Thierry Laurion
53156c3917
WiP: staging changes, refusing to fight against tools helping me, formatting changed. sign after tpm-reset now to work around primary handle issue.
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:19:42 -05:00
Thierry Laurion
0d3964274e
WiP: staging changes, warn loud and clear of weak security posture by using weak OEM defaults provisioned secrets
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:19:36 -05:00
Thierry Laurion
94b77e8704
WiP: staging changes
...
Insights:
- We should use oem generated pubkey naming to distinguish between oem/user generated keys and try to use default PINs also for GPG User to sign with default PIN and warn even if it works/doesn't, urging users to do reownership
- Point is that oem factory reset does in the direction of using randomized PINs, while continuing to use those for a user should be strongly discouraged
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:19:07 -05:00
Thierry Laurion
19fd98df2d
WiP: staging changes (TPM1 regression fixes for LOG/DEBUG on quiet mode)
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:19:01 -05:00
Thierry Laurion
abc97fe1be
WiP: staging changes including https://github.com/linuxboot/heads/pull/1850 https://github.com/Nitrokey/nitrokey-hotp-verification/pull/43 and https://github.com/Nitrokey/nitrokey-hotp-verification/pull/46
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:18:55 -05:00
Thierry Laurion
3726e9083f
initrd/bin/tmpr: silence tpm reset console output, LOG instead
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:13:37 -05:00
Thierry Laurion
48807de222
codebase: silence dd output while capturing output in variables when needed
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:13:31 -05:00
Thierry Laurion
1f029123e9
initrd bin/* sbin/insmod + /etc/ash_functions: TPM extend operations now all passed to LOG (quiet mode doesn't show them and logs them to /tmp/debug.log)
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-12-21 13:13:13 -05:00
Thierry Laurion
77d4be1dc6
TPM extend ops: Augment output of TPM1/TMP22 for filename and file content hash ops
...
Debug logtrace, screenshots of non-debug will be added in PR #1758
TPM1:
[ 4.815559] [U] hello world
[ 5.099000] DEBUG: Debug output enabled from board CONFIG_DEBUG_OUTPUT=y option (/etc/config)
[ 5.122059] TRACE: Under init
[ 5.165917] DEBUG: Applying panic_on_oom setting to sysctl
[ 5.388757] TRACE: /bin/cbfs-init(5): main
[ 5.516637] TRACE: /bin/cbfs-init(24): main
[ 5.662271] DEBUG: TPM: Will extend PCR[7] with hash of filename /.gnupg/pubring.kbx
[ 5.732223] TRACE: /bin/tpmr(790): main
[ 5.785372] DEBUG: TPM: Extending PCR[7] with hash 7ccf4f64044946cf4e5b0efe3d959f00562227ae
[ 5.838082] DEBUG: exec tpm extend -ix 7 -ic /.gnupg/pubring.kbx
[ 6.081466] DEBUG: TPM: Will extend PCR[7] hash content of file /.gnupg/pubring.kbx
[ 6.147455] TRACE: /bin/tpmr(790): main
[ 6.196545] DEBUG: TPM: Extending PCR[7] with hash ee79223a3b9724ad1aab290a3785132805c79eae
[ 6.251251] DEBUG: exec tpm extend -ix 7 -if /.gnupg/pubring.kbx
[ 6.445119] TRACE: /bin/cbfs-init(24): main
[ 6.585854] DEBUG: TPM: Will extend PCR[7] with hash of filename /.gnupg/trustdb.gpg
[ 6.659172] TRACE: /bin/tpmr(790): main
[ 6.707564] DEBUG: TPM: Extending PCR[7] with hash 7236ea8e612c1435259a8a0f8e0a8f1f5dba7042
[ 6.757645] DEBUG: exec tpm extend -ix 7 -ic /.gnupg/trustdb.gpg
[ 7.013547] DEBUG: TPM: Will extend PCR[7] hash content of file /.gnupg/trustdb.gpg
[ 7.082863] TRACE: /bin/tpmr(790): main
[ 7.131022] DEBUG: TPM: Extending PCR[7] with hash ca8898407cacd96d6f2de90ae90825351be81c62
[ 7.183344] DEBUG: exec tpm extend -ix 7 -if /.gnupg/trustdb.gpg
[ 7.413787] TRACE: /bin/key-init(6): main
[ 8.718367] TRACE: Under /etc/ash_functions:combine_configs
[ 8.803914] TRACE: Under /etc/ash_functions:pause_recovery
!!! Hit enter to proceed to recovery shell !!!
