1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
5 #include "alloc-util.h"
7 #include "cryptsetup-util.h"
8 #include "dirent-util.h"
9 #include "dlfcn-util.h"
11 #include "extract-word.h"
14 #include "format-table.h"
16 #include "hexdecoct.h"
18 #include "initrd-util.h"
20 #include "lock-util.h"
22 #include "logarithm.h"
23 #include "memory-util.h"
25 #include "nulstr-util.h"
26 #include "parse-util.h"
27 #include "random-util.h"
29 #include "sort-util.h"
30 #include "stat-util.h"
31 #include "string-table.h"
32 #include "sync-util.h"
33 #include "time-util.h"
34 #include "tpm2-util.h"
38 static void *libtss2_esys_dl
= NULL
;
39 static void *libtss2_rc_dl
= NULL
;
40 static void *libtss2_mu_dl
= NULL
;
42 static TSS2_RC (*sym_Esys_Create
)(ESYS_CONTEXT
*esysContext
, ESYS_TR parentHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_SENSITIVE_CREATE
*inSensitive
, const TPM2B_PUBLIC
*inPublic
, const TPM2B_DATA
*outsideInfo
, const TPML_PCR_SELECTION
*creationPCR
, TPM2B_PRIVATE
**outPrivate
, TPM2B_PUBLIC
**outPublic
, TPM2B_CREATION_DATA
**creationData
, TPM2B_DIGEST
**creationHash
, TPMT_TK_CREATION
**creationTicket
) = NULL
;
43 static TSS2_RC (*sym_Esys_CreateLoaded
)(ESYS_CONTEXT
*esysContext
, ESYS_TR parentHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_SENSITIVE_CREATE
*inSensitive
, const TPM2B_TEMPLATE
*inPublic
, ESYS_TR
*objectHandle
, TPM2B_PRIVATE
**outPrivate
, TPM2B_PUBLIC
**outPublic
) = NULL
;
44 static TSS2_RC (*sym_Esys_CreatePrimary
)(ESYS_CONTEXT
*esysContext
, ESYS_TR primaryHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_SENSITIVE_CREATE
*inSensitive
, const TPM2B_PUBLIC
*inPublic
, const TPM2B_DATA
*outsideInfo
, const TPML_PCR_SELECTION
*creationPCR
, ESYS_TR
*objectHandle
, TPM2B_PUBLIC
**outPublic
, TPM2B_CREATION_DATA
**creationData
, TPM2B_DIGEST
**creationHash
, TPMT_TK_CREATION
**creationTicket
) = NULL
;
45 static TSS2_RC (*sym_Esys_EvictControl
)(ESYS_CONTEXT
*esysContext
, ESYS_TR auth
, ESYS_TR objectHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, TPMI_DH_PERSISTENT persistentHandle
, ESYS_TR
*newObjectHandle
) = NULL
;
46 static void (*sym_Esys_Finalize
)(ESYS_CONTEXT
**context
) = NULL
;
47 static TSS2_RC (*sym_Esys_FlushContext
)(ESYS_CONTEXT
*esysContext
, ESYS_TR flushHandle
) = NULL
;
48 static void (*sym_Esys_Free
)(void *ptr
) = NULL
;
49 static TSS2_RC (*sym_Esys_GetCapability
)(ESYS_CONTEXT
*esysContext
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, TPM2_CAP capability
, UINT32 property
, UINT32 propertyCount
, TPMI_YES_NO
*moreData
, TPMS_CAPABILITY_DATA
**capabilityData
) = NULL
;
50 static TSS2_RC (*sym_Esys_GetRandom
)(ESYS_CONTEXT
*esysContext
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, UINT16 bytesRequested
, TPM2B_DIGEST
**randomBytes
) = NULL
;
51 static TSS2_RC (*sym_Esys_Initialize
)(ESYS_CONTEXT
**esys_context
, TSS2_TCTI_CONTEXT
*tcti
, TSS2_ABI_VERSION
*abiVersion
) = NULL
;
52 static TSS2_RC (*sym_Esys_Load
)(ESYS_CONTEXT
*esysContext
, ESYS_TR parentHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_PRIVATE
*inPrivate
, const TPM2B_PUBLIC
*inPublic
, ESYS_TR
*objectHandle
) = NULL
;
53 static TSS2_RC (*sym_Esys_LoadExternal
)(ESYS_CONTEXT
*esysContext
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_SENSITIVE
*inPrivate
, const TPM2B_PUBLIC
*inPublic
, ESYS_TR hierarchy
, ESYS_TR
*objectHandle
) = NULL
;
54 static TSS2_RC (*sym_Esys_PCR_Extend
)(ESYS_CONTEXT
*esysContext
, ESYS_TR pcrHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPML_DIGEST_VALUES
*digests
) = NULL
;
55 static TSS2_RC (*sym_Esys_PCR_Read
)(ESYS_CONTEXT
*esysContext
, ESYS_TR shandle1
,ESYS_TR shandle2
, ESYS_TR shandle3
, const TPML_PCR_SELECTION
*pcrSelectionIn
, UINT32
*pcrUpdateCounter
, TPML_PCR_SELECTION
**pcrSelectionOut
, TPML_DIGEST
**pcrValues
) = NULL
;
56 static TSS2_RC (*sym_Esys_PolicyAuthorize
)(ESYS_CONTEXT
*esysContext
, ESYS_TR policySession
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_DIGEST
*approvedPolicy
, const TPM2B_NONCE
*policyRef
, const TPM2B_NAME
*keySign
, const TPMT_TK_VERIFIED
*checkTicket
) = NULL
;
57 static TSS2_RC (*sym_Esys_PolicyAuthValue
)(ESYS_CONTEXT
*esysContext
, ESYS_TR policySession
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
) = NULL
;
58 static TSS2_RC (*sym_Esys_PolicyGetDigest
)(ESYS_CONTEXT
*esysContext
, ESYS_TR policySession
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, TPM2B_DIGEST
**policyDigest
) = NULL
;
59 static TSS2_RC (*sym_Esys_PolicyPCR
)(ESYS_CONTEXT
*esysContext
, ESYS_TR policySession
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_DIGEST
*pcrDigest
, const TPML_PCR_SELECTION
*pcrs
) = NULL
;
60 static TSS2_RC (*sym_Esys_ReadPublic
)(ESYS_CONTEXT
*esysContext
, ESYS_TR objectHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, TPM2B_PUBLIC
**outPublic
, TPM2B_NAME
**name
, TPM2B_NAME
**qualifiedName
) = NULL
;
61 static TSS2_RC (*sym_Esys_StartAuthSession
)(ESYS_CONTEXT
*esysContext
, ESYS_TR tpmKey
, ESYS_TR bind
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_NONCE
*nonceCaller
, TPM2_SE sessionType
, const TPMT_SYM_DEF
*symmetric
, TPMI_ALG_HASH authHash
, ESYS_TR
*sessionHandle
) = NULL
;
62 static TSS2_RC (*sym_Esys_Startup
)(ESYS_CONTEXT
*esysContext
, TPM2_SU startupType
) = NULL
;
63 static TSS2_RC (*sym_Esys_TestParms
)(ESYS_CONTEXT
*esysContext
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPMT_PUBLIC_PARMS
*parameters
) = NULL
;
64 static TSS2_RC (*sym_Esys_TR_Close
)(ESYS_CONTEXT
*esys_context
, ESYS_TR
*rsrc_handle
) = NULL
;
65 static TSS2_RC (*sym_Esys_TR_Deserialize
)(ESYS_CONTEXT
*esys_context
, uint8_t const *buffer
, size_t buffer_size
, ESYS_TR
*esys_handle
) = NULL
;
66 static TSS2_RC (*sym_Esys_TR_FromTPMPublic
)(ESYS_CONTEXT
*esysContext
, TPM2_HANDLE tpm_handle
, ESYS_TR optionalSession1
, ESYS_TR optionalSession2
, ESYS_TR optionalSession3
, ESYS_TR
*object
) = NULL
;
67 static TSS2_RC (*sym_Esys_TR_GetName
)(ESYS_CONTEXT
*esysContext
, ESYS_TR handle
, TPM2B_NAME
**name
) = NULL
;
68 static TSS2_RC (*sym_Esys_TR_GetTpmHandle
)(ESYS_CONTEXT
*esys_context
, ESYS_TR esys_handle
, TPM2_HANDLE
*tpm_handle
) = NULL
;
69 static TSS2_RC (*sym_Esys_TR_Serialize
)(ESYS_CONTEXT
*esys_context
, ESYS_TR object
, uint8_t **buffer
, size_t *buffer_size
) = NULL
;
70 static TSS2_RC (*sym_Esys_TR_SetAuth
)(ESYS_CONTEXT
*esysContext
, ESYS_TR handle
, TPM2B_AUTH
const *authValue
) = NULL
;
71 static TSS2_RC (*sym_Esys_TRSess_GetAttributes
)(ESYS_CONTEXT
*esysContext
, ESYS_TR session
, TPMA_SESSION
*flags
) = NULL
;
72 static TSS2_RC (*sym_Esys_TRSess_SetAttributes
)(ESYS_CONTEXT
*esysContext
, ESYS_TR session
, TPMA_SESSION flags
, TPMA_SESSION mask
) = NULL
;
73 static TSS2_RC (*sym_Esys_Unseal
)(ESYS_CONTEXT
*esysContext
, ESYS_TR itemHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, TPM2B_SENSITIVE_DATA
**outData
) = NULL
;
74 static TSS2_RC (*sym_Esys_VerifySignature
)(ESYS_CONTEXT
*esysContext
, ESYS_TR keyHandle
, ESYS_TR shandle1
, ESYS_TR shandle2
, ESYS_TR shandle3
, const TPM2B_DIGEST
*digest
, const TPMT_SIGNATURE
*signature
, TPMT_TK_VERIFIED
**validation
) = NULL
;
76 static TSS2_RC (*sym_Tss2_MU_TPM2_CC_Marshal
)(TPM2_CC src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
77 static TSS2_RC (*sym_Tss2_MU_TPM2B_PRIVATE_Marshal
)(TPM2B_PRIVATE
const *src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
78 static TSS2_RC (*sym_Tss2_MU_TPM2B_PRIVATE_Unmarshal
)(uint8_t const buffer
[], size_t buffer_size
, size_t *offset
, TPM2B_PRIVATE
*dest
) = NULL
;
79 static TSS2_RC (*sym_Tss2_MU_TPM2B_PUBLIC_Marshal
)(TPM2B_PUBLIC
const *src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
80 static TSS2_RC (*sym_Tss2_MU_TPM2B_PUBLIC_Unmarshal
)(uint8_t const buffer
[], size_t buffer_size
, size_t *offset
, TPM2B_PUBLIC
*dest
) = NULL
;
81 static TSS2_RC (*sym_Tss2_MU_TPML_PCR_SELECTION_Marshal
)(TPML_PCR_SELECTION
const *src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
82 static TSS2_RC (*sym_Tss2_MU_TPMT_HA_Marshal
)(TPMT_HA
const *src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
83 static TSS2_RC (*sym_Tss2_MU_TPMT_PUBLIC_Marshal
)(TPMT_PUBLIC
const *src
, uint8_t buffer
[], size_t buffer_size
, size_t *offset
) = NULL
;
85 static const char* (*sym_Tss2_RC_Decode
)(TSS2_RC rc
) = NULL
;
87 int dlopen_tpm2(void) {
90 r
= dlopen_many_sym_or_warn(
91 &libtss2_esys_dl
, "libtss2-esys.so.0", LOG_DEBUG
,
92 DLSYM_ARG(Esys_Create
),
93 DLSYM_ARG(Esys_CreateLoaded
),
94 DLSYM_ARG(Esys_CreatePrimary
),
95 DLSYM_ARG(Esys_EvictControl
),
96 DLSYM_ARG(Esys_Finalize
),
97 DLSYM_ARG(Esys_FlushContext
),
99 DLSYM_ARG(Esys_GetCapability
),
100 DLSYM_ARG(Esys_GetRandom
),
101 DLSYM_ARG(Esys_Initialize
),
102 DLSYM_ARG(Esys_Load
),
103 DLSYM_ARG(Esys_LoadExternal
),
104 DLSYM_ARG(Esys_PCR_Extend
),
105 DLSYM_ARG(Esys_PCR_Read
),
106 DLSYM_ARG(Esys_PolicyAuthorize
),
107 DLSYM_ARG(Esys_PolicyAuthValue
),
108 DLSYM_ARG(Esys_PolicyGetDigest
),
109 DLSYM_ARG(Esys_PolicyPCR
),
110 DLSYM_ARG(Esys_ReadPublic
),
111 DLSYM_ARG(Esys_StartAuthSession
),
112 DLSYM_ARG(Esys_Startup
),
113 DLSYM_ARG(Esys_TestParms
),
114 DLSYM_ARG(Esys_TR_Close
),
115 DLSYM_ARG(Esys_TR_Deserialize
),
116 DLSYM_ARG(Esys_TR_FromTPMPublic
),
117 DLSYM_ARG(Esys_TR_GetName
),
118 DLSYM_ARG(Esys_TR_Serialize
),
119 DLSYM_ARG(Esys_TR_SetAuth
),
120 DLSYM_ARG(Esys_TRSess_GetAttributes
),
121 DLSYM_ARG(Esys_TRSess_SetAttributes
),
122 DLSYM_ARG(Esys_Unseal
),
123 DLSYM_ARG(Esys_VerifySignature
));
127 /* Esys_TR_GetTpmHandle was added to tpm2-tss in version 2.4.0. Once we can set a minimum tpm2-tss
128 * version of 2.4.0 this sym can be moved up to the normal list above. */
129 r
= dlsym_many_or_warn(libtss2_esys_dl
, LOG_DEBUG
, DLSYM_ARG_FORCE(Esys_TR_GetTpmHandle
));
131 log_debug("libtss2-esys too old, does not include Esys_TR_GetTpmHandle.");
133 r
= dlopen_many_sym_or_warn(
134 &libtss2_rc_dl
, "libtss2-rc.so.0", LOG_DEBUG
,
135 DLSYM_ARG(Tss2_RC_Decode
));
139 return dlopen_many_sym_or_warn(
140 &libtss2_mu_dl
, "libtss2-mu.so.0", LOG_DEBUG
,
141 DLSYM_ARG(Tss2_MU_TPM2_CC_Marshal
),
142 DLSYM_ARG(Tss2_MU_TPM2B_PRIVATE_Marshal
),
143 DLSYM_ARG(Tss2_MU_TPM2B_PRIVATE_Unmarshal
),
144 DLSYM_ARG(Tss2_MU_TPM2B_PUBLIC_Marshal
),
145 DLSYM_ARG(Tss2_MU_TPM2B_PUBLIC_Unmarshal
),
146 DLSYM_ARG(Tss2_MU_TPML_PCR_SELECTION_Marshal
),
147 DLSYM_ARG(Tss2_MU_TPMT_HA_Marshal
),
148 DLSYM_ARG(Tss2_MU_TPMT_PUBLIC_Marshal
));
151 void Esys_Freep(void *p
) {
153 sym_Esys_Free(*(void**) p
);
156 /* Get a specific TPM capability (or capabilities).
158 * Returns 0 if there are no more capability properties of the requested type, or 1 if there are more, or < 0
159 * on any error. Both 0 and 1 indicate this completed successfully, but do not indicate how many capability
160 * properties were provided in 'ret_capability_data'. To find the number of provided properties, check the
161 * specific type's 'count' field (e.g. for TPM2_CAP_ALGS, check ret_capability_data->algorithms.count).
163 * This calls TPM2_GetCapability() and does not alter the provided data, so it is important to understand how
164 * that TPM function works. It is recommended to check the TCG TPM specification Part 3 ("Commands") section
165 * on TPM2_GetCapability() for full details, but a short summary is: if this returns 0, all available
166 * properties have been provided in ret_capability_data, or no properties were available. If this returns 1,
167 * there are between 1 and "count" properties provided in ret_capability_data, and there are more available.
