chkcryptoboot_hook

#!/usr/bin/ash

check_mbr ()
{
    if [ -n "$BOOTDISK" -a -s /etc/chkcryptoboot/disk-head.sha512 ]; then
	dd if=$BOOTDISK of=/etc/chkcryptoboot/disk-head bs=446 count=1
	cd /etc/chkcryptoboot
	sha512sum -c disk-head.sha512
	if [ $? -ne 0 ]; then
	    echo -e "\nCHKCRYPTOBOOT ALERT!\n"
	    echo -e "CHANGES HAVE BEEN DETECTED IN THE BOOT LOADER CODE INSTALLED IN YOUR MBR!\n"
            cd -
	    return 1
	else
	    echo "Your boot loader code mbr hash was verified successfully."
            cd -
	    return 0
	fi
    fi
}

check_core ()
{
    if [ -n "$BOOTDISK" -a -s /etc/chkcryptoboot/grub-core.sha512 ]; then
	if [ -n "$BOOT_PARTITION" ]; then
	    dd if=$BOOT_PARTITION of=/etc/chkcryptoboot/grub-core bs=512 count=62
	else
	    dd if=$BOOTDISK of=/etc/chkcryptoboot/grub-core skip=1 bs=512 count=62
	fi
	cd /etc/chkcryptoboot
	sha512sum -c grub-core.sha512
	if [ $? -ne 0 ]; then
	    echo -e "\nCHKCRYPTOBOOT ALERT!\n"
	    echo -e "CHANGES HAVE BEEN DETECTED IN THE BOOT LOADER CORE!\n"
            cd -
	    return 1
	else
	    echo "Your boot loader core hash was verified successfully."
            cd -
	    return 0
	fi
    fi
}

check_efi ()
{
    if [ -n "$ESP" -a -s /etc/chkcryptoboot/efistub.sha512 ]; then
	resolve_device "$ESP"
	mount $ESP
	sha512sum -c /etc/chkcryptoboot/efistub.sha512
	if [ $? -ne 0 ]; then
	    echo -e "\nCHKCRYPTOBOOT ALERT!\n"
	    echo -e "CHANGES HAVE BEEN DETECTED IN YOUR BOOT LOADER EFISTUB!\n"
	    return 1
	else
	    echo "Your boot loader efistub hash was verified successfully."
	    return 0
	fi
    fi
}

check_cmdline ()
{
    if [ -n "$CMDLINE_NAME" -a -n "$CMDLINE_VALUE" ]; then
	#checks if the name value pair was configured and checks for them in the kernel's cmdline
	for param in `cat /proc/cmdline` ; do
	    if [ $param = $CMDLINE_NAME=$CMDLINE_VALUE ]; then
		echo "Your kernel cmdline contain the correct parameters."
		return 0
	    fi
	done
    fi
    echo -e "\nCHKCRYPTOBOOT ALERT!\n"
    echo -e "YOUR KERNEL CMDLINE DO NOT CONTAIN THE PARAMETERS THAT ARE IN\n"
    echo -e "THE CHKCRYPTOBOOT CONFIGURATION!\n"
    echo -e "THIS INDICATES YOUR BOOT LOADER CONFIGURATION WAS PROBABLY BYPASSED!\n"
    return 1
}

warning_confirm ()
{
    while true; do
	{
   	    echo -e "YOU ARE STRONGLY ADVISED NOT TO ENTER YOUR ROOT CONTAINER PASSWORD!"
	    echo -e "\nPlease type uppercase yes to continue:"
	    read YES
	    if [ $YES = YES ]; then
		break
	    fi
	}
    done
}

run_hook ()
{
    if [ -s /etc/chkcryptoboot/chkcryptoboot.conf ]; then
	source /etc/chkcryptoboot/chkcryptoboot.conf
	if [ $BOOTMODE = "mbr" ]; then
	    check_mbr
	    mbr_check=$?
	    check_core
	    core_check=$?
	    check_cmdline
	    if [ $mbr_check -ne 0 -o $core_check -ne 0 -o $? -ne 0 ]; then
		warning_confirm
	    fi
	elif [ $BOOTMODE = "efi" ]; then
	    check_efi
	    efi_check=$?
	    check_cmdline
	    if [ $efi_check -ne 0 -o $? -ne 0 ]; then
		warning_confirm
	    fi
	else
	    echo -e "\nCHKCRYPTOBOOT WARNING!\n"
	    echo -e "YOUR CHKCRYPTOBOOT CONFIGURATION CONTAIN ERRORS!"
	    warning_confirm
	fi
    fi
}

run_cleanuphook ()
{
    if [ -s /etc/chkcryptoboot/chkcryptoboot.conf ]; then
	source /etc/chkcryptoboot/chkcryptoboot.conf
	if [ $BOOTMODE = "efi" ]; then
	    if [ -n $ESP ]; then
		umount $ESP
	    fi
	fi
    fi
}