[ 9.045341] TRACE: /bin/setconsolefont.sh(6): main
[ 9.096853] DEBUG: Board does not ship setfont, not checking console font
[ 9.320494] TRACE: /bin/gui-init(641): main
[ 9.356729] TRACE: Under /etc/ash_functions:enable_usb
[ 9.445981] TRACE: /sbin/insmod(9): main
[ 9.609464] TRACE: /sbin/insmod(53): main
[ 9.660145] DEBUG: No module parameters, extending only with the module's content
[ 9.791896] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/ehci-hcd.ko
[ 9.860477] TRACE: /bin/tpmr(790): main
[ 9.914849] DEBUG: TPM: Extending PCR[5] with hash bc9ff28a99e314cda69695ba34b26ed0d8b1e4ed
[ 9.976867] DEBUG: exec tpm extend -ix 5 -if /lib/modules/ehci-hcd.ko
[ 10.146966] DEBUG: Loading /lib/modules/ehci-hcd.ko with busybox insmod
[ 10.184086] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 10.276564] TRACE: /sbin/insmod(9): main
[ 10.433503] TRACE: /sbin/insmod(53): main
[ 10.486272] DEBUG: No module parameters, extending only with the module's content
[ 10.620200] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/uhci-hcd.ko
[ 10.698710] TRACE: /bin/tpmr(790): main
[ 10.750637] DEBUG: TPM: Extending PCR[5] with hash bcb2f15c7eb52484072a76fc8a0d7399f6cf2189
[ 10.808379] DEBUG: exec tpm extend -ix 5 -if /lib/modules/uhci-hcd.ko
[ 10.996254] DEBUG: Loading /lib/modules/uhci-hcd.ko with busybox insmod
[ 11.026108] uhci_hcd: USB Universal Host Controller Interface driver
[ 11.040703] uhci_hcd 0000:00:1d.0: UHCI Host Controller
[ 11.053129] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1
[ 11.061568] uhci_hcd 0000:00:1d.0: detected 2 ports
[ 11.070973] uhci_hcd 0000:00:1d.0: irq 16, io base 0x0000ff00
[ 11.089004] hub 1-0:1.0: USB hub found
[ 11.097535] hub 1-0:1.0: 2 ports detected
[ 11.114890] uhci_hcd 0000:00:1d.1: UHCI Host Controller
[ 11.123848] uhci_hcd 0000:00:1d.1: new USB bus registered, assigned bus number 2
[ 11.134989] uhci_hcd 0000:00:1d.1: detected 2 ports
[ 11.142404] uhci_hcd 0000:00:1d.1: irq 17, io base 0x0000fee0
[ 11.153338] hub 2-0:1.0: USB hub found
[ 11.160572] hub 2-0:1.0: 2 ports detected
[ 11.176481] uhci_hcd 0000:00:1d.2: UHCI Host Controller
[ 11.183898] uhci_hcd 0000:00:1d.2: new USB bus registered, assigned bus number 3
[ 11.193509] uhci_hcd 0000:00:1d.2: detected 2 ports
[ 11.201574] uhci_hcd 0000:00:1d.2: irq 18, io base 0x0000fec0
[ 11.211182] hub 3-0:1.0: USB hub found
[ 11.219256] hub 3-0:1.0: 2 ports detected
[ 11.314467] TRACE: /sbin/insmod(9): main
[ 11.468430] TRACE: /sbin/insmod(53): main
[ 11.521914] DEBUG: No module parameters, extending only with the module's content
[ 11.656647] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/ohci-hcd.ko
[ 11.726721] TRACE: /bin/tpmr(790): main
[ 11.778253] DEBUG: TPM: Extending PCR[5] with hash f563e46fbbed46423a1e10219953233d310792f5
[ 11.831718] DEBUG: exec tpm extend -ix 5 -if /lib/modules/ohci-hcd.ko
[ 12.010752] DEBUG: Loading /lib/modules/ohci-hcd.ko with busybox insmod
[ 12.044192] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 12.136462] TRACE: /sbin/insmod(9): main
[ 12.293409] TRACE: /sbin/insmod(53): main
[ 12.345947] DEBUG: No module parameters, extending only with the module's content
[ 12.481562] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/ohci-pci.ko
[ 12.547754] TRACE: /bin/tpmr(790): main
[ 12.604827] DEBUG: TPM: Extending PCR[5] with hash a24699fdaac9976cc9447fd0cd444a469299ad2f
[ 12.661256] DEBUG: exec tpm extend -ix 5 -if /lib/modules/ohci-pci.ko
[ 12.847247] DEBUG: Loading /lib/modules/ohci-pci.ko with busybox insmod
[ 12.870986] ohci-pci: OHCI PCI platform driver
[ 12.959387] TRACE: /sbin/insmod(9): main
[ 13.112275] TRACE: /sbin/insmod(53): main
[ 13.163112] DEBUG: No module parameters, extending only with the module's content
[ 13.291360] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/ehci-pci.ko
[ 13.364853] TRACE: /bin/tpmr(790): main
[ 13.438536] DEBUG: TPM: Extending PCR[5] with hash b80a90e11a01eba40bb7e566f3374d0aad326acb
[ 13.505500] DEBUG: exec tpm extend -ix 5 -if /lib/modules/ehci-pci.ko
[ 13.679865] DEBUG: Loading /lib/modules/ehci-pci.ko with busybox insmod
[ 13.704539] ehci-pci: EHCI PCI platform driver
[ 13.725570] ehci-pci 0000:00:1d.7: EHCI Host Controller
[ 13.735562] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 4
[ 13.745092] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfcf80000
[ 13.773286] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00
[ 13.783544] hub 4-0:1.0: USB hub found
[ 13.791110] hub 4-0:1.0: 6 ports detected
[ 13.800844] hub 1-0:1.0: USB hub found
[ 13.807808] hub 1-0:1.0: 2 ports detected
[ 13.823094] hub 2-0:1.0: USB hub found
[ 13.829910] hub 2-0:1.0: 2 ports detected
[ 13.839182] hub 3-0:1.0: USB hub found
[ 13.846231] hub 3-0:1.0: 2 ports detected
[ 13.946297] TRACE: /sbin/insmod(9): main
[ 14.099143] TRACE: /sbin/insmod(53): main
[ 14.149765] DEBUG: No module parameters, extending only with the module's content
[ 14.291413] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/xhci-hcd.ko
[ 14.372815] TRACE: /bin/tpmr(790): main
[ 14.426919] DEBUG: TPM: Extending PCR[5] with hash 1fc55e846b9d5c93e58c6c8b6f867e744fa694bc
[ 14.482815] DEBUG: exec tpm extend -ix 5 -if /lib/modules/xhci-hcd.ko
[ 14.670419] DEBUG: Loading /lib/modules/xhci-hcd.ko with busybox insmod
[ 14.783374] TRACE: /sbin/insmod(9): main
[ 14.939364] TRACE: /sbin/insmod(53): main
[ 14.995136] DEBUG: No module parameters, extending only with the module's content
[ 15.135482] DEBUG: TPM: Will extend PCR[5] hash content of file /lib/modules/xhci-pci.ko
[ 15.204263] TRACE: /bin/tpmr(790): main
[ 15.255478] DEBUG: TPM: Extending PCR[5] with hash bbdd85242570aa438b908420a43b8d7042db8b4f
[ 15.305598] DEBUG: exec tpm extend -ix 5 -if /lib/modules/xhci-pci.ko
[ 15.480844] DEBUG: Loading /lib/modules/xhci-pci.ko with busybox insmod
[ 15.512476] xhci_hcd 0000:00:04.0: xHCI Host Controller
[ 15.528230] xhci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 5
[ 15.540456] xhci_hcd 0000:00:04.0: hcc params 0x00087001 hci version 0x100 quirks 0x0000000000000010
[ 15.554225] hub 5-0:1.0: USB hub found
[ 15.562061] hub 5-0:1.0: 4 ports detected
[ 15.572058] xhci_hcd 0000:00:04.0: xHCI Host Controller
[ 15.589966] xhci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 6
[ 15.598116] xhci_hcd 0000:00:04.0: Host supports USB 3.0 SuperSpeed
[ 15.606150] usb usb6: We don't know the algorithms for LPM for this host, disabling LPM.