168 * Note that this may provide less than "count" properties even if the TPM has more available. Also, each
169 * capability category may have more specific requirements than described here; see the spec for exact
171 static int tpm2_get_capability(
176 TPMU_CAPABILITIES
*ret_capability_data
) {
178 _cleanup_(Esys_Freep
) TPMS_CAPABILITY_DATA
*capabilities
= NULL
;
184 log_debug("Getting TPM2 capability 0x%04" PRIx32
" property 0x%04" PRIx32
" count %" PRIu32
".",
185 capability
, property
, count
);
187 rc
= sym_Esys_GetCapability(
197 if (rc
!= TSS2_RC_SUCCESS
)
198 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
199 "Failed to get TPM2 capability 0x%04" PRIx32
" property 0x%04" PRIx32
": %s",
200 capability
, property
, sym_Tss2_RC_Decode(rc
));
202 if (capabilities
->capability
!= capability
)
203 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
204 "TPM provided wrong capability: 0x%04" PRIx32
" instead of 0x%04" PRIx32
".",
205 capabilities
->capability
, capability
);
207 if (ret_capability_data
)
208 *ret_capability_data
= capabilities
->data
;
210 return more
== TPM2_YES
;
213 #define TPMA_CC_TO_TPM2_CC(cca) (((cca) & TPMA_CC_COMMANDINDEX_MASK) >> TPMA_CC_COMMANDINDEX_SHIFT)
215 static int tpm2_cache_capabilities(Tpm2Context
*c
) {
216 TPMU_CAPABILITIES capability
;
221 /* Cache the algorithms. The spec indicates supported algorithms can only be modified during runtime
222 * by the SetAlgorithmSet() command. Unfortunately, the spec doesn't require a TPM reinitialization
223 * after changing the algorithm set (unless the PCR algorithms are changed). However, the spec also
224 * indicates the TPM behavior after SetAlgorithmSet() is "vendor-dependent", giving the example of
225 * flushing sessions and objects, erasing policies, etc. So, if the algorithm set is programmatically
226 * changed while we are performing some operation, it's reasonable to assume it will break us even if
227 * we don't cache the algorithms, thus they should be "safe" to cache. */
228 TPM2_ALG_ID current_alg
= TPM2_ALG_FIRST
;
230 r
= tpm2_get_capability(
233 (uint32_t) current_alg
, /* The spec states to cast TPM2_ALG_ID to uint32_t. */
239 TPML_ALG_PROPERTY algorithms
= capability
.algorithms
;
241 /* We should never get 0; the TPM must support some algorithms, and it must not set 'more' if
242 * there are no more. */
243 assert(algorithms
.count
> 0);
245 if (!GREEDY_REALLOC_APPEND(
246 c
->capability_algorithms
,
247 c
->n_capability_algorithms
,
248 algorithms
.algProperties
,
250 return log_oom_debug();
255 /* Set current_alg to alg id after last alg id the TPM provided */
256 current_alg
= algorithms
.algProperties
[algorithms
.count
- 1].alg
+ 1;
259 /* Cache the command capabilities. The spec isn't actually clear if commands can be added/removed
260 * while running, but that would be crazy, so let's hope it is not possible. */
261 TPM2_CC current_cc
= TPM2_CC_FIRST
;
263 r
= tpm2_get_capability(
272 TPML_CCA commands
= capability
.command
;
274 /* We should never get 0; the TPM must support some commands, and it must not set 'more' if
275 * there are no more. */
276 assert(commands
.count
> 0);
278 if (!GREEDY_REALLOC_APPEND(
279 c
->capability_commands
,
280 c
->n_capability_commands
,
281 commands
.commandAttributes
,
283 return log_oom_debug();
288 /* Set current_cc to index after last cc the TPM provided */
289 current_cc
= TPMA_CC_TO_TPM2_CC(commands
.commandAttributes
[commands
.count
- 1]) + 1;
292 /* Cache the PCR capabilities, which are safe to cache, as the only way they can change is
293 * TPM2_PCR_Allocate(), which changes the allocation after the next _TPM_Init(). If the TPM is
294 * reinitialized while we are using it, all our context and sessions will be invalid, so we can
295 * safely assume the TPM PCR allocation will not change while we are using it. */
296 r
= tpm2_get_capability(
305 /* This should never happen. Part 3 ("Commands") of the TCG TPM2 spec in the section for
306 * TPM2_GetCapability states: "TPM_CAP_PCRS – Returns the current allocation of PCR in a
307 * TPML_PCR_SELECTION. The property parameter shall be zero. The TPM will always respond to
308 * this command with the full PCR allocation and moreData will be NO." */
309 log_debug("TPM bug: reported multiple PCR sets; using only first set.");
310 c
->capability_pcrs
= capability
.assignedPCR
;
315 /* Get the TPMA_ALGORITHM for a TPM2_ALG_ID. Returns true if the TPM supports the algorithm and the
316 * TPMA_ALGORITHM is provided, otherwise false. */
317 static bool tpm2_get_capability_alg(Tpm2Context
*c
, TPM2_ALG_ID alg
, TPMA_ALGORITHM
*ret
) {
320 FOREACH_ARRAY(alg_prop
, c
->capability_algorithms
, c
->n_capability_algorithms
)
321 if (alg_prop
->alg
== alg
) {
323 *ret
= alg_prop
->algProperties
;
327 log_debug("TPM does not support alg 0x%02" PRIx16
".", alg
);
334 bool tpm2_supports_alg(Tpm2Context
*c
, TPM2_ALG_ID alg
) {
335 return tpm2_get_capability_alg(c
, alg
, NULL
);
338 /* Get the TPMA_CC for a TPM2_CC. Returns true if the TPM supports the command and the TPMA_CC is provided,
339 * otherwise false. */
340 static bool tpm2_get_capability_command(Tpm2Context
*c
, TPM2_CC command
, TPMA_CC
*ret
) {
343 FOREACH_ARRAY(cca
, c
->capability_commands
, c
->n_capability_commands
)
344 if (TPMA_CC_TO_TPM2_CC(*cca
) == command
) {
350 log_debug("TPM does not support command 0x%04" PRIx32
".", command
);
357 bool tpm2_supports_command(Tpm2Context
*c
, TPM2_CC command
) {
358 return tpm2_get_capability_command(c
, command
, NULL
);
361 /* Returns 1 if the TPM supports the ECC curve, 0 if not, or < 0 for any error. */
362 static int tpm2_supports_ecc_curve(Tpm2Context
*c
, TPM2_ECC_CURVE curve
) {
363 TPMU_CAPABILITIES capability
;
366 /* The spec explicitly states the TPM2_ECC_CURVE should be cast to uint32_t. */
367 r
= tpm2_get_capability(c
, TPM2_CAP_ECC_CURVES
, (uint32_t) curve
, 1, &capability
);
371 TPML_ECC_CURVE eccCurves
= capability
.eccCurves
;
372 if (eccCurves
.count
== 0 || eccCurves
.eccCurves
[0] != curve
) {
373 log_debug("TPM does not support ECC curve 0x%02" PRIx16
".", curve
);
380 /* Query the TPM for populated handles.
382 * This provides an array of handle indexes populated in the TPM, starting at the requested handle. The array will
383 * contain only populated handle addresses (which might not include the requested handle). The number of
384 * handles will be no more than the 'max' number requested. This will not search past the end of the handle
385 * range (i.e. handle & 0xff000000).
387 * Returns 0 if all populated handles in the range (starting at the requested handle) were provided (or no
388 * handles were in the range), or 1 if there are more populated handles in the range, or < 0 on any error. */
389 static int tpm2_get_capability_handles(
393 TPM2_HANDLE
**ret_handles
,
394 size_t *ret_n_handles
) {
396 _cleanup_free_ TPM2_HANDLE
*handles
= NULL
;
397 size_t n_handles
= 0;
398 TPM2_HANDLE current
= start
;
403 assert(ret_n_handles
);
406 TPMU_CAPABILITIES capability
;
407 r
= tpm2_get_capability(c
, TPM2_CAP_HANDLES
, current
, (uint32_t) max
, &capability
);
411 TPML_HANDLE handle_list
= capability
.handles
;
412 if (handle_list
.count
== 0)
415 assert(handle_list
.count
<= max
);
417 if (n_handles
> SIZE_MAX
- handle_list
.count
)
418 return log_oom_debug();
420 if (!GREEDY_REALLOC(handles
, n_handles
+ handle_list
.count
))
421 return log_oom_debug();
423 memcpy_safe(&handles
[n_handles
], handle_list
.handle
, sizeof(handles
[0]) * handle_list
.count
);
425 max
-= handle_list
.count
;
426 n_handles
+= handle_list
.count
;
428 /* Update current to the handle index after the last handle in the list. */
429 current
= handles
[n_handles
- 1] + 1;
432 /* No more handles in this range. */
436 *ret_handles
= TAKE_PTR(handles
);
437 *ret_n_handles
= n_handles
;
442 #define TPM2_HANDLE_RANGE(h) ((TPM2_HANDLE)((h) & TPM2_HR_RANGE_MASK))
443 #define TPM2_HANDLE_TYPE(h) ((TPM2_HT)(TPM2_HANDLE_RANGE(h) >> TPM2_HR_SHIFT))
445 /* Returns 1 if the handle is populated in the TPM, 0 if not, and < 0 on any error. */
446 static int tpm2_get_capability_handle(Tpm2Context
*c
, TPM2_HANDLE handle
) {
447 _cleanup_free_ TPM2_HANDLE
*handles
= NULL
;
448 size_t n_handles
= 0;
451 r
= tpm2_get_capability_handles(c
, handle
, 1, &handles
, &n_handles
);
455 return n_handles
== 0 ? false : handles
[0] == handle
;
458 /* Returns 1 if the TPM supports the parms, or 0 if the TPM does not support the parms. */
459 bool tpm2_test_parms(Tpm2Context
*c
, TPMI_ALG_PUBLIC alg
, const TPMU_PUBLIC_PARMS
*parms
) {
465 TPMT_PUBLIC_PARMS parameters
= {
467 .parameters
= *parms
,
470 rc
= sym_Esys_TestParms(c
->esys_context
, ESYS_TR_NONE
, ESYS_TR_NONE
, ESYS_TR_NONE
, ¶meters
);
471 if (rc
!= TSS2_RC_SUCCESS
)
472 /* The spec says if the parms are not supported the TPM returns "...the appropriate
473 * unmarshaling error if a parameter is not valid". Since the spec (currently) defines 15
474 * unmarshaling errors, instead of checking for them all here, let's just assume any error
475 * indicates unsupported parms, and log the specific error text. */
476 log_debug("TPM does not support tested parms: %s", sym_Tss2_RC_Decode(rc
));
478 return rc
== TSS2_RC_SUCCESS
;
481 static bool tpm2_supports_tpmt_public(Tpm2Context
*c
, const TPMT_PUBLIC
*public) {
485 return tpm2_test_parms(c
, public->type
, &public->parameters
);
488 static bool tpm2_supports_tpmt_sym_def_object(Tpm2Context
*c
, const TPMT_SYM_DEF_OBJECT
*parameters
) {
492 TPMU_PUBLIC_PARMS parms
= {
493 .symDetail
.sym
= *parameters
,
496 return tpm2_test_parms(c
, TPM2_ALG_SYMCIPHER
, &parms
);
499 static bool tpm2_supports_tpmt_sym_def(Tpm2Context
*c
, const TPMT_SYM_DEF
*parameters
) {
503 /* Unfortunately, TPMT_SYM_DEF and TPMT_SYM_DEF_OBEJECT are separately defined, even though they are
504 * functionally identical. */
505 TPMT_SYM_DEF_OBJECT object
= {
506 .algorithm
= parameters
->algorithm
,
507 .keyBits
= parameters
->keyBits
,
508 .mode
= parameters
->mode
,
511 return tpm2_supports_tpmt_sym_def_object(c
, &object
);
514 static Tpm2Context
*tpm2_context_free(Tpm2Context
*c
) {
519 sym_Esys_Finalize(&c
->esys_context
);
521 c
->tcti_context
= mfree(c
->tcti_context
);
522 c
->tcti_dl
= safe_dlclose(c
->tcti_dl
);
524 c
->capability_algorithms
= mfree(c
->capability_algorithms
);
525 c
->capability_commands
= mfree(c
->capability_commands
);
530 DEFINE_TRIVIAL_REF_UNREF_FUNC(Tpm2Context
, tpm2_context
, tpm2_context_free
);
532 static const TPMT_SYM_DEF SESSION_TEMPLATE_SYM_AES_128_CFB
= {
533 .algorithm
= TPM2_ALG_AES
,
535 .mode
.aes
= TPM2_ALG_CFB
, /* The spec requires sessions to use CFB. */
538 int tpm2_context_new(const char *device
, Tpm2Context
**ret_context
) {
539 _cleanup_(tpm2_context_unrefp
) Tpm2Context
*context
= NULL
;
545 context
= new(Tpm2Context
, 1);
547 return log_oom_debug();
549 *context
= (Tpm2Context
) {
555 return log_debug_errno(r
, "TPM2 support not installed: %m");
558 device
= secure_getenv("SYSTEMD_TPM2_DEVICE");
560 /* Setting the env var to an empty string forces tpm2-tss' own device picking
561 * logic to be used. */
562 device
= empty_to_null(device
);
564 /* If nothing was specified explicitly, we'll use a hardcoded default: the "device" tcti
565 * driver and the "/dev/tpmrm0" device. We do this since on some distributions the tpm2-abrmd
566 * might be used and we really don't want that, since it is a system service and that creates
567 * various ordering issues/deadlocks during early boot. */
568 device
= "device:/dev/tpmrm0";
572 const char *param
, *driver
, *fn
;
573 const TSS2_TCTI_INFO
* info
;
574 TSS2_TCTI_INFO_FUNC func
;
577 param
= strchr(device
, ':');
579 /* Syntax #1: Pair of driver string and arbitrary parameter */
580 driver
= strndupa_safe(device
, param
- device
);
582 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 driver name is empty, refusing.");
585 } else if (path_is_absolute(device
) && path_is_valid(device
)) {
586 /* Syntax #2: TPM device node */
590 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Invalid TPM2 driver string, refusing.");
592 log_debug("Using TPM2 TCTI driver '%s' with device '%s'.", driver
, param
);
594 fn
= strjoina("libtss2-tcti-", driver
, ".so.0");
596 /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
597 if (!filename_is_valid(fn
))
598 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 driver name '%s' not valid, refusing.", driver
);
600 context
->tcti_dl
= dlopen(fn
, RTLD_NOW
);
601 if (!context
->tcti_dl
)
602 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "Failed to load %s: %s", fn
, dlerror());
604 func
= dlsym(context
->tcti_dl
, TSS2_TCTI_INFO_SYMBOL
);
606 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
607 "Failed to find TCTI info symbol " TSS2_TCTI_INFO_SYMBOL
": %s",
612 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "Unable to get TCTI info data.");
614 log_debug("Loaded TCTI module '%s' (%s) [Version %" PRIu32
"]", info
->name
, info
->description
, info
->version
);
616 rc
= info
->init(NULL
, &sz
, NULL
);
617 if (rc
!= TPM2_RC_SUCCESS
)
618 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
619 "Failed to initialize TCTI context: %s", sym_Tss2_RC_Decode(rc
));
621 context
->tcti_context
= malloc0(sz
);
622 if (!context
->tcti_context
)
623 return log_oom_debug();
625 rc
= info
->init(context
->tcti_context
, &sz
, param
);
626 if (rc
!= TPM2_RC_SUCCESS
)
627 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
628 "Failed to initialize TCTI context: %s", sym_Tss2_RC_Decode(rc
));
631 rc
= sym_Esys_Initialize(&context
->esys_context
, context
->tcti_context
, NULL
);
632 if (rc
!= TSS2_RC_SUCCESS
)
633 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
634 "Failed to initialize TPM context: %s", sym_Tss2_RC_Decode(rc
));
636 rc
= sym_Esys_Startup(context
->esys_context
, TPM2_SU_CLEAR
);
637 if (rc
== TPM2_RC_INITIALIZE
)
638 log_debug("TPM already started up.");
639 else if (rc
== TSS2_RC_SUCCESS
)
640 log_debug("TPM successfully started up.");
642 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
643 "Failed to start up TPM: %s", sym_Tss2_RC_Decode(rc
));
645 r
= tpm2_cache_capabilities(context
);
647 return log_debug_errno(r
, "Failed to cache TPM capbilities: %m");
649 /* We require AES and CFB support for session encryption. */
650 if (!tpm2_supports_alg(context
, TPM2_ALG_AES
))
651 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "TPM does not support AES.");
653 if (!tpm2_supports_alg(context
, TPM2_ALG_CFB
))
654 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "TPM does not support CFB.");
656 if (!tpm2_supports_tpmt_sym_def(context
, &SESSION_TEMPLATE_SYM_AES_128_CFB
))
657 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "TPM does not support AES-128-CFB.");
659 *ret_context
= TAKE_PTR(context
);
664 static void tpm2_handle_cleanup(ESYS_CONTEXT
*esys_context
, ESYS_TR esys_handle
, bool flush
) {
667 if (!esys_context
|| esys_handle
== ESYS_TR_NONE
)
670 /* Closing the handle removes its reference from the esys_context, but leaves the corresponding
671 * handle in the actual TPM. Flushing the handle removes its reference from the esys_context as well
672 * as removing its corresponding handle from the actual TPM. */
674 rc
= sym_Esys_FlushContext(esys_context
, esys_handle
);
676 rc
= sym_Esys_TR_Close(esys_context
, &esys_handle
);
677 if (rc
!= TSS2_RC_SUCCESS
) /* We ignore failures here (besides debug logging), since this is called
678 * in error paths, where we cannot do anything about failures anymore. And
679 * when it is called in successful codepaths by this time we already did
680 * what we wanted to do, and got the results we wanted so there's no
681 * reason to make this fail more loudly than necessary. */
682 log_debug("Failed to %s TPM handle, ignoring: %s", flush
? "flush" : "close", sym_Tss2_RC_Decode(rc
));
685 Tpm2Handle
*tpm2_handle_free(Tpm2Handle
*handle
) {
689 _cleanup_(tpm2_context_unrefp
) Tpm2Context
*context
= (Tpm2Context
*)handle
->tpm2_context
;
691 tpm2_handle_cleanup(context
->esys_context
, handle
->esys_handle
, handle
->flush
);
693 return mfree(handle
);
696 int tpm2_handle_new(Tpm2Context
*context
, Tpm2Handle
**ret_handle
) {
697 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
701 handle
= new(Tpm2Handle
, 1);
703 return log_oom_debug();
705 *handle
= (Tpm2Handle
) {
706 .tpm2_context
= tpm2_context_ref(context
),
707 .esys_handle
= ESYS_TR_NONE
,
711 *ret_handle
= TAKE_PTR(handle
);
716 /* Create a Tpm2Handle object that references a pre-existing handle in the TPM, at the handle index provided.
