From dcc1ab02a5b14b84f71f62f8ea5701c6ff0504b6 Mon Sep 17 00:00:00 2001 From: Edwin Joassart Date: Thu, 13 Mar 2025 17:21:40 +0100 Subject: [PATCH] minor: extend device state for secureboot and FDE status --- src/balena-model.ts | 6 ++++++ src/balena.sbvr | 7 +++++++ src/features/device-state/routes/state-patch-v2.ts | 3 +++ src/features/device-state/routes/state-patch-v3.ts | 3 +++ src/features/device-state/state-patch-utils.ts | 3 +++ src/migrations/00102-device-add-secureboot-fde-status.sql | 3 +++ src/translations/v6/v6.sbvr | 7 +++++++ src/translations/v7/v7.sbvr | 7 +++++++ test/03_device-state.ts | 4 ++++ 9 files changed, 43 insertions(+) create mode 100644 src/migrations/00102-device-add-secureboot-fde-status.sql diff --git a/src/balena-model.ts b/src/balena-model.ts index aefc62a7f6..dac69f558b 100644 --- a/src/balena-model.ts +++ b/src/balena-model.ts @@ -717,7 +717,10 @@ export interface Device { mac_address: Types['Short Text']['Read'] | null; memory_usage: Types['Integer']['Read'] | null; memory_total: Types['Integer']['Read'] | null; + is_secureboot_enabled: Types['Boolean']['Read'] | null; + secureboot_keys_metadata: Types['Short Text']['Read'] | null; storage_block_device: Types['Short Text']['Read'] | null; + is_storage_encrypted: Types['Boolean']['Read'] | null; storage_usage: Types['Integer']['Read'] | null; storage_total: Types['Integer']['Read'] | null; cpu_usage: Types['Integer']['Read'] | null; @@ -828,7 +831,10 @@ export interface Device { mac_address: Types['Short Text']['Write'] | null; memory_usage: Types['Integer']['Write'] | null; memory_total: Types['Integer']['Write'] | null; + is_secureboot_enabled: Types['Boolean']['Write'] | null; + secureboot_keys_metadata: Types['Short Text']['Write'] | null; storage_block_device: Types['Short Text']['Write'] | null; + is_storage_encrypted: Types['Boolean']['Write'] | null; storage_usage: Types['Integer']['Write'] | null; storage_total: Types['Integer']['Write'] | null; cpu_usage: Types['Integer']['Write'] | null; diff --git a/src/balena.sbvr b/src/balena.sbvr index a7ec4f2737..0801e1ea74 100644 --- a/src/balena.sbvr +++ b/src/balena.sbvr @@ -193,6 +193,9 @@ Term: memory usage Term: memory total Concept Type: Integer (Type) +Term= secureboot keys metadata + Concept Type: Short Text (Type) + Term: storage block device Concept Type: Short Text (Type) @@ -549,8 +552,12 @@ Fact type: device has memory usage Necessity: each device has at most one memory usage Fact type: device has memory total Necessity: each device has at most one memory total +Fact type: device is secureboot enabled +Fact type: device has secureboot key metadata + Necessity: each device has at most one secureboot key metadata Fact type: device has storage block device Necessity: each device has at most one storage block device +Fact type: device is storage encrypted Fact type: device has storage usage Necessity: each device has at most one storage usage Fact type: device has storage total diff --git a/src/features/device-state/routes/state-patch-v2.ts b/src/features/device-state/routes/state-patch-v2.ts index 228c584c3d..f1d5ba35f2 100644 --- a/src/features/device-state/routes/state-patch-v2.ts +++ b/src/features/device-state/routes/state-patch-v2.ts @@ -49,6 +49,9 @@ export type StatePatchV2Body = { api_secret?: string; memory_usage?: number; memory_total?: number; + is_secureboot_enabled?: boolean; + is_storage_encrypted?: boolean; + secureboot_keys_metadata?: string | null; storage_block_device?: string; storage_usage?: number; storage_total?: number; diff --git a/src/features/device-state/routes/state-patch-v3.ts b/src/features/device-state/routes/state-patch-v3.ts index fc87d549c2..a72436f7b5 100644 --- a/src/features/device-state/routes/state-patch-v3.ts +++ b/src/features/device-state/routes/state-patch-v3.ts @@ -48,6 +48,9 @@ export type StatePatchV3Body = { api_secret?: string; memory_usage?: number; memory_total?: number; + is_secureboot_enabled?: boolean; + is_storage_encrypted?: boolean; + secureboot_keys_metadata?: string | null; storage_block_device?: string; storage_usage?: number; storage_total?: number; diff --git a/src/features/device-state/state-patch-utils.ts b/src/features/device-state/state-patch-utils.ts