[ 15.616354] hub 6-0:1.0: USB hub found
[ 15.623767] hub 6-0:1.0: 4 ports detected
[ 15.909854] usb 5-1: new high-speed USB device number 2 using xhci_hcd
[ 16.193548] usb 6-2: new SuperSpeed Gen 1 USB device number 2 using xhci_hcd
[ 16.345381] usb 5-3: new full-speed USB device number 3 using xhci_hcd
[ 17.674973] TRACE: /etc/functions(715): detect_boot_device
[ 17.718114] TRACE: /etc/functions(682): mount_possible_boot_device
[ 17.759829] TRACE: /etc/functions(642): is_gpt_bios_grub
[ 17.833271] TRACE: /dev/vda1 is partition 1 of vda
[ 17.925490] TRACE: /etc/functions(619): find_lvm_vg_name
[ 18.068352] TRACE: Try mounting /dev/vda1 as /boot
[ 18.114444] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null)
[ 18.158648] TRACE: /bin/gui-init(319): clean_boot_check
[ 18.247883] TRACE: /bin/gui-init(348): check_gpg_key
[ 18.338052] TRACE: /bin/gui-init(185): update_totp
[ 18.419286] TRACE: /bin/unseal-totp(8): main
[ 18.511352] TRACE: /bin/tpmr(614): tpm1_unseal
[ 18.624811] DEBUG: Running at_exit handlers
[ 18.661992] TRACE: /bin/tpmr(390): cleanup_shred
[ 18.692897] !!! ERROR: Unable to unseal TOTP secret !!!
[ 21.295284] TRACE: /bin/unseal-totp(8): main
[ 21.386377] TRACE: /bin/tpmr(614): tpm1_unseal
[ 21.496183] DEBUG: Running at_exit handlers
[ 21.527060] TRACE: /bin/tpmr(390): cleanup_shred
[ 21.558625] !!! ERROR: Unable to unseal TOTP secret !!!
[ 24.162881] TRACE: /bin/unseal-totp(8): main
[ 24.249549] TRACE: /bin/tpmr(614): tpm1_unseal
[ 24.362331] DEBUG: Running at_exit handlers
[ 24.394154] TRACE: /bin/tpmr(390): cleanup_shred
[ 24.427400] !!! ERROR: Unable to unseal TOTP secret !!!
[ 26.475340] DEBUG: CONFIG_TPM: y
[ 26.521538] DEBUG: CONFIG_TPM2_TOOLS:
[ 26.578490] DEBUG: Show PCRs
[ 26.730805] DEBUG: PCR-00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 26.751488] PCR-01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 26.778571] PCR-02: C0 A9 54 C8 45 5C 78 49 80 EC 1C DB D8 E8 9B CC 65 11 58 BF
[ 26.808771] PCR-03: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 26.830508] PCR-04: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 26.849538] PCR-05: 2C 3A 40 05 70 DB 21 89 4F CD C2 F8 D6 AE 40 DA 56 E1 B6 74
[ 26.878951] PCR-06: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 26.895421] PCR-07: 7A 8A 4C E6 BA B0 AA 26 22 B1 26 A2 F6 36 BD F3 86 23 50 B6
TPM2:
[ 5.305235] [U] hello world
[ 5.591175] DEBUG: Debug output enabled from board CONFIG_DEBUG_OUTPUT=y option (/etc/config)
[ 5.615802] TRACE: Under init
[ 5.657823] DEBUG: Applying panic_on_oom setting to sysctl
[ 5.831457] TRACE: /bin/tpmr(349): tpm2_startsession
[ 6.567984] TRACE: /bin/cbfs-init(5): main
[ 6.695758] TRACE: /bin/cbfs-init(24): main
[ 6.811665] TRACE: /bin/tpmr(832): main
[ 6.870411] DEBUG: TPM: Extending PCR[7] with /.gnupg/pubring.kbx
[ 6.907262] TRACE: /bin/tpmr(234): tpm2_extend
[ 6.983504] TRACE: /bin/tpmr(247): tpm2_extend
[ 7.037543] DEBUG: TPM: Will extend PCR[7] with hash of string /.gnupg/pubring.kbx
[ 7.192665] TRACE: /bin/tpmr(265): tpm2_extend
[ 7.246318] DEBUG: TPM: Extended PCR[7] with hash 96ab5053e4630a040d55549ba73cff2178d401d763147776771f9774597b86a1
[ 7.355327] TRACE: /bin/tpmr(832): main
[ 7.409042] DEBUG: TPM: Extending PCR[7] with /.gnupg/pubring.kbx
[ 7.446920] TRACE: /bin/tpmr(234): tpm2_extend
[ 7.485782] TRACE: /bin/tpmr(252): tpm2_extend
[ 7.540496] DEBUG: TPM: Will extend PCR[7] with hash of file content /.gnupg/pubring.kbx
[ 7.759033] TRACE: /bin/tpmr(265): tpm2_extend
[ 7.811693] DEBUG: TPM: Extended PCR[7] with hash f196f9cae98362568d31638e7522eee5042286b2c18627b06b30a0275207872e
[ 7.903033] TRACE: /bin/cbfs-init(24): main
[ 8.026099] TRACE: /bin/tpmr(832): main
[ 8.077074] DEBUG: TPM: Extending PCR[7] with /.gnupg/trustdb.gpg
[ 8.108061] TRACE: /bin/tpmr(234): tpm2_extend
[ 8.180580] TRACE: /bin/tpmr(247): tpm2_extend
[ 8.234748] DEBUG: TPM: Will extend PCR[7] with hash of string /.gnupg/trustdb.gpg
[ 8.412522] TRACE: /bin/tpmr(265): tpm2_extend
[ 8.469868] DEBUG: TPM: Extended PCR[7] with hash 53b843fe9bb52894d3a7d00197c776d56f3059f6a285124c7916724cd5013b0b
[ 8.596316] TRACE: /bin/tpmr(832): main