717 * This should be used only for persistent, transient, or NV handles; and the handle must already exist in
718 * the TPM at the specified handle index. The handle index should not be 0. Returns 1 if found, 0 if the
719 * index is empty, or < 0 on error. Also see tpm2_get_srk() below; the SRK is a commonly used persistent
721 int tpm2_index_to_handle(
724 const Tpm2Handle
*session
,
725 TPM2B_PUBLIC
**ret_public
,
726 TPM2B_NAME
**ret_name
,
727 TPM2B_NAME
**ret_qname
,
728 Tpm2Handle
**ret_handle
) {
735 /* Let's restrict this, at least for now, to allow only some handle types. */
736 switch (TPM2_HANDLE_TYPE(index
)) {
737 case TPM2_HT_PERSISTENT
:
738 case TPM2_HT_NV_INDEX
:
739 case TPM2_HT_TRANSIENT
:
742 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
743 "Invalid handle 0x%08" PRIx32
" (in PCR range).", index
);
744 case TPM2_HT_HMAC_SESSION
:
745 case TPM2_HT_POLICY_SESSION
:
746 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
747 "Invalid handle 0x%08" PRIx32
" (in session range).", index
);
748 case TPM2_HT_PERMANENT
: /* Permanent handles are defined, e.g. ESYS_TR_RH_OWNER. */
749 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
750 "Invalid handle 0x%08" PRIx32
" (in permanent range).", index
);
752 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
753 "Invalid handle 0x%08" PRIx32
" (in unknown range).", index
);
756 r
= tpm2_get_capability_handle(c
, index
);
760 log_debug("TPM handle 0x%08" PRIx32
" not populated.", index
);
772 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
773 r
= tpm2_handle_new(c
, &handle
);
777 /* Since we didn't create this handle in the TPM (this is only creating an ESYS_TR handle for the
778 * pre-existing TPM handle), we shouldn't flush (or evict) it on cleanup. */
779 handle
->flush
= false;
781 rc
= sym_Esys_TR_FromTPMPublic(
784 session
? session
->esys_handle
: ESYS_TR_NONE
,
787 &handle
->esys_handle
);
788 if (rc
!= TSS2_RC_SUCCESS
)
789 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
790 "Failed to read public info: %s", sym_Tss2_RC_Decode(rc
));
792 if (ret_public
|| ret_name
|| ret_qname
) {
793 r
= tpm2_read_public(c
, session
, handle
, ret_public
, ret_name
, ret_qname
);
799 *ret_handle
= TAKE_PTR(handle
);
804 /* Get the handle index for the provided Tpm2Handle. */
805 int tpm2_index_from_handle(Tpm2Context
*c
, const Tpm2Handle
*handle
, TPM2_HANDLE
*ret_index
) {
812 /* Esys_TR_GetTpmHandle was added to tpm2-tss in version 2.4.0. Once we can set a minimum tpm2-tss
813 * version of 2.4.0 this check can be removed. */
814 if (!sym_Esys_TR_GetTpmHandle
)
815 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
816 "libtss2-esys too old, does not include Esys_TR_GetTpmHandle.");
818 rc
= sym_Esys_TR_GetTpmHandle(c
->esys_context
, handle
->esys_handle
, ret_index
);
819 if (rc
!= TSS2_RC_SUCCESS
)
820 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
821 "Failed to get handle index: %s", sym_Tss2_RC_Decode(rc
));
826 /* Copy an object in the TPM at a transient handle to a persistent handle.
828 * The provided transient handle must exist in the TPM in the transient range. The persistent handle may be 0
829 * or any handle in the persistent range. If 0, this will try each handle in the persistent range, in
830 * ascending order, until an available one is found. If non-zero, only the requested persistent handle will
833 * Note that the persistent handle parameter is an handle index (i.e. number), while the transient handle is
834 * a Tpm2Handle object. The returned persistent handle will be a Tpm2Handle object that is located in the TPM
835 * at the requested persistent handle index (or the first available if none was requested).
837 * Returns 1 if the object was successfully persisted, or 0 if there is already a key at the requested
838 * handle, or < 0 on error. Theoretically, this would also return 0 if no specific persistent handle is
839 * requiested but all persistent handles are used, but it is extremely unlikely the TPM has enough internal
840 * memory to store the entire persistent range, in which case an error will be returned if the TPM is out of
841 * memory for persistent storage. The persistent handle is only provided when returning 1. */
842 static int tpm2_persist_handle(
844 const Tpm2Handle
*transient_handle
,
845 const Tpm2Handle
*session
,
846 TPMI_DH_PERSISTENT persistent_handle_index
,
847 Tpm2Handle
**ret_persistent_handle
) {
849 /* We don't use TPM2_PERSISTENT_FIRST and TPM2_PERSISTENT_LAST here due to:
850 * https://github.com/systemd/systemd/pull/27713#issuecomment-1591864753 */
851 TPMI_DH_PERSISTENT first
= UINT32_C(0x81000000), last
= UINT32_C(0x81ffffff);
856 assert(transient_handle
);
858 /* If persistent handle index specified, only try that. */
859 if (persistent_handle_index
!= 0) {
860 if (TPM2_HANDLE_TYPE(persistent_handle_index
) != TPM2_HT_PERSISTENT
)
861 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
862 "Handle not in persistent range: 0x%x", persistent_handle_index
);
864 first
= last
= persistent_handle_index
;
867 for (TPMI_DH_PERSISTENT requested
= first
; requested
<= last
; requested
++) {
868 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*persistent_handle
= NULL
;
869 r
= tpm2_handle_new(c
, &persistent_handle
);
873 /* Since this is a persistent handle, don't flush it. */
874 persistent_handle
->flush
= false;
876 rc
= sym_Esys_EvictControl(
879 transient_handle
->esys_handle
,
880 session
? session
->esys_handle
: ESYS_TR_PASSWORD
,
884 &persistent_handle
->esys_handle
);
885 if (rc
== TSS2_RC_SUCCESS
) {
886 if (ret_persistent_handle
)
887 *ret_persistent_handle
= TAKE_PTR(persistent_handle
);
891 if (rc
!= TPM2_RC_NV_DEFINED
)
892 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
893 "Failed to persist handle: %s", sym_Tss2_RC_Decode(rc
));
896 if (ret_persistent_handle
)
897 *ret_persistent_handle
= NULL
;
902 #define TPM2_CREDIT_RANDOM_FLAG_PATH "/run/systemd/tpm-rng-credited"
904 static int tpm2_credit_random(Tpm2Context
*c
) {
905 size_t rps
, done
= 0;
912 /* Pulls some entropy from the TPM and adds it into the kernel RNG pool. That way we can say that the
913 * key we will ultimately generate with the kernel random pool is at least as good as the TPM's RNG,
914 * but likely better. Note that we don't trust the TPM RNG very much, hence do not actually credit
917 if (access(TPM2_CREDIT_RANDOM_FLAG_PATH
, F_OK
) < 0) {
919 log_debug_errno(errno
, "Failed to detect if '" TPM2_CREDIT_RANDOM_FLAG_PATH
"' exists, ignoring: %m");
921 log_debug("Not adding TPM2 entropy to the kernel random pool again.");
922 return 0; /* Already done */
925 t
= now(CLOCK_MONOTONIC
);
927 for (rps
= random_pool_size(); rps
> 0;) {
928 _cleanup_(Esys_Freep
) TPM2B_DIGEST
*buffer
= NULL
;
930 rc
= sym_Esys_GetRandom(
935 MIN(rps
, 32U), /* 32 is supposedly a safe choice, given that AES 256bit keys are this long, and TPM2 baseline requires support for those. */
937 if (rc
!= TSS2_RC_SUCCESS
)
938 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
939 "Failed to acquire entropy from TPM: %s", sym_Tss2_RC_Decode(rc
));
941 if (buffer
->size
== 0)
942 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
943 "Zero-sized entropy returned from TPM.");
945 r
= random_write_entropy(-1, buffer
->buffer
, buffer
->size
, /* credit= */ false);
947 return log_debug_errno(r
, "Failed wo write entropy to kernel: %m");
949 done
+= buffer
->size
;
950 rps
= LESS_BY(rps
, buffer
->size
);
953 log_debug("Added %zu bytes of TPM2 entropy to the kernel random pool in %s.", done
, FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - t
, 0));
955 r
= touch(TPM2_CREDIT_RANDOM_FLAG_PATH
);
957 log_debug_errno(r
, "Failed to touch '" TPM2_CREDIT_RANDOM_FLAG_PATH
"', ignoring: %m");
962 int tpm2_read_public(
964 const Tpm2Handle
*session
,
965 const Tpm2Handle
*handle
,
966 TPM2B_PUBLIC
**ret_public
,
967 TPM2B_NAME
**ret_name
,
968 TPM2B_NAME
**ret_qname
) {
975 rc
= sym_Esys_ReadPublic(
978 session
? session
->esys_handle
: ESYS_TR_NONE
,
984 if (rc
!= TSS2_RC_SUCCESS
)
985 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
986 "Failed to read public info: %s", sym_Tss2_RC_Decode(rc
));
991 /* Get one of the legacy primary key templates.
993 * The legacy templates should only be used for older sealed data that did not use the SRK. Instead of a
994 * persistent SRK, a transient key was created to seal the data and then flushed; and the exact same template
995 * must be used to recreate the same transient key to unseal the data. The alg parameter must be TPM2_ALG_RSA
996 * or TPM2_ALG_ECC. This does not check if the alg is actually supported on this TPM. */
997 static int tpm2_get_legacy_template(TPMI_ALG_PUBLIC alg
, TPMT_PUBLIC
*ret_template
) {
999 static const TPMT_PUBLIC legacy_ecc
= {
1000 .type
= TPM2_ALG_ECC
,
1001 .nameAlg
= TPM2_ALG_SHA256
,
1002 .objectAttributes
= TPMA_OBJECT_RESTRICTED
|TPMA_OBJECT_DECRYPT
|TPMA_OBJECT_FIXEDTPM
|TPMA_OBJECT_FIXEDPARENT
|TPMA_OBJECT_SENSITIVEDATAORIGIN
|TPMA_OBJECT_USERWITHAUTH
,
1003 .parameters
.eccDetail
= {
1005 .algorithm
= TPM2_ALG_AES
,
1007 .mode
.aes
= TPM2_ALG_CFB
,
1009 .scheme
.scheme
= TPM2_ALG_NULL
,
1010 .curveID
= TPM2_ECC_NIST_P256
,
1011 .kdf
.scheme
= TPM2_ALG_NULL
,
1015 /* Do not modify. */
1016 static const TPMT_PUBLIC legacy_rsa
= {
1017 .type
= TPM2_ALG_RSA
,
1018 .nameAlg
= TPM2_ALG_SHA256
,
1019 .objectAttributes
= TPMA_OBJECT_RESTRICTED
|TPMA_OBJECT_DECRYPT
|TPMA_OBJECT_FIXEDTPM
|TPMA_OBJECT_FIXEDPARENT
|TPMA_OBJECT_SENSITIVEDATAORIGIN
|TPMA_OBJECT_USERWITHAUTH
,
1020 .parameters
.rsaDetail
= {
1022 .algorithm
= TPM2_ALG_AES
,
1024 .mode
.aes
= TPM2_ALG_CFB
,
1026 .scheme
.scheme
= TPM2_ALG_NULL
,
1031 assert(ret_template
);
1033 if (alg
== TPM2_ALG_ECC
)
1034 *ret_template
= legacy_ecc
;
1035 else if (alg
== TPM2_ALG_RSA
)
1036 *ret_template
= legacy_rsa
;
1038 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
1039 "Unsupported legacy SRK alg: 0x%x", alg
);
1044 /* Get a Storage Root Key (SRK) template.
1046 * The SRK template values are recommended by the "TCG TPM v2.0 Provisioning Guidance" document in section
1047 * 7.5.1 "Storage Primary Key (SRK) Templates", referencing "TCG EK Credential Profile for TPM Family 2.0".
1048 * The EK Credential Profile version 2.0 provides only a single template each for RSA and ECC, while later EK
1049 * Credential Profile versions provide more templates, and keep the original templates as "L-1" (for RSA) and
1052 * https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance
1053 * https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile
1055 * These templates are only needed to create a new persistent SRK (or a new transient key that is
1056 * SRK-compatible). Preferably, the TPM should contain a shared SRK located at the reserved shared SRK handle
1057 * (see TPM2_SRK_HANDLE and tpm2_get_srk() below).
1059 * The alg must be TPM2_ALG_RSA or TPM2_ALG_ECC. Returns error if the requested template is not supported on
1060 * this TPM. Also see tpm2_get_best_srk_template() below. */
1061 static int tpm2_get_srk_template(Tpm2Context
*c
, TPMI_ALG_PUBLIC alg
, TPMT_PUBLIC
*ret_template
) {
1062 /* The attributes are the same between ECC and RSA templates. This has the changes specified in the
1063 * Provisioning Guidance document, specifically:
1064 * TPMA_OBJECT_USERWITHAUTH is added.
1065 * TPMA_OBJECT_ADMINWITHPOLICY is removed.
