validity_check[0]}" = "Signature verification failed" ]]; then
341+
# Add to invalid signed kernels
342+
invalid_signed_kernels+=("$unvalidated_kernel")
343+
invalid_validity_checks+=("${validity_check[0]}")
344+
elif [[ "${#validity_check[@]}" = 2 && "${validity_check[0]}" = "No signature table present" ]]; then
345+
# Add to unsiged kernels
346+
unsigned_kernels+=("$unvalidated_kernel")
347+
else
348+
# SOME UNKNOWN ERROR?
349+
echo "??error??"
350+
fi
233351
done
352+
353+
# Print all kernels
354+
declare -i counter
355+
echo " Number of kernels available for signing: ${#unsigned_kernels[@]}"
356+
if [[ "${#unsigned_kernels[@]}" == 0 ]]; then
357+
echo " -none-"
358+
else
359+
for kernel in "${unsigned_kernels[@]}"; do
360+
echo " $kernel"
361+
done
362+
fi
363+
echo " Number of signed kernels: ${#valid_signed_kernels[@]}"
364+
if [[ "${#valid_signed_kernels[@]}" == 0 ]]; then
365+
echo " -none-"
366+
else
367+
counter=0
368+
for kernel in "${valid_signed_kernels[@]}"; do
369+
echo " $kernel"
370+
echo " -> ${valid_validity_checks[$counter]}"
371+
(( counter++ ))
372+
done
373+
fi
374+
echo " Number of invalid signed kernels: ${#invalid_signed_kernels[@]}"
375+
if [[ "${#invalid_signed_kernels[@]}" == 0 ]]; then
376+
echo " -none-"
377+
else
378+
counter=0
379+
for kernel in "${invalid_signed_kernels[@]}"; do
380+
echo " $kernel"
381+
echo " -> ${invalid_validity_checks[$counter]}"
382+
(( counter++ ))
383+
done
384+
fi
385+
234386
if [[ "$valid_keys" == "True" ]]; then
235387
echo "Signature Database key & certificate detected.."
236388
else

0 commit comments

Comments
 (0)