Merge pull request #28891 from poettering/pcrlock
new pcrlock tool for generating signed PCR policies for PCR 0, 1, 4, …
This commit is contained in:
Luca Boccassi
+8
-6
@@ -13,12 +13,14 @@
|
||||
#include "efivars-fundamental.h"
|
||||
#include "time-util.h"
|
||||
|
||||
#define EFI_VENDOR_LOADER SD_ID128_MAKE(4a,67,b0,82,0a,4c,41,cf,b6,c7,44,0b,29,bb,8c,4f)
|
||||
#define EFI_VENDOR_LOADER_STR SD_ID128_MAKE_UUID_STR(4a,67,b0,82,0a,4c,41,cf,b6,c7,44,0b,29,bb,8c,4f)
|
||||
#define EFI_VENDOR_GLOBAL SD_ID128_MAKE(8b,e4,df,61,93,ca,11,d2,aa,0d,00,e0,98,03,2b,8c)
|
||||
#define EFI_VENDOR_GLOBAL_STR SD_ID128_MAKE_UUID_STR(8b,e4,df,61,93,ca,11,d2,aa,0d,00,e0,98,03,2b,8c)
|
||||
#define EFI_VENDOR_SYSTEMD SD_ID128_MAKE(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
|
||||
#define EFI_VENDOR_SYSTEMD_STR SD_ID128_MAKE_UUID_STR(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
|
||||
#define EFI_VENDOR_LOADER SD_ID128_MAKE(4a,67,b0,82,0a,4c,41,cf,b6,c7,44,0b,29,bb,8c,4f)
|
||||
#define EFI_VENDOR_LOADER_STR SD_ID128_MAKE_UUID_STR(4a,67,b0,82,0a,4c,41,cf,b6,c7,44,0b,29,bb,8c,4f)
|
||||
#define EFI_VENDOR_GLOBAL SD_ID128_MAKE(8b,e4,df,61,93,ca,11,d2,aa,0d,00,e0,98,03,2b,8c)
|
||||
#define EFI_VENDOR_GLOBAL_STR SD_ID128_MAKE_UUID_STR(8b,e4,df,61,93,ca,11,d2,aa,0d,00,e0,98,03,2b,8c)
|
||||
#define EFI_VENDOR_DATABASE SD_ID128_MAKE(d7,19,b2,cb,3d,3a,45,96,a3,bc,da,d0,0e,67,65,6f)
|
||||
#define EFI_VENDOR_DATABASE_STR SD_ID128_MAKE_UUID_STR(d7,19,b2,cb,3d,3a,45,96,a3,bc,da,d0,0e,67,65,6f)
|
||||
#define EFI_VENDOR_SYSTEMD SD_ID128_MAKE(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
|
||||
#define EFI_VENDOR_SYSTEMD_STR SD_ID128_MAKE_UUID_STR(8c,f2,64,4b,4b,0b,42,8f,93,87,6d,87,60,50,dc,67)
|
||||
|
||||
#define EFI_VARIABLE_NON_VOLATILE UINT32_C(0x00000001)
|
||||
#define EFI_VARIABLE_BOOTSERVICE_ACCESS UINT32_C(0x00000002)
|
||||
|
||||
@@ -139,7 +139,8 @@ int enroll_tpm2(struct crypt_device *cd,
|
||||
const char *pubkey_path,
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
bool use_pin) {
|
||||
bool use_pin,
|
||||
const char *pcrlock_path) {
|
||||
|
||||
_cleanup_(erase_and_freep) void *secret = NULL;
|
||||
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *signature_json = NULL;
|
||||
@@ -207,6 +208,15 @@ int enroll_tpm2(struct crypt_device *cd,
|
||||
return log_debug_errno(r, "Failed to read TPM PCR signature: %m");
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy pcrlock_policy = {};
|
||||
if (pcrlock_path) {
|
||||
r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
flags |= TPM2_FLAGS_USE_PCRLOCK;
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL;
|
||||
r = tpm2_context_new(device, &tpm2_context);
|
||||
if (r < 0)
|
||||
@@ -248,6 +258,7 @@ int enroll_tpm2(struct crypt_device *cd,
|
||||
n_hash_pcr_values,
|
||||
pubkey ? &public : NULL,
|
||||
use_pin,
|
||||
pcrlock_path ? &pcrlock_policy : NULL,
|
||||
&policy);
|
||||
if (r < 0)
|
||||
return r;
|
||||
@@ -288,6 +299,7 @@ int enroll_tpm2(struct crypt_device *cd,
|
||||
pubkey_pcr_mask,
|
||||
signature_json,
|
||||
pin_str,
|
||||
pcrlock_path ? &pcrlock_policy : NULL,
|
||||
/* primary_alg= */ 0,
|
||||
blob, blob_size,
|
||||
policy.buffer, policy.size,
|
||||
|
||||
@@ -8,9 +8,9 @@
|
||||
#include "tpm2-util.h"
|
||||
|
||||
#if HAVE_TPM2
|
||||
int enroll_tpm2(struct crypt_device *cd, const void *volume_key, size_t volume_key_size, const char *device, uint32_t seal_key_handle, Tpm2PCRValue *hash_pcrs, size_t n_hash_pcrs, const char *pubkey_path, uint32_t pubkey_pcr_mask, const char *signature_path, bool use_pin);
|
||||
int enroll_tpm2(struct crypt_device *cd, const void *volume_key, size_t volume_key_size, const char *device, uint32_t seal_key_handle, Tpm2PCRValue *hash_pcrs, size_t n_hash_pcrs, const char *pubkey_path, uint32_t pubkey_pcr_mask, const char *signature_path, bool use_pin, const char *pcrlock_path);
|
||||
#else
|
||||
static inline int enroll_tpm2(struct crypt_device *cd, const void *volume_key, size_t volume_key_size, const char *device, uint32_t seal_key_handle, Tpm2PCRValue *hash_pcrs, size_t n_hash_pcrs, const char *pubkey_path, uint32_t pubkey_pcr_mask, const char *signature_path, bool use_pin) {
|
||||
static inline int enroll_tpm2(struct crypt_device *cd, const void *volume_key, size_t volume_key_size, const char *device, uint32_t seal_key_handle, Tpm2PCRValue *hash_pcrs, size_t n_hash_pcrs, const char *pubkey_path, uint32_t pubkey_pcr_mask, const char *signature_path, bool use_pin, const char *pcrlock_path) {
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
|
||||
"TPM2 key enrollment not supported.");
|
||||
}
|
||||
|
||||
@@ -43,6 +43,7 @@ static bool arg_tpm2_pin = false;
|
||||
static char *arg_tpm2_public_key = NULL;
|
||||
static uint32_t arg_tpm2_public_key_pcr_mask = 0;
|
||||
static char *arg_tpm2_signature = NULL;
|
||||
static char *arg_tpm2_pcrlock = NULL;
|
||||
static char *arg_node = NULL;
|
||||
static int *arg_wipe_slots = NULL;
|
||||
static size_t arg_n_wipe_slots = 0;
|
||||
@@ -65,6 +66,7 @@ STATIC_DESTRUCTOR_REGISTER(arg_tpm2_device, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_hash_pcr_values, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_public_key, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_signature, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_pcrlock, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_node, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_wipe_slots, freep);
|
||||
|
||||
@@ -144,6 +146,8 @@ static int help(void) {
|
||||
" --tpm2-signature=PATH\n"
|
||||
" Validate public key enrollment works with JSON signature\n"
|
||||
" file\n"
|
||||
" --tpm2-pcrlock=PATH\n"
|
||||
" Specify pcrlock policy to lock against\n"
|
||||
" --tpm2-with-pin=BOOL\n"
|
||||
" Whether to require entering a PIN to unlock the volume\n"
|
||||
"\nSee the %2$s for details.\n",
|
||||
@@ -173,6 +177,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
ARG_TPM2_PUBLIC_KEY_PCRS,
|
||||
ARG_TPM2_SIGNATURE,
|
||||
ARG_TPM2_PIN,
|
||||
ARG_TPM2_PCRLOCK,
|
||||
ARG_WIPE_SLOT,
|
||||
ARG_FIDO2_WITH_PIN,
|
||||
ARG_FIDO2_WITH_UP,
|
||||
@@ -200,11 +205,12 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
{ "tpm2-public-key-pcrs", required_argument, NULL, ARG_TPM2_PUBLIC_KEY_PCRS },
|
||||
{ "tpm2-signature", required_argument, NULL, ARG_TPM2_SIGNATURE },
|
||||
{ "tpm2-with-pin", required_argument, NULL, ARG_TPM2_PIN },
|
||||
{ "tpm2-pcrlock", required_argument, NULL, ARG_TPM2_PCRLOCK },
|
||||
{ "wipe-slot", required_argument, NULL, ARG_WIPE_SLOT },
|
||||
{}
|
||||
};
|
||||
|
||||
bool auto_hash_pcr_values = true, auto_public_key_pcr_mask = true;
|
||||
bool auto_hash_pcr_values = true, auto_public_key_pcr_mask = true, auto_pcrlock = true;
|
||||
int c, r;
|
||||
|
||||
assert(argc >= 0);
|
||||
@@ -412,6 +418,14 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
|
||||
break;
|
||||
|
||||
case ARG_TPM2_PCRLOCK:
|
||||
r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_tpm2_pcrlock);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
auto_pcrlock = false;
|
||||
break;
|
||||
|
||||
case ARG_WIPE_SLOT: {
|
||||
const char *p = optarg;
|
||||
|
||||
@@ -500,12 +514,23 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
}
|
||||
}
|
||||
|
||||
if (auto_pcrlock) {
|
||||
assert(!arg_tpm2_pcrlock);
|
||||
|
||||
r = tpm2_pcrlock_search_file(NULL, NULL, &arg_tpm2_pcrlock);
|
||||
if (r < 0) {
|
||||
if (r != -ENOENT)
|
||||
log_warning_errno(r, "Search for pcrlock.json failed, assuming it does not exist: %m");
|
||||
} else
|
||||
log_info("Automatically using pcrlock policy '%s'.", arg_tpm2_pcrlock);
|
||||
}
|
||||
|
||||
if (auto_public_key_pcr_mask) {
|
||||
assert(arg_tpm2_public_key_pcr_mask == 0);
|
||||
arg_tpm2_public_key_pcr_mask = INDEX_TO_MASK(uint32_t, TPM2_PCR_KERNEL_BOOT);
|
||||
}
|
||||
|
||||
if (auto_hash_pcr_values) {
|
||||
if (auto_hash_pcr_values && !arg_tpm2_pcrlock) { /* Only lock to PCR 7 by default if no pcrlock policy is around (which is a better replacement) */
|
||||
assert(arg_tpm2_n_hash_pcr_values == 0);
|
||||
|
||||
