SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28948 from poettering/tpm2-duplicate-pcr-names

Browse Source 
tpm2: unify tpm2 PCR symbolic identifiers
This commit is contained in:
Luca Boccassi
2023-08-28 17:43:10 +01:00
committed by GitHub
parent f154440980 e0e1f4f7a2
commit cd4ed8579b
17 changed files with 174 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/efi-loader.c
+4 -4
View File
@@ -7,7 +7,7 @@
#include "path-util.h"
#include "stat-util.h"
#include "strv.h"
#include "tpm-pcr.h"
#include "tpm2-pcr.h"
#include "utf8.h"
#if ENABLE_EFI
@@ -271,10 +271,10 @@ int efi_stub_measured(int log_level) {
if (r < 0)
return log_full_errno(log_level, r,
"Failed to parse StubPcrKernelImage EFI variable: %s", pcr_string);
if (pcr_nr != TPM_PCR_INDEX_KERNEL_IMAGE)
if (pcr_nr != TPM2_PCR_KERNEL_BOOT)
return log_full_errno(log_level, SYNTHETIC_ERRNO(EREMOTE),
"Kernel stub measured kernel image into PCR %u, which is different than expected %u.",
pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE);
"Kernel stub measured kernel image into PCR %u, which is different than expected %i.",
pcr_nr, TPM2_PCR_KERNEL_BOOT);
return 1;
}
src/shared/tpm2-util.c
+21 -21
View File
@@ -1737,7 +1737,7 @@ int tpm2_pcr_value_from_string(const char *arg, Tpm2PCRValue *ret_pcr_value) {
if (r < 1)
return log_error_errno(r, "Could not parse pcr value '%s': %m", p);
r = pcr_index_from_string(index);
r = tpm2_pcr_index_from_string(index);
if (r < 0)
return log_error_errno(r, "Invalid pcr index '%s': %m", index);
pcr_value.index = (unsigned) r;
@@ -5036,25 +5036,25 @@ int tpm2_util_pbkdf2_hmac_sha256(const void *pass,
return 0;
}
static const char* const pcr_index_table[_PCR_INDEX_MAX_DEFINED] = {
[PCR_PLATFORM_CODE] = "platform-code",
[PCR_PLATFORM_CONFIG] = "platform-config",
[PCR_EXTERNAL_CODE] = "external-code",
[PCR_EXTERNAL_CONFIG] = "external-config",
[PCR_BOOT_LOADER_CODE] = "boot-loader-code",
[PCR_BOOT_LOADER_CONFIG] = "boot-loader-config",
[PCR_HOST_PLATFORM] = "host-platform",
[PCR_SECURE_BOOT_POLICY] = "secure-boot-policy",
[PCR_KERNEL_INITRD] = "kernel-initrd",
[PCR_IMA] = "ima",
[PCR_KERNEL_BOOT] = "kernel-boot",
[PCR_KERNEL_CONFIG] = "kernel-config",
[PCR_SYSEXTS] = "sysexts",
[PCR_SHIM_POLICY] = "shim-policy",
[PCR_SYSTEM_IDENTITY] = "system-identity",
[PCR_DEBUG] = "debug",
[PCR_APPLICATION_SUPPORT] = "application-support",
static const char* const tpm2_pcr_index_table[_TPM2_PCR_INDEX_MAX_DEFINED] = {
[TPM2_PCR_PLATFORM_CODE] = "platform-code",
[TPM2_PCR_PLATFORM_CONFIG] = "platform-config",
[TPM2_PCR_EXTERNAL_CODE] = "external-code",
[TPM2_PCR_EXTERNAL_CONFIG] = "external-config",
[TPM2_PCR_BOOT_LOADER_CODE] = "boot-loader-code",
[TPM2_PCR_BOOT_LOADER_CONFIG] = "boot-loader-config",
[TPM2_PCR_HOST_PLATFORM] = "host-platform",
[TPM2_PCR_SECURE_BOOT_POLICY] = "secure-boot-policy",
[TPM2_PCR_KERNEL_INITRD] = "kernel-initrd",
[TPM2_PCR_IMA] = "ima",