1066 * TPMA_OBJECT_NODA is added. */
1067 TPMA_OBJECT srk_attributes
=
1068 TPMA_OBJECT_DECRYPT
|
1069 TPMA_OBJECT_FIXEDPARENT
|
1070 TPMA_OBJECT_FIXEDTPM
|
1072 TPMA_OBJECT_RESTRICTED
|
1073 TPMA_OBJECT_SENSITIVEDATAORIGIN
|
1074 TPMA_OBJECT_USERWITHAUTH
;
1076 /* The symmetric configuration is the same between ECC and RSA templates. */
1077 TPMT_SYM_DEF_OBJECT srk_symmetric
= {
1078 .algorithm
= TPM2_ALG_AES
,
1080 .mode
.aes
= TPM2_ALG_CFB
,
1083 /* Both templates have an empty authPolicy as specified by the Provisioning Guidance document. */
1085 /* From the EK Credential Profile template "L-2". */
1086 TPMT_PUBLIC srk_ecc
= {
1087 .type
= TPM2_ALG_ECC
,
1088 .nameAlg
= TPM2_ALG_SHA256
,
1089 .objectAttributes
= srk_attributes
,
1090 .parameters
.eccDetail
= {
1091 .symmetric
= srk_symmetric
,
1092 .scheme
.scheme
= TPM2_ALG_NULL
,
1093 .curveID
= TPM2_ECC_NIST_P256
,
1094 .kdf
.scheme
= TPM2_ALG_NULL
,
1098 /* From the EK Credential Profile template "L-1". */
1099 TPMT_PUBLIC srk_rsa
= {
1100 .type
= TPM2_ALG_RSA
,
1101 .nameAlg
= TPM2_ALG_SHA256
,
1102 .objectAttributes
= srk_attributes
,
1103 .parameters
.rsaDetail
= {
1104 .symmetric
= srk_symmetric
,
1105 .scheme
.scheme
= TPM2_ALG_NULL
,
1111 assert(ret_template
);
1113 if (alg
== TPM2_ALG_ECC
) {
1114 if (!tpm2_supports_alg(c
, TPM2_ALG_ECC
))
1115 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1116 "TPM does not support ECC.");
1118 if (!tpm2_supports_ecc_curve(c
, srk_ecc
.parameters
.eccDetail
.curveID
))
1119 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1120 "TPM does not support ECC-NIST-P256 curve.");
1122 if (!tpm2_supports_tpmt_public(c
, &srk_ecc
))
1123 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1124 "TPM does not support SRK ECC template L-2.");
1126 *ret_template
= srk_ecc
;
1130 if (alg
== TPM2_ALG_RSA
) {
1131 if (!tpm2_supports_alg(c
, TPM2_ALG_RSA
))
1132 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1133 "TPM does not support RSA.");
1135 if (!tpm2_supports_tpmt_public(c
, &srk_rsa
))
1136 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1137 "TPM does not support SRK RSA template L-1.");
1139 *ret_template
= srk_rsa
;
1143 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "Unsupported SRK alg: 0x%x.", alg
);
1146 /* Get the best supported SRK template. ECC is preferred, then RSA. */
1147 static int tpm2_get_best_srk_template(Tpm2Context
*c
, TPMT_PUBLIC
*ret_template
) {
1148 if (tpm2_get_srk_template(c
, TPM2_ALG_ECC
, ret_template
) >= 0 ||
1149 tpm2_get_srk_template(c
, TPM2_ALG_RSA
, ret_template
) >= 0)
1152 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
1153 "TPM does not support either SRK template L-1 (RSA) or L-2 (ECC).");
1156 /* The SRK handle is defined in the Provisioning Guidance document (see above) in the table "Reserved Handles
1157 * for TPM Provisioning Fundamental Elements". The SRK is useful because it is "shared", meaning it has no
1158 * authValue nor authPolicy set, and thus may be used by anyone on the system to generate derived keys or
1159 * seal secrets. This is useful if the TPM has an auth (password) set for the 'owner hierarchy', which would
1160 * prevent users from generating primary transient keys, unless they knew the owner hierarchy auth. See
1161 * the Provisioning Guidance document for more details. */
1162 #define TPM2_SRK_HANDLE UINT32_C(0x81000001)
1164 /* Get the SRK. Returns 1 if SRK is found, 0 if there is no SRK, or < 0 on error. Also see
1165 * tpm2_get_or_create_srk() below. */
1166 static int tpm2_get_srk(
1168 const Tpm2Handle
*session
,
1169 TPM2B_PUBLIC
**ret_public
,
1170 TPM2B_NAME
**ret_name
,
1171 TPM2B_NAME
**ret_qname
,
1172 Tpm2Handle
**ret_handle
) {
1174 return tpm2_index_to_handle(c
, TPM2_SRK_HANDLE
, session
, ret_public
, ret_name
, ret_qname
, ret_handle
);
1177 /* Get the SRK, creating one if needed. Returns 1 if a new SRK was created and persisted, 0 if an SRK already
1178 * exists, or < 0 on error. */
1179 int tpm2_get_or_create_srk(
1181 const Tpm2Handle
*session
,
1182 TPM2B_PUBLIC
**ret_public
,
1183 TPM2B_NAME
**ret_name
,
1184 TPM2B_NAME
**ret_qname
,
1185 Tpm2Handle
**ret_handle
) {
1189 r
= tpm2_get_srk(c
, session
, ret_public
, ret_name
, ret_qname
, ret_handle
);
1193 return 0; /* 0 → SRK already set up */
1195 /* No SRK, create and persist one */
1196 TPM2B_PUBLIC
template = { .size
= sizeof(TPMT_PUBLIC
), };
1197 r
= tpm2_get_best_srk_template(c
, &template.publicArea
);
1199 return log_debug_errno(r
, "Could not get best SRK template: %m");
1201 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*transient_handle
= NULL
;
1202 r
= tpm2_create_primary(
1206 /* sensitive= */ NULL
,
1207 /* ret_public= */ NULL
,
1212 /* Try to persist the transient SRK we created. No locking needed; if multiple threads are trying to
1213 * persist SRKs concurrently, only one will succeed (r == 1) while the rest will fail (r == 0). In
1214 * either case, all threads will get the persistent SRK below. */
1215 r
= tpm2_persist_handle(c
, transient_handle
, session
, TPM2_SRK_HANDLE
, /* ret_persistent_handle= */ NULL
);
1219 /* The SRK should exist now. */
1220 r
= tpm2_get_srk(c
, session
, ret_public
, ret_name
, ret_qname
, ret_handle
);
1224 /* This should never happen. */
1225 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "SRK we just persisted couldn't be found.");
1227 return 1; /* > 0 → SRK newly set up */
1230 /* Utility functions for TPMS_PCR_SELECTION. */
1232 /* Convert a TPMS_PCR_SELECTION object to a mask. */
1233 uint32_t tpm2_tpms_pcr_selection_to_mask(const TPMS_PCR_SELECTION
*s
) {
1235 assert(s
->sizeofSelect
<= sizeof(s
->pcrSelect
));
1238 for (unsigned i
= 0; i
< s
->sizeofSelect
; i
++)
1239 SET_FLAG(mask
, (uint32_t)s
->pcrSelect
[i
] << (i
* 8), true);
1243 /* Convert a mask and hash alg to a TPMS_PCR_SELECTION object. */
1244 void tpm2_tpms_pcr_selection_from_mask(uint32_t mask
, TPMI_ALG_HASH hash_alg
, TPMS_PCR_SELECTION
*ret
) {
1247 /* This is currently hardcoded at 24 PCRs, above. */
1248 if (!TPM2_PCR_MASK_VALID(mask
))
1249 log_debug("PCR mask selections (%x) out of range, ignoring.",
1250 mask
& ~((uint32_t)TPM2_PCRS_MASK
));
1252 *ret
= (TPMS_PCR_SELECTION
){
1254 .sizeofSelect
= TPM2_PCRS_MAX
/ 8,
1255 .pcrSelect
[0] = mask
& 0xff,
1256 .pcrSelect
[1] = (mask
>> 8) & 0xff,
1257 .pcrSelect
[2] = (mask
>> 16) & 0xff,
1261 /* Test if all bits in the mask are set in the TPMS_PCR_SELECTION. */
1262 bool tpm2_tpms_pcr_selection_has_mask(const TPMS_PCR_SELECTION
*s
, uint32_t mask
) {
1265 return FLAGS_SET(tpm2_tpms_pcr_selection_to_mask(s
), mask
);
1268 static void tpm2_tpms_pcr_selection_update_mask(TPMS_PCR_SELECTION
*s
, uint32_t mask
, bool b
) {
1271 tpm2_tpms_pcr_selection_from_mask(UPDATE_FLAG(tpm2_tpms_pcr_selection_to_mask(s
), mask
, b
), s
->hash
, s
);
1274 /* Add all PCR selections in the mask. */
1275 void tpm2_tpms_pcr_selection_add_mask(TPMS_PCR_SELECTION
*s
, uint32_t mask
) {
1276 tpm2_tpms_pcr_selection_update_mask(s
, mask
, 1);
1279 /* Remove all PCR selections in the mask. */
1280 void tpm2_tpms_pcr_selection_sub_mask(TPMS_PCR_SELECTION
*s
, uint32_t mask
) {
1281 tpm2_tpms_pcr_selection_update_mask(s
, mask
, 0);
1284 /* Add all PCR selections in 'b' to 'a'. Both must have the same hash alg. */
1285 void tpm2_tpms_pcr_selection_add(TPMS_PCR_SELECTION
*a
, const TPMS_PCR_SELECTION
*b
) {
1288 assert(a
->hash
== b
->hash
);
1290 tpm2_tpms_pcr_selection_add_mask(a
, tpm2_tpms_pcr_selection_to_mask(b
));
1293 /* Remove all PCR selections in 'b' from 'a'. Both must have the same hash alg. */
1294 void tpm2_tpms_pcr_selection_sub(TPMS_PCR_SELECTION
*a
, const TPMS_PCR_SELECTION
*b
) {
1297 assert(a
->hash
== b
->hash
);
1299 tpm2_tpms_pcr_selection_sub_mask(a
, tpm2_tpms_pcr_selection_to_mask(b
));
1302 /* Move all PCR selections in 'b' to 'a'. Both must have the same hash alg. */
1303 void tpm2_tpms_pcr_selection_move(TPMS_PCR_SELECTION
*a
, TPMS_PCR_SELECTION
*b
) {
1307 tpm2_tpms_pcr_selection_add(a
, b
);
1308 tpm2_tpms_pcr_selection_from_mask(0, b
->hash
, b
);
1311 #define FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml) \
1312 _FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml, UNIQ_T(l, UNIQ))
1313 #define _FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml, l) \
1314 for (typeof(tpml) (l) = (tpml); (l); (l) = NULL) \
1315 FOREACH_ARRAY(tpms, (l)->pcrSelections, (l)->count)
1317 #define FOREACH_PCR_IN_TPMS_PCR_SELECTION(pcr, tpms) \
1318 FOREACH_PCR_IN_MASK(pcr, tpm2_tpms_pcr_selection_to_mask(tpms))
1320 #define FOREACH_PCR_IN_TPML_PCR_SELECTION(pcr, tpms, tpml) \
1321 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml) \
1322 FOREACH_PCR_IN_TPMS_PCR_SELECTION(pcr, tpms)
1324 char *tpm2_tpms_pcr_selection_to_string(const TPMS_PCR_SELECTION
*s
) {
1327 const char *algstr
= strna(tpm2_hash_alg_to_string(s
->hash
));
1329 _cleanup_free_
char *mask
= tpm2_pcr_mask_to_string(tpm2_tpms_pcr_selection_to_mask(s
));
1333 return strjoin(algstr
, "(", mask
, ")");
1336 size_t tpm2_tpms_pcr_selection_weight(const TPMS_PCR_SELECTION
*s
) {
1339 return popcount(tpm2_tpms_pcr_selection_to_mask(s
));
1342 /* Utility functions for TPML_PCR_SELECTION. */
1344 /* Remove the (0-based) index entry from 'l', shift all following entries, and update the count. */
1345 static void tpm2_tpml_pcr_selection_remove_index(TPML_PCR_SELECTION
*l
, uint32_t index
) {
1347 assert(l
->count
<= ELEMENTSOF(l
->pcrSelections
));
1348 assert(index
< l
->count
);
1350 size_t s
= l
->count
- (index
+ 1);
1351 memmove(&l
->pcrSelections
[index
], &l
->pcrSelections
[index
+ 1], s
* sizeof(l
->pcrSelections
[0]));
1355 /* Get a TPMS_PCR_SELECTION from a TPML_PCR_SELECTION for the given hash alg. Returns NULL if there is no
1356 * entry for the hash alg. This guarantees the returned entry contains all the PCR selections for the given
1357 * hash alg, which may require modifying the TPML_PCR_SELECTION by removing duplicate entries. */
1358 static TPMS_PCR_SELECTION
*tpm2_tpml_pcr_selection_get_tpms_pcr_selection(
1359 TPML_PCR_SELECTION
*l
,
1360 TPMI_ALG_HASH hash_alg
) {
1363 assert(l
->count
<= ELEMENTSOF(l
->pcrSelections
));
1365 TPMS_PCR_SELECTION
*selection
= NULL
;
1366 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s
, l
)
1367 if (s
->hash
== hash_alg
) {
1375 /* Iterate backwards through the entries, removing any other entries for the hash alg. */
1376 for (uint32_t i
= l
->count
- 1; i
> 0; i
--) {
1377 TPMS_PCR_SELECTION
*s
= &l
->pcrSelections
[i
];
1382 if (s
->hash
== hash_alg
) {
1383 tpm2_tpms_pcr_selection_move(selection
, s
);
1384 tpm2_tpml_pcr_selection_remove_index(l
, i
);
1391 /* Combine all duplicate (same hash alg) TPMS_PCR_SELECTION entries in 'l'. */
1392 static void tpm2_tpml_pcr_selection_cleanup(TPML_PCR_SELECTION
*l
) {
1393 /* Can't use FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION() because we might modify l->count */
1394 for (uint32_t i
= 0; i
< l
->count
; i
++)
1395 /* This removes all duplicate TPMS_PCR_SELECTION entries for this hash. */
1396 (void) tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l
, l
->pcrSelections
[i
].hash
);
1399 /* Convert a TPML_PCR_SELECTION object to a mask. Returns empty mask (i.e. 0) if 'hash_alg' is not in the object. */
1400 uint32_t tpm2_tpml_pcr_selection_to_mask(const TPML_PCR_SELECTION
*l
, TPMI_ALG_HASH hash_alg
) {
1403 /* Make a copy, as tpm2_tpml_pcr_selection_get_tpms_pcr_selection() will modify the object if there
1404 * are multiple entries with the requested hash alg. */
1405 TPML_PCR_SELECTION lcopy
= *l
;
1407 TPMS_PCR_SELECTION
*s
;
1408 s
= tpm2_tpml_pcr_selection_get_tpms_pcr_selection(&lcopy
, hash_alg
);
1412 return tpm2_tpms_pcr_selection_to_mask(s
);
1415 /* Convert a mask and hash alg to a TPML_PCR_SELECTION object. */
1416 void tpm2_tpml_pcr_selection_from_mask(uint32_t mask
, TPMI_ALG_HASH hash_alg
, TPML_PCR_SELECTION
*ret
) {
1419 TPMS_PCR_SELECTION s
;
1420 tpm2_tpms_pcr_selection_from_mask(mask
, hash_alg
, &s
);
1422 *ret
= (TPML_PCR_SELECTION
){
1424 .pcrSelections
[0] = s
,
1428 /* Add the PCR selections in 's' to the corresponding hash alg TPMS_PCR_SELECTION entry in 'l'. Adds a new
1429 * TPMS_PCR_SELECTION entry for the hash alg if needed. This may modify the TPML_PCR_SELECTION by combining
1430 * entries with the same hash alg. */
1431 void tpm2_tpml_pcr_selection_add_tpms_pcr_selection(TPML_PCR_SELECTION
*l
, const TPMS_PCR_SELECTION
*s
) {
1435 if (tpm2_tpms_pcr_selection_is_empty(s
))
1438 TPMS_PCR_SELECTION
*selection
= tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l
, s
->hash
);
1440 tpm2_tpms_pcr_selection_add(selection
, s
);
1444 /* It's already broken if the count is higher than the array has size for. */
1445 assert(l
->count
<= ELEMENTSOF(l
->pcrSelections
));
1447 /* If full, the cleanup should result in at least one available entry. */
1448 if (l
->count
== ELEMENTSOF(l
->pcrSelections
))
1449 tpm2_tpml_pcr_selection_cleanup(l
);
1451 assert(l
->count
< ELEMENTSOF(l
->pcrSelections
));
1452 l
->pcrSelections
[l
->count
++] = *s
;
1455 /* Remove the PCR selections in 's' from the corresponding hash alg TPMS_PCR_SELECTION entry in 'l'. This
1456 * will combine all entries for 's->hash' in 'l'. */
1457 void tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(TPML_PCR_SELECTION
*l
, const TPMS_PCR_SELECTION
*s
) {
1461 if (tpm2_tpms_pcr_selection_is_empty(s
))
1464 TPMS_PCR_SELECTION
*selection
= tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l
, s
->hash
);
1466 tpm2_tpms_pcr_selection_sub(selection
, s
);
1469 /* Test if all bits in the mask for the hash are set in the TPML_PCR_SELECTION. */
1470 bool tpm2_tpml_pcr_selection_has_mask(const TPML_PCR_SELECTION
*l
, TPMI_ALG_HASH hash
, uint32_t mask
) {
1473 return FLAGS_SET(tpm2_tpml_pcr_selection_to_mask(l
, hash
), mask
);
1476 /* Add the PCR selections in the mask, with the provided hash. */
1477 void tpm2_tpml_pcr_selection_add_mask(TPML_PCR_SELECTION
*l
, TPMI_ALG_HASH hash
, uint32_t mask
) {
1478 TPMS_PCR_SELECTION tpms
;
1482 tpm2_tpms_pcr_selection_from_mask(mask
, hash
, &tpms
);
1483 tpm2_tpml_pcr_selection_add_tpms_pcr_selection(l
, &tpms
);
1486 /* Remove the PCR selections in the mask, with the provided hash. */
1487 void tpm2_tpml_pcr_selection_sub_mask(TPML_PCR_SELECTION
*l
, TPMI_ALG_HASH hash
, uint32_t mask
) {
1488 TPMS_PCR_SELECTION tpms
;
1492 tpm2_tpms_pcr_selection_from_mask(mask
, hash
, &tpms
);
1493 tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(l
, &tpms
);
1496 /* Add all PCR selections in 'b' to 'a'. */
1497 void tpm2_tpml_pcr_selection_add(TPML_PCR_SELECTION
*a
, const TPML_PCR_SELECTION
*b
) {
1501 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection_b
, b
)
1502 tpm2_tpml_pcr_selection_add_tpms_pcr_selection(a
, selection_b
);
1505 /* Remove all PCR selections in 'b' from 'a'. */
1506 void tpm2_tpml_pcr_selection_sub(TPML_PCR_SELECTION
*a
, const TPML_PCR_SELECTION
*b
) {
1510 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection_b
, b
)
1511 tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(a
, selection_b
);
1514 char *tpm2_tpml_pcr_selection_to_string(const TPML_PCR_SELECTION
*l
) {
1517 _cleanup_free_
char *banks
= NULL
;
1518 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s
, l
) {
1519 if (tpm2_tpms_pcr_selection_is_empty(s
))
1522 _cleanup_free_
char *str
= tpm2_tpms_pcr_selection_to_string(s
);
1523 if (!str
|| !strextend_with_separator(&banks
, ",", str
))
1527 return strjoin("[", strempty(banks
), "]");
1530 size_t tpm2_tpml_pcr_selection_weight(const TPML_PCR_SELECTION
*l
) {
1532 assert(l
->count
<= ELEMENTSOF(l
->pcrSelections
));
1535 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s
, l
) {
1536 size_t w
= tpm2_tpms_pcr_selection_weight(s
);
1537 assert(weight
<= SIZE_MAX
- w
);
1544 bool tpm2_pcr_value_valid(const Tpm2PCRValue
*pcr_value
) {
1550 if (!TPM2_PCR_INDEX_VALID(pcr_value
->index
)) {
1551 log_debug("PCR index %u invalid.", pcr_value
->index
);
1555 /* If it contains a value, the value size must match the hash size. */
1556 if (pcr_value
->value
.size
> 0) {
1557 r
= tpm2_hash_alg_to_size(pcr_value
->hash
);
1561 if (pcr_value
->value
.size
!= (size_t) r
) {
1562 log_debug("PCR hash 0x%" PRIx16
" expected size %d does not match actual size %" PRIu16
".",
1563 pcr_value
->hash
, r
, pcr_value
->value
.size
);
1571 /* Verify all entries are valid, and consistent with each other. The requirements for consistency are:
1573 * 1) all entries must be sorted in ascending order (e.g. using tpm2_sort_pcr_values())
1574 * 2) all entries must be unique, i.e. there cannot be 2 entries with the same hash and index
1576 * Returns true if all entries are valid (or if no entries are provided), false otherwise.
