File pcr-snapshot.patch of Package grub2

Overview Repositories Revisions Requests Users Attributes Meta

File pcr-snapshot.patch of Package grub2 (Revision 6757f9829ff077dd3a1b48db1bc9a621)

Currently displaying revision 6757f9829ff077dd3a1b48db1bc9a621 , Show latest

Index: grub-2.06/grub-core/tpm2/module.c
===================================================================
--- grub-2.06.orig/grub-core/tpm2/module.c
+++ grub-2.06/grub-core/tpm2/module.c
@@ -47,6 +47,7 @@ struct grub_tpm2_protector_context
   const char *keyfile;
   TPM_HANDLE srk;
   TPM_HANDLE nv;
+  const char *efivar;
 };
 
 static const struct grub_arg_option grub_tpm2_protector_init_cmd_options[] =
@@ -123,6 +124,16 @@ static const struct grub_arg_option grub
         N_("Required in NV Index mode, the NV handle to read which must "
            "readily exist on the TPM and which contains the key."),
     },
+    /* When publishing the unsealed key to a UEFI variable */
+    {
+      .longarg  = "efivar",
+      .shortarg = 'E',
+      .flags    = 0,
+      .arg      = NULL,
+      .type     = ARG_TYPE_STRING,
+      .doc      =
+        N_("Publish the unsealed key to the indicated UEFI variable."),
+    },
     /* End of list */
     {0, 0, 0, 0, 0, 0}
   };
@@ -456,9 +467,12 @@ grub_tpm2_protector_srk_recover (const s
      grub_printf("\n");
   }
 
-#if 1
-  (void) grub_tpm2_protector_publish_key(data.buffer, data.size, "LuksRootKey");
-#endif
+  if (ctx->efivar)
+    {
+      rc = grub_tpm2_protector_publish_key (data.buffer, data.size, ctx->efivar);
+      if (rc)
+	goto exit4;
+    }
 
   grub_memcpy (key_out, data.buffer, data.size);
 
@@ -588,20 +602,32 @@ grub_tpm2_protector_check_args (struct g
 }
 
 static grub_err_t
-grub_tpm2_protector_parse_keyfile (const char *value, const char **keyfile)
+grub_tpm2_protector_parse_string (const char *value, const char **var, const char *arg_name)
 {
   if (grub_strlen (value) == 0)
     return GRUB_ERR_BAD_ARGUMENT;
 
-  *keyfile = grub_strdup (value);
-  if (!*keyfile)
+  *var = grub_strdup (value);
+  if (!*var)
     return grub_error (GRUB_ERR_OUT_OF_MEMORY,
-                       N_("No memory to duplicate keyfile path"));
+                       N_("No memory to duplicate %s argument"), arg_name);
 
   return GRUB_ERR_NONE;
 }
 
 static grub_err_t
+grub_tpm2_protector_parse_keyfile (const char *value, const char **keyfile)
+{
+  return grub_tpm2_protector_parse_string (value, keyfile, "keyfile");
+}
+
+static grub_err_t
+grub_tpm2_protector_parse_efivar (const char *value, const char **efivar)
+{
+  return grub_tpm2_protector_parse_string (value, efivar, "efivar");
+}
+
+static grub_err_t
 grub_tpm2_protector_parse_mode (const char *value,
                                 grub_tpm2_protector_mode_t *mode)
 {
@@ -689,6 +715,14 @@ grub_tpm2_protector_init_cmd_handler (gr
       if (err)
         return err;
     }
+
+  if (state[7].set)  /* efivar */
+    {
+      err = grub_tpm2_protector_parse_efivar (state[7].arg,
+                                                  &grub_tpm2_protector_ctx.efivar);
+      if (err)
+        return err;
+    }
 
   err = grub_tpm2_protector_check_args (&grub_tpm2_protector_ctx);
 
Index: grub-2.06/grub-core/commands/tpm.c
===================================================================
--- grub-2.06.orig/grub-core/commands/tpm.c
+++ grub-2.06/grub-core/commands/tpm.c
@@ -26,6 +26,9 @@
 #include <grub/term.h>
 #include <grub/verify.h>
 #include <grub/dl.h>
+#include <grub/extcmd.h>
+#include <grub/tpm2/tpm2.h>
+#include <grub/efi/efi.h>
 
