run_tpm_setup() {
USERNAME="$1"
PROGRESS_FILE="/tmp/tpm_progress.txt"
ERROR_LOG="/tmp/tpm_errors.log"
STATUS_LOG="/tmp/tpm_status.log"
> "$PROGRESS_FILE"
> "$ERROR_LOG"
> "$STATUS_LOG"
(
export DEBIAN_FRONTEND=noninteractive
log_cmd() {
local cmd="$1"
local step="$2"
local output
output=$(eval "$cmd" 2>&1)
local exit_code=$?
if [ $exit_code -eq 0 ]; then
echo "$step: SUCCESS" >> "$STATUS_LOG"
return 0
else
echo "$step: FAILED (exit: $exit_code)" >> "$STATUS_LOG"
echo "$step ERROR: $output" >> "$ERROR_LOG"
return 1
fi
}
echo "10" > "$PROGRESS_FILE"
echo "Updating package lists..." >> "$PROGRESS_FILE"
log_cmd "apt-get update -qq" "APT_UPDATE"
echo "30" > "$PROGRESS_FILE"
echo "Installing TPM2 tools..." >> "$PROGRESS_FILE"
log_cmd "timeout 120 apt-get install -y -qq tpm2-tools" "TPM_INSTALL"
echo "40" > "$PROGRESS_FILE"
echo "Verifying TPM2 tools..." >> "$PROGRESS_FILE"
if command -v tpm2_clear >/dev/null 2>&1; then
echo "TPM2_TOOLS: SUCCESS" >> "$STATUS_LOG"
else
echo "TPM2_TOOLS: FAILED" >> "$STATUS_LOG"
echo "TPM2_TOOLS: tpm2-tools not available" >> "$ERROR_LOG"
fi
echo "50" > "$PROGRESS_FILE"
echo "Clearing TPM (CRITICAL)..." >> "$PROGRESS_FILE"
if log_cmd "tpm2_clear -c p" "TPM_CLEAR"; then
echo "TPM_CLEAR_SUCCESS: YES" >> "$STATUS_LOG"
else
if log_cmd "tpm2_clear" "TPM_CLEAR_ALT"; then
echo "TPM_CLEAR_SUCCESS: YES" >> "$STATUS_LOG"
else
echo "TPM_CLEAR_SUCCESS: NO" >> "$STATUS_LOG"
fi
fi
echo "60" > "$PROGRESS_FILE"
echo "Creating primary key (SHA256)..." >> "$PROGRESS_FILE"
log_cmd "tpm2_createprimary -C e -g sha256 -G rsa -c /tmp/primary_sha256.ctx" "PRIMARY_SHA256"
echo "70" > "$PROGRESS_FILE"
echo "Reading public key..." >> "$PROGRESS_FILE"
log_cmd "tpm2_readpublic -c /tmp/primary_sha256.ctx -f pem -o /tmp/endorsement.pem" "READ_PUBLIC"
echo "75" > "$PROGRESS_FILE"
echo "Creating primary key (SHA1)..." >> "$PROGRESS_FILE"
log_cmd "tpm2_createprimary -C e -g sha1 -G rsa -c /tmp/primary_sha1.ctx" "PRIMARY_SHA1"
echo "80" > "$PROGRESS_FILE"
echo "Creating owner key..." >> "$PROGRESS_FILE"
log_cmd "tpm2_createprimary -C o -g sha256 -G rsa -c /tmp/primary_owner.ctx" "PRIMARY_OWNER"
echo "85" > "$PROGRESS_FILE"
echo "Making keys persistent..." >> "$PROGRESS_FILE"
log_cmd "tpm2_evictcontrol -C o -c /tmp/primary_owner.ctx 0x81010001" "EVICT_CONTROL"
echo "90" > "$PROGRESS_FILE"
echo "Verifying persistent handles..." >> "$PROGRESS_FILE"
if tpm2_getcap handles-persistent 2>&1 | grep -q "0x81010001"; then
echo "PERSISTENT_HANDLE: SUCCESS" >> "$STATUS_LOG"
else
echo "PERSISTENT_HANDLE: FAILED" >> "$STATUS_LOG"
fi
echo "100" > "$PROGRESS_FILE"
echo "Finalizing..." >> "$PROGRESS_FILE"
echo "$(date): TPM setup for $USERNAME" >> /var/log/carbonauth.log 2>/dev/null
cat "$STATUS_LOG" >> /var/log/carbonauth.log 2>/dev/null
echo "DONE" >> "$PROGRESS_FILE"
) &
BG_PID=$!
