On Tue, Mar 12, 2024 at 11:03:17AM +0800, Hyman Huang wrote: Hi Hyman, > This patchset aims to supplement James's previous work, please refer to > the following link for details: > https://lists.gnu.org/archive/html/grub-devel/2020-12/msg00257.html > > The alterations listed below were made in light of earlier research: > 1. As Glenn advised, remove the first commit ([PATCH v3 1/3] cryptodisk: > make the password getter and additional argument to recover_key) while > maintaining the original recover key function declaration. > > 2. To decrypt the disk, use the password that was retrieved from the EFI > secret area and store it in the key_data field of the > grub_cryptomount_args_t. Then, pass the password to the > grub_cryptodisk_scan_device function. > > 3. Modify the put method's function definition in struct > grub_secret_entry, and use grub_errno to log method errors. > > We uploaded this series with the intention of receiving feedback, as > the title suggests. Any suggestions and feedback regarding this patchset > are welcom. > I'm working on disk unlocking with TPM2 and it's a bit similar to your work. Here is my v9 patchset: https://lists.gnu.org/archive/html/grub-devel/2024-02/msg00007.html
The original patch author, Herman, introduced the key protectors framework, and it may be useful in your case: - key protectors framework https://lists.gnu.org/archive/html/grub-devel/2024-02/msg00014.html - cryptodisk change https://lists.gnu.org/archive/html/grub-devel/2024-02/msg00016.html - TPM2 key protector https://lists.gnu.org/archive/html/grub-devel/2024-02/msg00017.html In short, it unlocks the disk with the commands like this: tpm2_key_protector_init --tpm2key=(hd0,gpt1)/efi/grub2/sealed-1.tpm cryptomount -u <PART1_UUID> -P tpm2 Maybe we can work together to support various disk unlocking mechanisms. Cheers, Gary Lin > Thanks, > > Yong > > Hyman Huang (2): > cryptodisk: add OS provided secret support > efi: Add API for retrieving the EFI secret for cryptodisk > > grub-core/Makefile.core.def | 8 +++ > grub-core/disk/cryptodisk.c | 49 ++++++++++++- > grub-core/disk/efi/efisecret.c | 123 +++++++++++++++++++++++++++++++++ > include/grub/cryptodisk.h | 14 ++++ > include/grub/efi/api.h | 15 ++++ > 5 files changed, 206 insertions(+), 3 deletions(-) > create mode 100644 grub-core/disk/efi/efisecret.c > > -- > 2.39.3 > > > _______________________________________________ > Grub-devel mailing list > Grub-devel@gnu.org > https://lists.gnu.org/mailman/listinfo/grub-devel _______________________________________________ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel
