SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28891 from poettering/pcrlock

Browse Source 
new pcrlock tool for generating signed PCR policies for PCR 0, 1, 4, …
This commit is contained in:
Luca Boccassi
2023-11-03 16:07:43 +00:00
committed by GitHub
parent f742f4176c e43f87a7a6
commit 8d04721507
54 changed files with 8548 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/creds-util.c
+2
View File
@@ -856,6 +856,7 @@ int encrypt_credential_and_warn(
tpm2_n_hash_pcr_values,
pubkey ? &public : NULL,
/* use_pin= */ false,
/* pcrlock_policy= */ NULL,
&tpm2_policy);
if (r < 0)
return log_error_errno(r, "Could not calculate sealing policy digest: %m");
@@ -1219,6 +1220,7 @@ int decrypt_credential_and_warn(
z ? le64toh(z->pcr_mask) : 0,
signature_json,
/* pin= */ NULL,
/* pcrlock_policy= */ NULL,
le16toh(t->primary_alg),
t->policy_hash_and_blob,
le32toh(t->blob_size),
src/shared/meson.build
+1
View File
@@ -161,6 +161,7 @@ shared_sources = files(
'tmpfile-util-label.c',
'tomoyo-util.c',
'tpm2-util.c',
'tpm2-event-log.c',
'udev-util.c',
'user-record-nss.c',
'user-record-show.c',
src/shared/tpm2-event-log.c
+67
View File
@@ -0,0 +1,67 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "tpm2-event-log.h"
#include "sort-util.h"
typedef struct tpm2_log_event_type_info {
uint32_t event_type;
const char *name;
} tpm2_log_event_type_info;
static tpm2_log_event_type_info tpm2_log_event_type_table[] = {
/* Unfortunately the types are defined all over the place, hence we are not using a dense table
* here.
*
* Keep this sorted by event type, so that we can do bisection! */
{ EV_PREBOOT_CERT, "preboot-cert" },
{ EV_POST_CODE, "post-code" },
{ EV_NO_ACTION, "no-action" },
{ EV_SEPARATOR, "separator" },
{ EV_ACTION, "action" },
{ EV_EVENT_TAG, "event-tag" },
{ EV_S_CRTM_CONTENTS, "s-crtm-contents" },
{ EV_S_CRTM_VERSION, "s-crtm-version" },
{ EV_CPU_MICROCODE, "cpu-microcode" },
{ EV_PLATFORM_CONFIG_FLAGS, "platform-config-flags" },
{ EV_TABLE_OF_DEVICES, "table-of-devices" },
{ EV_COMPACT_HASH, "compact-hash" },
{ EV_IPL, "ipl" },
{ EV_IPL_PARTITION_DATA, "ipl-partition-data" },
{ EV_NONHOST_CODE, "nonhost-code" },
{ EV_NONHOST_CONFIG, "nonhost-config" },
{ EV_NONHOST_INFO, "nonhost-info" },
{ EV_OMIT_BOOT_DEVICE_EVENTS, "omit-boot-device-events" },
/* omitting EV_EFI_EVENT_BASE, since its not an event, but just a base value for other events */
{ EV_EFI_VARIABLE_DRIVER_CONFIG, "efi-variable-driver-config" },
{ EV_EFI_VARIABLE_BOOT, "efi-variable-boot" },
{ EV_EFI_BOOT_SERVICES_APPLICATION, "efi-boot-services-application" },
{ EV_EFI_BOOT_SERVICES_DRIVER, "efi-boot-services-driver" },
{ EV_EFI_RUNTIME_SERVICES_DRIVER, "efi-runtime-services-driver" },
{ EV_EFI_GPT_EVENT, "efi-gpt-event" },
{ EV_EFI_ACTION, "efi-action" },
{ EV_EFI_PLATFORM_FIRMWARE_BLOB, "efi-platform-firmware-blob" },
{ EV_EFI_HANDOFF_TABLES, "efi-handoff-tables" },
{ EV_EFI_PLATFORM_FIRMWARE_BLOB2, "efi-platform-firmware-blob2" },
{ EV_EFI_HANDOFF_TABLES2, "efi-handoff-tables" },
{ EV_EFI_VARIABLE_BOOT2, "efi-variable-boot2" },
{ EV_EFI_HCRTM_EVENT, "efi-hcrtm-event" },
{ EV_EFI_VARIABLE_AUTHORITY, "efi-variable-authority" },