(
while [ ! -f "$PROGRESS_FILE" ]; do
sleep 0.1
done
TIMEOUT=240
ELAPSED=0
while [ $ELAPSED -lt $TIMEOUT ]; do
if [ -f "$PROGRESS_FILE" ]; then
PERCENT=$(head -n 1 "$PROGRESS_FILE" 2>/dev/null || echo "0")
MESSAGE=$(tail -n 1 "$PROGRESS_FILE" 2>/dev/null || echo "Initializing...")
echo "$PERCENT"
echo "XXX"
echo "$MESSAGE"
echo "XXX"
if grep -q "DONE" "$PROGRESS_FILE" 2>/dev/null; then
break
fi
fi
sleep 1
ELAPSED=$((ELAPSED + 1))
done
) | dialog --title "fTPM Spoofer - TPM Initialization" --gauge "Starting..." 8 60 0
wait $BG_PID 2>/dev/null
CRITICAL_ERRORS=0
ERROR_DETAILS=""
if ! grep -q "TPM_CLEAR_SUCCESS: YES" "$STATUS_LOG" 2>/dev/null; then
CRITICAL_ERRORS=$((CRITICAL_ERRORS + 1))
ERROR_DETAILS="$ERROR_DETAILS\n• TPM CLEAR FAILED - TPM was not reset!"
fi
if ! grep -q "TPM2_TOOLS: SUCCESS" "$STATUS_LOG" 2>/dev/null; then
CRITICAL_ERRORS=$((CRITICAL_ERRORS + 1))
ERROR_DETAILS="$ERROR_DETAILS\n• TPM2 tools not installed properly"
fi
if ! grep -q "PRIMARY_SHA256: SUCCESS" "$STATUS_LOG" 2>/dev/null; then
CRITICAL_ERRORS=$((CRITICAL_ERRORS + 1))
ERROR_DETAILS="$ERROR_DETAILS\n• Primary SHA256 key creation failed"
fi
if ! grep -q "PERSISTENT_HANDLE: SUCCESS" "$STATUS_LOG" 2>/dev/null; then
CRITICAL_ERRORS=$((CRITICAL_ERRORS + 1))
ERROR_DETAILS="$ERROR_DETAILS\n• Persistent handle creation failed"
fi
cp "$STATUS_LOG" /var/log/carbonauth_status.log 2>/dev/null
cp "$ERROR_LOG" /var/log/carbonauth_errors.log 2>/dev/null
if [ $CRITICAL_ERRORS -gt 0 ]; then
dialog --title "CRITICAL ERROR - TPM Setup Failed" --colors --msgbox "\Z1\ZbTPM INITIALIZATION FAILED\Zn\n\nErrors detected:\n$ERROR_DETAILS\n\nLogs saved to:\n/var/log/carbonauth_errors.log\n\n\Z1This system may not have TPM 2.0\nor TPM is disabled in BIOS.\Zn\n\nClick OK to shutdown." 18 65
shutdown -h now
exit 1
else
dialog --title "TPM Setup Successful" --colors --msgbox "\Z2\Zb✓ TPM INITIALIZED SUCCESSFULLY\Zn\n\nCompleted operations:\n\n• TPM cleared and reset\n• Primary keys created (SHA256/SHA1)\n• Persistent handles configured\n• Hardware identity changed\n\n\Z2System is ready to reboot.\Zn\n\nClick OK to reboot now." 16 60
reboot
exit 0
fi
rm -f "$PROGRESS_FILE"
}