On 28.06.21 13:28, Cedric Hombourger wrote: > Make use of systemd code to measure the kernel command line for the > selected configuration into PCR#8. This also causes the firmware > to add the measurement for the loaded EFI image into PCR#4 (as per > UEFI specs). With this change both the loaded kernel and command > line options are measured. Use of the TPM may be disabled by passing > --disable-tpm to the configure script. > > Signed-off-by: Cedric Hombourger <[email protected]> > --- > configure.ac | 16 ++++++++++++++++ > main.c | 12 ++++++++++++ > 2 files changed, 28 insertions(+) > > diff --git a/configure.ac b/configure.ac > index b8d2b1c..2d434d5 100644 > --- a/configure.ac > +++ b/configure.ac > @@ -77,6 +77,22 @@ AC_ARG_WITH([gnuefi-lib-dir], > AC_SUBST(GNUEFI_LIB_DIR) > AC_DEFINE_UNQUOTED(GNUEFI_LIB_DIR, ["$GNUEFI_LIB_DIR"], [The lib directory > for gnuefi]) > > +AC_ARG_ENABLE([tpm], > + AS_HELP_STRING([--disable-tpm], [Disable TPM support])) > + > +AS_IF([test "x$enable_tpm" != "xno"], [ > + AC_DEFINE([ENABLE_TPM], [1], [TPM support]) > +]) > + > +AC_ARG_WITH([options-pcr], > + AS_HELP_STRING([--with-options-pcr=NUMBER], > + [specify the PCR register to use for options, > defaults to 8]), > + [OPTIONS_PCR="$withval"], > + [OPTIONS_PCR="8"]) > + > +AC_SUBST(OPTIONS_PCR) > +AC_DEFINE_UNQUOTED(OPTIONS_PCR, [$OPTIONS_PCR], [The PCR register for > options]) > + > dnl Define ARCH_<NAME> conditionals > SET_ARCH(I586, i586*) > SET_ARCH(I686, i686*) > diff --git a/main.c b/main.c > index 7949218..dc388a4 100644 > --- a/main.c > +++ b/main.c > @@ -22,6 +22,7 @@ > #include <configuration.h> > #include "version.h" > #include "utils.h" > +#include "measure.h" > > extern const unsigned long init_array_start[]; > extern const unsigned long init_array_end[]; > @@ -192,6 +193,17 @@ EFI_STATUS efi_main(EFI_HANDLE image_handle, > EFI_SYSTEM_TABLE *system_table) > loaded_image->LoadOptionsSize = > (StrLen(bg_loader_params.payload_options) + 1) * sizeof(CHAR16); > > +#ifdef ENABLE_TPM > + /* Try to log any options to the TPM */ > + status = tpm_log_event(OPTIONS_PCR, > + (EFI_PHYSICAL_ADDRESS) (UINTN) > loaded_image->LoadOptions, > + loaded_image->LoadOptionsSize, > loaded_image->LoadOptions); > + /* Try to log any options to the TPM, especially manually edited > options */ > + if (EFI_ERROR(status)) { > + WARNING(L"Could not measure options (%x)\n", status); > + } > +#endif > + > INFO(L"Starting %s with watchdog set to %d seconds ...\n", > bg_loader_params.payload_path, bg_loader_params.timeout); > >
So, all this is just for measuring the parameters passed to the kernel image, right? Does it actually make sense in secure scenarios to use that feature? We are currently using unified kernel images, with the kernel parameters baked in. That permits to reject booting at all and automatically measures the options as well. Jan -- Siemens AG, T RDA IOT Corporate Competence Center Embedded Linux -- You received this message because you are subscribed to the Google Groups "EFI Boot Guard" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/efibootguard-dev/a24b50c8-b1a9-6fe4-9ad5-528c82e534f8%40siemens.com.