if (!GREEDY_REALLOC_APPEND(
|
||||
@@ -690,7 +715,7 @@ static int run(int argc, char *argv[]) {
|
||||
break;
|
||||
|
||||
case ENROLL_TPM2:
|
||||
slot = enroll_tpm2(cd, vk, vks, arg_tpm2_device, arg_tpm2_seal_key_handle, arg_tpm2_hash_pcr_values, arg_tpm2_n_hash_pcr_values, arg_tpm2_public_key, arg_tpm2_public_key_pcr_mask, arg_tpm2_signature, arg_tpm2_pin);
|
||||
slot = enroll_tpm2(cd, vk, vks, arg_tpm2_device, arg_tpm2_seal_key_handle, arg_tpm2_hash_pcr_values, arg_tpm2_n_hash_pcr_values, arg_tpm2_public_key, arg_tpm2_public_key_pcr_mask, arg_tpm2_signature, arg_tpm2_pin, arg_tpm2_pcrlock);
|
||||
break;
|
||||
|
||||
case _ENROLL_TYPE_INVALID:
|
||||
|
||||
@@ -109,6 +109,7 @@ _public_ int cryptsetup_token_open_pin(
|
||||
pubkey_pcr_mask,
|
||||
params.signature_path,
|
||||
pin_string,
|
||||
params.pcrlock_path,
|
||||
primary_alg,
|
||||
blob,
|
||||
blob_size,
|
||||
@@ -239,6 +240,7 @@ _public_ void cryptsetup_token_dump(
|
||||
crypt_log(cd, "\ttpm2-blob: %s\n", blob_str);
|
||||
crypt_log(cd, "\ttpm2-policy-hash:" CRYPT_DUMP_LINE_SEP "%s\n", policy_hash_str);
|
||||
crypt_log(cd, "\ttpm2-pin: %s\n", true_false(flags & TPM2_FLAGS_USE_PIN));
|
||||
crypt_log(cd, "\ttpm2-pcrlock: %s\n", true_false(flags & TPM2_FLAGS_USE_PCRLOCK));
|
||||
crypt_log(cd, "\ttpm2-salt: %s\n", true_false(salt));
|
||||
crypt_log(cd, "\ttpm2-srk: %s\n", true_false(srk_buf));
|
||||
}
|
||||
|
||||
@@ -22,6 +22,7 @@ int acquire_luks2_key(
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
const char *pin,
|
||||
const char *pcrlock_path,
|
||||
uint16_t primary_alg,
|
||||
const void *key_data,
|
||||
size_t key_data_size,
|
||||
@@ -76,6 +77,13 @@ int acquire_luks2_key(
|
||||
return log_error_errno(r, "Failed to load PCR signature: %m");
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy pcrlock_policy = {};
|
||||
if (FLAGS_SET(flags, TPM2_FLAGS_USE_PCRLOCK)) {
|
||||
r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL;
|
||||
r = tpm2_context_new(device, &tpm2_context);
|
||||
if (r < 0)
|
||||
@@ -88,6 +96,7 @@ int acquire_luks2_key(
|
||||
pubkey_pcr_mask,
|
||||
signature_json,
|
||||
pin,
|
||||
FLAGS_SET(flags, TPM2_FLAGS_USE_PCRLOCK) ? &pcrlock_policy : NULL,
|
||||
primary_alg,
|
||||
key_data, key_data_size,
|
||||
policy_hash, policy_hash_size,
|
||||
|
||||
@@ -14,6 +14,7 @@ int acquire_luks2_key(
|
||||
size_t pubkey_size,
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
const char *pcrlock_path,
|
||||
const char *pin,
|
||||
uint16_t primary_alg,
|
||||
const void *key_data,
|
||||
|
||||
@@ -62,6 +62,7 @@ int acquire_tpm2_key(
|
||||
size_t pubkey_size,
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
const char *pcrlock_path,
|
||||
uint16_t primary_alg,
|
||||
const char *key_file,
|
||||
size_t key_file_size,
|
||||
@@ -129,6 +130,14 @@ int acquire_tpm2_key(
|
||||
return log_error_errno(r, "Failed to load pcr signature: %m");
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy pcrlock_policy = {};
|
||||
|
||||
if (FLAGS_SET(flags, TPM2_FLAGS_USE_PCRLOCK)) {
|
||||
r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL;
|
||||
r = tpm2_context_new(device, &tpm2_context);
|
||||
if (r < 0)
|
||||
@@ -142,6 +151,7 @@ int acquire_tpm2_key(
|
||||
pubkey_pcr_mask,
|
||||
signature_json,
|
||||
/* pin= */ NULL,
|
||||
FLAGS_SET(flags, TPM2_FLAGS_USE_PCRLOCK) ? &pcrlock_policy : NULL,
|
||||
primary_alg,
|
||||
blob,
|
||||
blob_size,
|
||||
@@ -189,6 +199,7 @@ int acquire_tpm2_key(
|
||||
pubkey_pcr_mask,
|
||||
signature_json,
|
||||
b64_salted_pin,
|
||||
pcrlock_path ? &pcrlock_policy : NULL,
|
||||
primary_alg,
|
||||
blob,
|
||||
blob_size,
|
||||
|
||||
@@ -20,6 +20,7 @@ int acquire_tpm2_key(
|
||||
size_t pubkey_size,
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
const char *pcrlock_path,
|
||||
uint16_t primary_alg,
|
||||
const char *key_file,
|
||||
size_t key_file_size,
|
||||
@@ -72,6 +73,7 @@ static inline int acquire_tpm2_key(
|
||||
size_t pubkey_size,
|
||||
uint32_t pubkey_pcr_mask,
|
||||
const char *signature_path,
|
||||
const char *pcrlock_path,
|
||||
uint16_t primary_alg,
|
||||
const char *key_file,
|
||||
size_t key_file_size,
|
||||
|
||||
@@ -100,6 +100,7 @@ static bool arg_tpm2_device_auto = false;
|
||||
static uint32_t arg_tpm2_pcr_mask = UINT32_MAX;
|
||||
static char *arg_tpm2_signature = NULL;
|
||||
static bool arg_tpm2_pin = false;
|
||||
static char *arg_tpm2_pcrlock = NULL;
|
||||
static bool arg_headless = false;
|
||||
static usec_t arg_token_timeout_usec = 30*USEC_PER_SEC;
|
||||
static unsigned arg_tpm2_measure_pcr = UINT_MAX; /* This and the following field is about measuring the unlocked volume key to the local TPM */
|
||||
@@ -116,6 +117,7 @@ STATIC_DESTRUCTOR_REGISTER(arg_fido2_rp_id, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_device, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_signature, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_measure_banks, strv_freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_pcrlock, freep);
|
||||
|
||||
static const char* const passphrase_type_table[_PASSPHRASE_TYPE_MAX] = {
|
||||
[PASSPHRASE_REGULAR] = "passphrase",
|
||||
@@ -424,6 +426,16 @@ static int parse_one_option(const char *option) {
|
||||
|
||||
arg_tpm2_pin = r;
|
||||
|
||||
} else if ((val = startswith(option, "tpm2-pcrlock="))) {
|
||||
|
||||
if (!path_is_absolute(val))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
|
||||
"TPM2 pcrlock policy path \"%s\" is not absolute, refusing.", val);
|
||||
|
||||
r = free_and_strdup(&arg_tpm2_pcrlock, val);
|
||||
if (r < 0)
|
||||
return log_oom();
|
||||
|
||||
} else if ((val = startswith(option, "tpm2-measure-pcr="))) {
|
||||
unsigned pcr;
|
||||
|
||||
@@ -1605,6 +1617,7 @@ static int attach_luks2_by_tpm2_via_plugin(
|
||||
.search_pcr_mask = arg_tpm2_pcr_mask,
|
||||
.device = arg_tpm2_device,
|
||||
.signature_path = arg_tpm2_signature,
|
||||
.pcrlock_path = arg_tpm2_pcrlock,
|
||||
};
|
||||
|
||||
if (!libcryptsetup_plugins_support())
|
||||
@@ -1664,6 +1677,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
||||
/* pubkey= */ NULL, /* pubkey_size= */ 0,
|
||||
/* pubkey_pcr_mask= */ 0,
|
||||
/* signature_path= */ NULL,
|
||||
/* pcrlock_path= */ NULL,
|
||||
/* primary_alg= */ 0,
|
||||
key_file, arg_keyfile_size, arg_keyfile_offset,
|
||||
key_data, key_data_size,
|
||||
@@ -1761,6 +1775,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
||||
pubkey, pubkey_size,
|
||||
pubkey_pcr_mask,
|
||||
arg_tpm2_signature,
|
||||
arg_tpm2_pcrlock,
|
||||
primary_alg,
|
||||
/* key_file= */ NULL, /* key_file_size= */ 0, /* key_file_offset= */ 0, /* no key file */
|
||||
blob, blob_size,
|
||||
|
||||
+39
-3
@@ -152,6 +152,7 @@ static Tpm2PCRValue *arg_tpm2_hash_pcr_values = NULL;
|
||||
static size_t arg_tpm2_n_hash_pcr_values = 0;
|
||||
static char *arg_tpm2_public_key = NULL;
|
||||
static uint32_t arg_tpm2_public_key_pcr_mask = 0;
|
||||
static char *arg_tpm2_pcrlock = NULL;
|
||||
static bool arg_split = false;
|
||||
static GptPartitionType *arg_filter_partitions = NULL;
|
||||
static size_t arg_n_filter_partitions = 0;
|
||||
@@ -175,6 +176,7 @@ STATIC_DESTRUCTOR_REGISTER(arg_certificate, X509_freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_device, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_hash_pcr_values, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_public_key, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_pcrlock, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_filter_partitions, freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_image_policy, image_policy_freep);
|
||||
STATIC_DESTRUCTOR_REGISTER(arg_copy_from, strv_freep);
|
||||
@@ -3821,8 +3823,21 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
|
||||
return log_error_errno(r, "Could not get hash mask: %m");
|
||||
}
|
||||
|
||||
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy pcrlock_policy = {};
|
||||
if (arg_tpm2_pcrlock) {
|
||||
r = tpm2_pcrlock_policy_load(arg_tpm2_pcrlock, &pcrlock_policy);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
