vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Rework TPM measurements

Browse source 
Rework TPM measurements to use fewer PCRs. After discussion with upstream,
it's preferable to avoid using so many PCRs. Instead, measure into PCRs 8
and 9 but use a prefix in the event log to indicate which subsystem carried
out the measurements.
This commit is contained in:
Matthew Garrett 2016-03-23 17:03:43 -07:00
parent c2eee36ec0
commit bb3473d7c8
12 changed files with 24 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

4
grub-core/loader/i386/efi/linux.c
View file

@ -169,7 +169,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
argv[i]);
goto fail;
}
grub_tpm_measure (ptr, cursize, GRUB_INITRD_PCR, "UEFI Linux initrd");
grub_tpm_measure (ptr, cursize, GRUB_BINARY_PCR, "grub_linuxefi", "Initrd");
ptr += cursize;
grub_memset (ptr, 0, ALIGN_UP_OVERHEAD (cursize, 4));
ptr += ALIGN_UP_OVERHEAD (cursize, 4);
@ -225,7 +225,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
goto fail;
}
grub_tpm_measure (kernel, filelen, GRUB_KERNEL_PCR, "UEFI Linux kernel");
grub_tpm_measure (kernel, filelen, GRUB_BINARY_PCR, "grub_linuxefi", "Kernel");
if (! grub_linuxefi_secure_validate (kernel, filelen))
{