SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28948 from poettering/tpm2-duplicate-pcr-names

Browse Source 
tpm2: unify tpm2 PCR symbolic identifiers
This commit is contained in:
Luca Boccassi
2023-08-28 17:43:10 +01:00
committed by GitHub
parent f154440980 e0e1f4f7a2
commit cd4ed8579b
17 changed files with 174 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/boot/efi/measure.c
+4 -4
View File
@@ -5,7 +5,7 @@
#include "macro-fundamental.h"
#include "measure.h"
#include "proto/tcg.h"
#include "tpm-pcr.h"
#include "tpm2-pcr.h"
#include "util.h"
static EFI_STATUS tpm1_measure_to_pcr_and_event_log(
@@ -202,7 +202,7 @@ EFI_STATUS tpm_log_load_options(const char16_t *load_options, bool *ret_measured
/* Measures a load options string into the TPM2, i.e. the kernel command line */
err = tpm_log_event(
TPM_PCR_INDEX_KERNEL_PARAMETERS,
TPM2_PCR_KERNEL_CONFIG,
POINTER_TO_PHYSICAL_ADDRESS(load_options),
strsize16(load_options),
load_options,
@@ -210,8 +210,8 @@ EFI_STATUS tpm_log_load_options(const char16_t *load_options, bool *ret_measured
if (err != EFI_SUCCESS)
return log_error_status(
err,
"Unable to add load options (i.e. kernel command) line measurement to PCR %u: %m",
TPM_PCR_INDEX_KERNEL_PARAMETERS);
"Unable to add load options (i.e. kernel command) line measurement to PCR %i: %m",
TPM2_PCR_KERNEL_CONFIG);
if (ret_measured)
*ret_measured = measured;
src/boot/efi/stub.c
+10 -9
View File
@@ -13,7 +13,8 @@
#include "secure-boot.h"
#include "shim.h"
#include "splash.h"
#include "tpm-pcr.h"
#include "tpm2-pcr.h"
#include "uki.h"
#include "util.h"
#include "version.h"
#include "vmm.h"
@@ -417,7 +418,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
/* First measure the name of the section */
(void) tpm_log_event_ascii(
TPM_PCR_INDEX_KERNEL_IMAGE,
TPM2_PCR_KERNEL_BOOT,
POINTER_TO_PHYSICAL_ADDRESS(unified_sections[section]),
strsize8(unified_sections[section]), /* including NUL byte */
unified_sections[section],
@@ -427,7 +428,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
/* Then measure the data of the section */
(void) tpm_log_event_ascii(
TPM_PCR_INDEX_KERNEL_IMAGE,
TPM2_PCR_KERNEL_BOOT,
POINTER_TO_PHYSICAL_ADDRESS(loaded_image->ImageBase) + addrs[section],
szs[section],
unified_sections[section],
@@ -439,7 +440,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
/* After we are done, set an EFI variable that tells userspace this was done successfully, and encode
* in it which PCR was used. */
if (sections_measured > 0)
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrKernelImage", TPM_PCR_INDEX_KERNEL_IMAGE, 0);
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrKernelImage", TPM2_PCR_KERNEL_BOOT, 0);
/* Show splash screen as early as possible */
graphics_splash((const uint8_t*) loaded_image->ImageBase + addrs[UNIFIED_SECTION_SPLASH], szs[UNIFIED_SECTION_SPLASH]);