 GRUB_MOD_LICENSE ("GPLv3+");
 
@@ -84,12 +87,223 @@ struct grub_file_verifier grub_tpm_verif
   .verify_string = grub_tpm_verify_string,
 };
 
+/*
+ * Preserve current PCR values and record them to an EFI variable
+ */
+#define GRUB2_PCR_BITMASK_DEFAULT	((1 << 16) - 1)
+#define GRUB2_PCR_BITMASK_ALL		((1 << 24) - 1)
+
+static const struct grub_arg_option grub_tpm_record_pcrs_options[] =
+  {
+    {
+      .longarg  = "efivar",
+      .shortarg = 'E',
+      .flags    = 0,
+      .arg      = NULL,
+      .type     = ARG_TYPE_STRING,
+      .doc      =
+        N_("The EFI variable to publish the PCRs to (default GrubPcrSnapshot)"),
+    },
+
+    {0, 0, 0, 0, 0, 0}
+  };
+
+static grub_err_t
+grub_tpm_parse_pcr_index (const char *word, const char **end_ret, unsigned int *index)
+{
+  const char *end;
+
+  if (!grub_isdigit (word[0]))
+    return GRUB_ERR_BAD_NUMBER;
+
+  *index = grub_strtoul(word, &end, 0);
+  if (*index > 32)
+    return GRUB_ERR_BAD_NUMBER;
+
+  *end_ret = end;
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_tpm_parse_pcr_list (const char *arg, grub_uint32_t *bitmask)
+{
+  const char *word, *end;
+  unsigned int index, last_index;
+
+  if (!grub_strcmp (arg, "all"))
+    {
+      *bitmask = GRUB2_PCR_BITMASK_ALL;
+      return GRUB_ERR_NONE;
+    }
+
+  word = arg;
+  while (1)
+    {
+      if (grub_tpm_parse_pcr_index (word, &end, &index))
+	goto bad_pcr_index;
+
+      if (*end == '-')
+	{
+          if (grub_tpm_parse_pcr_index (end + 1, &end, &last_index) || last_index < index)
+	    goto bad_pcr_index;
+
+	  while (index <= last_index)
+	    *bitmask |= (1 << (index++));
+
+	  word = end;
+	  continue;
+	}
+      else
+	*bitmask |= (1 << index);
+
+      if (*end == '\0')
+	break;
+
+      if (*end != ',')
+	goto bad_pcr_index;
+
+       word = end + 1;
+    }
+
+  return GRUB_ERR_NONE;
+
+bad_pcr_index:
+  return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("cannot parse PCR list \"%s\""), arg);
+}
+
+static inline unsigned int
+nbits(grub_uint32_t mask)
+{
+  unsigned int r = 0;
+
+  for (; mask != 0; mask >>= 1)
+    r += (mask & 1);
+  return r;
+}
+
+static grub_err_t
+grub_tpm_snapshot_pcrs (grub_uint32_t pcr_bitmask, const char *algo,
+	       		void **buffer_ret, grub_size_t *size_ret)
+{
+  char *buffer;
+  grub_size_t size = 65536;
+  unsigned int wpos = 0;
+  grub_uint8_t pcr;
+
+  buffer = grub_malloc (size);
+  for (pcr = 0; pcr < 32; ++pcr)
+    {
+      struct grub_tpm_digest *d;
+      unsigned int need, k;
+
+      if (!(pcr_bitmask & (1 << pcr)))
+	continue;
+
+      d = grub_tpm_read_pcr (pcr, algo);
+      if (d == NULL)
+        {
+	  grub_error (GRUB_ERR_BAD_DEVICE, N_("unable to read PCR %d from TPM"), pcr);
+	  continue;
+        }
+
+      /* We need room for the PCR index, 2 spaces, newline, NUL. 16 should be enough. */
+      need = 16 + grub_strlen(d->algorithm) + 2 * d->size;
+      if (wpos + need > size)
+        {
+	  buffer = grub_realloc (buffer, size + need);
+	  if (buffer == NULL)
+	    return grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("Not enough memory when dumping PCR registers"));
+        }
+
+      grub_snprintf (buffer + wpos, size - wpos, "%02d %s ", pcr, d->algorithm);
+      wpos = grub_strlen(buffer);
+
+      for (k = 0; k < d->size; ++k)
+        {
+	  grub_snprintf (buffer + wpos, size - wpos, "%02x", d->value[k]);
+	  wpos += 2;
+        }
+
+      buffer[wpos++] = '\n';
+      buffer[wpos] = '\0';
+
+      grub_tpm_digest_free (d);
+    }
+
+  *buffer_ret = buffer;
+  *size_ret = wpos;
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_tpm_write_pcrs_to_efi (void *data, grub_size_t size, const char *var_name)
+{
+  grub_efi_guid_t vendor_guid = { 0x605dab50, 0xe046, 0x4300, { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 }};
+  grub_err_t rc;
+
+  rc = grub_efi_set_variable_with_attributes(var_name, &vendor_guid,
+                                              GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS | GRUB_EFI_VARIABLE_RUNTIME_ACCESS,
+                                              data, size);
+
+  if (rc)
+    return grub_error (GRUB_ERR_BAD_DEVICE, N_("Failed to publish PCR snapshot to UEFI variable %s"), var_name);
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_tpm_record_pcrs (grub_extcmd_context_t ctxt, int argc, char **args)
+{
+  struct grub_arg_list *state = ctxt->state;
+  grub_uint32_t pcr_bitmask = 0;
+  const char *efivar;
+  void *buffer = NULL;
+  grub_size_t size = 0;
+  int n, rv = 1;
+
+  if (argc == 0)
+    pcr_bitmask = GRUB2_PCR_BITMASK_DEFAULT;
+  else
+    {
+      for (n = 0; n < argc; ++n)
+	if (grub_tpm_parse_pcr_list (args[n], &pcr_bitmask))
+	  return 1;
+    }
+
+  if (grub_tpm_snapshot_pcrs (pcr_bitmask, NULL, &buffer, &size))
+    goto out;
+
+  if (state[0].set)
+    efivar = state[0].arg;
+  else
+    efivar = "GrubPcrSnapshot";
+
+  if (grub_tpm_write_pcrs_to_efi (buffer, size, efivar))
+    goto out;
+
+  rv = 0;
+
+out:
+  if (buffer)
+    grub_free (buffer);
+  return rv;
+}
+
+static grub_extcmd_t cmd;
+
 GRUB_MOD_INIT (tpm)
 {
   grub_verifier_register (&grub_tpm_verifier);
+
+  cmd = grub_register_extcmd ("tpm_record_pcrs", grub_tpm_record_pcrs, 0,
+			      N_("LIST_OF_PCRS"),
+			      N_("Snapshot one or more PCR values and record them in an EFI variable."),
+			      grub_tpm_record_pcrs_options);
 }
 