1578 bool tpm2_pcr_values_valid(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
1579 if (!pcr_values
&& n_pcr_values
> 0)
1582 const Tpm2PCRValue
*previous
= NULL
;
1583 FOREACH_ARRAY(current
, pcr_values
, n_pcr_values
) {
1584 if (!tpm2_pcr_value_valid(current
))
1592 /* Hashes must be sorted in ascending order */
1593 if (current
->hash
< previous
->hash
) {
1594 log_debug("PCR values not in ascending order, hash %" PRIu16
" is after %" PRIu16
".",
1595 current
->hash
, previous
->hash
);
1599 if (current
->hash
== previous
->hash
) {
1600 /* Indexes (for the same hash) must be sorted in ascending order */
1601 if (current
->index
< previous
->index
) {
1602 log_debug("PCR values not in ascending order, hash %" PRIu16
" index %u is after %u.",
1603 current
->hash
, current
->index
, previous
->index
);
1607 /* Indexes (for the same hash) must not be duplicates */
1608 if (current
->index
== previous
->index
) {
1609 log_debug("PCR values contain duplicates for hash %" PRIu16
" index %u.",
1610 current
->hash
, previous
->index
);
1619 /* Returns true if any of the provided PCR values has an actual hash value included, false otherwise. */
1620 bool tpm2_pcr_values_has_any_values(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
1621 assert(pcr_values
|| n_pcr_values
== 0);
1623 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
1624 if (v
->value
.size
> 0)
1630 /* Returns true if all of the provided PCR values has an actual hash value included, false otherwise. */
1631 bool tpm2_pcr_values_has_all_values(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
1632 assert(pcr_values
|| n_pcr_values
== 0);
1634 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
1635 if (v
->value
.size
== 0)
1641 static int cmp_pcr_values(const Tpm2PCRValue
*a
, const Tpm2PCRValue
*b
) {
1645 return CMP(a
->hash
, b
->hash
) ?: CMP(a
->index
, b
->index
);
1648 /* Sort the array of Tpm2PCRValue entries in-place. This sorts first in ascending order of hash algorithm
1649 * (sorting simply by the TPM2 hash algorithm number), and then sorting by pcr index. */
1650 void tpm2_sort_pcr_values(Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
1651 typesafe_qsort(pcr_values
, n_pcr_values
, cmp_pcr_values
);
1654 int tpm2_pcr_values_from_mask(uint32_t mask
, TPMI_ALG_HASH hash
, Tpm2PCRValue
**ret_pcr_values
, size_t *ret_n_pcr_values
) {
1655 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
1656 size_t n_pcr_values
= 0;
1658 assert(ret_pcr_values
);
1659 assert(ret_n_pcr_values
);
1661 FOREACH_PCR_IN_MASK(index
, mask
)
1662 if (!GREEDY_REALLOC_APPEND(
1665 &TPM2_PCR_VALUE_MAKE(index
, hash
, {}),
1667 return log_oom_debug();
1669 *ret_pcr_values
= TAKE_PTR(pcr_values
);
1670 *ret_n_pcr_values
= n_pcr_values
;
1675 int tpm2_pcr_values_to_mask(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
, TPMI_ALG_HASH hash
, uint32_t *ret_mask
) {
1678 assert(pcr_values
|| n_pcr_values
== 0);
1681 if (!tpm2_pcr_values_valid(pcr_values
, n_pcr_values
))
1682 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Invalid PCR values.");
1684 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
1685 if (v
->hash
== hash
)
1686 SET_BIT(mask
, v
->index
);
1693 int tpm2_tpml_pcr_selection_from_pcr_values(
1694 const Tpm2PCRValue
*pcr_values
,
1695 size_t n_pcr_values
,
1696 TPML_PCR_SELECTION
*ret_selection
,
1697 TPM2B_DIGEST
**ret_values
,
1698 size_t *ret_n_values
) {
1700 TPML_PCR_SELECTION selection
= {};
1701 _cleanup_free_ TPM2B_DIGEST
*values
= NULL
;
1702 size_t n_values
= 0;
1704 assert(pcr_values
|| n_pcr_values
== 0);
1706 if (!tpm2_pcr_values_valid(pcr_values
, n_pcr_values
))
1707 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "PCR values are not valid.");
1709 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
) {
1710 tpm2_tpml_pcr_selection_add_mask(&selection
, v
->hash
, INDEX_TO_MASK(uint32_t, v
->index
));
1712 if (!GREEDY_REALLOC_APPEND(values
, n_values
, &v
->value
, 1))
1713 return log_oom_debug();
1717 *ret_selection
= selection
;
1719 *ret_values
= TAKE_PTR(values
);
1721 *ret_n_values
= n_values
;
1726 /* Count the number of different hash algorithms for all the entries. */
1727 int tpm2_pcr_values_hash_count(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
, size_t *ret_count
) {
1728 TPML_PCR_SELECTION selection
;
1734 r
= tpm2_tpml_pcr_selection_from_pcr_values(
1738 /* ret_values= */ NULL
,
1739 /* ret_n_values= */ NULL
);
1743 *ret_count
= selection
.count
;
1748 /* Parse a string argument into a Tpm2PCRValue object.
1750 * The format is <index>[:hash[=value]] where index is the index number (or name) of the PCR, e.g. 0 (or
1751 * platform-code), hash is the name of the hash algorithm (e.g. sha256) and value is the hex hash digest
1752 * value, optionally with a leading 0x. This does not check for validity of the fields. */
1753 int tpm2_pcr_value_from_string(const char *arg
, Tpm2PCRValue
*ret_pcr_value
) {
1754 Tpm2PCRValue pcr_value
= {};
1755 const char *p
= arg
;
1759 assert(ret_pcr_value
);
1761 _cleanup_free_
char *index
= NULL
;
1762 r
= extract_first_word(&p
, &index
, ":", /* flags= */ 0);
1764 return log_debug_errno(r
, "Could not parse pcr value '%s': %m", p
);
1766 r
= tpm2_pcr_index_from_string(index
);
1768 return log_debug_errno(r
, "Invalid pcr index '%s': %m", index
);
1769 pcr_value
.index
= (unsigned) r
;
1772 _cleanup_free_
char *hash
= NULL
;
1773 r
= extract_first_word(&p
, &hash
, "=", /* flags= */ 0);
1775 return log_debug_errno(r
, "Could not parse pcr hash algorithm '%s': %m", p
);
1777 r
= tpm2_hash_alg_from_string(hash
);
1779 return log_debug_errno(r
, "Invalid pcr hash algorithm '%s': %m", hash
);
1780 pcr_value
.hash
= (TPMI_ALG_HASH
) r
;
1783 /* Remove leading 0x if present */
1784 p
= startswith_no_case(p
, "0x") ?: p
;
1786 _cleanup_free_
void *buf
= NULL
;
1787 size_t buf_size
= 0;
1788 r
= unhexmem(p
, SIZE_MAX
, &buf
, &buf_size
);
1790 return log_debug_errno(r
, "Invalid pcr hash value '%s': %m", p
);
1792 r
= TPM2B_DIGEST_CHECK_SIZE(buf_size
);
1794 return log_debug_errno(r
, "PCR hash value size %zu too large.", buf_size
);
1796 pcr_value
.value
= TPM2B_DIGEST_MAKE(buf
, buf_size
);
1800 *ret_pcr_value
= pcr_value
;
1805 /* Return a string for the PCR value. The format is described in tpm2_pcr_value_from_string(). Note that if
1806 * the hash algorithm is not recognized, neither hash name nor hash digest value is included in the
1807 * string. This does not check for validity. */
1808 char *tpm2_pcr_value_to_string(const Tpm2PCRValue
*pcr_value
) {
1809 _cleanup_free_
char *index
= NULL
, *value
= NULL
;
1811 if (asprintf(&index
, "%u", pcr_value
->index
) < 0)
1814 const char *hash
= pcr_value
->hash
> 0 ? tpm2_hash_alg_to_string(pcr_value
->hash
) : NULL
;
1816 if (hash
&& pcr_value
->value
.size
> 0) {
1817 value
= hexmem(pcr_value
->value
.buffer
, pcr_value
->value
.size
);
1822 return strjoin(index
, hash
? ":" : "", strempty(hash
), value
? "=" : "", strempty(value
));
1825 /* Parse a string argument into an array of Tpm2PCRValue objects.
1827 * The format is zero or more entries separated by ',' or '+'. The format of each entry is described in
1828 * tpm2_pcr_value_from_string(). This does not check for validity of the entries. */
1829 int tpm2_pcr_values_from_string(const char *arg
, Tpm2PCRValue
**ret_pcr_values
, size_t *ret_n_pcr_values
) {
1830 const char *p
= arg
;
1834 assert(ret_pcr_values
);
1835 assert(ret_n_pcr_values
);
1837 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
1838 size_t n_pcr_values
= 0;
1841 _cleanup_free_
char *pcr_arg
= NULL
;
1842 r
= extract_first_word(&p
, &pcr_arg
, ",+", /* flags= */ 0);
1844 return log_debug_errno(r
, "Could not parse pcr values '%s': %m", p
);
1848 Tpm2PCRValue pcr_value
;
1849 r
= tpm2_pcr_value_from_string(pcr_arg
, &pcr_value
);
1853 if (!GREEDY_REALLOC_APPEND(pcr_values
, n_pcr_values
, &pcr_value
, 1))
1854 return log_oom_debug();
1857 *ret_pcr_values
= TAKE_PTR(pcr_values
);
1858 *ret_n_pcr_values
= n_pcr_values
;
1863 /* Return a string representing the array of PCR values. The format is as described in
1864 * tpm2_pcr_values_from_string(). This does not check for validity. */
1865 char *tpm2_pcr_values_to_string(const Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
1866 _cleanup_free_
char *s
= NULL
;
1868 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
) {
1869 _cleanup_free_
char *pcrstr
= tpm2_pcr_value_to_string(v
);
1870 if (!pcrstr
|| !strextend_with_separator(&s
, "+", pcrstr
))
1874 return s
? TAKE_PTR(s
) : strdup("");
1877 void tpm2_log_debug_tpml_pcr_selection(const TPML_PCR_SELECTION
*l
, const char *msg
) {
1878 if (!DEBUG_LOGGING
|| !l
)
1881 _cleanup_free_
char *s
= tpm2_tpml_pcr_selection_to_string(l
);
1882 log_debug("%s: %s", msg
?: "PCR selection", strna(s
));
1885 void tpm2_log_debug_pcr_value(const Tpm2PCRValue
*pcr_value
, const char *msg
) {
1886 if (!DEBUG_LOGGING
|| !pcr_value
)
1889 _cleanup_free_
char *s
= tpm2_pcr_value_to_string(pcr_value
);
1890 log_debug("%s: %s", msg
?: "PCR value", strna(s
));
1893 void tpm2_log_debug_buffer(const void *buffer
, size_t size
, const char *msg
) {
1894 if (!DEBUG_LOGGING
|| !buffer
|| size
== 0)
1897 _cleanup_free_
char *h
= hexmem(buffer
, size
);
1898 log_debug("%s: %s", msg
?: "Buffer", strna(h
));
1901 void tpm2_log_debug_digest(const TPM2B_DIGEST
*digest
, const char *msg
) {
1903 tpm2_log_debug_buffer(digest
->buffer
, digest
->size
, msg
?: "Digest");
1906 void tpm2_log_debug_name(const TPM2B_NAME
*name
, const char *msg
) {
1908 tpm2_log_debug_buffer(name
->name
, name
->size
, msg
?: "Name");
1911 static int tpm2_get_policy_digest(
1913 const Tpm2Handle
*session
,
1914 TPM2B_DIGEST
**ret_policy_digest
) {
1918 if (!DEBUG_LOGGING
&& !ret_policy_digest
)
1924 log_debug("Acquiring policy digest.");
1926 _cleanup_(Esys_Freep
) TPM2B_DIGEST
*policy_digest
= NULL
;
1927 rc
= sym_Esys_PolicyGetDigest(
1929 session
->esys_handle
,
1934 if (rc
!= TSS2_RC_SUCCESS
)
1935 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1936 "Failed to get policy digest from TPM: %s", sym_Tss2_RC_Decode(rc
));
1938 tpm2_log_debug_digest(policy_digest
, "Session policy digest");
1940 if (ret_policy_digest
)
1941 *ret_policy_digest
= TAKE_PTR(policy_digest
);
1946 int tpm2_create_primary(
1948 const Tpm2Handle
*session
,
1949 const TPM2B_PUBLIC
*template,
1950 const TPM2B_SENSITIVE_CREATE
*sensitive
,
1951 TPM2B_PUBLIC
**ret_public
,
1952 Tpm2Handle
**ret_handle
) {
1961 log_debug("Creating primary key on TPM.");
1963 ts
= now(CLOCK_MONOTONIC
);
1965 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
1966 r
= tpm2_handle_new(c
, &handle
);
1970 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*public = NULL
;
1971 rc
= sym_Esys_CreatePrimary(
1974 session
? session
->esys_handle
: ESYS_TR_PASSWORD
,
1977 sensitive
? sensitive
: &(TPM2B_SENSITIVE_CREATE
) {},
1979 /* outsideInfo= */ NULL
,
1980 &(TPML_PCR_SELECTION
) {},
1981 &handle
->esys_handle
,
1983 /* creationData= */ NULL
,
1984 /* creationHash= */ NULL
,
1985 /* creationTicket= */ NULL
);
1986 if (rc
!= TSS2_RC_SUCCESS
)
1987 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
1988 "Failed to generate primary key in TPM: %s",
1989 sym_Tss2_RC_Decode(rc
));
1991 log_debug("Successfully created primary key on TPM in %s.",
1992 FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - ts
, USEC_PER_MSEC
));
1995 *ret_public
= TAKE_PTR(public);
1997 *ret_handle
= TAKE_PTR(handle
);
2002 /* Create a TPM object. Do not use this to create primary keys, because some HW TPMs refuse to allow that;
2003 * instead use tpm2_create_primary(). */
2004 int tpm2_create(Tpm2Context
*c
,
2005 const Tpm2Handle
*parent
,
2006 const Tpm2Handle
*session
,
2007 const TPMT_PUBLIC
*template,
2008 const TPMS_SENSITIVE_CREATE
*sensitive
,
2009 TPM2B_PUBLIC
**ret_public
,
2010 TPM2B_PRIVATE
**ret_private
) {
2019 log_debug("Creating object on TPM.");
2021 ts
= now(CLOCK_MONOTONIC
);
2023 TPM2B_PUBLIC tpm2b_public
= {
2024 .size
= sizeof(*template) - sizeof(template->unique
),
2025 .publicArea
= *template,
2028 /* Zero the unique area. */
2029 zero(tpm2b_public
.publicArea
.unique
);
2031 TPM2B_SENSITIVE_CREATE tpm2b_sensitive
;
2033 tpm2b_sensitive
= (TPM2B_SENSITIVE_CREATE
) {
2034 .size
= sizeof(*sensitive
),
2035 .sensitive
= *sensitive
,
2038 tpm2b_sensitive
= (TPM2B_SENSITIVE_CREATE
) {};
2040 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*public = NULL
;
2041 _cleanup_(Esys_Freep
) TPM2B_PRIVATE
*private = NULL
;
2042 rc
= sym_Esys_Create(
2044 parent
->esys_handle
,
2045 session
? session
->esys_handle
: ESYS_TR_PASSWORD
,
2050 /* outsideInfo= */ NULL
,
2051 &(TPML_PCR_SELECTION
) {},
2054 /* creationData= */ NULL
,
2055 /* creationHash= */ NULL
,
2056 /* creationTicket= */ NULL
);
2057 if (rc
!= TSS2_RC_SUCCESS
)
2058 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2059 "Failed to generate object in TPM: %s",
2060 sym_Tss2_RC_Decode(rc
));
2062 log_debug("Successfully created object on TPM in %s.",
2063 FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - ts
, USEC_PER_MSEC
));
2066 *ret_public
= TAKE_PTR(public);
2068 *ret_private
= TAKE_PTR(private);
2073 static int tpm2_load(
2075 const Tpm2Handle
*parent
,
2076 const Tpm2Handle
*session
,
2077 const TPM2B_PUBLIC
*public,
2078 const TPM2B_PRIVATE
*private,
2079 Tpm2Handle
**ret_handle
) {
