ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-18 20:47:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

cbfs-init, insmod: Bring back params/filenames into PCR measurements

Browse Source 
cbfs-init used to measure filenames as well as the data in the files,
but after refactoring it only measures file data.  This means files
could be renamed, or contents pivoted, without affecting the PCR
measurements.  Bring back the filename measurement.

Similarly, insmod used to measure module parameters, but no longer
does.  Though we don't currently insert any modules with parameters,
there's no reason to leave this open to break later, bring back the
measurement.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This commit is contained in:
Jonathon Hall 2024-09-05 14:00:58 -04:00 committed by Thierry Laurion
parent 250a144d67
commit de7902f5b9
No known key found for this signature in database
GPG Key ID: 9A53E1BB3FF00461
2 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
initrd/bin/cbfs-init
View File

@ -22,7 +22,11 @@ for cbfsname in `echo $cbfsfiles`; do
|| die "$filename: cbfs file read failed"
if [ "$CONFIG_TPM" = "y" ]; then
echo "TPM: Extending PCR[$CONFIG_PCR with] with $filename"
tpmr extend -ix "$CONFIG_PCR" -if $filename \
# Measure both the filename and its content. This
# ensures that renaming files or pivoting file content
# will still affect the resulting PCR measurement.
tpmr extend -ix "$CONFIG_PCR" -ic "$filename"
tpmr extend -ix "$CONFIG_PCR" -if "$filename" \
|| die "$filename: tpm extend failed"
fi
fi

12
initrd/sbin/insmod
View File

@ -39,17 +39,15 @@ if [ ! -r /sys/class/tpm/tpm0/pcrs -o ! -x /bin/tpm ]; then
fi
if [ -z "$tpm_missing" ]; then
echo "TPM: Extending PCR[$MODULE_PCR] with $MODULE prior of loading into kernel"
echo "TPM: Extending PCR[$MODULE_PCR] with $MODULE and parameters '$*' before loading"
# Extend with the module parameters (even if they are empty) and the
# module. Changing the parameters or the module content will result in a
# different PCR measurement.
tpmr extend -ix "$MODULE_PCR" -ic "$*"
tpmr extend -ix "$MODULE_PCR" -if "$MODULE" \
|| die "$MODULE: tpm extend failed"
fi
if [ ! -z "$*" -a -z "$tpm_missing" ]; then
echo "TPM: Extending PCR[$MODULE_PCR] with $MODULE prior of loading into kernel"
tpmr extend -ix "$MODULE_PCR" -if "$MODULE" \
|| die "$MODULE: tpm extend on arguments failed"
fi
# Since we have replaced the real insmod, we must invoke
# the busybox insmod via the original executable
DEBUG "Loading $MODULE with busybox insmod"