 GRUB_MOD_FINI (tpm)
 {
   grub_verifier_unregister (&grub_tpm_verifier);
+  grub_unregister_extcmd (cmd);
 }
Index: grub-2.06/include/grub/tpm.h
===================================================================
--- grub-2.06.orig/include/grub/tpm.h
+++ grub-2.06/include/grub/tpm.h
@@ -34,6 +34,15 @@
 
 #define EV_IPL 0x0d
 
+struct grub_tpm_digest {
+	const char *	algorithm;
+	unsigned int	size;
+	unsigned char	value[1];	/* variable length */
+};
+
 grub_err_t grub_tpm_measure (unsigned char *buf, grub_size_t size,
 			     grub_uint8_t pcr, const char *description);
+struct grub_tpm_digest *grub_tpm_read_pcr (grub_uint8_t index, const char *algo);
+void grub_tpm_digest_free (struct grub_tpm_digest *d);
+
 #endif
Index: grub-2.06/grub-core/commands/efi/tpm.c
===================================================================
--- grub-2.06.orig/grub-core/commands/efi/tpm.c
+++ grub-2.06/grub-core/commands/efi/tpm.c
@@ -189,16 +189,14 @@ grub_tpm1_log_event (grub_efi_handle_t t
 }
 
 static void
-select_pcr(TPML_PCR_SELECTION *o, unsigned int pcrIndex, unsigned int algo)
+grub_tpm2_select_pcr(TPML_PCR_SELECTION *o, unsigned int pcrIndex, unsigned int algo)
 {
-	TPMS_PCR_SELECTION *pcr;
+  TPMS_PCR_SELECTION *pcr;
 