2089 log_debug("Loading object into TPM.");
2091 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
2092 r
= tpm2_handle_new(c
, &handle
);
2098 parent
? parent
->esys_handle
: ESYS_TR_RH_OWNER
,
2099 session
? session
->esys_handle
: ESYS_TR_PASSWORD
,
2104 &handle
->esys_handle
);
2105 if (rc
== TPM2_RC_LOCKOUT
)
2106 return log_debug_errno(SYNTHETIC_ERRNO(ENOLCK
),
2107 "TPM2 device is in dictionary attack lockout mode.");
2108 if (rc
!= TSS2_RC_SUCCESS
)
2109 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2110 "Failed to load key into TPM: %s", sym_Tss2_RC_Decode(rc
));
2112 *ret_handle
= TAKE_PTR(handle
);
2117 static int tpm2_load_external(
2119 const Tpm2Handle
*session
,
2120 const TPM2B_PUBLIC
*public,
2121 const TPM2B_SENSITIVE
*private,
2122 Tpm2Handle
**ret_handle
) {
2130 log_debug("Loading external key into TPM.");
2132 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
2133 r
= tpm2_handle_new(c
, &handle
);
2137 rc
= sym_Esys_LoadExternal(
2139 session
? session
->esys_handle
: ESYS_TR_NONE
,
2145 /* tpm2-tss >= 3.0.0 requires a ESYS_TR_RH_* constant specifying the requested
2146 * hierarchy, older versions need TPM2_RH_* instead. */
2151 &handle
->esys_handle
);
2152 if (rc
!= TSS2_RC_SUCCESS
)
2153 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2154 "Failed to load public key into TPM: %s", sym_Tss2_RC_Decode(rc
));
2156 *ret_handle
= TAKE_PTR(handle
);
2161 /* This calls TPM2_CreateLoaded() directly, without checking if the TPM supports it. Callers should instead
2162 * use tpm2_create_loaded(). */
2163 static int _tpm2_create_loaded(
2165 const Tpm2Handle
*parent
,
2166 const Tpm2Handle
*session
,
2167 const TPMT_PUBLIC
*template,
2168 const TPMS_SENSITIVE_CREATE
*sensitive
,
2169 TPM2B_PUBLIC
**ret_public
,
2170 TPM2B_PRIVATE
**ret_private
,
2171 Tpm2Handle
**ret_handle
) {
2181 log_debug("Creating loaded object on TPM.");
2183 ts
= now(CLOCK_MONOTONIC
);
2185 /* Copy the input template and zero the unique area. */
2186 TPMT_PUBLIC template_copy
= *template;
2187 zero(template_copy
.unique
);
2189 TPM2B_TEMPLATE tpm2b_template
;
2191 rc
= sym_Tss2_MU_TPMT_PUBLIC_Marshal(
2193 tpm2b_template
.buffer
,
2194 sizeof(tpm2b_template
.buffer
),
2196 if (rc
!= TSS2_RC_SUCCESS
)
2197 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2198 "Failed to marshal public key template: %s", sym_Tss2_RC_Decode(rc
));
2199 assert(size
<= UINT16_MAX
);
2200 tpm2b_template
.size
= size
;
2202 TPM2B_SENSITIVE_CREATE tpm2b_sensitive
;
2204 tpm2b_sensitive
= (TPM2B_SENSITIVE_CREATE
) {
2205 .size
= sizeof(*sensitive
),
2206 .sensitive
= *sensitive
,
2209 tpm2b_sensitive
= (TPM2B_SENSITIVE_CREATE
) {};
2211 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
2212 r
= tpm2_handle_new(c
, &handle
);
2216 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*public = NULL
;
2217 _cleanup_(Esys_Freep
) TPM2B_PRIVATE
*private = NULL
;
2218 rc
= sym_Esys_CreateLoaded(
2220 parent
->esys_handle
,
2221 session
? session
->esys_handle
: ESYS_TR_PASSWORD
,
2226 &handle
->esys_handle
,
2229 if (rc
!= TSS2_RC_SUCCESS
)
2230 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2231 "Failed to generate loaded object in TPM: %s",
2232 sym_Tss2_RC_Decode(rc
));
2234 log_debug("Successfully created loaded object on TPM in %s.",
2235 FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - ts
, USEC_PER_MSEC
));
2238 *ret_public
= TAKE_PTR(public);
2240 *ret_private
= TAKE_PTR(private);
2242 *ret_handle
= TAKE_PTR(handle
);
2247 /* This calls TPM2_CreateLoaded() if the TPM supports it, otherwise it calls TPM2_Create() and TPM2_Load()
2248 * separately. Do not use this to create primary keys, because some HW TPMs refuse to allow that; instead use
2249 * tpm2_create_primary(). */
2250 int tpm2_create_loaded(
2252 const Tpm2Handle
*parent
,
2253 const Tpm2Handle
*session
,
2254 const TPMT_PUBLIC
*template,
2255 const TPMS_SENSITIVE_CREATE
*sensitive
,
2256 TPM2B_PUBLIC
**ret_public
,
2257 TPM2B_PRIVATE
**ret_private
,
2258 Tpm2Handle
**ret_handle
) {
2262 if (tpm2_supports_command(c
, TPM2_CC_CreateLoaded
))
2263 return _tpm2_create_loaded(c
, parent
, session
, template, sensitive
, ret_public
, ret_private
, ret_handle
);
2265 /* Unfortunately, this TPM doesn't support CreateLoaded (added at spec revision 130) so we need to
2266 * create and load manually. */
2267 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*public = NULL
;
2268 _cleanup_(Esys_Freep
) TPM2B_PRIVATE
*private = NULL
;
2269 r
= tpm2_create(c
, parent
, session
, template, sensitive
, &public, &private);
2273 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
2274 r
= tpm2_load(c
, parent
, session
, public, private, &handle
);
2279 *ret_public
= TAKE_PTR(public);
2281 *ret_private
= TAKE_PTR(private);
2283 *ret_handle
= TAKE_PTR(handle
);
2288 /* Read hash values from the specified PCR selection. Provides a Tpm2PCRValue array that contains all
2289 * requested PCR values, in the order provided by the TPM. Normally, the provided pcr values will match
2290 * exactly what is in the provided selection, but the TPM may ignore some selected PCRs (for example, if an
2291 * unimplemented PCR index is requested), in which case those PCRs will be absent from the provided pcr
2295 const TPML_PCR_SELECTION
*pcr_selection
,
2296 Tpm2PCRValue
**ret_pcr_values
,
2297 size_t *ret_n_pcr_values
) {
2299 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
2300 size_t n_pcr_values
= 0;
2304 assert(pcr_selection
);
2305 assert(ret_pcr_values
);
2306 assert(ret_n_pcr_values
);
2308 TPML_PCR_SELECTION remaining
= *pcr_selection
;
2309 while (!tpm2_tpml_pcr_selection_is_empty(&remaining
)) {
2310 _cleanup_(Esys_Freep
) TPML_PCR_SELECTION
*current_read
= NULL
;
2311 _cleanup_(Esys_Freep
) TPML_DIGEST
*current_values
= NULL
;
2313 tpm2_log_debug_tpml_pcr_selection(&remaining
, "Reading PCR selection");
2315 /* Unfortunately, PCR_Read will not return more than 8 values. */
2316 rc
= sym_Esys_PCR_Read(
2325 if (rc
!= TSS2_RC_SUCCESS
)
2326 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2327 "Failed to read TPM2 PCRs: %s", sym_Tss2_RC_Decode(rc
));
2329 tpm2_log_debug_tpml_pcr_selection(current_read
, "Read PCR selection");
2331 if (tpm2_tpml_pcr_selection_is_empty(current_read
)) {
2332 log_debug("TPM2 refused to read possibly unimplemented PCRs, ignoring.");
2337 FOREACH_PCR_IN_TPML_PCR_SELECTION(index
, tpms
, current_read
) {
2338 assert(i
< current_values
->count
);
2339 Tpm2PCRValue pcr_value
= {
2342 .value
= current_values
->digests
[i
++],
2345 tpm2_log_debug_pcr_value(&pcr_value
, /* msg= */ NULL
);
2347 if (!GREEDY_REALLOC_APPEND(pcr_values
, n_pcr_values
, &pcr_value
, 1))
2348 return log_oom_debug();
2350 assert(i
== current_values
->count
);
2352 tpm2_tpml_pcr_selection_sub(&remaining
, current_read
);
2355 tpm2_sort_pcr_values(pcr_values
, n_pcr_values
);
2357 if (!tpm2_pcr_values_valid(pcr_values
, n_pcr_values
))
2358 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "PCR values read from TPM are not valid.");
2360 *ret_pcr_values
= TAKE_PTR(pcr_values
);
2361 *ret_n_pcr_values
= n_pcr_values
;
2366 /* Read the PCR value for each TPM2PCRValue entry in the array that does not have a value set. If all entries
2367 * have an unset hash (i.e. hash == 0), this first detects the "best" PCR bank to use; otherwise, all entries
2368 * must have a valid hash set. All entries must have a valid index. If this cannot read a PCR value for all
2369 * appropriate entries, this returns an error. This does not check the array for validity. */
2370 int tpm2_pcr_read_missing_values(Tpm2Context
*c
, Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
2371 TPMI_ALG_HASH pcr_bank
= 0;
2375 assert(pcr_values
|| n_pcr_values
== 0);
2377 if (n_pcr_values
> 0) {
2379 r
= tpm2_pcr_values_hash_count(pcr_values
, n_pcr_values
, &hash_count
);
2381 return log_debug_errno(r
, "Could not get hash count from pcr values: %m");
2383 if (hash_count
== 1 && pcr_values
[0].hash
== 0) {
2385 r
= tpm2_pcr_values_to_mask(pcr_values
, n_pcr_values
, 0, &mask
);
2389 r
= tpm2_get_best_pcr_bank(c
, mask
, &pcr_bank
);
2395 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
) {
2399 if (v
->value
.size
> 0)
2402 TPML_PCR_SELECTION selection
;
2403 r
= tpm2_tpml_pcr_selection_from_pcr_values(v
, 1, &selection
, NULL
, NULL
);
2407 _cleanup_free_ Tpm2PCRValue
*read_values
= NULL
;
2408 size_t n_read_values
;
2409 r
= tpm2_pcr_read(c
, &selection
, &read_values
, &n_read_values
);
2413 if (n_read_values
== 0)
2414 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2415 "Could not read PCR hash 0x%" PRIu16
" index %u",
2418 assert(n_read_values
== 1);
2419 assert(read_values
[0].hash
== v
->hash
);
2420 assert(read_values
[0].index
== v
->index
);
2422 v
->value
= read_values
[0].value
;
2428 static int tpm2_pcr_mask_good(
2433 TPML_PCR_SELECTION selection
;
2438 /* So we have the problem that some systems might have working TPM2 chips, but the firmware doesn't
2439 * actually measure into them, or only into a suboptimal bank. If so, the PCRs should be all zero or
2440 * all 0xFF. Detect that, so that we can warn and maybe pick a better bank. */
2442 tpm2_tpml_pcr_selection_from_mask(mask
, bank
, &selection
);
2444 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
2445 size_t n_pcr_values
;
2446 r
= tpm2_pcr_read(c
, &selection
, &pcr_values
, &n_pcr_values
);
2450 /* If at least one of the selected PCR values is something other than all 0x00 or all 0xFF we are happy. */
2451 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
2452 if (!memeqbyte(0x00, v
->value
.buffer
, v
->value
.size
) &&
2453 !memeqbyte(0xFF, v
->value
.buffer
, v
->value
.size
))
2459 static int tpm2_bank_has24(const TPMS_PCR_SELECTION
*selection
) {
2463 /* As per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf a
2464 * TPM2 on a Client PC must have at least 24 PCRs. If this TPM has less, just skip over it. */
2465 if (selection
->sizeofSelect
< TPM2_PCRS_MAX
/8) {
2466 log_debug("Skipping TPM2 PCR bank %s with fewer than 24 PCRs.",
2467 strna(tpm2_hash_alg_to_string(selection
->hash
)));
2471 assert_cc(TPM2_PCRS_MAX
% 8 == 0);
2473 /* It's not enough to check how many PCRs there are, we also need to check that the 24 are
2474 * enabled for this bank. Otherwise this TPM doesn't qualify. */
2476 for (size_t j
= 0; j
< TPM2_PCRS_MAX
/8; j
++)
2477 if (selection
->pcrSelect
[j
] != 0xFF) {
2483 log_debug("TPM2 PCR bank %s has fewer than 24 PCR bits enabled, ignoring.",
2484 strna(tpm2_hash_alg_to_string(selection
->hash
)));
2489 int tpm2_get_best_pcr_bank(
2492 TPMI_ALG_HASH
*ret
) {
2494 TPMI_ALG_HASH supported_hash
= 0, hash_with_valid_pcr
= 0;
2500 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection
, &c
->capability_pcrs
) {
2501 TPMI_ALG_HASH hash
= selection
->hash
;
2504 /* For now we are only interested in the SHA1 and SHA256 banks */
2505 if (!IN_SET(hash
, TPM2_ALG_SHA256
, TPM2_ALG_SHA1
))
2508 r
= tpm2_bank_has24(selection
);
2514 good
= tpm2_pcr_mask_good(c
, hash
, pcr_mask
);
2518 if (hash
== TPM2_ALG_SHA256
) {
2519 supported_hash
= TPM2_ALG_SHA256
;
2521 /* Great, SHA256 is supported and has initialized PCR values, we are done. */
2522 hash_with_valid_pcr
= TPM2_ALG_SHA256
;
2526 assert(hash
== TPM2_ALG_SHA1
);
2528 if (supported_hash
== 0)
2529 supported_hash
= TPM2_ALG_SHA1
;
2531 if (good
&& hash_with_valid_pcr
== 0)
2532 hash_with_valid_pcr
= TPM2_ALG_SHA1
;
2536 /* We preferably pick SHA256, but only if its PCRs are initialized or neither the SHA1 nor the SHA256
2537 * PCRs are initialized. If SHA256 is not supported but SHA1 is and its PCRs are too, we prefer
2540 * We log at LOG_NOTICE level whenever we end up using the SHA1 bank or when the PCRs we bind to are
2541 * not initialized. */
2543 if (hash_with_valid_pcr
== TPM2_ALG_SHA256
) {
2544 assert(supported_hash
== TPM2_ALG_SHA256
);
2545 log_debug("TPM2 device supports SHA256 PCR bank and SHA256 PCRs are valid, yay!");
2546 *ret
= TPM2_ALG_SHA256
;
2547 } else if (hash_with_valid_pcr
== TPM2_ALG_SHA1
) {
2548 if (supported_hash
== TPM2_ALG_SHA256
)
2549 log_notice("TPM2 device supports both SHA1 and SHA256 PCR banks, but only SHA1 PCRs are valid, falling back to SHA1 bank. This reduces the security level substantially.");
2551 assert(supported_hash
== TPM2_ALG_SHA1
);
2552 log_notice("TPM2 device lacks support for SHA256 PCR bank, but SHA1 bank is supported and SHA1 PCRs are valid, falling back to SHA1 bank. This reduces the security level substantially.");
2555 *ret
= TPM2_ALG_SHA1
;
2556 } else if (supported_hash
== TPM2_ALG_SHA256
) {
2557 log_notice("TPM2 device supports SHA256 PCR bank but none of the selected PCRs are valid! Firmware apparently did not initialize any of the selected PCRs. Proceeding anyway with SHA256 bank. PCR policy effectively unenforced!");
2558 *ret
= TPM2_ALG_SHA256
;
2559 } else if (supported_hash
== TPM2_ALG_SHA1
) {
2560 log_notice("TPM2 device lacks support for SHA256 bank, but SHA1 bank is supported, but none of the selected PCRs are valid! Firmware apparently did not initialize any of the selected PCRs. Proceeding anyway with SHA1 bank. PCR policy effectively unenforced!");
2561 *ret
= TPM2_ALG_SHA1
;
2563 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
2564 "TPM2 module supports neither SHA1 nor SHA256 PCR banks, cannot operate.");
2569 int tpm2_get_good_pcr_banks(
2572 TPMI_ALG_HASH
**ret
) {