{ EV_EFI_SPDM_FIRMWARE_BLOB, "efi-spdm-firmware-blob" },
{ EV_EFI_SPDM_FIRMWARE_CONFIG, "efi-spdm-firmware-config" },
};
static int tpm2_log_event_type_info_cmp(const tpm2_log_event_type_info *a, const tpm2_log_event_type_info *b) {
return CMP(ASSERT_PTR(a)->event_type, ASSERT_PTR(b)->event_type);
}
const char *tpm2_log_event_type_to_string(uint32_t type) {
tpm2_log_event_type_info *found, key = {
.event_type = type,
};
found = typesafe_bsearch(&key, tpm2_log_event_type_table, ELEMENTSOF(tpm2_log_event_type_table), tpm2_log_event_type_info_cmp);
return found ? found->name : NULL;
}
src/shared/tpm2-event-log.h
+139
View File
@@ -0,0 +1,139 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include <uchar.h>
#include "tpm2-util.h"
/* Definitions as per "TCG PC Client Specific Platform Firmware Profile Specification"
* (https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/),
* section 10.4.1 "Event Types" (at least in version 1.05 Revision 23 of the spec) */
#ifndef EV_PREBOOT_CERT
#define EV_PREBOOT_CERT UINT32_C(0x00000000)
#define EV_POST_CODE UINT32_C(0x00000001)
#define EV_NO_ACTION UINT32_C(0x00000003)
#define EV_SEPARATOR UINT32_C(0x00000004)
#define EV_ACTION UINT32_C(0x00000005)
#define EV_EVENT_TAG UINT32_C(0x00000006)
#define EV_S_CRTM_CONTENTS UINT32_C(0x00000007)
#define EV_S_CRTM_VERSION UINT32_C(0x00000008)
#define EV_CPU_MICROCODE UINT32_C(0x00000009)
#define EV_PLATFORM_CONFIG_FLAGS UINT32_C(0x0000000a)
#define EV_TABLE_OF_DEVICES UINT32_C(0x0000000b)
#define EV_COMPACT_HASH UINT32_C(0x0000000c)
#define EV_IPL UINT32_C(0x0000000d)
#define EV_IPL_PARTITION_DATA UINT32_C(0x0000000e)
#define EV_NONHOST_CODE UINT32_C(0x0000000f)
#define EV_NONHOST_CONFIG UINT32_C(0x00000010)
#define EV_NONHOST_INFO UINT32_C(0x00000011)
#define EV_OMIT_BOOT_DEVICE_EVENTS UINT32_C(0x00000012)
#define EV_EFI_EVENT_BASE UINT32_C(0x80000000)
#define EV_EFI_VARIABLE_DRIVER_CONFIG UINT32_C(0x80000001)
#define EV_EFI_VARIABLE_BOOT UINT32_C(0x80000002)
#define EV_EFI_BOOT_SERVICES_APPLICATION UINT32_C(0x80000003)
#define EV_EFI_BOOT_SERVICES_DRIVER UINT32_C(0x80000004)
#define EV_EFI_RUNTIME_SERVICES_DRIVER UINT32_C(0x80000005)
#define EV_EFI_GPT_EVENT UINT32_C(0x80000006)
#define EV_EFI_ACTION UINT32_C(0x80000007)
#define EV_EFI_PLATFORM_FIRMWARE_BLOB UINT32_C(0x80000008)
#define EV_EFI_HANDOFF_TABLES UINT32_C(0x80000009)
#define EV_EFI_PLATFORM_FIRMWARE_BLOB2 UINT32_C(0x8000000A)
#define EV_EFI_HANDOFF_TABLES2 UINT32_C(0x8000000B)
#define EV_EFI_VARIABLE_BOOT2 UINT32_C(0x8000000C)
#define EV_EFI_HCRTM_EVENT UINT32_C(0x80000010)
#define EV_EFI_VARIABLE_AUTHORITY UINT32_C(0x800000E0)
#define EV_EFI_SPDM_FIRMWARE_BLOB UINT32_C(0x800000E1)
#define EV_EFI_SPDM_FIRMWARE_CONFIG UINT32_C(0x800000E2)
#endif
/* Defined in drivers/firmware/efi/libstub/efistub.h in the Linux kernel sources */
#ifndef INITRD_EVENT_TAG_ID
#define INITRD_EVENT_TAG_ID UINT32_C(0x8F3B22EC)
#endif
#ifndef LOAD_OPTIONS_EVENT_TAG_ID
#define LOAD_OPTIONS_EVENT_TAG_ID UINT32_C(0x8F3B22ED)
#endif
const char *tpm2_log_event_type_to_string(uint32_t type) _const_;
#if HAVE_TPM2
/* UEFI event log data structures */