@@ -515,7 +516,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
".extra/credentials",
/* dir_mode= */ 0500,
/* access_mode= */ 0400,
/* tpm_pcr= */ TPM_PCR_INDEX_KERNEL_PARAMETERS,
/* tpm_pcr= */ TPM2_PCR_KERNEL_CONFIG,
u"Credentials initrd",
&credential_initrd,
&credential_initrd_size,
@@ -528,7 +529,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
".extra/global_credentials",
/* dir_mode= */ 0500,
/* access_mode= */ 0400,
/* tpm_pcr= */ TPM_PCR_INDEX_KERNEL_PARAMETERS,
/* tpm_pcr= */ TPM2_PCR_KERNEL_CONFIG,
u"Global credentials initrd",
&global_credential_initrd,
&global_credential_initrd_size,
@@ -541,7 +542,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
".extra/sysext",
/* dir_mode= */ 0555,
/* access_mode= */ 0444,
/* tpm_pcr= */ TPM_PCR_INDEX_INITRD_SYSEXTS,
/* tpm_pcr= */ TPM2_PCR_SYSEXTS,
u"System extension initrd",
&sysext_initrd,
&sysext_initrd_size,
@@ -549,9 +550,9 @@ static EFI_STATUS run(EFI_HANDLE image) {
sysext_measured = m;
if (parameters_measured > 0)
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrKernelParameters", TPM_PCR_INDEX_KERNEL_PARAMETERS, 0);
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrKernelParameters", TPM2_PCR_KERNEL_CONFIG, 0);
if (sysext_measured)
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrInitRDSysExts", TPM_PCR_INDEX_INITRD_SYSEXTS, 0);
(void) efivar_set_uint_string(MAKE_GUID_PTR(LOADER), u"StubPcrInitRDSysExts", TPM2_PCR_SYSEXTS, 0);
/* If the PCR signature was embedded in the PE image, then let's wrap it in a cpio and also pass it
* to the kernel, so that it can be read from /.extra/tpm2-pcr-signature.json. Note that this section
src/boot/measure.c
+22 -25
View File
@@ -18,8 +18,9 @@
#include "pretty-print.h"
#include "sha256.h"
#include "terminal-util.h"
#include "tpm-pcr.h"
#include "tpm2-pcr.h"
#include "tpm2-util.h"
#include "uki.h"
#include "verbs.h"
/* Tool for pre-calculating expected TPM PCR values based on measured resources. This is intended to be used
@@ -409,7 +410,7 @@ static int measure_kernel(PcrState *pcr_states, size_t n) {
_cleanup_free_ void *v = NULL;
size_t sz;
if (asprintf(&p, "/sys/class/tpm/tpm0/pcr-%s/%" PRIu32, pcr_states[i].bank, TPM_PCR_INDEX_KERNEL_IMAGE) < 0)
if (asprintf(&p, "/sys/class/tpm/tpm0/pcr-%s/%i", pcr_states[i].bank, TPM2_PCR_KERNEL_BOOT) < 0)
return log_oom();
r = read_virtual_file(p, 4096, &s, NULL);
@@ -679,9 +680,9 @@ static int verb_calculate(int argc, char *argv[], void *userdata) {
if (i == 0) {
fflush(stdout);
fprintf(stderr, "%s# PCR[%" PRIu32 "] Phase <%s>%s\n",
fprintf(stderr, "%s# PCR[%i] Phase <%s>%s\n",
ansi_grey(),
TPM_PCR_INDEX_KERNEL_IMAGE,
TPM2_PCR_KERNEL_BOOT,
isempty(*phase) ? ":" : *phase,
ansi_normal());
fflush(stderr);
@@ -691,7 +692,7 @@ static int verb_calculate(int argc, char *argv[], void *userdata) {
if (!hd)
return log_oom();
printf("%" PRIu32 ":%s=%s\n", TPM_PCR_INDEX_KERNEL_IMAGE, pcr_states[i].bank, hd);