2574 _cleanup_free_ TPMI_ALG_HASH
*good_banks
= NULL
, *fallback_banks
= NULL
;
2575 size_t n_good_banks
= 0, n_fallback_banks
= 0;
2581 FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection
, &c
->capability_pcrs
) {
2582 TPMI_ALG_HASH hash
= selection
->hash
;
2584 /* Let's see if this bank is superficially OK, i.e. has at least 24 enabled registers */
2585 r
= tpm2_bank_has24(selection
);
2591 /* Let's now see if this bank has any of the selected PCRs actually initialized */
2592 r
= tpm2_pcr_mask_good(c
, hash
, pcr_mask
);
2596 if (n_good_banks
+ n_fallback_banks
>= INT_MAX
)
2597 return log_debug_errno(SYNTHETIC_ERRNO(E2BIG
), "Too many good TPM2 banks?");
2600 if (!GREEDY_REALLOC(good_banks
, n_good_banks
+1))
2601 return log_oom_debug();
2603 good_banks
[n_good_banks
++] = hash
;
2605 if (!GREEDY_REALLOC(fallback_banks
, n_fallback_banks
+1))
2606 return log_oom_debug();
2608 fallback_banks
[n_fallback_banks
++] = hash
;
2612 /* Preferably, use the good banks (i.e. the ones the PCR values are actually initialized so
2613 * far). Otherwise use the fallback banks (i.e. which exist and are enabled, but so far not used. */
2614 if (n_good_banks
> 0) {
2615 log_debug("Found %zu fully initialized TPM2 banks.", n_good_banks
);
2616 *ret
= TAKE_PTR(good_banks
);
2617 return (int) n_good_banks
;
2619 if (n_fallback_banks
> 0) {
2620 log_debug("Found %zu enabled but un-initialized TPM2 banks.", n_fallback_banks
);
2621 *ret
= TAKE_PTR(fallback_banks
);
2622 return (int) n_fallback_banks
;
2625 /* No suitable banks found. */
2630 int tpm2_get_good_pcr_banks_strv(
2636 _cleanup_free_ TPMI_ALG_HASH
*algs
= NULL
;
2637 _cleanup_strv_free_
char **l
= NULL
;
2643 n_algs
= tpm2_get_good_pcr_banks(c
, pcr_mask
, &algs
);
2647 FOREACH_ARRAY(a
, algs
, n_algs
) {
2648 _cleanup_free_
char *n
= NULL
;
2649 const EVP_MD
*implementation
;
2652 salg
= tpm2_hash_alg_to_string(*a
);
2654 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "TPM2 operates with unknown PCR algorithm, can't measure.");
2656 implementation
= EVP_get_digestbyname(salg
);
2657 if (!implementation
)
2658 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "TPM2 operates with unsupported PCR algorithm, can't measure.");
2660 n
= strdup(ASSERT_PTR(EVP_MD_name(implementation
)));
2662 return log_oom_debug();
2664 ascii_strlower(n
); /* OpenSSL uses uppercase digest names, we prefer them lower case. */
2666 if (strv_consume(&l
, TAKE_PTR(n
)) < 0)
2667 return log_oom_debug();
2672 #else /* HAVE_OPENSSL */
2673 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "OpenSSL support is disabled.");
2677 /* Hash data into the digest.
2679 * If 'extend' is true, the hashing operation starts with the existing digest hash (and the digest is
2680 * required to have a hash and its size must be correct). If 'extend' is false, the digest size is
2681 * initialized to the correct size for 'alg' and the hashing operation does not include any existing digest
2682 * hash. If 'extend' is false and no data is provided, the digest is initialized to a zero digest.
2684 * On success, the digest hash will be updated with the hashing operation result and the digest size will be
2685 * correct for 'alg'.
2687 * This currently only provides SHA256, so 'alg' must be TPM2_ALG_SHA256. */
2688 int tpm2_digest_many(
2690 TPM2B_DIGEST
*digest
,
2691 const struct iovec data
[],
2695 struct sha256_ctx ctx
;
2698 assert(data
|| n_data
== 0);
2700 if (alg
!= TPM2_ALG_SHA256
)
2701 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
2702 "Hash algorithm not supported: 0x%x", alg
);
2704 if (extend
&& digest
->size
!= SHA256_DIGEST_SIZE
)
2705 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
2706 "Digest size 0x%x, require 0x%x",
2707 digest
->size
, (unsigned)SHA256_DIGEST_SIZE
);
2709 /* Since we're hardcoding SHA256 (for now), we can check this at compile time. */
2710 assert_cc(sizeof(digest
->buffer
) >= SHA256_DIGEST_SIZE
);
2714 sha256_init_ctx(&ctx
);
2717 sha256_process_bytes(digest
->buffer
, digest
->size
, &ctx
);
2719 *digest
= (TPM2B_DIGEST
){ .size
= SHA256_DIGEST_SIZE
, };
2720 if (n_data
== 0) /* If not extending and no data, return zero hash */
2724 FOREACH_ARRAY(d
, data
, n_data
)
2725 sha256_process_bytes(d
->iov_base
, d
->iov_len
, &ctx
);
2727 sha256_finish_ctx(&ctx
, digest
->buffer
);
2732 /* Same as tpm2_digest_many() but data is contained in TPM2B_DIGEST[]. The digests may be any size digests. */
2733 int tpm2_digest_many_digests(
2735 TPM2B_DIGEST
*digest
,
2736 const TPM2B_DIGEST data
[],
2740 _cleanup_free_
struct iovec
*iovecs
= NULL
;
2742 assert(data
|| n_data
== 0);
2744 iovecs
= new(struct iovec
, n_data
);
2746 return log_oom_debug();
2748 for (size_t i
= 0; i
< n_data
; i
++)
2749 iovecs
[i
] = IOVEC_MAKE((void*) data
[i
].buffer
, data
[i
].size
);
2751 return tpm2_digest_many(alg
, digest
, iovecs
, n_data
, extend
);
2754 /* This hashes the provided pin into a digest value, but also verifies that the final byte is not 0, because
2755 * the TPM specification Part 1 ("Architecture") section Authorization Values (subsection "Authorization Size
2756 * Convention") states "Trailing octets of zero are to be removed from any string before it is used as an
2757 * authValue". Since the TPM doesn't know if the auth value is a "string" or just a hash digest, any hash
2758 * digest that randomly happens to end in 0 must have the final 0(s) trimmed.
2760 * This is required at 2 points. First, when setting the authValue during creation of new sealed objects, in
2761 * tpm2_seal(). This only applies to newly created objects, of course. Second, when using a previously
2762 * created sealed object that has an authValue set, we use the sealed objects as the session bind key. This
2763 * requires calling SetAuth so tpm2-tss can correctly calculate the HMAC to use for the encryption session.
2765 * TPM implementations will perform the trimming for any authValue for existing sealed objects, so the
2766 * tpm2-tss library must also perform the trimming before HMAC calculation, but it does not yet; this bug is
2767 * open to add the trimming: https://github.com/tpm2-software/tpm2-tss/issues/2664
2769 * Until our minimum tpm2-tss version contains a fix for that bug, we must perform the trimming
2770 * ourselves. Note that since we are trimming, which is exactly what a TPM implementation would do, this will
2771 * work for both existing objects with a authValue ending in 0(s) as well as new sealed objects we create,
2772 * which we will trim the 0(s) from before sending to the TPM.
2774 static void tpm2_trim_auth_value(TPM2B_AUTH
*auth
) {
2775 bool trimmed
= false;
2779 while (auth
->size
> 0 && auth
->buffer
[auth
->size
- 1] == 0) {
2785 log_debug("authValue ends in 0, trimming as required by the TPM2 specification Part 1 section 'HMAC Computation' authValue Note 2.");
2788 static int tpm2_get_pin_auth(TPMI_ALG_HASH hash
, const char *pin
, TPM2B_AUTH
*ret_auth
) {
2789 TPM2B_AUTH auth
= {};
2795 r
= tpm2_digest_buffer(hash
, &auth
, pin
, strlen(pin
), /* extend= */ false);
2799 tpm2_trim_auth_value(&auth
);
2801 *ret_auth
= TAKE_STRUCT(auth
);
2806 static int tpm2_set_auth(Tpm2Context
*c
, const Tpm2Handle
*handle
, const char *pin
) {
2807 TPM2B_AUTH auth
= {};
2817 CLEANUP_ERASE(auth
);
2819 r
= tpm2_get_pin_auth(TPM2_ALG_SHA256
, pin
, &auth
);
2823 rc
= sym_Esys_TR_SetAuth(c
->esys_context
, handle
->esys_handle
, &auth
);
2824 if (rc
!= TSS2_RC_SUCCESS
)
2825 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2826 "Failed to load PIN in TPM: %s", sym_Tss2_RC_Decode(rc
));
2831 static bool tpm2_is_encryption_session(Tpm2Context
*c
, const Tpm2Handle
*session
) {
2832 TPMA_SESSION flags
= 0;
2838 rc
= sym_Esys_TRSess_GetAttributes(c
->esys_context
, session
->esys_handle
, &flags
);
2839 if (rc
!= TSS2_RC_SUCCESS
)
2842 return (flags
& TPMA_SESSION_DECRYPT
) && (flags
& TPMA_SESSION_ENCRYPT
);
2845 static int tpm2_make_encryption_session(
2847 const Tpm2Handle
*primary
,
2848 const Tpm2Handle
*bind_key
,
2849 Tpm2Handle
**ret_session
) {
2851 const TPMA_SESSION sessionAttributes
= TPMA_SESSION_DECRYPT
| TPMA_SESSION_ENCRYPT
|
2852 TPMA_SESSION_CONTINUESESSION
;
2857 assert(ret_session
);
2859 log_debug("Starting HMAC encryption session.");
2861 /* Start a salted, unbound HMAC session with a well-known key (e.g. primary key) as tpmKey, which
2862 * means that the random salt will be encrypted with the well-known key. That way, only the TPM can
2863 * recover the salt, which is then used for key derivation. */
2864 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*session
= NULL
;
2865 r
= tpm2_handle_new(c
, &session
);
2869 rc
= sym_Esys_StartAuthSession(
2871 primary
->esys_handle
,
2872 bind_key
->esys_handle
,
2878 &SESSION_TEMPLATE_SYM_AES_128_CFB
,
2880 &session
->esys_handle
);
2881 if (rc
!= TSS2_RC_SUCCESS
)
2882 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2883 "Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc
));
2885 /* Enable parameter encryption/decryption with AES in CFB mode. Together with HMAC digests (which are
2886 * always used for sessions), this provides confidentiality, integrity and replay protection for
2887 * operations that use this session. */
2888 rc
= sym_Esys_TRSess_SetAttributes(c
->esys_context
, session
->esys_handle
, sessionAttributes
, 0xff);
2889 if (rc
!= TSS2_RC_SUCCESS
)
2890 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2891 "Failed to configure TPM session: %s", sym_Tss2_RC_Decode(rc
));
2893 *ret_session
= TAKE_PTR(session
);
2898 static int tpm2_make_policy_session(
2900 const Tpm2Handle
*primary
,
2901 const Tpm2Handle
*encryption_session
,
2902 Tpm2Handle
**ret_session
) {
2909 assert(encryption_session
);
2910 assert(ret_session
);
2912 if (!tpm2_is_encryption_session(c
, encryption_session
))
2913 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
2914 "Missing encryption session");
2916 log_debug("Starting policy session.");
2918 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*session
= NULL
;
2919 r
= tpm2_handle_new(c
, &session
);
2923 rc
= sym_Esys_StartAuthSession(
2925 primary
->esys_handle
,
2927 encryption_session
->esys_handle
,
2932 &SESSION_TEMPLATE_SYM_AES_128_CFB
,
2934 &session
->esys_handle
);
2935 if (rc
!= TSS2_RC_SUCCESS
)
2936 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
2937 "Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc
));
2939 *ret_session
= TAKE_PTR(session
);
2944 static int find_signature(
2946 const TPML_PCR_SELECTION
*pcr_selection
,
2951 void *ret_signature
,
2952 size_t *ret_signature_size
) {
2959 /* Searches for a signature blob in the specified JSON object. Search keys are PCR bank, PCR mask,
2960 * public key, and policy digest. */
2962 if (!json_variant_is_object(v
))
2963 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Signature is not a JSON object.");
2965 uint16_t pcr_bank
= pcr_selection
->pcrSelections
[0].hash
;
2966 uint32_t pcr_mask
= tpm2_tpml_pcr_selection_to_mask(pcr_selection
, pcr_bank
);
2968 k
= tpm2_hash_alg_to_string(pcr_bank
);
2970 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "Don't know PCR bank %" PRIu16
, pcr_bank
);
2972 /* First, find field by bank */
2973 b
= json_variant_by_key(v
, k
);
2975 return log_debug_errno(SYNTHETIC_ERRNO(ENXIO
), "Signature lacks data for PCR bank '%s'.", k
);
2977 if (!json_variant_is_array(b
))
2978 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Bank data is not a JSON array.");
2980 /* Now iterate through all signatures known for this bank */
2981 JSON_VARIANT_ARRAY_FOREACH(i
, b
) {
2982 _cleanup_free_
void *fpj_data
= NULL
, *polj_data
= NULL
;
2983 JsonVariant
*maskj
, *fpj
, *sigj
, *polj
;
2984 size_t fpj_size
, polj_size
;
2985 uint32_t parsed_mask
;
2987 if (!json_variant_is_object(i
))
2988 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Bank data element is not a JSON object");
2990 /* Check if the PCR mask matches our expectations */
2991 maskj
= json_variant_by_key(i
, "pcrs");
2995 r
= tpm2_parse_pcr_json_array(maskj
, &parsed_mask
);
2997 return log_debug_errno(r
, "Failed to parse JSON PCR mask");
2999 if (parsed_mask
!= pcr_mask
)
3000 continue; /* Not for this PCR mask */
3002 /* Then check if this is for the public key we operate with */
3003 fpj
= json_variant_by_key(i
, "pkfp");
3007 r
= json_variant_unhex(fpj
, &fpj_data
, &fpj_size
);
3009 return log_debug_errno(r
, "Failed to decode fingerprint in JSON data: %m");
3011 if (memcmp_nn(fp
, fp_size
, fpj_data
, fpj_size
) != 0)
3012 continue; /* Not for this public key */
3014 /* Finally, check if this is for the PCR policy we expect this to be */
3015 polj
= json_variant_by_key(i
, "pol");
3019 r
= json_variant_unhex(polj
, &polj_data
, &polj_size
);
3021 return log_debug_errno(r
, "Failed to decode policy hash JSON data: %m");
3023 if (memcmp_nn(policy
, policy_size
, polj_data
, polj_size
) != 0)
3026 /* This entry matches all our expectations, now return the signature included in it */
3027 sigj
= json_variant_by_key(i
, "sig");
3031 return json_variant_unbase64(sigj
, ret_signature
, ret_signature_size
);
3034 return log_debug_errno(SYNTHETIC_ERRNO(ENXIO
), "Couldn't find signature for this PCR bank, PCR index and public key.");
3035 #else /* HAVE_OPENSSL */
3036 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "OpenSSL support is disabled.");
3040 /* Calculates the "name" of a public key.