TPM2B_DIGEST policy = TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE);
|
||||
r = tpm2_calculate_sealing_policy(arg_tpm2_hash_pcr_values, arg_tpm2_n_hash_pcr_values, pubkey ? &public : NULL, /* use_pin= */ false, &policy);
|
||||
r = tpm2_calculate_sealing_policy(
|
||||
arg_tpm2_hash_pcr_values,
|
||||
arg_tpm2_n_hash_pcr_values,
|
||||
pubkey ? &public : NULL,
|
||||
/* use_pin= */ false,
|
||||
arg_tpm2_pcrlock ? &pcrlock_policy : NULL,
|
||||
&policy);
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Could not calculate sealing policy digest: %m");
|
||||
|
||||
@@ -6435,6 +6450,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
ARG_TPM2_PCRS,
|
||||
ARG_TPM2_PUBLIC_KEY,
|
||||
ARG_TPM2_PUBLIC_KEY_PCRS,
|
||||
ARG_TPM2_PCRLOCK,
|
||||
ARG_SPLIT,
|
||||
ARG_INCLUDE_PARTITIONS,
|
||||
ARG_EXCLUDE_PARTITIONS,
|
||||
@@ -6472,6 +6488,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
{ "tpm2-pcrs", required_argument, NULL, ARG_TPM2_PCRS },
|
||||
{ "tpm2-public-key", required_argument, NULL, ARG_TPM2_PUBLIC_KEY },
|
||||
{ "tpm2-public-key-pcrs", required_argument, NULL, ARG_TPM2_PUBLIC_KEY_PCRS },
|
||||
{ "tpm2-pcrlock", required_argument, NULL, ARG_TPM2_PCRLOCK },
|
||||
{ "split", required_argument, NULL, ARG_SPLIT },
|
||||
{ "include-partitions", required_argument, NULL, ARG_INCLUDE_PARTITIONS },
|
||||
{ "exclude-partitions", required_argument, NULL, ARG_EXCLUDE_PARTITIONS },
|
||||
@@ -6485,7 +6502,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
{}
|
||||
};
|
||||
|
||||
bool auto_hash_pcr_values = true, auto_public_key_pcr_mask = true;
|
||||
bool auto_hash_pcr_values = true, auto_public_key_pcr_mask = true, auto_pcrlock = true;
|
||||
int c, r;
|
||||
|
||||
assert(argc >= 0);
|
||||
@@ -6728,6 +6745,14 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
|
||||
break;
|
||||
|
||||
case ARG_TPM2_PCRLOCK:
|
||||
r = parse_path_argument(optarg, /* suppress_root= */ false, &arg_tpm2_pcrlock);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
auto_pcrlock = false;
|
||||
break;
|
||||
|
||||
case ARG_SPLIT:
|
||||
r = parse_boolean_argument("--split=", optarg, NULL);
|
||||
if (r < 0)
|
||||
@@ -6935,12 +6960,23 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
|
||||
"A path to an image file must be specified when --split is used.");
|
||||
|
||||
if (auto_pcrlock) {
|
||||
assert(!arg_tpm2_pcrlock);
|
||||
|
||||
r = tpm2_pcrlock_search_file(NULL, NULL, &arg_tpm2_pcrlock);
|
||||
if (r < 0) {
|
||||
if (r != -ENOENT)
|
||||
log_warning_errno(r, "Search for pcrlock.json failed, assuming it does not exist: %m");
|
||||
} else
|
||||
log_info("Automatically using pcrlock policy '%s'.", arg_tpm2_pcrlock);
|
||||
}
|
||||
|
||||
if (auto_public_key_pcr_mask) {
|
||||
assert(arg_tpm2_public_key_pcr_mask == 0);
|
||||
arg_tpm2_public_key_pcr_mask = INDEX_TO_MASK(uint32_t, TPM2_PCR_KERNEL_BOOT);
|
||||
}
|
||||
|
||||
if (auto_hash_pcr_values) {
|
||||
if (auto_hash_pcr_values && !arg_tpm2_pcrlock) { /* Only lock to PCR 7 if no pcr policy is specified. */
|
||||
assert(arg_tpm2_n_hash_pcr_values == 0);
|
||||
|
||||
if (!GREEDY_REALLOC_APPEND(
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
|
||||
executables += [
|
||||
libexec_template + {
|
||||
'name' : 'systemd-pcrlock',
|
||||
'conditions' : [
|
||||
'HAVE_OPENSSL',
|
||||
'HAVE_TPM2'
|
||||
],
|
||||
'sources' : files(
|
||||
'pcrlock.c',
|
||||
'pcrlock-firmware.c',
|
||||
'pehash.c',
|
||||
),
|
||||
'dependencies' : [
|
||||
libm,
|
||||
libopenssl,
|
||||
tpm2,
|
||||
],
|
||||
},
|
||||
]
|
||||
|
||||
if conf.get('HAVE_OPENSSL') == 1 and conf.get('HAVE_TPM2') == 1
|
||||
install_data('pcrlock.d/350-action-efi-application.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/400-secureboot-separator.pcrlock.d/300-0x00000000.pcrlock', install_dir : pcrlockdir / '400-secureboot-separator.pcrlock.d')
|
||||
install_data('pcrlock.d/400-secureboot-separator.pcrlock.d/600-0xffffffff.pcrlock', install_dir : pcrlockdir / '400-secureboot-separator.pcrlock.d')
|
||||
install_data('pcrlock.d/500-separator.pcrlock.d/300-0x00000000.pcrlock', install_dir : pcrlockdir / '500-separator.pcrlock.d')
|
||||
install_data('pcrlock.d/500-separator.pcrlock.d/600-0xffffffff.pcrlock', install_dir : pcrlockdir / '500-separator.pcrlock.d')
|
||||
install_data('pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/300-present.pcrlock', install_dir : pcrlockdir / '700-action-efi-exit-boot-services.pcrlock.d')
|
||||
install_data('pcrlock.d/700-action-efi-exit-boot-services.pcrlock.d/600-absent.pcrlock', install_dir : pcrlockdir / '700-action-efi-exit-boot-services.pcrlock.d')
|
||||
install_data('pcrlock.d/750-enter-initrd.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/800-leave-initrd.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/850-sysinit.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/900-ready.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/950-shutdown.pcrlock', install_dir : pcrlockdir)
|
||||
install_data('pcrlock.d/990-final.pcrlock', install_dir : pcrlockdir)
|
||||
endif
|
||||
@@ -0,0 +1,168 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
|
||||
#include <openssl/evp.h>
|
||||
|
||||
#include "pcrlock-firmware.h"
|
||||
#include "unaligned.h"
|
||||
|
||||
static int tcg_pcr_event2_digests_size(
|
||||
const TCG_EfiSpecIdEventAlgorithmSize *algorithms,
|
||||
size_t n_algorithms,
|
||||
size_t *ret) {
|
||||
|
||||
size_t m = 0;
|
||||
|
||||
assert(algorithms || n_algorithms == 0);
|
||||
assert(ret);
|
||||
|
||||
FOREACH_ARRAY(a, algorithms, n_algorithms) {
|
||||
|
||||
if (a->digestSize > UINT32_MAX - offsetof(TPMT_HA, digest) - m)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Accumulated hash size too large");
|
||||
|
||||
m += offsetof(TPMT_HA, digest) + a->digestSize;
|
||||
}
|
||||
|
||||
*ret = m;
|
||||
return 0;
|
||||
}
|
||||
|
||||
int validate_firmware_event(
|
||||
const TCG_PCR_EVENT2 *event,
|
||||
size_t left,
|
||||
const TCG_EfiSpecIdEventAlgorithmSize *algorithms,
|
||||
size_t n_algorithms,
|
||||
const TCG_PCR_EVENT2 **ret_next_event,
|
||||
size_t *ret_left,
|
||||
const void **ret_payload,
|
||||
size_t *ret_payload_size) {
|
||||
|
||||
size_t digests_size;
|
||||
int r;
|
||||
|
||||
assert(event);
|
||||
assert(algorithms || n_algorithms == 0);
|
||||
assert(ret_next_event);
|
||||
assert(ret_left);
|
||||
|
||||
if (left == 0) {
|
||||
*ret_next_event = NULL;
|
||||
*ret_left = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
r = tcg_pcr_event2_digests_size(algorithms, n_algorithms, &digests_size);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
if (left < (uint64_t) offsetof(TCG_PCR_EVENT2, digests.digests) + (uint64_t) digests_size + sizeof(uint32_t))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event header too short.");
|
||||
|
||||
if (event->digests.count != n_algorithms)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Number of digests in event doesn't match log.");
|
||||
|
||||
uint32_t eventSize = unaligned_read_ne32((const uint8_t*) &event->digests.digests + digests_size);
|
||||
uint64_t size = (uint64_t) offsetof(TCG_PCR_EVENT2, digests.digests) + (uint64_t) digests_size + sizeof(uint32_t) + eventSize;
|
||||
|
||||
if (size > left)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event header too short.");
|
||||
|
||||
*ret_next_event = (const TCG_PCR_EVENT2*) ((const uint8_t*) event + size);
|
||||
*ret_left = left - size;
|
||||
|
||||
if (ret_payload)
|
||||
*ret_payload = (const uint8_t*) &event->digests.digests + digests_size + sizeof(uint32_t);
|
||||
if (ret_payload_size)
|
||||
*ret_payload_size = eventSize;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int validate_firmware_header(
|
||||
const void *start,
|
||||
size_t size,
|
||||
const TCG_EfiSpecIdEventAlgorithmSize **ret_algorithms,
|
||||
size_t *ret_n_algorithms,
|
||||
const TCG_PCR_EVENT2 **ret_first,
|
||||
size_t *ret_left) {
|
||||
|
||||
assert(start || size == 0);
|
||||
assert(ret_algorithms);
|
||||
assert(ret_n_algorithms);
|
||||
assert(ret_first);
|
||||
assert(ret_left);
|
||||
|
||||