[ 8.655651] DEBUG: TPM: Extending PCR[7] with /.gnupg/trustdb.gpg
[ 8.690508] TRACE: /bin/tpmr(234): tpm2_extend
[ 8.723206] TRACE: /bin/tpmr(252): tpm2_extend
[ 8.782554] DEBUG: TPM: Will extend PCR[7] with hash of file content /.gnupg/trustdb.gpg
[ 8.999969] TRACE: /bin/tpmr(265): tpm2_extend
[ 9.066744] DEBUG: TPM: Extended PCR[7] with hash abf745ef9f960af5d8b19a1acd4bc0a19da056f607b06cce6b920eab83cbbdec
[ 9.215143] TRACE: /bin/key-init(6): main
[ 10.661503] TRACE: Under /etc/ash_functions:combine_configs
[ 10.749050] TRACE: Under /etc/ash_functions:pause_recovery
!!! Hit enter to proceed to recovery shell !!!
[ 10.998267] TRACE: /bin/setconsolefont.sh(6): main
[ 11.059640] DEBUG: Board does not ship setfont, not checking console font
[ 11.303012] TRACE: /bin/gui-init(641): main
[ 11.334099] TRACE: Under /etc/ash_functions:enable_usb
[ 11.421487] TRACE: /sbin/insmod(9): main
[ 11.578754] TRACE: /sbin/insmod(53): main
[ 11.630500] DEBUG: No module parameters, extending only with the module's content
[ 11.741780] TRACE: /bin/tpmr(832): main
[ 11.789365] DEBUG: TPM: Extending PCR[5] with /lib/modules/ehci-hcd.ko
[ 11.823496] TRACE: /bin/tpmr(234): tpm2_extend
[ 11.862739] TRACE: /bin/tpmr(252): tpm2_extend
[ 11.920404] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/ehci-hcd.ko
[ 12.123507] TRACE: /bin/tpmr(265): tpm2_extend
[ 12.175292] DEBUG: TPM: Extended PCR[5] with hash 40c5206f06702e45d8e6632632255258af433be0641c96f514ea75ac14523a30
[ 12.234130] DEBUG: Loading /lib/modules/ehci-hcd.ko with busybox insmod
[ 12.278479] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 12.371875] TRACE: /sbin/insmod(9): main
[ 12.523874] TRACE: /sbin/insmod(53): main
[ 12.578418] DEBUG: No module parameters, extending only with the module's content
[ 12.697785] TRACE: /bin/tpmr(832): main
[ 12.753607] DEBUG: TPM: Extending PCR[5] with /lib/modules/uhci-hcd.ko
[ 12.786940] TRACE: /bin/tpmr(234): tpm2_extend
[ 12.819199] TRACE: /bin/tpmr(252): tpm2_extend
[ 12.879805] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/uhci-hcd.ko
[ 13.088925] TRACE: /bin/tpmr(265): tpm2_extend
[ 13.158660] DEBUG: TPM: Extended PCR[5] with hash 1877332107fb8737a5636da26d4db2c10ffe4d1db2bcbde30b47774cdf05e02f
[ 13.223888] DEBUG: Loading /lib/modules/uhci-hcd.ko with busybox insmod
[ 13.253700] uhci_hcd: USB Universal Host Controller Interface driver
[ 13.269580] uhci_hcd 0000:00:1d.0: UHCI Host Controller
[ 13.278675] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 1
[ 13.287280] uhci_hcd 0000:00:1d.0: detected 2 ports
[ 13.296481] uhci_hcd 0000:00:1d.0: irq 16, io base 0x0000ff00
[ 13.314557] hub 1-0:1.0: USB hub found
[ 13.332614] hub 1-0:1.0: 2 ports detected
[ 13.352400] uhci_hcd 0000:00:1d.1: UHCI Host Controller
[ 13.361016] uhci_hcd 0000:00:1d.1: new USB bus registered, assigned bus number 2
[ 13.368653] uhci_hcd 0000:00:1d.1: detected 2 ports
[ 13.376700] uhci_hcd 0000:00:1d.1: irq 17, io base 0x0000fee0
[ 13.395046] hub 2-0:1.0: USB hub found
[ 13.403107] hub 2-0:1.0: 2 ports detected
[ 13.418573] uhci_hcd 0000:00:1d.2: UHCI Host Controller
[ 13.426975] uhci_hcd 0000:00:1d.2: new USB bus registered, assigned bus number 3
[ 13.434733] uhci_hcd 0000:00:1d.2: detected 2 ports
[ 13.442497] uhci_hcd 0000:00:1d.2: irq 18, io base 0x0000fec0
[ 13.460237] hub 3-0:1.0: USB hub found
[ 13.467466] hub 3-0:1.0: 2 ports detected
[ 13.579102] TRACE: /sbin/insmod(9): main
[ 13.730892] TRACE: /sbin/insmod(53): main
[ 13.781345] DEBUG: No module parameters, extending only with the module's content
[ 13.891152] TRACE: /bin/tpmr(832): main
[ 13.954015] DEBUG: TPM: Extending PCR[5] with /lib/modules/ohci-hcd.ko
[ 13.995207] TRACE: /bin/tpmr(234): tpm2_extend
[ 14.031074] TRACE: /bin/tpmr(252): tpm2_extend
[ 14.095694] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/ohci-hcd.ko
[ 14.315253] TRACE: /bin/tpmr(265): tpm2_extend
[ 14.369608] DEBUG: TPM: Extended PCR[5] with hash 8a12ce4abfc87f11a023d4f1c26c225f5cffae248f9dad1fd30e78022996df02
[ 14.425800] DEBUG: Loading /lib/modules/ohci-hcd.ko with busybox insmod