printf("%i:%s=%s\n", TPM2_PCR_KERNEL_BOOT, pcr_states[i].bank, hd);
} else {
_cleanup_(json_variant_unrefp) JsonVariant *array = NULL;
@@ -701,7 +702,7 @@ static int verb_calculate(int argc, char *argv[], void *userdata) {
&array,
JSON_BUILD_OBJECT(
JSON_BUILD_PAIR_CONDITION(!isempty(*phase), "phase", JSON_BUILD_STRING(*phase)),
JSON_BUILD_PAIR("pcr", JSON_BUILD_INTEGER(TPM_PCR_INDEX_KERNEL_IMAGE)),
JSON_BUILD_PAIR("pcr", JSON_BUILD_INTEGER(TPM2_PCR_KERNEL_BOOT)),
JSON_BUILD_PAIR("hash", JSON_BUILD_HEX(pcr_states[i].value, pcr_states[i].value_size))));
if (r < 0)
return log_error_errno(r, "Failed to append JSON object to array: %m");
@@ -826,7 +827,7 @@ static int verb_sign(int argc, char *argv[], void *userdata) {
if (tpmalg < 0)
return log_error_errno(tpmalg, "Unsupported PCR bank");
Tpm2PCRValue pcr_value = TPM2_PCR_VALUE_MAKE(TPM_PCR_INDEX_KERNEL_IMAGE,
Tpm2PCRValue pcr_value = TPM2_PCR_VALUE_MAKE(TPM2_PCR_KERNEL_BOOT,
tpmalg,
TPM2B_DIGEST_MAKE(p->value, p->value_size));
@@ -869,7 +870,7 @@ static int verb_sign(int argc, char *argv[], void *userdata) {
return r;
_cleanup_(json_variant_unrefp) JsonVariant *a = NULL;
r = tpm2_make_pcr_json_array(UINT64_C(1) << TPM_PCR_INDEX_KERNEL_IMAGE, &a);
r = tpm2_make_pcr_json_array(UINT64_C(1) << TPM2_PCR_KERNEL_BOOT, &a);
if (r < 0)
return log_error_errno(r, "Failed to build JSON PCR mask array: %m");
@@ -944,15 +945,15 @@ static int validate_stub(void) {
log_warning("Warning: current kernel image does not support measuring itself, the command line or initrd system extension images.\n"
"The PCR measurements seen are unlikely to be valid.");
r = compare_reported_pcr_nr(TPM_PCR_INDEX_KERNEL_IMAGE, EFI_LOADER_VARIABLE(StubPcrKernelImage), "kernel image");
r = compare_reported_pcr_nr(TPM2_PCR_KERNEL_BOOT, EFI_LOADER_VARIABLE(StubPcrKernelImage), "kernel image");
if (r < 0)
return r;
r = compare_reported_pcr_nr(TPM_PCR_INDEX_KERNEL_PARAMETERS, EFI_LOADER_VARIABLE(StubPcrKernelParameters), "kernel parameters");
r = compare_reported_pcr_nr(TPM2_PCR_KERNEL_CONFIG, EFI_LOADER_VARIABLE(StubPcrKernelParameters), "kernel parameters");
if (r < 0)
return r;
r = compare_reported_pcr_nr(TPM_PCR_INDEX_INITRD_SYSEXTS, EFI_LOADER_VARIABLE(StubPcrInitRDSysExts), "initrd system extension images");
r = compare_reported_pcr_nr(TPM2_PCR_SYSEXTS, EFI_LOADER_VARIABLE(StubPcrInitRDSysExts), "initrd system extension images");
if (r < 0)
return r;
@@ -980,17 +981,13 @@ static int validate_stub(void) {
}
static int verb_status(int argc, char *argv[], void *userdata) {
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
static const struct {
uint32_t nr;
const char *description;
} relevant_pcrs[] = {
{ TPM_PCR_INDEX_KERNEL_IMAGE, "Unified Kernel Image" },
{ TPM_PCR_INDEX_KERNEL_PARAMETERS, "Kernel Parameters" },
{ TPM_PCR_INDEX_INITRD_SYSEXTS, "initrd System Extensions" },