if (size < offsetof(TCG_PCClientPCREvent, event))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log too short for TCG_PCClientPCREvent.");
|
||||
|
||||
const TCG_PCClientPCREvent *h = start;
|
||||
|
||||
if (size < (uint64_t) offsetof(TCG_PCClientPCREvent, event) + (uint64_t) h->eventDataSize)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log too short for TCG_PCClientPCREvent events data.");
|
||||
|
||||
if (h->pcrIndex != 0)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header has unexpected PCR index %" PRIu32, h->pcrIndex);
|
||||
if (h->eventType != EV_NO_ACTION)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header has unexpected event type 0x%" PRIx32, h->eventType);
|
||||
if (!memeqzero(h->digest, sizeof(h->digest)))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header has unexpected non-zero digest.");
|
||||
|
||||
if (h->eventDataSize < offsetof(TCG_EfiSpecIDEvent, digestSizes))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header too short for TCG_EfiSpecIdEvent.");
|
||||
|
||||
const TCG_EfiSpecIDEvent *id = (const TCG_EfiSpecIDEvent*) h->event;
|
||||
|
||||
/* Signature as per "TCG PC Client Specific Platform Firmware Profile Specification"
|
||||
* (https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/),
|
||||
* section 10.4.5.1 "Specification ID Version Event" (at least in version 1.05 Revision 23 of the
|
||||
* spec) */
|
||||
if (memcmp(id->signature,
|
||||
(const uint8_t[]) { 0x53, 0x70, 0x65, 0x63, 0x20, 0x49, 0x44, 0x20, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30, 0x33, 0x00 },
|
||||
sizeof(id->signature)) != 0)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Missing TPM2 event log signature.");
|
||||
|
||||
if (id->numberOfAlgorithms <= 0)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Number of advertised hash algorithms is zero.");
|
||||
if (id->numberOfAlgorithms > UINT32_MAX / sizeof(TCG_EfiSpecIdEventAlgorithmSize))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Number of advertised hash algorithms too large.");
|
||||
|
||||
log_debug("TPM PC Client Platform Firmware Profile: family %u.%u, revision %u.%u",
|
||||
id->specVersionMajor, id->specVersionMinor,
|
||||
id->specErrata / 100, id->specErrata % 100);
|
||||
|
||||
if (h->eventDataSize < (uint64_t) offsetof(TCG_EfiSpecIDEvent, digestSizes) + (uint64_t) (id->numberOfAlgorithms * sizeof(TCG_EfiSpecIdEventAlgorithmSize)) + 1U)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header doesn't fit all algorithms.");
|
||||
|
||||
uint8_t vendorInfoSize = *((const uint8_t*) id + offsetof(TCG_EfiSpecIDEvent, digestSizes) + (id->numberOfAlgorithms * sizeof(TCG_EfiSpecIdEventAlgorithmSize)));
|
||||
if (h->eventDataSize != offsetof(TCG_EfiSpecIDEvent, digestSizes) + (id->numberOfAlgorithms * sizeof(TCG_EfiSpecIdEventAlgorithmSize)) + 1U + vendorInfoSize)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Event log header doesn't fit vendor info.");
|
||||
|
||||
for (size_t i = 0; i < id->numberOfAlgorithms; i++) {
|
||||
const EVP_MD *implementation;
|
||||
const char *a;
|
||||
|
||||
a = tpm2_hash_alg_to_string(id->digestSizes[i].algorithmId);
|
||||
if (!a) {
|
||||
log_notice("Event log advertises unknown hash algorithm 0x%4x, can't validate.", id->digestSizes[i].algorithmId);
|
||||
continue;
|
||||
}
|
||||
|
||||
implementation = EVP_get_digestbyname(a);
|
||||
if (!implementation) {
|
||||
log_notice("Event log advertises hash algorithm '%s' we don't implement, can't validate.", a);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (EVP_MD_size(implementation) != id->digestSizes[i].digestSize)
|
||||
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Advertised digest size for '%s' is wrong, refusing.", a);
|
||||
}
|
||||
|
||||
*ret_algorithms = id->digestSizes;
|
||||
*ret_n_algorithms = id->numberOfAlgorithms;
|
||||
|
||||
size_t offset = offsetof(TCG_PCClientPCREvent, event) + h->eventDataSize;
|
||||
*ret_first = (TCG_PCR_EVENT2*) ((const uint8_t*) h + offset);
|
||||
*ret_left = size - offset;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
#pragma once
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include "tpm2-event-log.h"
|
||||
#include "tpm2-util.h"
|
||||
|
||||
int validate_firmware_event(
|
||||
const TCG_PCR_EVENT2 *event,
|
||||
size_t left,
|
||||
const TCG_EfiSpecIdEventAlgorithmSize *algorithms,
|
||||
size_t n_algorithms,
|
||||
const TCG_PCR_EVENT2 **ret_next_event,
|
||||
size_t *ret_left,
|
||||
const void **ret_payload,
|
||||
size_t *ret_payload_size);
|
||||
|
||||
int validate_firmware_header(
|
||||
const void *start,
|
||||
size_t size,
|
||||
const TCG_EfiSpecIdEventAlgorithmSize **ret_algorithms,
|
||||
size_t *ret_n_algorithms,
|
||||
const TCG_PCR_EVENT2 **ret_first,
|
||||
size_t *ret_left);
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":4,"digests":[{"hashAlg":"sha1","digest":"cd0fdb4531a6ec41be2753ba042637d6e5f7f256"},{"hashAlg":"sha256","digest":"3d6772b4f84ed47595d72a2c4c5ffd15f5bb72c7507fe26f2aaee2c69d5633ba"},{"hashAlg":"sha384","digest":"77a0dab2312b4e1e57a84d865a21e5b2ee8d677a21012ada819d0a98988078d3d740f6346bfe0abaa938ca20439a8d71"},{"hashAlg":"sha512","digest":"03020279c5ea3676d6630c82a9931343225e8eab81529b65c786aeb6a445d3852a34dd193178f938b6b47345a72d4b647df309c971f7c02f0ede296a136a1086"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":7,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":7,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":0,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":1,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":2,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":3,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":4,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":5,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]},{"pcr":6,"digests":[{"hashAlg":"sha1","digest":"9069ca78e7450a285173431b3e52c5c25299e473"},{"hashAlg":"sha256","digest":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"},{"hashAlg":"sha384","digest":"394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0"},{"hashAlg":"sha512","digest":"ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":0,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":1,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":2,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":3,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":4,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":5,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]},{"pcr":6,"digests":[{"hashAlg":"sha1","digest":"d9be6524a5f5047db5866813acf3277892a7a30a"},{"hashAlg":"sha256","digest":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e"},{"hashAlg":"sha384","digest":"4a06b879c7eedbe01c945d46b5bd785b59203dce81ea6a1206c28091ca285365f760d9167778f0dc1763d4854aafd40a"},{"hashAlg":"sha512","digest":"ea71bb243b0b2db729b9eb88e3c55a3f490fbff23457825051224a1fe6e6d3f480590cfa3a4a6b12c622d6ac366feb03cd17004ed004cb3f0d52731626946679"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":5,"digests":[{"hashAlg":"sha1","digest":"443a6b7b82b7af564f2e393cd9d5a388b7fa4a98"},{"hashAlg":"sha256","digest":"d8043d6b7b85ad358eb3b6ae6a873ab7ef23a26352c5dc4faa5aeedacf5eb41b"},{"hashAlg":"sha384","digest":"214b0bef1379756011344877743fdc2a5382bac6e70362d624ccf3f654407c1b4badf7d8f9295dd3dabdef65b27677e0"},{"hashAlg":"sha512","digest":"0fed3a4c9552021436534d27f3adb481e22b50b29e4b37a63f518540a651a174f149b69f500b0bdb2cb3bf4e0e21e0781451090af33e88f6bee4cbebd15c1668"}]},{"pcr":5,"digests":[{"hashAlg":"sha1","digest":"475545ddc978d7bfd036facc7e2e987f48189f0d"},{"hashAlg":"sha256","digest":"b54f7542cbd872a81a9d9dea839b2b8d747c7ebd5ea6615c40f42f44a6dbeba0"},{"hashAlg":"sha384","digest":"0a2e01c85deae718a530ad8c6d20a84009babe6c8989269e950d8cf440c6e997695e64d455c4174a652cd080f6230b74"},{"hashAlg":"sha512","digest":"1bb30cdbd6da78fe2a8a161ef51176e22d64dce305b40b47243673af64a2b16fca6182116433e3891be94773f6d7d411275721d5bf7d40ea51a274d5c891637c"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"b1b01d5f73f321eb70e76f8a0e241ac0a3fa4a6e"},{"hashAlg":"sha256","digest":"51e6b92f405d1f98