[ 14.455207] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 14.548050] TRACE: /sbin/insmod(9): main
[ 14.693175] TRACE: /sbin/insmod(53): main
[ 14.742761] DEBUG: No module parameters, extending only with the module's content
[ 14.855233] TRACE: /bin/tpmr(832): main
[ 14.908035] DEBUG: TPM: Extending PCR[5] with /lib/modules/ohci-pci.ko
[ 14.940321] TRACE: /bin/tpmr(234): tpm2_extend
[ 14.970307] TRACE: /bin/tpmr(252): tpm2_extend
[ 15.018421] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/ohci-pci.ko
[ 15.226408] TRACE: /bin/tpmr(265): tpm2_extend
[ 15.279951] DEBUG: TPM: Extended PCR[5] with hash 2065ee6544d78a5d31e67983166a9b8cf60dbe61bf0ee99c39e92816cc3a98db
[ 15.335930] DEBUG: Loading /lib/modules/ohci-pci.ko with busybox insmod
[ 15.360537] ohci-pci: OHCI PCI platform driver
[ 15.446600] TRACE: /sbin/insmod(9): main
[ 15.597149] TRACE: /sbin/insmod(53): main
[ 15.649850] DEBUG: No module parameters, extending only with the module's content
[ 15.753738] TRACE: /bin/tpmr(832): main
[ 15.809086] DEBUG: TPM: Extending PCR[5] with /lib/modules/ehci-pci.ko
[ 15.847559] TRACE: /bin/tpmr(234): tpm2_extend
[ 15.878030] TRACE: /bin/tpmr(252): tpm2_extend
[ 15.930320] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/ehci-pci.ko
[ 16.131948] TRACE: /bin/tpmr(265): tpm2_extend
[ 16.190395] DEBUG: TPM: Extended PCR[5] with hash 116145df2c495dfd58354025799fe5bb9b4d8e078960e8d0d7ceda746e4f2d06
[ 16.247675] DEBUG: Loading /lib/modules/ehci-pci.ko with busybox insmod
[ 16.275465] ehci-pci: EHCI PCI platform driver
[ 16.296704] ehci-pci 0000:00:1d.7: EHCI Host Controller
[ 16.306151] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 4
[ 16.316293] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfcf80000
[ 16.340527] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00
[ 16.357688] hub 4-0:1.0: USB hub found
[ 16.365707] hub 4-0:1.0: 6 ports detected
[ 16.376687] hub 1-0:1.0: USB hub found
[ 16.384573] hub 1-0:1.0: 2 ports detected
[ 16.393986] hub 2-0:1.0: USB hub found
[ 16.401424] hub 2-0:1.0: 2 ports detected
[ 16.410387] hub 3-0:1.0: USB hub found
[ 16.418087] hub 3-0:1.0: 2 ports detected
[ 16.513839] TRACE: /sbin/insmod(9): main
[ 16.670778] TRACE: /sbin/insmod(53): main
[ 16.721953] DEBUG: No module parameters, extending only with the module's content
[ 16.835964] TRACE: /bin/tpmr(832): main
[ 16.888003] DEBUG: TPM: Extending PCR[5] with /lib/modules/xhci-hcd.ko
[ 16.919798] TRACE: /bin/tpmr(234): tpm2_extend
[ 16.957470] TRACE: /bin/tpmr(252): tpm2_extend
[ 17.013535] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/xhci-hcd.ko
[ 17.225097] TRACE: /bin/tpmr(265): tpm2_extend
[ 17.281099] DEBUG: TPM: Extended PCR[5] with hash 7f5a6bd0f7de6104e49374e1e5ce421e11795fcc4f53014ef9259d630d7876bc
[ 17.337551] DEBUG: Loading /lib/modules/xhci-hcd.ko with busybox insmod
[ 17.448660] TRACE: /sbin/insmod(9): main
[ 17.595458] TRACE: /sbin/insmod(53): main
[ 17.653305] DEBUG: No module parameters, extending only with the module's content
[ 17.763612] TRACE: /bin/tpmr(832): main
[ 17.817350] DEBUG: TPM: Extending PCR[5] with /lib/modules/xhci-pci.ko
[ 17.849196] TRACE: /bin/tpmr(234): tpm2_extend
[ 17.879069] TRACE: /bin/tpmr(252): tpm2_extend
[ 17.927859] DEBUG: TPM: Will extend PCR[5] with hash of file content /lib/modules/xhci-pci.ko
[ 18.126778] TRACE: /bin/tpmr(265): tpm2_extend
[ 18.188056] DEBUG: TPM: Extended PCR[5] with hash 5502fa8c101f7e509145b9826094f06dd0e225c2311a14edc9ae9c812518a250
[ 18.247945] DEBUG: Loading /lib/modules/xhci-pci.ko with busybox insmod
[ 18.286509] xhci_hcd 0000:00:04.0: xHCI Host Controller
[ 18.294553] xhci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 5
[ 18.308276] xhci_hcd 0000:00:04.0: hcc params 0x00087001 hci version 0x100 quirks 0x0000000000000010
[ 18.320288] hub 5-0:1.0: USB hub found
[ 18.328425] hub 5-0:1.0: 4 ports detected
[ 18.337635] xhci_hcd 0000:00:04.0: xHCI Host Controller
[ 18.344430] xhci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 6
[ 18.351769] xhci_hcd 0000:00:04.0: Host supports USB 3.0 SuperSpeed
[ 18.360900] usb usb6: We don't know the algorithms for LPM for this host, disabling LPM.