typedef struct _packed_ TCG_PCClientPCREvent {
uint32_t pcrIndex;
uint32_t eventType;
uint8_t digest[20];
uint32_t eventDataSize;
uint32_t event[];
} TCG_PCClientPCREvent;
typedef struct _packed_ packed_TPMT_HA {
uint16_t hashAlg;
TPMU_HA digest;
} packed_TPMT_HA;
typedef struct _packed_ packed_TPML_DIGEST_VALUES {
uint32_t count;
packed_TPMT_HA digests[];
} packed_TPML_DIGEST_VALUES;
typedef struct _packed_ TCG_PCR_EVENT2 {
uint32_t pcrIndex;
uint32_t eventType;
packed_TPML_DIGEST_VALUES digests;
/* … */
} TCG_PCR_EVENT2;
typedef struct _packed_ TCG_EfiSpecIdEventAlgorithmSize {
uint16_t algorithmId;
uint16_t digestSize;
} TCG_EfiSpecIdEventAlgorithmSize;
typedef struct _packed_ tdTCG_EfiSpecIdEvent {
uint8_t signature[16];
uint32_t platformClass;
uint8_t specVersionMinor;
uint8_t specVersionMajor;
uint8_t specErrata;
uint8_t uintnSize;
uint32_t numberOfAlgorithms;
TCG_EfiSpecIdEventAlgorithmSize digestSizes[];
/* … */
} TCG_EfiSpecIDEvent;
typedef struct _packed_ UEFI_VARIABLE_DATA {
uint8_t variableName[16];
uint64_t unicodeNameLength;
uint64_t variableDataLength;
char16_t unicodeName[];
/* … */
} UEFI_VARIABLE_DATA;
typedef struct _packed_ TCG_PCClientTaggedEvent{
uint32_t taggedEventID;
uint32_t taggedEventDataSize;
uint8_t taggedEventData[];
} TCG_PCClientTaggedEvent;
typedef struct _packed_ packed_EFI_DEVICE_PATH {
uint8_t type;
uint8_t subType;
uint16_t length;
uint8_t path[];
} packed_EFI_DEVICE_PATH;
typedef struct _packed_ UEFI_IMAGE_LOAD_EVENT {
uint64_t imageLocationInMemory;
uint64_t imageLengthInMemory;
uint64_t imageLinkTimeAddress;
uint64_t lengthOfDevicePath;
packed_EFI_DEVICE_PATH devicePath[];
} UEFI_IMAGE_LOAD_EVENT;
typedef struct _packed_ UEFI_PLATFORM_FIRMWARE_BLOB {
uint64_t blobBase;
uint64_t blobLength;
} UEFI_PLATFORM_FIRMWARE_BLOB;
#endif
src/shared/tpm2-util.c
+1350 -22
View File
File diff suppressed because it is too large Load Diff
src/shared/tpm2-util.h
+94 -3
View File
@@ -8,11 +8,13 @@
#include "json.h"
#include "macro.h"
#include "openssl-util.h"
#include "ordered-set.h"
#include "sha256.h"
#include "tpm2-pcr.h"
typedef enum TPM2Flags {
TPM2_FLAGS_USE_PIN = 1 << 0,
TPM2_FLAGS_USE_PIN = 1 << 0,
TPM2_FLAGS_USE_PCRLOCK = 1 << 1,
} TPM2Flags;
/* As per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf a
@@ -37,6 +39,8 @@ static inline bool TPM2_PCR_MASK_VALID(uint32_t pcr_mask) {
#define FOREACH_PCR_IN_MASK(pcr, mask) BIT_FOREACH(pcr, mask)
#define TPM2_N_HASH_ALGORITHMS 4U
#if HAVE_TPM2
#include <tss2/tss2_esys.h>
@@ -111,9 +115,14 @@ char *tpm2_pcr_values_to_string(const Tpm2PCRValue *pcr_values, size_t n_pcr_val
int tpm2_pcr_values_hash_count(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, size_t *ret_count);
int tpm2_tpml_pcr_selection_from_pcr_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPML_PCR_SELECTION *ret_selection, TPM2B_DIGEST **ret_values, size_t *ret_n_values);
int tpm2_make_encryption_session(Tpm2Context *c, const Tpm2Handle *primary, const Tpm2Handle *bind_key, Tpm2Handle **ret_session);
int tpm2_create_primary(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_PUBLIC *template, const TPM2B_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, Tpm2Handle **ret_handle);
