Previously we only logged our measurements to the journal. This is not a
great solution though, since regular logs are subject to rotation, which
is something we really cannot have for measurements (as it means we can
never reproduce the PCR values from the data). Hence, let's maintain an
explicit log.
Ideally, we'd just use the TCG Canonical Event Log format 1:1
(https://trustedcomputinggroup.org/resource/canonical-event-log-format/).
However it's not a perfect fit fo us, for various reasons. But let's
follow it (in its JSON incantation) as closely at it makes sense, so
that it can easily be converted to the full format by programs consuming
it.
Code comments explain where we deviate from the TCG CEL-JSON, and what
to do about it when reading the data.
This partially reverts 3c1eee5bed.
I thought that it is not necessary, but
https://mesonbuild.com/Reference-manual_functions.html#vcs_tag says:
> This method returns a custom_tgt should be used to signal dependencies if
> other targets use the file outputted by this.
>
> For example, if you generate a header with this and want to use that in a
> build target, you must add the return value to the sources of that build
> target. Without that, Meson will not know the order in which to build the
> targets.
We can use version_h directly, since we already have it.
Hopefully fixes https://github.com/systemd/systemd/issues/28994.
There's really no point in first extracting a command line from an UKI
to just pass it unmodified to the UKI. In particular as this is
systematically ignored in SecureBoot is enabled.
Let's drop this, so that unless the user actually edits the cmdline we
pass nothing to the invoked kernel.
Note that this low-key is a compat break, since the passed cmdline gets
measured. However, in the interest of minimized the difference between
systems with and without sd-boot to behave the same i think we should
suppress the command line anyway.
The use of vcs_tag was dropped in #28567, which results in builds having
stale version information once new commit are made.
This also fixes a case where CI builds would have no version information
because they are checked out without any tags for git-describe to use.
Additionally, use `--git-dir` now, as that particular issues seems to
have been fixed by now.
I always found it confusing that most of our TPM related definitions are
in tpm2-util.h, but the PCR names in tpm-pcr.h, without the "2". Let's
fix that and make this systematic, in particular as the definitions in
the file all start with TPM2_ already.
No code flow changes, just some renaming.
We so far maintained two places for symboic names for PCRs. One in
tpm2-util.h and one in tpm-pcr.h.
Let's unify this into one, i.e. move the full list from tpm2-util.h into
tpm-pcr.h, replacing the short list placed so far there.
Systematically prefix the definitions with TPM2_ or tpm2_, to follow how
we do this for all other defines in this context.
No change in behaviour, just unification of tables.
Let's make utf8_to_utf16() and utf16_to_utf8() a bit nicer to use by
adding shortcuts for common cases.
This is particularly relevant for utf16_to_utf8() since the
multiplication with 2 is easy to forget.
I couldn't get ctrl work properly over serial line/qemu. Hence, let's
add an alias for Ctrl-l: a simple Shift-l (i.e. uppercase L)
(Note that lowercase L will result in selection of the first Linux
entry, hence we stay away from that)
Let's modernize the function a bit, and make it return the string passed
in, as we usually do.
Most importanly though: also drop leading whitespace, not just trailing
whitespace.
"static inline" makes sense in .h files. But in .c files it's useless
decoration, the compiler should just make its own decisions there, and
it can do that.
hence, replace all remaining uses of "static line" by a simple" static"
in all .c files (but keep them in .h files, where they make sense)
The gnu-efi definition of the struct uses [1], our local one [0] to size
the filename array. Let's avoid an ambiguity and use offsetof() so that
this difference doesn't matter. Also, doing it this way makes very clear
to the read what happens here: it's a structure with a variable size
suffix.
The command is deprecated, as per NEWS of 254. Let's go one step further
and remove it from the help text and man page, so that people are not
inspired to use it at this time anymore.
This is how we usually have done this before: remove it from visibility,
but support it for a while still.
An array of Tpm2PCRValue objects effectively replaces a TPML_PCR_SELECTION
object combined with an array of (properly ordered) TPM2B_DIGEST objects.
Also update tpm2_calculate_sealing_policy() pin parameter to boolean use_pin,
since the function does not need to know the pin value, only if a pin is being
used.
We were passing the dir handle for the ESP to
config_entry_bump_counters(), which will obviously fail if the entry
actually resides on the XBOOTLDR partition.
Fixes: #28637
$ journalctl -u systemd-bless-boot.service
systemd[1]: Starting Mark the Current Boot Loader Entry as Good...
systemd-bless-boot[536]: Marked boot as 'good'. (Boot attempt counter is at 2.)
systemd-bless-boot[536]: Can't find boot counter source file for '/loader/entries/arch.conf': Device or resource busy
systemd[1]: Finished Mark the Current Boot Loader Entry as Good.
The stub image may not have enough sections to cause enough PE header
space to be free for later expansion. Given that the stub is guaranteed
to be expanded we should always reserve enough sections for it.
This also bumps the reservation to 15. It doesn't add more space
compared to current builds but it more closely reflects the amount of
sections that a UKI could have in total if all optional sections are
used.
Fixes: #28593
Given that ERRNO_IS_NOT_SUPPORTED() also matches positive values,
make sure this macro is not called with arguments that do not have
errno semantics.
In this case the argument passed to ERRNO_IS_NOT_SUPPORTED() is the
value returned by efi_loader_get_entries() which is not expected to
return any positive values, but let's be consistent anyway and move
the ERRNO_IS_NOT_SUPPORTED() invocation to the branch where
the return value is known to be negative.
Joerg Behrmann
Zbigniew Jędrzejewski-Szmek
Lennart Poettering
Jan Janssen
Mike Yuan
Luca Boccassi
Emanuele Giuseppe Esposito
Dan Streetman
Yu Watanabe
Daan De Meyer
Dmitry V. Levin