[ 18.371095] hub 6-0:1.0: USB hub found
[ 18.378046] hub 6-0:1.0: 4 ports detected
[ 18.673695] usb 5-1: new high-speed USB device number 2 using xhci_hcd
[ 18.960744] usb 6-2: new SuperSpeed Gen 1 USB device number 2 using xhci_hcd
[ 19.112485] usb 5-3: new full-speed USB device number 3 using xhci_hcd
[ 20.433294] TRACE: /etc/functions(715): detect_boot_device
[ 20.489580] TRACE: /etc/functions(682): mount_possible_boot_device
[ 20.546126] TRACE: /etc/functions(642): is_gpt_bios_grub
[ 20.653417] TRACE: /dev/vda1 is partition 1 of vda
[ 20.777737] TRACE: /etc/functions(619): find_lvm_vg_name
[ 20.946450] TRACE: Try mounting /dev/vda1 as /boot
[ 20.997145] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null)
[ 21.053058] TRACE: /bin/gui-init(319): clean_boot_check
[ 21.157752] TRACE: /bin/gui-init(348): check_gpg_key
[ 21.260339] TRACE: /bin/gui-init(185): update_totp
[ 21.376906] TRACE: /bin/unseal-totp(8): main
[ 21.497372] TRACE: /bin/tpmr(569): tpm2_unseal
[ 21.574501] DEBUG: tpm2_unseal: handle=0x81004d47 pcrl=0,1,2,3,4,7 file=/tmp/secret/totp.key pass=<empty>
[ 22.212056] DEBUG: Running at_exit handlers
[ 22.247818] TRACE: /bin/tpmr(374): cleanup_session
[ 22.301292] DEBUG: Clean up session: /tmp/secret/unsealfile_policy.session
[ 22.423005] !!! ERROR: Unable to unseal TOTP secret !!!
[ 25.058227] TRACE: /bin/unseal-totp(8): main
[ 25.205031] TRACE: /bin/tpmr(569): tpm2_unseal
[ 25.284388] DEBUG: tpm2_unseal: handle=0x81004d47 pcrl=0,1,2,3,4,7 file=/tmp/secret/totp.key pass=<empty>
[ 25.914243] DEBUG: Running at_exit handlers
[ 25.947988] TRACE: /bin/tpmr(374): cleanup_session
[ 26.001694] DEBUG: Clean up session: /tmp/secret/unsealfile_policy.session
[ 26.126464] !!! ERROR: Unable to unseal TOTP secret !!!
[ 28.766165] TRACE: /bin/unseal-totp(8): main
[ 28.898452] TRACE: /bin/tpmr(569): tpm2_unseal
[ 28.982708] DEBUG: tpm2_unseal: handle=0x81004d47 pcrl=0,1,2,3,4,7 file=/tmp/secret/totp.key pass=<empty>
[ 29.609216] DEBUG: Running at_exit handlers
[ 29.643372] TRACE: /bin/tpmr(374): cleanup_session
[ 29.696741] DEBUG: Clean up session: /tmp/secret/unsealfile_policy.session
[ 29.822748] !!! ERROR: Unable to unseal TOTP secret !!!
[ 31.890980] DEBUG: CONFIG_TPM: y
[ 31.945147] DEBUG: CONFIG_TPM2_TOOLS: y
[ 31.999643] DEBUG: Show PCRs
[ 32.157607] DEBUG: sha256:
[ 32.190288] 0 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.221302] 1 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.251240] 2 : 0x9FC171D45D54BDD49D40E8438BCF15808427BA72B11EC2DF1ACE877CA0CF4F14
[ 32.282127] 3 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.315382] 4 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.345767] 5 : 0xD76470232B7C3FD7D18D4DF3B77DACAFFDB876DBF3E84C996D74F7ECFA0FF60F
[ 32.379099] 6 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.409630] 7 : 0x2E3147A8ADA1FEBEB2D32D7F50F25DC10F47D7CD48DF1D61A2D6BF958114A231
[ 32.439780] 8 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.508514] 9 : 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.537395] 10: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.583510] 11: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.622661] 12: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.651831] 13: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.687298] 14: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.721766] 15: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.751345] 16: 0x0000000000000000000000000000000000000000000000000000000000000000
[ 32.782919] 17: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.813071] 18: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.841994] 19: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.869358] 20: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.907215] 21: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.937346] 22: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 32.967810] 23: 0x0000000000000000000000000000000000000000000000000000000000000000
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-09-06 17:15:53 -04:00
Thierry Laurion
7ca8d42cde
tpmr : match desc of function in comment
...
Co-authored-by: JonathonHall-Purism <109107914+JonathonHall-Purism@users.noreply.github.com>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-08-28 14:51:28 -04:00
Thierry Laurion
52992664ea
Improve TPM Extend infor in normal and DEBUG mode
...
cbfs-init: remove temp files, measure direct cbfs output, extend PCR with proper introspection tracing
flash.sh: do not die but go to recovery if flashrom fails, cosmetic fix for warning given to user
kexec-insert-key: extend PCR with proper introspection tracing
kexec-select-boot: extend PCR with proper introspection tracing
kexec-measure-luks: extend PCR with proper introspection tracing
tpmr: Add missing TRACE_FUNC, fix comments, extend give hash that was extended to tpm call in DEBUG, fix TPM startsession unsuppressed output still present
ash_functions: extend PCR with proper introspection tracing
insmod: DEBUG info more pertinent, extend PCR with proper introspection tracing
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-08-24 15:33:51 -04:00
Thierry Laurion
60d9aa4d5a
tpmr: remove warning "Warn: check public portion of the tpmkey manually"
...