int tpm2_create(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private);
int tpm2_create_loaded(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private, Tpm2Handle **ret_handle);
int tpm2_load(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPM2B_PUBLIC *public, const TPM2B_PRIVATE *private, Tpm2Handle **ret_handle);
int tpm2_marshal_nv_public(const TPM2B_NV_PUBLIC *nv_public, void **ret, size_t *ret_size);
int tpm2_unmarshal_nv_public(const void *data, size_t size, TPM2B_NV_PUBLIC *ret_nv_public);
bool tpm2_supports_alg(Tpm2Context *c, TPM2_ALG_ID alg);
bool tpm2_supports_command(Tpm2Context *c, TPM2_CC command);
@@ -126,6 +135,7 @@ int tpm2_get_good_pcr_banks_strv(Tpm2Context *c, uint32_t pcr_mask, char ***ret)
int tpm2_get_best_pcr_bank(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH *ret);
const char *tpm2_userspace_log_path(void);
const char *tpm2_firmware_log_path(void);
typedef enum Tpm2UserspaceEventType {
TPM2_EVENT_PHASE,
@@ -184,22 +194,85 @@ void tpm2_log_debug_buffer(const void *buffer, size_t size, const char *msg);
void tpm2_log_debug_digest(const TPM2B_DIGEST *digest, const char *msg);
void tpm2_log_debug_name(const TPM2B_NAME *name, const char *msg);
typedef struct Tpm2PCRPredictionResult {
TPM2B_DIGEST hash[TPM2_N_HASH_ALGORITHMS]; /* a hash for each potential algorithm */
} Tpm2PCRPredictionResult;
TPM2B_DIGEST *tpm2_pcr_prediction_result_get_hash(Tpm2PCRPredictionResult *result, uint16_t alg);
/* A structure encapsulating a full set of PCR predictions with alternatives. This can be converted into a
* series of PolicyOR + PolicyPCR items for the TPM. */
typedef struct Tpm2PCRPrediction {
uint32_t pcrs; /* A mask of pcrs included */
OrderedSet* results[TPM2_PCRS_MAX]; /* set of Tpm2PCRPredictionResult objects, one for each PCR */
} Tpm2PCRPrediction;
void tpm2_pcr_prediction_done(Tpm2PCRPrediction *p);
extern const struct hash_ops tpm2_pcr_prediction_result_hash_ops;
bool tpm2_pcr_prediction_equal(Tpm2PCRPrediction *a, Tpm2PCRPrediction *b, uint16_t algorithm);
int tpm2_pcr_prediction_to_json(const Tpm2PCRPrediction *prediction, uint16_t algorithm, JsonVariant **ret);
int tpm2_pcr_prediction_from_json(Tpm2PCRPrediction *prediction, uint16_t algorithm, JsonVariant *aj);
/* As structure encapsulating all metadata stored for a pcrlock policy on disk */
typedef struct Tpm2PCRLockPolicy {
/* The below is the fixed metadata encoding information about the NV index we store the
* PolicyAuthorizeNV policy in, as well as a pinned SRK, and the encrypted PIN to use for writing to
* the NV Index. */
uint16_t algorithm;
uint32_t nv_index;
struct iovec nv_handle;
struct iovec nv_public;
struct iovec srk_handle;
struct iovec pin_public;
struct iovec pin_private;
/* The below contains the current prediction whose resulting policy is stored in the NV
* index. Once in JSON and once in parsed form. When the policy is updated the fields below are
* changed, the fields above remain fixed. */
JsonVariant *prediction_json;
Tpm2PCRPrediction prediction;
} Tpm2PCRLockPolicy;
