Merge pull request #1 from teldra/bioscheck

Adding support for BIOS.

hashboot

@@ -3,7 +3,8 @@
 #Exit codes: 0 = success, 1 = checksum mbr mismatch, 2 = checksum /boot mismatch,
 #3 = checksum mbr/boot mismatch, 4 = not root, 5 = no hasher found, 6 = wrong usage,
 #7 = write error, 8 = dd error, 9 = file not found
-
+#10 = bios mismatch, 11 == mbr&bios mismatch, 12 = files&bios mismatch
+#13 = mbr&bios&files mismatch
 ###################################################################################
 # "THE HUG-WARE LICENSE" (Revision 1):                                            #
 # xo <xo@rotce.de> and tastytea <tastytea@tastytea.de> wrote these files. As long #
@@ -11,7 +12,7 @@
 # meet some day, and you think this stuff is worth it, you can give us a hug.     #
 ###################################################################################
 
-VERSION="0.8.3"
+VERSION="0.9.0"
 PATH="/bin:/usr/bin:/sbin:/usr/sbin:${PATH}"
 
 DIGEST_FILE="/var/lib/hashboot.digest"
@@ -20,12 +21,14 @@ LOG_FILE="/tmp/hashboot.log"
 MBR_DEVICE="/dev/sda"
 MBR_SIZE=1024
 MBR_TMP="/tmp/mbr"
+BIOS_TMP="/tmp/bios"
 BACKUP_FILE="/var/cache/boot-backup.tar"
 HASHER=""
 BOOT_MOUNTED=0
 CONFIG_FILE="/etc/hashboot.cfg"
 COUNTER=0
 DD_STATUS="none"
+PROGRAMMER="no" #standard change enables bios mode
 
 #Umount /boot if we mounted it, exit with given exit code
 die ()
@@ -45,6 +48,12 @@ write_hashes ()
     echo "#hashboot ${VERSION} - Algorithm: $(basename ${HASHER})" > ${1}
     #Write MBR of MBR_DEVICE to ${1}
     dd if=${MBR_DEVICE} of=${MBR_TMP} bs=${MBR_SIZE}K count=1 status=${DD_STATUS} || die 8
+    #Write bios to ${1}
+    #if we set an programmer chip in config, read bios and write it to digestfile.
+    if [ ! ${PROGRAMMER} == "no" ]; then
+        flashrom --programmer ${PROGRAMMER} -r ${BIOS_TMP} > /dev/null 2>&1
+        ${HASHER} ${BIOS_TMP} >> ${1}
+    fi
     #Write hashes of all regular files to ${1}
     ${HASHER} ${MBR_TMP} >> ${1}
     find /boot -type f -exec ${HASHER} --binary {} >> ${1} +
@@ -89,11 +98,27 @@ else
         [ -z "${BACKUP_FILE}" ] && BACKUP_FILE="/var/cache/boot-backup.tar"
         echo "#Where the Backup files are stored" >> ${CONFIG_FILE}
         echo "BACKUP_FILE=${BACKUP_FILE}" >> ${CONFIG_FILE}
+        echo -n "Include BIOS check? (y/n)"
+        read b
+        if [ ${b} == "y"]; then
+            if which flashrom; then
+                flashrom
+                echo -n "Which programmer? (eg. internal)"
+                read p
+                echo "PROGRAMMER=${p}" >> ${CONFIG_FILE}
+            else
+                echo "No flashrom found. You need to install it."
+                echo "PROGRAMMER=${PROGRAMMER}" >> ${CONFIG_FILE}
+            fi
+        else
+            echo "PROGRAMMER=no" >> ${CONFIG_FILE}
+        fi
     else
         echo "#Device with the MBR on it" > ${CONFIG_FILE}
         echo "MBR_DEVICE=${MBR_DEVICE}" >> ${CONFIG_FILE}
         echo "#Where the Backup files are stored" >> ${CONFIG_FILE}
         echo "BACKUP_FILE=${BACKUP_FILE}" >> ${CONFIG_FILE}
+        echo "PROGRAMMER=${PROGRAMMER}" >> ${CONFIG_FILE}
     fi
 fi
 
@@ -144,7 +169,7 @@ then
         else
             for file in $(diff ${DIGEST_FILE} ${DIGEST_FILE_TMP} | grep -v '#hashboot' | grep '<' | cut -d'*' -f2 | sed 's/\ /\\ /g' );
             do
-                #lösche_aus_tar
+                #delete from tar
                 tar --delete -v -P -f $BACKUP_FILE $file
             done
             for file in $(diff ${DIGEST_FILE} ${DIGEST_FILE_TMP} | grep -v '#hashboot' | grep '>' | cut -d'*' -f2 | sed 's/\ /\\ /g' );
@@ -156,7 +181,7 @@ then
     mv ${DIGEST_FILE_TMP} ${DIGEST_FILE}
     else
         write_hashes $DIGEST_FILE
-        tar -cpPf ${BACKUP_FILE} ${MBR_TMP} /boot ${DIGEST_FILE} || die 7 "Error writing ${BACKUP_FILE}"
+        tar -cpPf ${BACKUP_FILE} ${BIOS} ${MBR_TMP} /boot ${DIGEST_FILE} || die 7 "Error writing ${BACKUP_FILE}"
         echo "Backup written to ${BACKUP_FILE}"
     fi
 
@@ -165,17 +190,28 @@ then
     [ -f ${DIGEST_FILE} ] || die 9 "No digestfile"
     HASHER=$(head -n1 ${DIGEST_FILE} | awk '{print $5}')
     dd if=${MBR_DEVICE} of=${MBR_TMP} bs=${MBR_SIZE}K count=1 status=${DD_STATUS} || die 8
+    flashrom --programmer ${PROGRAMMER} -r ${BIOS_TMP} > /dev/null 2>&1
     if ! grep ${MBR_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict | tee ${LOG_FILE}
     then
         echo "    !! TIME TO PANIK: MBR WAS MODIFIED !!"
         COUNTER=$((COUNTER + 1))
     fi
-    if ! grep -v ${MBR_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict | tee -a ${LOG_FILE}
+    if ! grep -v ${MBR_TMP} ${DIGEST_FILE} | grep -v ${BIOS_TMP} | ${HASHER} --check --warn --quiet --strict | tee -a ${LOG_FILE}
     then
         echo "    !! TIME TO PANIK: AT LEAST 1 FILE WAS MODIFIED !!"
         COUNTER=$((COUNTER + 2))
         die $COUNTER
     fi
+    #if we set an programmer chip in config, find line with hash for bios and compare. if smthg wrong, panic
+    if [ ! ${PROGRAMMER} == "no" ]; then
+        if grep ${BIOS_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict | tee -a ${LOG_FILE}
+        then
+            echo "    !! TIME TO PANIK: BIOS WAS MODIFIED !!"
+            COUNTER=$((COUNTER + 10))
+            die $COUNTER
+        fi
+    fi
+
 elif [ "${1}" == "recover" ]
 then
     echo "Restoring files from backup... (type yes or no for each file)"