Discussed under https://github.com/linuxboot/heads/pull/1630#issuecomment-2075120429
TODO added in code.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-04-26 11:14:14 -04:00
Thierry Laurion
40c34453df
all scripts: replace TRACE manual strings with dynamic tracing by bash debug
...
Exception: scripts sourcing/calls within etc/ash_functions continues to use old TRACE functions until we switch to bash completely getting rid of ash.
This would mean getting rid of legacy boards (flash + legacy boards which do not have enough space for bash in flash boards) once and for all.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-02-01 15:48:27 -05:00
Thierry Laurion
b4068e61fa
tpmr: fix TPM Disk Unlock Key which was not using proper cached passphrase.
...
Add debugging that was needed to spot the issue
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-12-29 15:22:17 -05:00
Jonathon Hall
fd6a947cb3
tpmr: Move last TPM owner password prompt/shred into tpmr
...
Prompt for TPM owner password internally within tpm2_counter_create.
Add tpm1_counter_create to prompt for password internally. Wipe the
cache in either if the operation fails, in case the password was
incorrect.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-11-06 15:20:29 -05:00
Thierry Laurion
cd3ce6999c
tpmr/kexec-seal-key/functions: end refactoring of tpmr being in carge of wiping /tmp/secret/tpm_owner_password if invalid
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-03 13:53:47 -04:00
Thierry Laurion
afb817ca48
tpmr: give users better error/DEBUG messages in regard of TPM errors
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-03 11:07:36 -04:00
Thierry Laurion
84374dfbcd
kexec-seal-key/seal-totp/tpmr/functions: move wiping of tpm_owner_password to tpmr calls directly
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-03 10:54:16 -04:00
Thierry Laurion
e2985d386e
seal-totp/tpmr: differenciate die messages to show which between tpm1_seal/tpm2_seal or check_tpm_counter fails to seal as first step to possible refactor
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-03 10:15:52 -04:00
Thierry Laurion
921acd0f6f
tpmr: move TPM2 related secrets artifacts to /tmp/secret to be autowiped when recovery shell is accessed. If you want to see those, use qemu and have main console launching qemu under recovery shell prior of doing ops you want to see /tmp/secret/ artifacts before being deleted. We still have pcap under /tmp which is as expected
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-02 11:45:02 -04:00
Thierry Laurion
c3a5359a85
Squash: remove DEBUG that were TODO for removal
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:08:03 -04:00
Thierry Laurion
27c457f04b
TPM2 DUK and TOTP/HOTP reseal fix, refactoring and ifferenciating tpm_password into tpm_owner_password and reusing correctly
...
i
TODO: fix all TODO in PR prior of review + squash
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:27 -04:00
Thierry Laurion
3fb84f0b42
WiP: Clean cached /tmp/secret/tpm_password when sealing fails, otherwise reuse it on TPM Reset/TOTP+HOTP Sealing once for TPM1/TPM2+TPM Disk Unlock Key
...
gui-init: make sure that reseal_tpm_disk_decryption_key happens only on successful TOTP/HOTP sealing, reusing cached TPM Owner password
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:17 -04:00
Thierry Laurion
911eb07565
TPM1/TPM2: unify wording for TPM Owner Password and cache it externally to /tmp/secret/tpm_password to be reused in a boot session until recovery shell access or reboot
...
TODO: Why two functions prompt_tpm_password and prompt_new_owner_password
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:14 -04:00
Thierry Laurion
88d00dfcb2
scripts: unify luks in text/prompts/messages to LUKS
...
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2023-11-01 10:07:01 -04:00
Thierry Laurion
4910c1188f
TPM Disk Unlock Key sealing/renewal cleanup (Triggered automatically when resealing TOTP)
...
Changes:
- As per master: when TOTP cannot unseal TOTP, user is prompted to either reset or regenerate TOTP
- Now, when either is done and a previous TPM Disk Unlock Key was setuped, the user is guided into:
- Regenerating checksums and signing them
- Regenerating TPM disk Unlock Key and resealing TPM disk Unlock Key with passphrase into TPM
- LUKS header being modified, user is asked to resign kexec.sig one last time prior of being able to default boot
- When no previous Disk Unlock Key was setuped, the user is guided into:
- The above, plus
- Detection of LUKS containers,suggesting only relevant partitions
- Addition of TRACE and DEBUG statements to troubleshoot actual vs expected behavior while coding
- Were missing under TPM Disk Unlock Key setup codepaths
- Fixes for #645 : We now check if only one slots exists and we do not use it if its slot1.
- Also shows in DEBUG traces now
Unrelated staged changes
- ash_functions: warn and die now contains proper spacing and eye attaction
- all warn and die calls modified if containing warnings and too much punctuation
- unify usage of term TPM Disk Unlock Key and Disk Recovery Key
2023-08-30 18:06:29 -04:00
Jonathon Hall
47e9e4cf45
Merge remote-tracking branch 'github-heads/master' into pureboot-27-heads-upstream
2023-07-12 14:14:17 -04:00
Krystian Hebel
77eb9536d6
initrd/bin/tpmr: add debug for replay_pcr()
...
It also includes instructions for introspecting the replayed values
manually.
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-07-12 14:57:44 +02:00
Krystian Hebel
d1a18f1f83
initrd/bin/tpmr: replay PCR values from event log instead of assumming their values
...
Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2023-07-12 14:50:42 +02:00
Kyle Rankin
79da79a5e4
Implement Restricted Boot Mode
...
Restricted Boot mode only allows booting from signed files, whether that
is signed kernels in /boot or signed ISOs on mounted USB disks. This
disables booting from abitrary USB disks as well as the forced "unsafe"
boot mode. This also disables the recovery console so you can't bypass
this mode simply by running kexec manually.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-06-21 13:26:45 -04:00
Jonathon Hall
ea5b8dc30f
tpmr: Provide startsession for TPM1 and TPM2
...
