vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Rework TPM measurements

Browse source 
Rework TPM measurements to use fewer PCRs. After discussion with upstream,
it's preferable to avoid using so many PCRs. Instead, measure into PCRs 8
and 9 but use a prefix in the event log to indicate which subsystem carried
out the measurements.
This commit is contained in:
Matthew Garrett 2016-03-23 17:03:43 -07:00
parent c2eee36ec0
commit bb3473d7c8
12 changed files with 24 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

4
grub-core/loader/i386/efi/linux.c
View file

@ -169,7 +169,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
argv[i]);
goto fail;
}
grub_tpm_measure (ptr, cursize, GRUB_INITRD_PCR, "UEFI Linux initrd");
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_linuxefi", "Initrd");
ptr += cursize;
grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
ptr += ALIGN_UP_OVERHEAD (cursize, 4);
@ -225,7 +225,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
goto fail;
}
grub_tpm_measure (kernel, filelen, GRUB_KERNEL_PCR, "UEFI Linux kernel");
grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel");
if (! grub_linuxefi_secure_validate (kernel, filelen))
{

2
grub-core/loader/i386/linux.c
View file

@ -718,7 +718,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
goto fail;
}
grub_tpm_measure (kernel, len, GRUB_KERNEL_PCR, "Linux Kernel");
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux", "Kernel");
grub_memcpy (&lh, kernel, sizeof (lh));

2
grub-core/loader/i386/multiboot_mbi.c
View file

@ -165,7 +165,7 @@ grub_multiboot_load (grub_file_t file, const char *filename)
return grub_errno;
}
grub_tpm_measure((unsigned char*)buffer, len, GRUB_KERNEL_PCR, filename);
grub_tpm_measure((unsigned char*)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
header = find_header (buffer, len);

2
grub-core/loader/i386/pc/linux.c
View file

@ -161,7 +161,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
goto fail;
}
grub_tpm_measure (kernel, len, GRUB_KERNEL_PCR, "BIOS Linux Kernel");
grub_tpm_measure (kernel, len, GRUB_BINARY_PCR, "grub_linux16", "Kernel");
grub_memcpy (&lh, kernel, sizeof (lh));
kernel_offset = sizeof (lh);

2
grub-core/loader/linux.c
View file

@ -289,7 +289,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
grub_initrd_close (initrd_ctx);
return grub_errno;
}
grub_tpm_measure (ptr, cursize, GRUB_INITRD_PCR, "Linux Initrd");
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_initrd", "Initrd");
ptr += cursize;
}
if (newc)

2
grub-core/loader/multiboot.c
View file

@ -385,7 +385,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
}
grub_file_close (file);
grub_tpm_measure (module, size, GRUB_KERNEL_PCR, argv[0]);
grub_tpm_measure (module, size, GRUB_BINARY_PCR, "grub_multiboot", argv[0]);
return GRUB_ERR_NONE;
}

2
grub-core/loader/multiboot_mbi2.c
View file

@ -127,7 +127,7 @@ grub_multiboot_load (grub_file_t file, const char *filename)
COMPILE_TIME_ASSERT (MULTIBOOT_HEADER_ALIGN % 4 == 0);
grub_tpm_measure ((unsigned char *)buffer, len, GRUB_KERNEL_PCR, filename);
grub_tpm_measure ((unsigned char *)buffer, len, GRUB_BINARY_PCR, "grub_multiboot", filename);
header = find_header (buffer, len);