d96e3de343d61d420ad6923b25de21d766f9298192f14fed"},{"hashAlg":"sha384","digest":"687eef3a3a8c716439b5ed583657e8668401630c321f2f35d19b953ddf20b68a96474d0c2e5f0e1757bfa5ba70b9fc32"},{"hashAlg":"sha512","digest":"ab0ddfdabe43f1d06b3e58fbe17439a0f7f552e9e228d85665d485ececf7e733bae4cd7e0a17e5456e2ee7e412f5a0f37de05a782cce781e173ee26958de7f30"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"865e1ff2cc5b8db815313b23fe3d8b561212f5d1"},{"hashAlg":"sha256","digest":"3be261aff7db92bf507eae947f4003ffa2bcad0bffe3524601d62d0bc8be7135"},{"hashAlg":"sha384","digest":"9c0743b7a2e1ee06c70b7137b763cd2205c26ced274149959b05bd5a51bfa96b4fedaa4f87398b5c88986d1ff0879910"},{"hashAlg":"sha512","digest":"01b8ca86b9f8fac967f383380aff7cdffd2ef0c496574517c25398f7c74aa611821dd469ba021b2aa9b9a7232865708ca45c79368f2e7fffda3dd6b308264008"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"aeabcf402223916e804cce79778a55d5a9276983"},{"hashAlg":"sha256","digest":"730bb5a583ba880c277e656d2dc8aba1a314a11b14d25b05153d2bab82567a48"},{"hashAlg":"sha384","digest":"955cc8939f81d862b3119aabe612fd36bf91668bb62397f5e4126085d79ba6d7cbfa4e3a2345747f0b476ce4b1cbc2c9"},{"hashAlg":"sha512","digest":"a9eb62cdd1cd8292b6325a8ee3770d6f1b613426a749e17ffba8f90bdd6c41806468fb79d01276de7cc791877dfebae165d4ed07585154acf96652c6db92acc1"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"75c0533730caf1f78561c0883fb87bc8d98ef04b"},{"hashAlg":"sha256","digest":"b24d6d33736ecd5604a4b17bc9c6481039fac362bb7df044ef1c10a2bfd21db6"},{"hashAlg":"sha384","digest":"23ed5781da39fe6dc17f79478aeeb9eb2bca1d776061da188e10f9c85f7933fb39cfdba50f39af8aed24e5b45b80d006"},{"hashAlg":"sha512","digest":"ca6616f94a209e53f6fdc526b473172eb4b2157cf4809c31e36ad52db614ed352e68407be53c238ba17a561c4fde43f4a859aa8711f9781a0c934296d4d7571b"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"53669f193b2174641c72654b5c3e5b67950334ae"},{"hashAlg":"sha256","digest":"08434ba9cdf55a02284e2913400586cd289878e0f055f7bb0b07ce392caeb989"},{"hashAlg":"sha384","digest":"186e2d6603b9755221b7ef894dd52b1154b48ef4786aec06ab6f7709e639715e89bd59fa80736bb45f0ca88583c212c1"},{"hashAlg":"sha512","digest":"9e5549deb36fc48768cb80e03bc91c36cf549ff5921e05bab5b68faefda7fac8c8a0755db783cbf1c1b98c80dc22ef06ff3f4a0a16704749f5cd4acf40e42a94"}]}]}
|
||||
@@ -0,0 +1 @@
|
||||
{"records":[{"pcr":11,"digests":[{"hashAlg":"sha1","digest":"d594c2cc0a53025004791399d80e20852af4c988"},{"hashAlg":"sha256","digest":"2443630b4620165c8b173e7265e17526fe2787ae594364dd6d839ad58f2fc007"},{"hashAlg":"sha384","digest":"90697eec39ed47f2b7ed278aa6fe6a1c073fcc7f3af54299fb95ac8a18c771acbac71e25b5a5639554943bfdfab76737"},{"hashAlg":"sha512","digest":"b3d9598ca0aa5da28be1c97a45d53cc5c72a80e61c439c8bf3e89c5c0661f49df8fa34019a21cd5e31261ae3a3a87ef4592d8010aad6a5ecdc9dbaae38cd1470"}]}]}
|
||||
@@ -0,0 +1,246 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include "alloc-util.h"
|
||||
#include "hexdecoct.h"
|
||||
#include "pe-binary.h"
|
||||
#include "pehash.h"
|
||||
#include "sort-util.h"
|
||||
#include "stat-util.h"
|
||||
#include "string-table.h"
|
||||
|
||||
/* Implements:
|
||||
*
|
||||
* https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx
|
||||
* → Section "Calculating the PE Image Hash"
|
||||
*/
|
||||
|
||||
#define IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE 4U
|
||||
|
||||
static int hash_file(int fd, EVP_MD_CTX *md_ctx, uint64_t offset, uint64_t size) {
|
||||
uint8_t buffer[64*1024];
|
||||
|
||||
log_debug("Hashing %" PRIu64 " @ %" PRIu64 " → %" PRIu64, size, offset, offset + size);
|
||||
|
||||
while (size > 0) {
|
||||
size_t m = MIN(size, sizeof(buffer));
|
||||
ssize_t n;
|
||||
|
||||
n = pread(fd, buffer, m, offset);
|
||||
if (n < 0)
|
||||
return log_debug_errno(errno, "Failed to read file for hashing: %m");
|
||||
if ((size_t) n != m)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Short read while hashing.");
|
||||
|
||||
if (EVP_DigestUpdate(md_ctx, buffer, m) != 1)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to hash data.");
|
||||
|
||||
offset += m;
|
||||
size -= m;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int section_offset_cmp(const IMAGE_SECTION_HEADER *a, const IMAGE_SECTION_HEADER *b) {
|
||||
return CMP(ASSERT_PTR(a)->PointerToRawData, ASSERT_PTR(b)->PointerToRawData);
|
||||
}
|
||||
|
||||
int pe_hash(int fd,
|
||||
const EVP_MD *md,
|
||||
void **ret_hash,
|
||||
size_t *ret_hash_size) {
|
||||
|
||||
_cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
|
||||
_cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
|
||||
_cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
|
||||
_cleanup_free_ PeHeader *pe_header = NULL;
|
||||
const IMAGE_DATA_DIRECTORY *certificate_table;
|
||||
struct stat st;
|
||||
uint64_t p, q;
|
||||
int r;
|
||||
|
||||
assert(fd >= 0);
|
||||
assert(md);
|
||||
assert(ret_hash_size);
|
||||
assert(ret_hash);
|
||||
|
||||
if (fstat(fd, &st) < 0)
|
||||
return log_debug_errno(errno, "Failed to stat file: %m");
|
||||
r = stat_verify_regular(&st);
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Not a regular file: %m");
|
||||
|
||||
r = pe_load_headers(fd, &dos_header, &pe_header);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
r = pe_load_sections(fd, dos_header, pe_header, §ions);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
certificate_table = pe_header_get_data_directory(pe_header, IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE);
|
||||
if (!certificate_table)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "File lacks certificate table.");
|
||||
|
||||
mdctx = EVP_MD_CTX_new();
|
||||
if (!mdctx)
|
||||
return log_oom_debug();
|
||||
|
||||
if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
|
||||
|
||||
/* Everything from beginning of file to CheckSum field in PE header */
|
||||
p = (uint64_t) dos_header->e_lfanew +
|
||||
offsetof(PeHeader, optional.CheckSum);
|
||||
r = hash_file(fd, mdctx, 0, p);
|
||||
if (r < 0)
|
||||
return r;
|
||||
p += sizeof(le32_t);
|
||||
|
||||
/* Everything between the CheckSum field and the Image Data Directory Entry for the Certification Table */
|
||||
q = (uint64_t) dos_header->e_lfanew +
|
||||
PE_HEADER_OPTIONAL_FIELD_OFFSET(pe_header, DataDirectory[IMAGE_DATA_DIRECTORY_INDEX_CERTIFICATION_TABLE]);
|
||||
r = hash_file(fd, mdctx, p, q - p);
|
||||
if (r < 0)
|
||||
return r;
|
||||
q += sizeof(IMAGE_DATA_DIRECTORY);
|
||||
|
||||
/* The rest of the header + the section table */
|
||||
p = pe_header->optional.SizeOfHeaders;
|
||||
if (p < q)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "SizeOfHeaders too short.");
|
||||
r = hash_file(fd, mdctx, q, p - q);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
/* Sort by location in file */
|
||||
typesafe_qsort(sections, pe_header->pe.NumberOfSections, section_offset_cmp);
|
||||
|
||||
FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
|
||||
r = hash_file(fd, mdctx, section->PointerToRawData, section->SizeOfRawData);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
p += section->SizeOfRawData;
|
||||
}
|
||||
|
||||
if ((uint64_t) st.st_size > p) {
|
||||
|
||||
if (st.st_size - p < certificate_table->Size)
|
||||
return log_debug_errno(errno, "No space for certificate table, refusing.");
|
||||
|
||||
r = hash_file(fd, mdctx, p, st.st_size - p - certificate_table->Size);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
int hsz = EVP_MD_CTX_size(mdctx);
|
||||
if (hsz < 0)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
|
||||
|
||||
unsigned hash_size = (unsigned) hsz;
|
||||
_cleanup_free_ void *hash = malloc(hsz);
|
||||
if (!hash)
|
||||
return log_oom_debug();
|
||||
|
||||
if (EVP_DigestFinal_ex(mdctx, hash, &hash_size) != 1)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
|
||||
|
||||
assert(hash_size == (unsigned) hsz);
|
||||
|
||||
*ret_hash = TAKE_PTR(hash);
|
||||
*ret_hash_size = hash_size;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
typedef void* SectionHashArray[_UNIFIED_SECTION_MAX];
|
||||
|
||||
static void section_hash_array_done(SectionHashArray *array) {
|
||||
assert(array);
|