It's a no-op on TPM1, but provide it so init doesn't have to
distinguish TPM1/TPM2.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:10:24 -04:00
Jonathon Hall
55b3fcfe1a
tpmr: Use at_exit for cleanup traps
...
Multiple traps overwrite each other. While no tpmr functions have more
than one trap right now, it is fragile, and the quoting is complex due
to double expansion. Use at_exit to add exit handlers that accumulate
and do not require special quoting.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:50:43 -05:00
Jonathon Hall
698fc83046
gui-init: Eliminate extra TPM owner password prompts in TPM reset
...
We just set the TPM owner password, so there's no need to make the user
enter it again. Eliminates some failure modes if the user mistypes it
or enters the wrong password.
Allow optionally passing in the TPM owner password in tpmr seal,
check_tpm_counter(), seal-totp, and generate_totp_htop(). The user is
still prompted if the password is needed but was not provided, so
existing uses in other contexts continue to work unchanged.
Prompt for the password in reset_tpm() and pass it down to each of the
above.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:36:24 -05:00
Jonathon Hall
9d34dd6687
tpmr: Apply owner password to endorsement hierarchy
...
Heads doesn't use the endorsement hierarchy, but we shouldn't leave it
with an empty password following a tpm2 clear.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:09 -05:00
Jonathon Hall
67f3ac5103
tpmr: Provide reset for both TPM1 and TPM2
...
tpmr reset now works for both TPM1 and TPM2; bring in TPM1 logic from
tpm-reset.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:07:44 -05:00
Jonathon Hall
a2e4392497
tpmr: Do not hash sealing passwords, always pass passwords as hex
...
Don't hash password used to seal an object. This limits the password
to 32-characters but avoids obfuscating the usage of the password. The
32-character limit is considered acceptable because password limits are
lower already (GPG token limits to 25 chars). We may allow >32 char
passwords in the future by hashing only if the password is >32 chars.
Always pass passwords as hex to tpm2-tools to avoid possible ambiguity
if the password begins with a control prefix like 'hex:' or 'file:'.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 14:46:34 -05:00
Jonathon Hall
298cde26ab
tpmr: Set dictionary lockout parameters and auth when resetting TPM2
...
Set consistent dictionary lockout parameters suited to Heads. Disable
lockout reset by setting a random password.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 12:25:08 -05:00
Thierry Laurion
536f4a1623
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts
...
gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout)
kexec-seal-key: Add DEBUG statement for PCR precalc
seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops
seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret
tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls
tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1
tpmr: add DO_WITH_DEBUG calls for calcfuturepcr
functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL
Not so related but part of output review and corrections:
kexec-insert-key: cosmetic changes prepending "+++" to disk related changes
kexec-save-default: cosmetic changes prepending "+++" to disk related changes
config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-10 12:11:57 -05:00
Jonathon Hall
77060b0031
tpmr: Delete outdated TODO in tpm2_seal
...
The sealing password is now hashed, so there's no length limit.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:18:11 -05:00
Jonathon Hall
733fea8e2d
tpmr: Add TRACE to cleanup functions
...
Add TRACE to cleanup_shred, cleanup_session
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:17:01 -05:00
Jonathon Hall
ebabcffbdc
tpmr: Use existing HMAC session in tpm2_unseal
...
We already have HMAC sessions for encryption and decryption, there's no
need to create an ad-hoc session in tpm2_unseal.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:07:00 -05:00
Jonathon Hall
8d834f649d
tpmr: Add missing traces to tpm2_kexec_finalize, tpm2_shutdown
...
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:06:31 -05:00
Jonathon Hall
c62b96b4a6
tpmr: Move tpm1_unseal next to tpm2_unseal
...
All the other tpm2/tpm1 corresponding wrappers are next to each other,
do the same for unseal.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:44:47 -05:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
...
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark. Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Jonathon Hall
215ff2a397
reboot, poweroff: Prepare TPM2 for shutdown
...
TPM2 must be prepared for shutdown, or it may track an auth failure for
dictionary attack prevention (per the spec, to prevent an attack by
attempting to authenticate and then powering off the TPM before it can
update the nonvolatile counter).
Add tpmr shutdown to prepare for shutdown (no-op on TPM1). Invoke it
from poweroff and reboot.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:20:21 -05:00
Jonathon Hall
7b8824adf1
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2
...
Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for
both TPM1 and TPM2.
Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key. This is
essentially the TPM2 logic now that tpmr provides the same wrapped
commands for both TPM1 and TPM2.
Remove algorithm prefix from PCR list in tpmr unseal for consistency
with tpmr seal.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:57 -05:00
Jonathon Hall
641bea4d46
tpmr: Don't add newline when extending PCR with literal data
...
tpmr extend with -ic (extend with literal data) was adding a newline,
use echo -n so it only includes the data given in the hash.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
92a6b5410d
tpmr: Improve debug output, hide secrets, trim extend output more
...
Provide mask_param() function to uniformly mask secret parameters,
while still indicating whether they are empty.
Extend DO_WITH_DEBUG to allow masking a password parameter by position,
using mask_param(). Move from ash_functions to functions (isn't used
by ash scripts).
Mask password parameters in kexec-unseal-key and tpmr seal. Use
mask_param() on existing masked params in tpmr.
Trim more troubleshooting output from tpm2_extend() in tpmr.
Clarify tpmr kexec_finalize echo; it's the TPM's platform heirarchy,
users might not know what this was referring to.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
93459563d0
tpmr: Delete unimplemented nvram commands
...
nv_definespace, nv_writevalue, and nv_readvalue were never actually
implemented, remove them.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
7afb1e474f
tpmr: Provide HMAC session when unsealing with policy
...
Provide an HMAC session to tpm2 when unsealing with an auth policy.
The HMAC session is used for transport encryption.
This allows transport encryption to work when unsealing.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