-	pcr = &o->pcrSelections[o->count++];
-	pcr->hash = algo;
-	pcr->sizeOfSelect = 3;
-	/* TPMS_PCR_SELECTION_SelectPCR(pcr, pcrIndex); */
-	pcr->pcrSelect[TPM2_PCR_TO_SELECT(pcrIndex)] |= TPM2_PCR_TO_BIT(pcrIndex);
-	/* grub_printf("  pcrSelect: 0x%0x 0x%0x 0x%0x\n", pcr->pcrSelect[0], pcr->pcrSelect[1], pcr->pcrSelect[2]); */
+  pcr = &o->pcrSelections[o->count++];
+  pcr->hash = algo;
+  pcr->sizeOfSelect = 3;
+  pcr->pcrSelect[TPM2_PCR_TO_SELECT(pcrIndex)] |= TPM2_PCR_TO_BIT(pcrIndex);
 }
 
 #ifdef notyet
@@ -226,65 +224,104 @@ get_auth_session(void)
 			grub_error (GRUB_ERR_IO, "Failed to start auth session (error %u/0x%x)", rc, rc);
 			return 0;
 		}
-		grub_printf("TPM2_StartAuthSession() returns session handle 0x%x", (unsigned int) session);
+		grub_printf ("TPM2_StartAuthSession() returns session handle 0x%x", (unsigned int) session);
 	}
 	return session;
 }
 #endif
 
-static void
-display_pcr(const char *what, unsigned int pcrIndex, int algo)
+struct grub_tpm_hash_info {
+  const char *name;
+  grub_size_t size;
+  int id;
+};
+
+static const struct grub_tpm_hash_info *
+grub_tpm2_get_digest_info (const char *algo)
 {
-	TPML_PCR_SELECTION inSelection, outSelection;
-	grub_uint32_t pcrUpdateCounter;
-	TPML_DIGEST digests = { 0 };
-	int rc;
+  static struct grub_tpm_hash_info __hashes[] = {
+	  { "sha256",	32,	TPM_ALG_SHA256 },	/* first entry is the default */
+	  { "sha512",	64,	TPM_ALG_SHA512 },
+	  { "sha1",	20,	TPM_ALG_SHA1 },
+	  { NULL }
+  };
+  struct grub_tpm_hash_info *h;
+
+  if (algo == NULL)
+    return &__hashes[0];
+
+  for (h = __hashes; h->name; ++h)
+    if (!grub_strcmp(h->name, algo))
+      return h;
 
-	if (algo < 0)
-		algo = TPM_ALG_SHA256;
+  return NULL;
+}
 
-	grub_memset(&inSelection, 0, sizeof(inSelection));
-	grub_memset(&outSelection, 0, sizeof(outSelection));
-	select_pcr(&inSelection, pcrIndex, algo);
-
-	rc = TPM2_PCR_Read(
-			NULL,
-			&inSelection,
-			&pcrUpdateCounter,
-			&outSelection,
-			&digests,
-			NULL
-		);
-
-	if (rc != 0) {
-		grub_printf("TPM2_PCR_Read failed, status=%d\n", rc);
-	} else {
-		TPM2B_DIGEST *d;
-		grub_uint16_t offset;
-#if 0
-		TPMS_PCR_SELECTION *pcr;
-
-		pcr = &outSelection.pcrSelections[0];
-		grub_printf("Found %u PCR selections on return; %u digests\n", outSelection.count, digests.count);
-		grub_printf("  sel0: hash=%d; bitmap 0x%0x 0x%0x 0x%0x; updateCounter=%u\n",
-				(int) pcr->hash, pcr->pcrSelect[0], pcr->pcrSelect[1], pcr->pcrSelect[2],
-				(unsigned int) pcrUpdateCounter);
-#endif
+static grub_err_t
+grub_tpm2_read_pcr (grub_int8_t pcrIndex, const char *algo, struct grub_tpm_digest **ret)
+{
+  const struct grub_tpm_hash_info *info;
+  TPML_PCR_SELECTION inSelection, outSelection;
+  grub_uint32_t pcrUpdateCounter;
+  TPML_DIGEST digests = { 0 };
+  TPM2B_DIGEST *d;
+  struct grub_tpm_digest *result;
+  int rc;
+
+  info = grub_tpm2_get_digest_info (algo);
+  if (info == NULL)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("Unknown digest algorithm %s"), algo);
+
+  grub_memset(&inSelection, 0, sizeof(inSelection));
+  grub_memset(&outSelection, 0, sizeof(outSelection));
+  grub_tpm2_select_pcr(&inSelection, pcrIndex, info->id);
+
+  rc = TPM2_PCR_Read(
+      NULL,
+      &inSelection,
+      &pcrUpdateCounter,
+      &outSelection,
+      &digests,
+      NULL
+    );
+
+  if (rc != 0)
+    return grub_error (GRUB_ERR_BAD_DEVICE, "TPM2_PCR_Read failed, status=%d", rc);
+
+  d = &digests.digests[0];
+
+  *ret = result = grub_malloc (sizeof (*result) + d->size);
+  grub_memcpy (result->value, d->buffer, d->size);
+  result->algorithm = algo;
+  result->size = d->size;
 