||||
|
||||
for (size_t i = 0; i < _UNIFIED_SECTION_MAX; i++)
|
||||
free((*array)[i]);
|
||||
}
|
||||
|
||||
int uki_hash(int fd,
|
||||
const EVP_MD *md,
|
||||
void* ret_hashes[static _UNIFIED_SECTION_MAX],
|
||||
size_t *ret_hash_size) {
|
||||
|
||||
_cleanup_(section_hash_array_done) SectionHashArray hashes = {};
|
||||
_cleanup_free_ IMAGE_SECTION_HEADER *sections = NULL;
|
||||
_cleanup_free_ IMAGE_DOS_HEADER *dos_header = NULL;
|
||||
_cleanup_free_ PeHeader *pe_header = NULL;
|
||||
int r;
|
||||
|
||||
assert(fd >= 0);
|
||||
assert(ret_hashes);
|
||||
assert(ret_hash_size);
|
||||
|
||||
r = pe_load_headers(fd, &dos_header, &pe_header);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
r = pe_load_sections(fd, dos_header, pe_header, §ions);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
int hsz = EVP_MD_size(md);
|
||||
if (hsz < 0)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get hash size.");
|
||||
|
||||
FOREACH_ARRAY(section, sections, pe_header->pe.NumberOfSections) {
|
||||
_cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *mdctx = NULL;
|
||||
_cleanup_free_ char *n = NULL;
|
||||
ssize_t i;
|
||||
|
||||
n = memdup_suffix0(section->Name, sizeof(section->Name));
|
||||
if (!n)
|
||||
return log_oom_debug();
|
||||
|
||||
i = string_table_lookup(unified_sections, _UNIFIED_SECTION_MAX, n);
|
||||
if (i < 0)
|
||||
continue;
|
||||
|
||||
if (hashes[i])
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Duplicate section");
|
||||
|
||||
mdctx = EVP_MD_CTX_new();
|
||||
if (!mdctx)
|
||||
return log_oom_debug();
|
||||
|
||||
if (EVP_DigestInit_ex(mdctx, md, NULL) != 1)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to allocate message digest.");
|
||||
|
||||
r = hash_file(fd, mdctx, section->PointerToRawData, section->VirtualSize);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
hashes[i] = malloc(hsz);
|
||||
if (!hashes[i])
|
||||
return log_oom_debug();
|
||||
|
||||
unsigned hash_size = (unsigned) hsz;
|
||||
if (EVP_DigestFinal_ex(mdctx, hashes[i], &hash_size) != 1)
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to finalize hash function.");
|
||||
|
||||
assert(hash_size == (unsigned) hsz);
|
||||
|
||||
if (DEBUG_LOGGING) {
|
||||
_cleanup_free_ char *hs = NULL;
|
||||
|
||||
hs = hexmem(hashes[i], hsz);
|
||||
log_debug("Section %s with %s is %s.", n, EVP_MD_name(md), strna(hs));
|
||||
}
|
||||
}
|
||||
|
||||
memcpy(ret_hashes, hashes, sizeof(hashes));
|
||||
zero(hashes);
|
||||
*ret_hash_size = (unsigned) hsz;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
#pragma once
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#include "openssl-util.h"
|
||||
#include "uki.h"
|
||||
|
||||
int pe_hash(int fd, const EVP_MD *md, void **ret_hash, size_t *ret_hash_size);
|
||||
|
||||
int uki_hash(int fd, const EVP_MD *md, void *ret_hashes[static _UNIFIED_SECTION_MAX], size_t *ret_hash_size);
|
||||
@@ -856,6 +856,7 @@ int encrypt_credential_and_warn(
|
||||
tpm2_n_hash_pcr_values,
|
||||
pubkey ? &public : NULL,
|
||||
/* use_pin= */ false,
|
||||
/* pcrlock_policy= */ NULL,
|
||||
&tpm2_policy);
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Could not calculate sealing policy digest: %m");
|
||||
@@ -1219,6 +1220,7 @@ int decrypt_credential_and_warn(
|
||||
z ? le64toh(z->pcr_mask) : 0,
|
||||
signature_json,
|
||||
/* pin= */ NULL,
|
||||
/* pcrlock_policy= */ NULL,
|
||||
le16toh(t->primary_alg),
|
||||
t->policy_hash_and_blob,
|
||||
le32toh(t->blob_size),
|
||||
|
||||
@@ -161,6 +161,7 @@ shared_sources = files(
|
||||
'tmpfile-util-label.c',
|
||||
'tomoyo-util.c',
|
||||
'tpm2-util.c',
|
||||
'tpm2-event-log.c',
|
||||
'udev-util.c',
|
||||
'user-record-nss.c',
|
||||
'user-record-show.c',
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
|
||||
#include "tpm2-event-log.h"
|
||||
|
||||
#include "sort-util.h"
|
||||
|
||||
typedef struct tpm2_log_event_type_info {
|
||||
uint32_t event_type;
|
||||
const char *name;
|
||||
} tpm2_log_event_type_info;
|
||||
|
||||
static tpm2_log_event_type_info tpm2_log_event_type_table[] = {
|
||||
/* Unfortunately the types are defined all over the place, hence we are not using a dense table
|
||||
* here.
|
||||
*
|
||||
* Keep this sorted by event type, so that we can do bisection! */
|
||||
{ EV_PREBOOT_CERT, "preboot-cert" },
|
||||
{ EV_POST_CODE, "post-code" },
|
||||
{ EV_NO_ACTION, "no-action" },
|
||||
{ EV_SEPARATOR, "separator" },
|
||||
{ EV_ACTION, "action" },
|
||||
{ EV_EVENT_TAG, "event-tag" },
|
||||
{ EV_S_CRTM_CONTENTS, "s-crtm-contents" },
|
||||
{ EV_S_CRTM_VERSION, "s-crtm-version" },
|
||||
{ EV_CPU_MICROCODE, "cpu-microcode" },
|
||||
{ EV_PLATFORM_CONFIG_FLAGS, "platform-config-flags" },
|
||||
{ EV_TABLE_OF_DEVICES, "table-of-devices" },
|
||||
{ EV_COMPACT_HASH, "compact-hash" },
|
||||
{ EV_IPL, "ipl" },
|
||||
{ EV_IPL_PARTITION_DATA, "ipl-partition-data" },
|
||||
{ EV_NONHOST_CODE, "nonhost-code" },
|
||||
{ EV_NONHOST_CONFIG, "nonhost-config" },
|
||||
{ EV_NONHOST_INFO, "nonhost-info" },
|
||||
{ EV_OMIT_BOOT_DEVICE_EVENTS, "omit-boot-device-events" },
|
||||
/* omitting EV_EFI_EVENT_BASE, since its not an event, but just a base value for other events */
|
||||
{ EV_EFI_VARIABLE_DRIVER_CONFIG, "efi-variable-driver-config" },
|
||||
{ EV_EFI_VARIABLE_BOOT, "efi-variable-boot" },
|
||||
{ EV_EFI_BOOT_SERVICES_APPLICATION, "efi-boot-services-application" },
|
||||
{ EV_EFI_BOOT_SERVICES_DRIVER, "efi-boot-services-driver" },
|
||||
{ EV_EFI_RUNTIME_SERVICES_DRIVER, "efi-runtime-services-driver" },
|
||||
{ EV_EFI_GPT_EVENT, "efi-gpt-event" },
|
||||
{ EV_EFI_ACTION, "efi-action" },
|
||||
{ EV_EFI_PLATFORM_FIRMWARE_BLOB, "efi-platform-firmware-blob" },
|
||||
{ EV_EFI_HANDOFF_TABLES, "efi-handoff-tables" },
|
||||
{ EV_EFI_PLATFORM_FIRMWARE_BLOB2, "efi-platform-firmware-blob2" },
|
||||
{ EV_EFI_HANDOFF_TABLES2, "efi-handoff-tables" },
|
||||
{ EV_EFI_VARIABLE_BOOT2, "efi-variable-boot2" },
|
||||
{ EV_EFI_HCRTM_EVENT, "efi-hcrtm-event" },
|
||||
{ EV_EFI_VARIABLE_AUTHORITY, "efi-variable-authority" },
|
||||
{ EV_EFI_SPDM_FIRMWARE_BLOB, "efi-spdm-firmware-blob" },
|
||||
{ EV_EFI_SPDM_FIRMWARE_CONFIG, "efi-spdm-firmware-config" },
|
||||
};
|
||||
|
||||
static int tpm2_log_event_type_info_cmp(const tpm2_log_event_type_info *a, const tpm2_log_event_type_info *b) {
|
||||
return CMP(ASSERT_PTR(a)->event_type, ASSERT_PTR(b)->event_type);
|
||||
}
|
||||
|
||||
const char *tpm2_log_event_type_to_string(uint32_t type) {
|
||||
|
||||
tpm2_log_event_type_info *found, key = {
|
||||
.event_type = type,
|
||||
};
|
||||
|
||||
found = typesafe_bsearch(&key, tpm2_log_event_type_table, ELEMENTSOF(tpm2_log_event_type_table), tpm2_log_event_type_info_cmp);
|
||||
|
||||
return found ? found->name : NULL;
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||||
#pragma once
|
||||
|
||||
#include <uchar.h>
|
||||
|
||||
#include "tpm2-util.h"
|
||||
|
||||
/* Definitions as per "TCG PC Client Specific Platform Firmware Profile Specification"
|
||||
* (https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/),
|
||||
* section 10.4.1 "Event Types" (at least in version 1.05 Revision 23 of the spec) */
|
||||
#ifndef EV_PREBOOT_CERT
|
||||
#define EV_PREBOOT_CERT UINT32_C(0x00000000)
|
||||
#define EV_POST_CODE UINT32_C(0x00000001)
|
||||
#define EV_NO_ACTION UINT32_C(0x00000003)
|
||||
#define EV_SEPARATOR UINT32_C(0x00000004)
|
||||
#define EV_ACTION UINT32_C(0x00000005)
|
||||
#define EV_EVENT_TAG UINT32_C(0x00000006)
|
||||
#define EV_S_CRTM_CONTENTS UINT32_C(0x00000007)
|
||||
#define EV_S_CRTM_VERSION UINT32_C(0x00000008)
|
||||
#define EV_CPU_MICROCODE UINT32_C(0x00000009)
|
||||
#define EV_PLATFORM_CONFIG_FLAGS UINT32_C(0x0000000a)
|
||||
#define EV_TABLE_OF_DEVICES UINT32_C(0x0000000b)
|
||||
#define EV_COMPACT_HASH UINT32_C(0x0000000c)
|
||||
#define EV_IPL UINT32_C(0x0000000d)
|
||||
#define EV_IPL_PARTITION_DATA UINT32_C(0x0000000e)
|
||||
#define EV_NONHOST_CODE UINT32_C(0x0000000f)
|
||||
#define EV_NONHOST_CONFIG UINT32_C(0x00000010)
|
||||
#define EV_NONHOST_INFO UINT32_C(0x00000011)
|
||||
