ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-20 05:28:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

kexec-seal-key, seal-totp: Silence dd status when setting up PCRs

Browse Source 
Add status=none to dd invocations building PCR data.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This commit is contained in:
Jonathon Hall 2023-03-08 16:42:19 -05:00
parent 50daa904f9
commit d88fcca2f2
No known key found for this signature in database
GPG Key ID: 1E9C3CA91AE25114
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
initrd/bin/kexec-seal-key
View File

@ -94,7 +94,7 @@ tpmr pcrread -a 1 "$pcrf"
tpmr pcrread -a 2 "$pcrf"
tpmr pcrread -a 3 "$pcrf"
# Note that PCR 4 needs to be set with the "normal-boot" path value, which is 0.
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 >> "$pcrf"
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 status=none >> "$pcrf"
if [ "$CONFIG_USB_KEYBOARD" = "y" -o -r /lib/modules/libata.ko -o -x /bin/hotp_verification ]; then
DEBUG "Seal with PCR5 involvement (additional kernel modules are loaded per board config)..."
# Here, we take pcr 5 into consideration if modules are expected to be measured+loaded
@ -102,7 +102,7 @@ if [ "$CONFIG_USB_KEYBOARD" = "y" -o -r /lib/modules/libata.ko -o -x /bin/hotp_v
else
DEBUG "Seal without PCR5 involvement, PCR5=0..."
#no kernel modules are expected to be measured+loaded
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 >> "$pcrf"
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 status=none >> "$pcrf"
fi
# Precompute the value for pcr 6
tpmr calcfuturepcr -a "/tmp/luksDump.txt" "$pcrf"

2
initrd/bin/seal-totp
View File

@ -34,7 +34,7 @@ tpmr pcrread -a 1 "$pcrf"
tpmr pcrread -a 2 "$pcrf"
tpmr pcrread -a 3 "$pcrf"
# pcr 4 is expected to be zero (boot mode: init)
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 >> "$pcrf"
dd if=/dev/zero bs="$(tpmr pcrsize)" count=1 status=none >> "$pcrf"
# pcr 5 (kernel modules loaded) is not measured at sealing/unsealing of totp
# pcr 6 (drive luks header) is not measured at sealing/unsealing of totp
# pcr 7 is containing measurements of user injected stuff in cbfs