-		d = &digests.digests[0];
-		grub_printf("  %-8s: hash=", what);
-		for (offset = 0; offset < d->size; offset += 2) {
-			if (offset)
-				grub_printf(":");
-			grub_printf("%02x%02x", d->buffer[offset], d->buffer[offset + 1]);
-		}
+  return GRUB_ERR_NONE;
+}
 
-#if 0
-		grub_printf("; updateCounter=%u", (unsigned int) pcrUpdateCounter);
-		grub_printf("; algo=%u", (unsigned int) pcr->hash);
-#endif
-		grub_printf("\n");
-	}
+void
+grub_tpm_digest_free (struct grub_tpm_digest *d)
+{
+  grub_free (d);
+}
+
+static void
+display_pcr(const char *what, grub_uint8_t pcrIndex, const char *algo)
+{
+  struct grub_tpm_digest *d;
+  unsigned int offset;
+
+  if (grub_tpm2_read_pcr (pcrIndex, algo, &d))
+    return;
+
+  grub_printf ("  %-8s: hash=", what);
+  for (offset = 0; offset < d->size; offset += 2) {
+    if (offset)
+      grub_printf (":");
+    grub_printf ("%02x%02x", d->value[offset], d->value[offset + 1]);
+  }
+
+  grub_tpm_digest_free (d);
+  grub_printf ("\n");
 }
 
 static grub_err_t
@@ -302,7 +339,7 @@ grub_tpm2_log_event (grub_efi_handle_t t
   if (!grub_tpm2_present (tpm))
     return 0;
 
-  grub_printf("PCR %u: %s\n", pcr, description);
+  grub_printf ("PCR %u: %s\n", pcr, description);
 
   event =
     grub_zalloc (sizeof (EFI_TCG2_EVENT) + grub_strlen (description) + 1);
@@ -322,7 +359,7 @@ grub_tpm2_log_event (grub_efi_handle_t t
 		       (grub_uint64_t) size, event);
   grub_free (event);
 
-  display_pcr("after", 0, -1);
+  display_pcr("after", 0, NULL);
 
   grub_millisleep(100);
   return grub_efi_log_event_status (status);
@@ -346,3 +383,26 @@ grub_tpm_measure (unsigned char *buf, gr
   else
     return grub_tpm2_log_event (tpm_handle, buf, size, pcr, description);
 }
+
+struct grub_tpm_digest *
+grub_tpm_read_pcr (grub_uint8_t pcr, const char *algo)
+{
+  grub_efi_handle_t tpm_handle;
+  grub_efi_uint8_t protocol_version;
+  struct grub_tpm_digest *result = NULL;
+
+
+  if (!grub_tpm_handle_find (&tpm_handle, &protocol_version))
+    return 0;
+
+  if (protocol_version != 2)
+    {
+      grub_error (GRUB_ERR_BAD_DEVICE, N_("%s: TPM version %d not implemented"), __func__, protocol_version);
+      return NULL;
+    }
+
+  if (grub_tpm2_read_pcr (pcr, algo, &result))
+    return NULL;
+
+  return result;
+}

Places

File pcr-snapshot.patch of Package grub2 (Revision 6757f9829ff077dd3a1b48db1bc9a621)

Places