#define EV_OMIT_BOOT_DEVICE_EVENTS UINT32_C(0x00000012)
|
||||
#define EV_EFI_EVENT_BASE UINT32_C(0x80000000)
|
||||
#define EV_EFI_VARIABLE_DRIVER_CONFIG UINT32_C(0x80000001)
|
||||
#define EV_EFI_VARIABLE_BOOT UINT32_C(0x80000002)
|
||||
#define EV_EFI_BOOT_SERVICES_APPLICATION UINT32_C(0x80000003)
|
||||
#define EV_EFI_BOOT_SERVICES_DRIVER UINT32_C(0x80000004)
|
||||
#define EV_EFI_RUNTIME_SERVICES_DRIVER UINT32_C(0x80000005)
|
||||
#define EV_EFI_GPT_EVENT UINT32_C(0x80000006)
|
||||
#define EV_EFI_ACTION UINT32_C(0x80000007)
|
||||
#define EV_EFI_PLATFORM_FIRMWARE_BLOB UINT32_C(0x80000008)
|
||||
#define EV_EFI_HANDOFF_TABLES UINT32_C(0x80000009)
|
||||
#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 UINT32_C(0x8000000A)
|
||||
#define EV_EFI_HANDOFF_TABLES2 UINT32_C(0x8000000B)
|
||||
#define EV_EFI_VARIABLE_BOOT2 UINT32_C(0x8000000C)
|
||||
#define EV_EFI_HCRTM_EVENT UINT32_C(0x80000010)
|
||||
#define EV_EFI_VARIABLE_AUTHORITY UINT32_C(0x800000E0)
|
||||
#define EV_EFI_SPDM_FIRMWARE_BLOB UINT32_C(0x800000E1)
|
||||
#define EV_EFI_SPDM_FIRMWARE_CONFIG UINT32_C(0x800000E2)
|
||||
#endif
|
||||
|
||||
/* Defined in drivers/firmware/efi/libstub/efistub.h in the Linux kernel sources */
|
||||
#ifndef INITRD_EVENT_TAG_ID
|
||||
#define INITRD_EVENT_TAG_ID UINT32_C(0x8F3B22EC)
|
||||
#endif
|
||||
|
||||
#ifndef LOAD_OPTIONS_EVENT_TAG_ID
|
||||
#define LOAD_OPTIONS_EVENT_TAG_ID UINT32_C(0x8F3B22ED)
|
||||
#endif
|
||||
|
||||
const char *tpm2_log_event_type_to_string(uint32_t type) _const_;
|
||||
|
||||
#if HAVE_TPM2
|
||||
|
||||
/* UEFI event log data structures */
|
||||
typedef struct _packed_ TCG_PCClientPCREvent {
|
||||
uint32_t pcrIndex;
|
||||
uint32_t eventType;
|
||||
uint8_t digest[20];
|
||||
uint32_t eventDataSize;
|
||||
uint32_t event[];
|
||||
} TCG_PCClientPCREvent;
|
||||
|
||||
typedef struct _packed_ packed_TPMT_HA {
|
||||
uint16_t hashAlg;
|
||||
TPMU_HA digest;
|
||||
} packed_TPMT_HA;
|
||||
|
||||
typedef struct _packed_ packed_TPML_DIGEST_VALUES {
|
||||
uint32_t count;
|
||||
packed_TPMT_HA digests[];
|
||||
} packed_TPML_DIGEST_VALUES;
|
||||
|
||||
typedef struct _packed_ TCG_PCR_EVENT2 {
|
||||
uint32_t pcrIndex;
|
||||
uint32_t eventType;
|
||||
packed_TPML_DIGEST_VALUES digests;
|
||||
/* … */
|
||||
} TCG_PCR_EVENT2;
|
||||
|
||||
typedef struct _packed_ TCG_EfiSpecIdEventAlgorithmSize {
|
||||
uint16_t algorithmId;
|
||||
uint16_t digestSize;
|
||||
} TCG_EfiSpecIdEventAlgorithmSize;
|
||||
|
||||
typedef struct _packed_ tdTCG_EfiSpecIdEvent {
|
||||
uint8_t signature[16];
|
||||
uint32_t platformClass;
|
||||
uint8_t specVersionMinor;
|
||||
uint8_t specVersionMajor;
|
||||
uint8_t specErrata;
|
||||
uint8_t uintnSize;
|
||||
uint32_t numberOfAlgorithms;
|
||||
TCG_EfiSpecIdEventAlgorithmSize digestSizes[];
|
||||
/* … */
|
||||
} TCG_EfiSpecIDEvent;
|
||||
|
||||
typedef struct _packed_ UEFI_VARIABLE_DATA {
|
||||
uint8_t variableName[16];
|
||||
uint64_t unicodeNameLength;
|
||||
uint64_t variableDataLength;
|
||||
char16_t unicodeName[];
|
||||
/* … */
|
||||
} UEFI_VARIABLE_DATA;
|
||||
|
||||
typedef struct _packed_ TCG_PCClientTaggedEvent{
|
||||
uint32_t taggedEventID;
|
||||
uint32_t taggedEventDataSize;
|
||||
uint8_t taggedEventData[];
|
||||
} TCG_PCClientTaggedEvent;
|
||||
|
||||
typedef struct _packed_ packed_EFI_DEVICE_PATH {
|
||||
uint8_t type;
|
||||
uint8_t subType;
|
||||
uint16_t length;
|
||||
uint8_t path[];
|
||||
} packed_EFI_DEVICE_PATH;
|
||||
|
||||
typedef struct _packed_ UEFI_IMAGE_LOAD_EVENT {
|
||||
uint64_t imageLocationInMemory;
|
||||
uint64_t imageLengthInMemory;
|
||||
uint64_t imageLinkTimeAddress;
|
||||
uint64_t lengthOfDevicePath;
|
||||
packed_EFI_DEVICE_PATH devicePath[];
|
||||
} UEFI_IMAGE_LOAD_EVENT;
|
||||
|
||||
typedef struct _packed_ UEFI_PLATFORM_FIRMWARE_BLOB {
|
||||
uint64_t blobBase;
|
||||
uint64_t blobLength;
|
||||
} UEFI_PLATFORM_FIRMWARE_BLOB;
|
||||
|
||||
#endif
|
||||
+1350
-22
File diff suppressed because it is too large
Load Diff
+94
-3
@@ -8,11 +8,13 @@
|
||||
#include "json.h"
|
||||
#include "macro.h"
|
||||
#include "openssl-util.h"
|
||||
#include "ordered-set.h"
|
||||
#include "sha256.h"
|
||||
#include "tpm2-pcr.h"
|
||||
|
||||
typedef enum TPM2Flags {
|
||||
TPM2_FLAGS_USE_PIN = 1 << 0,
|
||||
TPM2_FLAGS_USE_PIN = 1 << 0,
|
||||
TPM2_FLAGS_USE_PCRLOCK = 1 << 1,
|
||||
} TPM2Flags;
|
||||
|
||||
/* As per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf a
|
||||
@@ -37,6 +39,8 @@ static inline bool TPM2_PCR_MASK_VALID(uint32_t pcr_mask) {
|
||||
|
||||
#define FOREACH_PCR_IN_MASK(pcr, mask) BIT_FOREACH(pcr, mask)
|
||||
|
||||
#define TPM2_N_HASH_ALGORITHMS 4U
|
||||
|
||||
#if HAVE_TPM2
|
||||
|
||||
#include <tss2/tss2_esys.h>
|
||||
@@ -111,9 +115,14 @@ char *tpm2_pcr_values_to_string(const Tpm2PCRValue *pcr_values, size_t n_pcr_val
|
||||
int tpm2_pcr_values_hash_count(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, size_t *ret_count);
|
||||
int tpm2_tpml_pcr_selection_from_pcr_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPML_PCR_SELECTION *ret_selection, TPM2B_DIGEST **ret_values, size_t *ret_n_values);
|
||||
|
||||
int tpm2_make_encryption_session(Tpm2Context *c, const Tpm2Handle *primary, const Tpm2Handle *bind_key, Tpm2Handle **ret_session);
|
||||
|
||||
int tpm2_create_primary(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_PUBLIC *template, const TPM2B_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, Tpm2Handle **ret_handle);
|
||||
int tpm2_create(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private);
|
||||
int tpm2_create_loaded(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private, Tpm2Handle **ret_handle);
|
||||
int tpm2_load(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPM2B_PUBLIC *public, const TPM2B_PRIVATE *private, Tpm2Handle **ret_handle);
|
||||
int tpm2_marshal_nv_public(const TPM2B_NV_PUBLIC *nv_public, void **ret, size_t *ret_size);
|
||||
int tpm2_unmarshal_nv_public(const void *data, size_t size, TPM2B_NV_PUBLIC *ret_nv_public);
|
||||
|
||||
bool tpm2_supports_alg(Tpm2Context *c, TPM2_ALG_ID alg);
|
||||
bool tpm2_supports_command(Tpm2Context *c, TPM2_CC command);
|
||||
@@ -126,6 +135,7 @@ int tpm2_get_good_pcr_banks_strv(Tpm2Context *c, uint32_t pcr_mask, char ***ret)
|
||||
int tpm2_get_best_pcr_bank(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH *ret);
|
||||
|
||||
const char *tpm2_userspace_log_path(void);
|
||||
const char *tpm2_firmware_log_path(void);
|
||||
|
||||
typedef enum Tpm2UserspaceEventType {
|
||||
TPM2_EVENT_PHASE,
|
||||
@@ -184,22 +194,85 @@ void tpm2_log_debug_buffer(const void *buffer, size_t size, const char *msg);
|
||||
void tpm2_log_debug_digest(const TPM2B_DIGEST *digest, const char *msg);
|
||||
void tpm2_log_debug_name(const TPM2B_NAME *name, const char *msg);
|
||||
|
||||
typedef struct Tpm2PCRPredictionResult {
|
||||
TPM2B_DIGEST hash[TPM2_N_HASH_ALGORITHMS]; /* a hash for each potential algorithm */
|
||||
} Tpm2PCRPredictionResult;
|
||||
|
||||
TPM2B_DIGEST *tpm2_pcr_prediction_result_get_hash(Tpm2PCRPredictionResult *result, uint16_t alg);
|
||||
|
||||
/* A structure encapsulating a full set of PCR predictions with alternatives. This can be converted into a
|
||||
* series of PolicyOR + PolicyPCR items for the TPM. */
|
||||
typedef struct Tpm2PCRPrediction {
|
||||
uint32_t pcrs; /* A mask of pcrs included */
|
||||
OrderedSet* results[TPM2_PCRS_MAX]; /* set of Tpm2PCRPredictionResult objects, one for each PCR */
|
||||
} Tpm2PCRPrediction;
|
||||
|
||||
void tpm2_pcr_prediction_done(Tpm2PCRPrediction *p);
|
||||
|
||||
extern const struct hash_ops tpm2_pcr_prediction_result_hash_ops;
|
||||
|
||||
bool tpm2_pcr_prediction_equal(Tpm2PCRPrediction *a, Tpm2PCRPrediction *b, uint16_t algorithm);
|
||||
|
||||
int tpm2_pcr_prediction_to_json(const Tpm2PCRPrediction *prediction, uint16_t algorithm, JsonVariant **ret);
|
||||
int tpm2_pcr_prediction_from_json(Tpm2PCRPrediction *prediction, uint16_t algorithm, JsonVariant *aj);
|
||||
|
||||
/* As structure encapsulating all metadata stored for a pcrlock policy on disk */
|
||||