index c157550457..de3e910788 100644 --- a/src/features/device-state/state-patch-utils.ts +++ b/src/features/device-state/state-patch-utils.ts @@ -27,6 +27,9 @@ export const v3ValidPatchFields = [ 'cpu_id', 'is_undervolted', 'update_status', + 'is_secureboot_enabled', + 'is_storage_encrypted', + 'secureboot_keys_metadata', ] satisfies Array< Exclude | 'update_status' >; diff --git a/src/migrations/00102-device-add-secureboot-fde-status.sql b/src/migrations/00102-device-add-secureboot-fde-status.sql new file mode 100644 index 0000000000..2444b507e4 --- /dev/null +++ b/src/migrations/00102-device-add-secureboot-fde-status.sql @@ -0,0 +1,3 @@ +ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "is secureboot enabled" BOOLEAN NULL; +ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "is storage encrypted" BOOLEAN NULL; +ALTER TABLE "device" ADD COLUMN IF NOT EXISTS "secureboot keys metadata" JSONB NULL; \ No newline at end of file diff --git a/src/translations/v6/v6.sbvr b/src/translations/v6/v6.sbvr index aac88cd761..ed39e2a912 100644 --- a/src/translations/v6/v6.sbvr +++ b/src/translations/v6/v6.sbvr @@ -187,6 +187,9 @@ Term: memory usage Term: memory total Concept Type: Integer (Type) +Term= secureboot keys metadata + Concept Type: Short Text (Type) + Term: storage block device Concept Type: Short Text (Type) @@ -567,10 +570,14 @@ Fact type: device has memory usage Necessity: each device has at most one memory usage Fact type: device has memory total Necessity: each device has at most one memory total +Fact type: device is secureboot enabled +Fact type: device has secureboot key metadata + Necessity: each device has at most one secureboot key metadata Fact type: device has storage block device Necessity: each device has at most one storage block device Fact type: device has storage usage Necessity: each device has at most one storage usage +Fact type: device is storage encrypted Fact type: device has storage total Necessity: each device has at most one storage total Fact type: device has cpu usage diff --git a/src/translations/v7/v7.sbvr b/src/translations/v7/v7.sbvr index 573f8bd1a4..b9bf0d2190 100644 --- a/src/translations/v7/v7.sbvr +++ b/src/translations/v7/v7.sbvr @@ -187,6 +187,9 @@ Term: memory usage Term: memory total Concept Type: Integer (Type) +Term= secureboot keys metadata + Concept Type: Short Text (Type) + Term: storage block device Concept Type: Short Text (Type) @@ -557,10 +560,14 @@ Fact type: device has memory usage Necessity: each device has at most one memory usage Fact type: device has memory total Necessity: each device has at most one memory total +Fact type: device is secureboot enabled +Fact type: device has secureboot key metadata + Necessity: each device has at most one secureboot key metadata Fact type: device has storage block device Necessity: each device has at most one storage block device Fact type: device has storage usage Necessity: each device has at most one storage usage +Fact type: device is storage encrypted Fact type: device has storage total Necessity: each device has at most one storage total Fact type: device has cpu usage diff --git a/test/03_device-state.ts b/test/03_device-state.ts index 93aecf5a47..7218a6b2a4 100644 --- a/test/03_device-state.ts +++ b/test/03_device-state.ts @@ -1465,8 +1465,12 @@ export default () => { api_port: 48484, cpu_usage: 34, cpu_temp: 56, + is_secureboot_enabled: false, memory_usage: 1000, // 1GB in MiB memory_total: 4000, // 4GB in MiB + is_storage_encrypted: false, + secureboot_keys_metadata: + '[{"type":"PK","issuer":"CN = balenaOS PK","subject":"CN = balenaOS PK","validity":"notBefore=Apr 11 14:23:52 2023 GMT notAfter=Apr 11 14:23:52 2043 GMT","serial":"11AFA8270B745848117A4649E7D42B2FB8876F62","sha256":"A25DBA1EE7D0FF6E77ED267AE782FDED2237E0F057E418A43B05F5C702D74FD3"},{"type":"KEK","issuer":"CN = balenaOS KEK","subject":"CN = balenaOS KEK","validity":"notBefore=Apr 11 14:23:52 2023 GMT notAfter=Apr 11 14:23:52 2043 GMT","serial":"3F89E8613C09E7813BA0020BAF8D649769FFD491","sha256":"3AD25718D2A3652FFEF0AC0868D8586CD7DD96A3EBDB64174E6950934E6E954F"}]', storage_block_device: '/dev/mmcblk0', storage_usage: 1000, // 1GB in MiB storage_total: 64000, // 64GB in MiB