void tpm2_pcrlock_policy_done(Tpm2PCRLockPolicy *data);
int tpm2_pcrlock_search_file(const char *path, FILE **ret_file, char **ret_path);
int tpm2_pcrlock_policy_load(const char *path, Tpm2PCRLockPolicy *ret_policy);
int tpm2_index_to_handle(Tpm2Context *c, TPM2_HANDLE index, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
int tpm2_index_from_handle(Tpm2Context *c, const Tpm2Handle *handle, TPM2_HANDLE *ret_index);
int tpm2_pcr_read(Tpm2Context *c, const TPML_PCR_SELECTION *pcr_selection, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
int tpm2_pcr_read_missing_values(Tpm2Context *c, Tpm2PCRValue *pcr_values, size_t n_pcr_values);
int tpm2_get_pin_auth(TPMI_ALG_HASH hash, const char *pin, TPM2B_AUTH *ret_auth);
int tpm2_set_auth(Tpm2Context *c, const Tpm2Handle *handle, const char *pin);
int tpm2_set_auth_binary(Tpm2Context *c, const Tpm2Handle *handle, const TPM2B_AUTH *auth);
int tpm2_make_policy_session(Tpm2Context *c, const Tpm2Handle *primary, const Tpm2Handle *encryption_session, Tpm2Handle **ret_session);
int tpm2_policy_auth_value(Tpm2Context *c, const Tpm2Handle *session, TPM2B_DIGEST **ret_policy_digest);
int tpm2_policy_authorize_nv(Tpm2Context *c, const Tpm2Handle *session, const Tpm2Handle *nv_handle, TPM2B_DIGEST **ret_policy_digest);
int tpm2_policy_pcr(Tpm2Context *c, const Tpm2Handle *session, const TPML_PCR_SELECTION *pcr_selection, TPM2B_DIGEST **ret_policy_digest);
int tpm2_policy_or(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_DIGEST *branches, size_t n_branches, TPM2B_DIGEST **ret_policy_digest);
int tpm2_policy_super_pcr(Tpm2Context *c, const Tpm2Handle *session, const Tpm2PCRPrediction *prediction, uint16_t algorithm);
int tpm2_calculate_pubkey_name(const TPMT_PUBLIC *public, TPM2B_NAME *ret_name);
int tpm2_calculate_nv_index_name(const TPMS_NV_PUBLIC *nvpublic, TPM2B_NAME *ret_name);
int tpm2_calculate_policy_auth_value(TPM2B_DIGEST *digest);
int tpm2_calculate_policy_authorize(const TPM2B_PUBLIC *public, const TPM2B_DIGEST *policy_ref, TPM2B_DIGEST *digest);
int tpm2_calculate_policy_authorize_nv(const TPM2B_NV_PUBLIC *public, TPM2B_DIGEST *digest);
int tpm2_calculate_policy_pcr(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPM2B_DIGEST *digest);
int tpm2_calculate_sealing_policy(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, const TPM2B_PUBLIC *public, bool use_pin, TPM2B_DIGEST *digest);
int tpm2_calculate_policy_or(const TPM2B_DIGEST *branches, size_t n_branches, TPM2B_DIGEST *digest);
int tpm2_calculate_policy_super_pcr(Tpm2PCRPrediction *prediction, uint16_t algorithm, TPM2B_DIGEST *pcr_policy);
int tpm2_calculate_sealing_policy(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, const TPM2B_PUBLIC *public, bool use_pin, const Tpm2PCRLockPolicy *policy, TPM2B_DIGEST *digest);
int tpm2_get_or_create_srk(Tpm2Context *c, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
int tpm2_seal(Tpm2Context *c, uint32_t seal_key_handle, const TPM2B_DIGEST *policy, const char *pin, void **ret_secret, size_t *ret_secret_size, void **ret_blob, size_t *ret_blob_size, uint16_t *ret_primary_alg, void **ret_srk_buf, size_t *ret_srk_buf_size);