typedef struct Tpm2PCRLockPolicy {
|
||||
/* The below is the fixed metadata encoding information about the NV index we store the
|
||||
* PolicyAuthorizeNV policy in, as well as a pinned SRK, and the encrypted PIN to use for writing to
|
||||
* the NV Index. */
|
||||
uint16_t algorithm;
|
||||
uint32_t nv_index;
|
||||
struct iovec nv_handle;
|
||||
struct iovec nv_public;
|
||||
struct iovec srk_handle;
|
||||
struct iovec pin_public;
|
||||
struct iovec pin_private;
|
||||
|
||||
/* The below contains the current prediction whose resulting policy is stored in the NV
|
||||
* index. Once in JSON and once in parsed form. When the policy is updated the fields below are
|
||||
* changed, the fields above remain fixed. */
|
||||
JsonVariant *prediction_json;
|
||||
Tpm2PCRPrediction prediction;
|
||||
} Tpm2PCRLockPolicy;
|
||||
|
||||
void tpm2_pcrlock_policy_done(Tpm2PCRLockPolicy *data);
|
||||
int tpm2_pcrlock_search_file(const char *path, FILE **ret_file, char **ret_path);
|
||||
int tpm2_pcrlock_policy_load(const char *path, Tpm2PCRLockPolicy *ret_policy);
|
||||
|
||||
int tpm2_index_to_handle(Tpm2Context *c, TPM2_HANDLE index, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
|
||||
int tpm2_index_from_handle(Tpm2Context *c, const Tpm2Handle *handle, TPM2_HANDLE *ret_index);
|
||||
|
||||
int tpm2_pcr_read(Tpm2Context *c, const TPML_PCR_SELECTION *pcr_selection, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
|
||||
int tpm2_pcr_read_missing_values(Tpm2Context *c, Tpm2PCRValue *pcr_values, size_t n_pcr_values);
|
||||
|
||||
int tpm2_get_pin_auth(TPMI_ALG_HASH hash, const char *pin, TPM2B_AUTH *ret_auth);
|
||||
int tpm2_set_auth(Tpm2Context *c, const Tpm2Handle *handle, const char *pin);
|
||||
int tpm2_set_auth_binary(Tpm2Context *c, const Tpm2Handle *handle, const TPM2B_AUTH *auth);
|
||||
|
||||
int tpm2_make_policy_session(Tpm2Context *c, const Tpm2Handle *primary, const Tpm2Handle *encryption_session, Tpm2Handle **ret_session);
|
||||
|
||||
int tpm2_policy_auth_value(Tpm2Context *c, const Tpm2Handle *session, TPM2B_DIGEST **ret_policy_digest);
|
||||
int tpm2_policy_authorize_nv(Tpm2Context *c, const Tpm2Handle *session, const Tpm2Handle *nv_handle, TPM2B_DIGEST **ret_policy_digest);
|
||||
int tpm2_policy_pcr(Tpm2Context *c, const Tpm2Handle *session, const TPML_PCR_SELECTION *pcr_selection, TPM2B_DIGEST **ret_policy_digest);
|
||||
int tpm2_policy_or(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_DIGEST *branches, size_t n_branches, TPM2B_DIGEST **ret_policy_digest);
|
||||
int tpm2_policy_super_pcr(Tpm2Context *c, const Tpm2Handle *session, const Tpm2PCRPrediction *prediction, uint16_t algorithm);
|
||||
|
||||
int tpm2_calculate_pubkey_name(const TPMT_PUBLIC *public, TPM2B_NAME *ret_name);
|
||||
int tpm2_calculate_nv_index_name(const TPMS_NV_PUBLIC *nvpublic, TPM2B_NAME *ret_name);
|
||||
|
||||
int tpm2_calculate_policy_auth_value(TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_policy_authorize(const TPM2B_PUBLIC *public, const TPM2B_DIGEST *policy_ref, TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_policy_authorize_nv(const TPM2B_NV_PUBLIC *public, TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_policy_pcr(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_sealing_policy(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, const TPM2B_PUBLIC *public, bool use_pin, TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_policy_or(const TPM2B_DIGEST *branches, size_t n_branches, TPM2B_DIGEST *digest);
|
||||
int tpm2_calculate_policy_super_pcr(Tpm2PCRPrediction *prediction, uint16_t algorithm, TPM2B_DIGEST *pcr_policy);
|
||||
int tpm2_calculate_sealing_policy(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, const TPM2B_PUBLIC *public, bool use_pin, const Tpm2PCRLockPolicy *policy, TPM2B_DIGEST *digest);
|
||||
|
||||
int tpm2_get_or_create_srk(Tpm2Context *c, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
|
||||
|
||||
int tpm2_seal(Tpm2Context *c, uint32_t seal_key_handle, const TPM2B_DIGEST *policy, const char *pin, void **ret_secret, size_t *ret_secret_size, void **ret_blob, size_t *ret_blob_size, uint16_t *ret_primary_alg, void **ret_srk_buf, size_t *ret_srk_buf_size);
|
||||
int tpm2_unseal(Tpm2Context *c, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, JsonVariant *signature, const char *pin, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *srk_buf, size_t srk_buf_size, void **ret_secret, size_t *ret_secret_size);
|
||||
int tpm2_unseal(Tpm2Context *c, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, JsonVariant *signature, const char *pin, const Tpm2PCRLockPolicy *pcrlock_policy, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *srk_buf, size_t srk_buf_size, void **ret_secret, size_t *ret_secret_size);
|
||||
|
||||
#if HAVE_OPENSSL
|
||||
int tpm2_tpm2b_public_to_openssl_pkey(const TPM2B_PUBLIC *public, EVP_PKEY **ret);
|
||||
@@ -209,6 +282,16 @@ int tpm2_tpm2b_public_from_openssl_pkey(const EVP_PKEY *pkey, TPM2B_PUBLIC *ret)
|
||||
int tpm2_tpm2b_public_from_pem(const void *pem, size_t pem_size, TPM2B_PUBLIC *ret);
|
||||
int tpm2_tpm2b_public_to_fingerprint(const TPM2B_PUBLIC *public, void **ret_fingerprint, size_t *ret_fingerprint_size);
|
||||
|
||||
int tpm2_define_policy_nv_index(Tpm2Context *c, const Tpm2Handle *session, TPM2_HANDLE requested_nv_index, const TPM2B_DIGEST *write_policy, const char *pin, const TPM2B_AUTH *auth, TPM2_HANDLE *ret_nv_index, Tpm2Handle **ret_nv_handle, TPM2B_NV_PUBLIC *ret_nv_public);
|
||||
int tpm2_write_policy_nv_index(Tpm2Context *c, const Tpm2Handle *policy_session, TPM2_HANDLE nv_index, const Tpm2Handle *nv_handle, const TPM2B_DIGEST *policy_digest);
|
||||
int tpm2_undefine_policy_nv_index(Tpm2Context *c, const Tpm2Handle *session, TPM2_HANDLE nv_index, const Tpm2Handle *nv_handle);
|
||||
|
||||
int tpm2_seal_data(Tpm2Context *c, const struct iovec *data, const Tpm2Handle *primary_handle, const Tpm2Handle *encryption_session, const TPM2B_DIGEST *policy, struct iovec *ret_public, struct iovec *ret_private);
|
||||
int tpm2_unseal_data(Tpm2Context *c, const struct iovec *public, const struct iovec *private, const Tpm2Handle *primary_handle, const Tpm2Handle *policy_session, const Tpm2Handle *encryption_session, struct iovec *ret_data);
|
||||
|
||||
int tpm2_serialize(Tpm2Context *c, const Tpm2Handle *handle, void **ret_serialized, size_t *ret_serialized_size);
|
||||
int tpm2_deserialize(Tpm2Context *c, const void *serialized, size_t serialized_size, Tpm2Handle **ret_handle);
|
||||
|
||||
/* The tpm2-tss library has many structs that are simply a combination of an array (or object) and
|
||||
* size. These macros allow easily initializing or assigning instances of such structs from an existing
|
||||
* buffer/object and size, while also checking the size for safety with the struct buffer/object size. If the
|
||||
@@ -271,6 +354,11 @@ typedef struct {} Tpm2Handle;
|
||||
typedef struct {} Tpm2PCRValue;
|
||||
|
||||
#define TPM2_PCR_VALUE_MAKE(i, h, v) (Tpm2PCRValue) {}
|
||||
|
||||
static inline int tpm2_pcrlock_search_file(const char *path, FILE **ret_file, char **ret_path) {
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
#endif /* HAVE_TPM2 */
|
||||
|
||||
int tpm2_list_devices(void);
|
||||
@@ -322,10 +410,13 @@ int tpm2_asym_alg_from_string(const char *alg) _pure_;
|
||||
|
||||
char *tpm2_pcr_mask_to_string(uint32_t mask);
|
||||
|
||||
extern const uint16_t tpm2_hash_algorithms[];
|
||||
|
||||
typedef struct {
|
||||
uint32_t search_pcr_mask;
|
||||
const char *device;
|
||||
const char *signature_path;
|
||||
const char *pcrlock_path;
|
||||
} systemd_tpm2_plugin_params;
|
||||
|
||||
typedef enum Tpm2Support {
|
||||
|
||||
@@ -1043,6 +1043,7 @@ static void check_seal_unseal_for_handle(Tpm2Context *c, TPM2_HANDLE handle) {
|
||||
/* pubkey_pcr_mask= */ 0,
|
||||
/* signature= */ NULL,
|
||||
/* pin= */ NULL,
|
||||
/* pcrlock_policy= */ NULL,
|
||||
/* primary_alg= */ 0,
|
||||
blob, blob_size,
|
||||
/* policy_hash= */ NULL, /* policy_hash_size= */ 0,
|
||||
|
||||
Reference in New Issue
Block a user