[TPM2_PCR_KERNEL_BOOT] = "kernel-boot",
[TPM2_PCR_KERNEL_CONFIG] = "kernel-config",
[TPM2_PCR_SYSEXTS] = "sysexts",
[TPM2_PCR_SHIM_POLICY] = "shim-policy",
[TPM2_PCR_SYSTEM_IDENTITY] = "system-identity",
[TPM2_PCR_DEBUG] = "debug",
[TPM2_PCR_APPLICATION_SUPPORT] = "application-support",
};
DEFINE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_FALLBACK(pcr_index, int, TPM2_PCRS_MAX - 1);
DEFINE_STRING_TABLE_LOOKUP_TO_STRING(pcr_index, int);
DEFINE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_FALLBACK(tpm2_pcr_index, int, TPM2_PCRS_MAX - 1);
DEFINE_STRING_TABLE_LOOKUP_TO_STRING(tpm2_pcr_index, int);
src/shared/tpm2-util.h
+10 -30
View File
@@ -9,6 +9,7 @@
#include "macro.h"
#include "openssl-util.h"
#include "sha256.h"
#include "tpm2-pcr.h"
typedef enum TPM2Flags {
TPM2_FLAGS_USE_PIN = 1 << 0,
@@ -18,6 +19,7 @@ typedef enum TPM2Flags {
* TPM2 on a Client PC must have at least 24 PCRs. This hardcodes our expectation of 24. */
#define TPM2_PCRS_MAX 24U
#define TPM2_PCRS_MASK ((UINT32_C(1) << TPM2_PCRS_MAX) - 1)
static inline bool TPM2_PCR_INDEX_VALID(unsigned pcr) {
return pcr < TPM2_PCRS_MAX;
}
@@ -306,34 +308,6 @@ typedef enum Tpm2Support {
TPM2_SUPPORT_FULL = TPM2_SUPPORT_FIRMWARE|TPM2_SUPPORT_DRIVER|TPM2_SUPPORT_SYSTEM|TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_LIBRARIES,
} Tpm2Support;
enum {
/* The following names for PCRs 0…7 are based on the names in the "TCG PC Client Specific Platform
* Firmware Profile Specification"
* (https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/) */
PCR_PLATFORM_CODE = 0,
PCR_PLATFORM_CONFIG = 1,
PCR_EXTERNAL_CODE = 2,
PCR_EXTERNAL_CONFIG = 3,
PCR_BOOT_LOADER_CODE = 4,
PCR_BOOT_LOADER_CONFIG = 5,
PCR_HOST_PLATFORM = 6,
PCR_SECURE_BOOT_POLICY = 7,
/* The following names for PCRs 9…15 are based on the "Linux TPM PCR Registry"
(https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/) */
PCR_KERNEL_INITRD = 9,
PCR_IMA = 10,
PCR_KERNEL_BOOT = 11,
PCR_KERNEL_CONFIG = 12,
PCR_SYSEXTS = 13,
PCR_SHIM_POLICY = 14,
PCR_SYSTEM_IDENTITY = 15,
/* As per "TCG PC Client Specific Platform Firmware Profile Specification" again, see above */
PCR_DEBUG = 16,
PCR_APPLICATION_SUPPORT = 23,
_PCR_INDEX_MAX_DEFINED = TPM2_PCRS_MAX,
_PCR_INDEX_INVALID = -EINVAL,
};
Tpm2Support tpm2_support(void);
int tpm2_parse_pcr_argument(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
@@ -349,5 +323,11 @@ int tpm2_util_pbkdf2_hmac_sha256(const void *pass,
size_t saltlen,
uint8_t res[static SHA256_DIGEST_SIZE]);
int pcr_index_from_string(const char *s) _pure_;
const char *pcr_index_to_string(int pcr) _const_;
enum {
/* Additional defines for the PCR index naming enum from "fundamental/tpm2-pcr.h" */
_TPM2_PCR_INDEX_MAX_DEFINED = TPM2_PCRS_MAX,
_TPM2_PCR_INDEX_INVALID = -EINVAL,
};
int tpm2_pcr_index_from_string(const char *s) _pure_;
const char *tpm2_pcr_index_to_string(int pcr) _const_;