static const uint32_t relevant_pcrs[] = {
TPM2_PCR_KERNEL_BOOT,
TPM2_PCR_KERNEL_CONFIG,
TPM2_PCR_SYSEXTS,
};
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
int r;
r = validate_stub();
@@ -1008,7 +1005,7 @@ static int verb_status(int argc, char *argv[], void *userdata) {
if (!b)
return log_oom();
if (asprintf(&p, "/sys/class/tpm/tpm0/pcr-%s/%" PRIu32, ascii_strlower(b), relevant_pcrs[i].nr) < 0)
if (asprintf(&p, "/sys/class/tpm/tpm0/pcr-%s/%" PRIu32, ascii_strlower(b), relevant_pcrs[i]) < 0)
return log_oom();
r = read_virtual_file(p, 4096, &s, NULL);
@@ -1034,21 +1031,21 @@ static int verb_status(int argc, char *argv[], void *userdata) {
fflush(stdout);
fprintf(stderr, "%s# PCR[%" PRIu32 "] %s%s%s\n",
ansi_grey(),
relevant_pcrs[i].nr,
relevant_pcrs[i].description,
relevant_pcrs[i],
tpm2_pcr_index_to_string(relevant_pcrs[i]),
memeqzero(h, l) ? " (NOT SET!)" : "",
ansi_normal());
fflush(stderr);
}
printf("%" PRIu32 ":%s=%s\n", relevant_pcrs[i].nr, b, f);
printf("%" PRIu32 ":%s=%s\n", relevant_pcrs[i], b, f);
} else {
_cleanup_(json_variant_unrefp) JsonVariant *bv = NULL, *a = NULL;
r = json_build(&bv,
JSON_BUILD_OBJECT(
JSON_BUILD_PAIR("pcr", JSON_BUILD_INTEGER(relevant_pcrs[i].nr)),
JSON_BUILD_PAIR("pcr", JSON_BUILD_INTEGER(relevant_pcrs[i])),
JSON_BUILD_PAIR("hash", JSON_BUILD_HEX(h, l))
)
);
src/boot/pcrphase.c
+5 -5
View File
@@ -18,7 +18,7 @@
#include "openssl-util.h"
#include "parse-argument.h"
#include "pretty-print.h"
#include "tpm-pcr.h"
#include "tpm2-pcr.h"
#include "tpm2-util.h"
static bool arg_graceful = false;
@@ -290,7 +290,7 @@ static int run(int argc, char *argv[]) {
return log_error_errno(r, "Failed to get file system identifier string for '%s': %m", arg_file_system);
}
target_pcr_nr = TPM_PCR_INDEX_VOLUME_KEY; /* → PCR 15 */
target_pcr_nr = TPM2_PCR_SYSTEM_IDENTITY; /* → PCR 15 */
} else if (arg_machine_id) {
sd_id128_t mid;
@@ -306,7 +306,7 @@ static int run(int argc, char *argv[]) {
if (!word)
return log_oom();
target_pcr_nr = TPM_PCR_INDEX_VOLUME_KEY; /* → PCR 15 */
target_pcr_nr = TPM2_PCR_SYSTEM_IDENTITY; /* → PCR 15 */
} else {
if (optind+1 != argc)
@@ -322,7 +322,7 @@ static int run(int argc, char *argv[]) {
if (isempty(word))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "String to measure cannot be empty, refusing.");
target_pcr_nr = TPM_PCR_INDEX_KERNEL_IMAGE; /* → PCR 11 */
target_pcr_nr = TPM2_PCR_KERNEL_BOOT; /* → PCR 11 */
}
if (arg_graceful && tpm2_support() != TPM2_SUPPORT_FULL) {
@@ -337,7 +337,7 @@ static int run(int argc, char *argv[]) {
if (r < 0)
return r;
if (r == 0) {
log_info("Kernel stub did not measure kernel image into PCR %u, skipping userspace measurement, too.", TPM_PCR_INDEX_KERNEL_IMAGE);
log_info("Kernel stub did not measure kernel image into PCR %i, skipping userspace measurement, too.", TPM2_PCR_KERNEL_BOOT);
return EXIT_SUCCESS;
}