int tpm2_unseal(Tpm2Context *c, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, JsonVariant *signature, const char *pin, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *srk_buf, size_t srk_buf_size, void **ret_secret, size_t *ret_secret_size);
int tpm2_unseal(Tpm2Context *c, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, JsonVariant *signature, const char *pin, const Tpm2PCRLockPolicy *pcrlock_policy, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *srk_buf, size_t srk_buf_size, void **ret_secret, size_t *ret_secret_size);
#if HAVE_OPENSSL
int tpm2_tpm2b_public_to_openssl_pkey(const TPM2B_PUBLIC *public, EVP_PKEY **ret);
@@ -209,6 +282,16 @@ int tpm2_tpm2b_public_from_openssl_pkey(const EVP_PKEY *pkey, TPM2B_PUBLIC *ret)
int tpm2_tpm2b_public_from_pem(const void *pem, size_t pem_size, TPM2B_PUBLIC *ret);
int tpm2_tpm2b_public_to_fingerprint(const TPM2B_PUBLIC *public, void **ret_fingerprint, size_t *ret_fingerprint_size);
int tpm2_define_policy_nv_index(Tpm2Context *c, const Tpm2Handle *session, TPM2_HANDLE requested_nv_index, const TPM2B_DIGEST *write_policy, const char *pin, const TPM2B_AUTH *auth, TPM2_HANDLE *ret_nv_index, Tpm2Handle **ret_nv_handle, TPM2B_NV_PUBLIC *ret_nv_public);
int tpm2_write_policy_nv_index(Tpm2Context *c, const Tpm2Handle *policy_session, TPM2_HANDLE nv_index, const Tpm2Handle *nv_handle, const TPM2B_DIGEST *policy_digest);
int tpm2_undefine_policy_nv_index(Tpm2Context *c, const Tpm2Handle *session, TPM2_HANDLE nv_index, const Tpm2Handle *nv_handle);
int tpm2_seal_data(Tpm2Context *c, const struct iovec *data, const Tpm2Handle *primary_handle, const Tpm2Handle *encryption_session, const TPM2B_DIGEST *policy, struct iovec *ret_public, struct iovec *ret_private);
int tpm2_unseal_data(Tpm2Context *c, const struct iovec *public, const struct iovec *private, const Tpm2Handle *primary_handle, const Tpm2Handle *policy_session, const Tpm2Handle *encryption_session, struct iovec *ret_data);
int tpm2_serialize(Tpm2Context *c, const Tpm2Handle *handle, void **ret_serialized, size_t *ret_serialized_size);
int tpm2_deserialize(Tpm2Context *c, const void *serialized, size_t serialized_size, Tpm2Handle **ret_handle);
/* The tpm2-tss library has many structs that are simply a combination of an array (or object) and
* size. These macros allow easily initializing or assigning instances of such structs from an existing
* buffer/object and size, while also checking the size for safety with the struct buffer/object size. If the
@@ -271,6 +354,11 @@ typedef struct {} Tpm2Handle;
typedef struct {} Tpm2PCRValue;
#define TPM2_PCR_VALUE_MAKE(i, h, v) (Tpm2PCRValue) {}
static inline int tpm2_pcrlock_search_file(const char *path, FILE **ret_file, char **ret_path) {
return -ENOENT;
}
#endif /* HAVE_TPM2 */
int tpm2_list_devices(void);
@@ -322,10 +410,13 @@ int tpm2_asym_alg_from_string(const char *alg) _pure_;
char *tpm2_pcr_mask_to_string(uint32_t mask);
extern const uint16_t tpm2_hash_algorithms[];
typedef struct {
uint32_t search_pcr_mask;
const char *device;
const char *signature_path;
const char *pcrlock_path;
} systemd_tpm2_plugin_params;
typedef enum Tpm2Support {