3042 * As specified in TPM2 spec "Part 1: Architecture", a key's "name" is its nameAlg value followed by a hash
3043 * of its TPM2 public area, all properly marshalled. This allows a key's "name" to be dependent not only on
3044 * the key fingerprint, but also on the TPM2-specific fields that associated with the key (i.e. all fields in
3045 * TPMT_PUBLIC). Note that this means an existing key may not change any of its TPMT_PUBLIC fields, since
3046 * that would also change the key name.
3048 * Since we (currently) hardcode to always using SHA256 for hashing, this returns an error if the public key
3049 * nameAlg is not TPM2_ALG_SHA256. */
3050 int tpm2_calculate_name(const TPMT_PUBLIC
*public, TPM2B_NAME
*ret_name
) {
3059 return log_debug_errno(r
, "TPM2 support not installed: %m");
3061 if (public->nameAlg
!= TPM2_ALG_SHA256
)
3062 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
3063 "Unsupported nameAlg: 0x%x",
3066 _cleanup_free_
uint8_t *buf
= NULL
;
3069 buf
= (uint8_t*) new(TPMT_PUBLIC
, 1);
3071 return log_oom_debug();
3073 rc
= sym_Tss2_MU_TPMT_PUBLIC_Marshal(public, buf
, sizeof(TPMT_PUBLIC
), &size
);
3074 if (rc
!= TSS2_RC_SUCCESS
)
3075 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3076 "Failed to marshal public key: %s", sym_Tss2_RC_Decode(rc
));
3078 TPM2B_DIGEST digest
= {};
3079 r
= tpm2_digest_buffer(TPM2_ALG_SHA256
, &digest
, buf
, size
, /* extend= */ false);
3084 .hashAlg
= TPM2_ALG_SHA256
,
3086 assert(digest
.size
<= sizeof(ha
.digest
.sha256
));
3087 memcpy_safe(ha
.digest
.sha256
, digest
.buffer
, digest
.size
);
3091 rc
= sym_Tss2_MU_TPMT_HA_Marshal(&ha
, name
.name
, sizeof(name
.name
), &size
);
3092 if (rc
!= TSS2_RC_SUCCESS
)
3093 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3094 "Failed to marshal key name: %s", sym_Tss2_RC_Decode(rc
));
3097 tpm2_log_debug_name(&name
, "Calculated name");
3104 /* Get the "name" of a key from the TPM.
3106 * The "name" of a key is explained above in tpm2_calculate_name().
3108 * The handle must reference a key already present in the TPM. It may be either a public key only, or a
3109 * public/private keypair. */
3110 static int tpm2_get_name(
3112 const Tpm2Handle
*handle
,
3113 TPM2B_NAME
**ret_name
) {
3115 _cleanup_(Esys_Freep
) TPM2B_NAME
*name
= NULL
;
3122 rc
= sym_Esys_TR_GetName(c
->esys_context
, handle
->esys_handle
, &name
);
3123 if (rc
!= TSS2_RC_SUCCESS
)
3124 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3125 "Failed to get name of public key from TPM: %s", sym_Tss2_RC_Decode(rc
));
3127 tpm2_log_debug_name(name
, "Object name");
3129 *ret_name
= TAKE_PTR(name
);
3134 /* Extend 'digest' with the PolicyAuthValue calculated hash. */
3135 int tpm2_calculate_policy_auth_value(TPM2B_DIGEST
*digest
) {
3136 TPM2_CC command
= TPM2_CC_PolicyAuthValue
;
3141 assert(digest
->size
== SHA256_DIGEST_SIZE
);
3145 return log_debug_errno(r
, "TPM2 support not installed: %m");
3147 uint8_t buf
[sizeof(command
)];
3150 rc
= sym_Tss2_MU_TPM2_CC_Marshal(command
, buf
, sizeof(buf
), &offset
);
3151 if (rc
!= TSS2_RC_SUCCESS
)
3152 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3153 "Failed to marshal PolicyAuthValue command: %s", sym_Tss2_RC_Decode(rc
));
3155 if (offset
!= sizeof(command
))
3156 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3157 "Offset 0x%zx wrong after marshalling PolicyAuthValue command", offset
);
3159 r
= tpm2_digest_buffer(TPM2_ALG_SHA256
, digest
, buf
, offset
, /* extend= */ true);
3163 tpm2_log_debug_digest(digest
, "PolicyAuthValue calculated digest");
3168 static int tpm2_policy_auth_value(
3170 const Tpm2Handle
*session
,
3171 TPM2B_DIGEST
**ret_policy_digest
) {
3178 log_debug("Adding authValue policy.");
3180 rc
= sym_Esys_PolicyAuthValue(
3182 session
->esys_handle
,
3186 if (rc
!= TSS2_RC_SUCCESS
)
3187 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3188 "Failed to add authValue policy to TPM: %s",
3189 sym_Tss2_RC_Decode(rc
));
3191 return tpm2_get_policy_digest(c
, session
, ret_policy_digest
);
3194 /* Extend 'digest' with the PolicyPCR calculated hash. */
3195 int tpm2_calculate_policy_pcr(
3196 const Tpm2PCRValue
*pcr_values
,
3197 size_t n_pcr_values
,
3198 TPM2B_DIGEST
*digest
) {
3200 TPM2_CC command
= TPM2_CC_PolicyPCR
;
3204 assert(pcr_values
|| n_pcr_values
== 0);
3206 assert(digest
->size
== SHA256_DIGEST_SIZE
);
3210 return log_debug_errno(r
, "TPM2 support not installed: %m");
3212 TPML_PCR_SELECTION pcr_selection
;
3213 _cleanup_free_ TPM2B_DIGEST
*values
= NULL
;
3215 r
= tpm2_tpml_pcr_selection_from_pcr_values(pcr_values
, n_pcr_values
, &pcr_selection
, &values
, &n_values
);
3217 return log_debug_errno(r
, "Could not convert PCR values to TPML_PCR_SELECTION: %m");
3219 TPM2B_DIGEST hash
= {};
3220 r
= tpm2_digest_many_digests(TPM2_ALG_SHA256
, &hash
, values
, n_values
, /* extend= */ false);
3224 _cleanup_free_
uint8_t *buf
= NULL
;
3225 size_t size
= 0, maxsize
= sizeof(command
) + sizeof(pcr_selection
);
3227 buf
= malloc(maxsize
);
3229 return log_oom_debug();
3231 rc
= sym_Tss2_MU_TPM2_CC_Marshal(command
, buf
, maxsize
, &size
);
3232 if (rc
!= TSS2_RC_SUCCESS
)
3233 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3234 "Failed to marshal PolicyPCR command: %s", sym_Tss2_RC_Decode(rc
));
3236 rc
= sym_Tss2_MU_TPML_PCR_SELECTION_Marshal(&pcr_selection
, buf
, maxsize
, &size
);
3237 if (rc
!= TSS2_RC_SUCCESS
)
3238 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3239 "Failed to marshal PCR selection: %s", sym_Tss2_RC_Decode(rc
));
3241 struct iovec data
[] = {
3242 IOVEC_MAKE(buf
, size
),
3243 IOVEC_MAKE(hash
.buffer
, hash
.size
),
3245 r
= tpm2_digest_many(TPM2_ALG_SHA256
, digest
, data
, ELEMENTSOF(data
), /* extend= */ true);
3249 tpm2_log_debug_digest(digest
, "PolicyPCR calculated digest");
3254 static int tpm2_policy_pcr(
3256 const Tpm2Handle
*session
,
3257 const TPML_PCR_SELECTION
*pcr_selection
,
3258 TPM2B_DIGEST
**ret_policy_digest
) {
3264 assert(pcr_selection
);
3266 log_debug("Adding PCR hash policy.");
3268 rc
= sym_Esys_PolicyPCR(
3270 session
->esys_handle
,
3276 if (rc
!= TSS2_RC_SUCCESS
)
3277 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3278 "Failed to add PCR policy to TPM: %s", sym_Tss2_RC_Decode(rc
));
3280 return tpm2_get_policy_digest(c
, session
, ret_policy_digest
);
3283 /* Extend 'digest' with the PolicyAuthorize calculated hash. */
3284 int tpm2_calculate_policy_authorize(
3285 const TPM2B_PUBLIC
*public,
3286 const TPM2B_DIGEST
*policy_ref
,
3287 TPM2B_DIGEST
*digest
) {
3289 TPM2_CC command
= TPM2_CC_PolicyAuthorize
;
3295 assert(digest
->size
== SHA256_DIGEST_SIZE
);
3299 return log_debug_errno(r
, "TPM2 support not installed: %m");
3301 uint8_t buf
[sizeof(command
)];
3304 rc
= sym_Tss2_MU_TPM2_CC_Marshal(command
, buf
, sizeof(buf
), &offset
);
3305 if (rc
!= TSS2_RC_SUCCESS
)
3306 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3307 "Failed to marshal PolicyAuthorize command: %s", sym_Tss2_RC_Decode(rc
));
3309 if (offset
!= sizeof(command
))
3310 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3311 "Offset 0x%zx wrong after marshalling PolicyAuthorize command", offset
);
3313 TPM2B_NAME name
= {};
3314 r
= tpm2_calculate_name(&public->publicArea
, &name
);
3318 /* PolicyAuthorize does not use the previous hash value; we must zero and then extend it. */
3319 zero(digest
->buffer
);
3321 struct iovec data
[] = {
3322 IOVEC_MAKE(buf
, offset
),
3323 IOVEC_MAKE(name
.name
, name
.size
),
3325 r
= tpm2_digest_many(TPM2_ALG_SHA256
, digest
, data
, ELEMENTSOF(data
), /* extend= */ true);
3329 /* PolicyAuthorize requires hashing twice; this is either an extension or rehashing. */
3331 r
= tpm2_digest_many_digests(TPM2_ALG_SHA256
, digest
, policy_ref
, 1, /* extend= */ true);
3333 r
= tpm2_digest_rehash(TPM2_ALG_SHA256
, digest
);
3337 tpm2_log_debug_digest(digest
, "PolicyAuthorize calculated digest");
3342 static int tpm2_policy_authorize(
3344 const Tpm2Handle
*session
,
3345 TPML_PCR_SELECTION
*pcr_selection
,
3346 const TPM2B_PUBLIC
*public,
3349 JsonVariant
*signature_json
,
3350 TPM2B_DIGEST
**ret_policy_digest
) {
3357 assert(pcr_selection
);
3359 assert(fp
&& fp_size
> 0);
3361 log_debug("Adding PCR signature policy.");
3363 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*pubkey_handle
= NULL
;
3364 r
= tpm2_load_external(c
, NULL
, public, NULL
, &pubkey_handle
);
3368 /* Acquire the "name" of what we just loaded */
3369 _cleanup_(Esys_Freep
) TPM2B_NAME
*pubkey_name
= NULL
;
3370 r
= tpm2_get_name(c
, pubkey_handle
, &pubkey_name
);
3374 /* If we have a signature, proceed with verifying the PCR digest */
3375 const TPMT_TK_VERIFIED
*check_ticket
;
3376 _cleanup_(Esys_Freep
) TPMT_TK_VERIFIED
*check_ticket_buffer
= NULL
;
3377 _cleanup_(Esys_Freep
) TPM2B_DIGEST
*approved_policy
= NULL
;
3378 if (signature_json
) {
3379 r
= tpm2_policy_pcr(
3387 _cleanup_free_
void *signature_raw
= NULL
;
3388 size_t signature_size
;
3394 approved_policy
->buffer
,
3395 approved_policy
->size
,
3401 /* TPM2_VerifySignature() will only verify the RSA part of the RSA+SHA256 signature,
3402 * hence we need to do the SHA256 part ourselves, first */
3403 TPM2B_DIGEST signature_hash
= *approved_policy
;
3404 r
= tpm2_digest_rehash(TPM2_ALG_SHA256
, &signature_hash
);
3408 r
= TPM2B_PUBLIC_KEY_RSA_CHECK_SIZE(signature_size
);
3410 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "Signature larger than buffer.");
3412 TPMT_SIGNATURE policy_signature
= {
3413 .sigAlg
= TPM2_ALG_RSASSA
,
3414 .signature
.rsassa
= {
3415 .hash
= TPM2_ALG_SHA256
,
3416 .sig
= TPM2B_PUBLIC_KEY_RSA_MAKE(signature_raw
, signature_size
),
3420 rc
= sym_Esys_VerifySignature(
3422 pubkey_handle
->esys_handle
,
3428 &check_ticket_buffer
);
3429 if (rc
!= TSS2_RC_SUCCESS
)
3430 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3431 "Failed to validate signature in TPM: %s", sym_Tss2_RC_Decode(rc
));
3433 check_ticket
= check_ticket_buffer
;
3435 /* When enrolling, we pass a NULL ticket */
3436 static const TPMT_TK_VERIFIED check_ticket_null
= {
3437 .tag
= TPM2_ST_VERIFIED
,
3438 .hierarchy
= TPM2_RH_OWNER
,
3441 check_ticket
= &check_ticket_null
;
3444 rc
= sym_Esys_PolicyAuthorize(
3446 session
->esys_handle
,
3451 /* policyRef= */ &(const TPM2B_NONCE
) {},
3454 if (rc
!= TSS2_RC_SUCCESS
)
3455 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3456 "Failed to push Authorize policy into TPM: %s", sym_Tss2_RC_Decode(rc
));
3458 return tpm2_get_policy_digest(c
, session
, ret_policy_digest
);
3461 /* Extend 'digest' with the calculated policy hash. */
3462 int tpm2_calculate_sealing_policy(
3463 const Tpm2PCRValue
*pcr_values
,
3464 size_t n_pcr_values
,
3465 const TPM2B_PUBLIC
*public,
3467 TPM2B_DIGEST
*digest
) {
3471 assert(pcr_values
|| n_pcr_values
== 0);
3475 r
= tpm2_calculate_policy_authorize(public, NULL
, digest
);
3480 if (n_pcr_values
> 0) {
3481 r
= tpm2_calculate_policy_pcr(pcr_values
, n_pcr_values
, digest
);
3487 r
= tpm2_calculate_policy_auth_value(digest
);
3495 static int tpm2_build_sealing_policy(
3497 const Tpm2Handle
*session
,
3498 uint32_t hash_pcr_mask
,
3500 const TPM2B_PUBLIC
*public,
3503 uint32_t pubkey_pcr_mask
,
3504 JsonVariant
*signature_json
,
3506 TPM2B_DIGEST
**ret_policy_digest
) {
3512 assert(pubkey_pcr_mask
== 0 || public);
3514 log_debug("Building sealing policy.");
3516 if ((hash_pcr_mask
| pubkey_pcr_mask
) != 0) {
3517 r
= tpm2_pcr_mask_good(c
, pcr_bank
, hash_pcr_mask
|pubkey_pcr_mask
);
3521 log_debug("Selected TPM2 PCRs are not initialized on this system.");
3524 if (pubkey_pcr_mask
!= 0) {
3525 TPML_PCR_SELECTION pcr_selection
;
3526 tpm2_tpml_pcr_selection_from_mask(pubkey_pcr_mask
, (TPMI_ALG_HASH
)pcr_bank
, &pcr_selection
);
3527 r
= tpm2_policy_authorize(c
, session
, &pcr_selection
, public, fp
, fp_size
, signature_json
, NULL
);
3532 if (hash_pcr_mask
!= 0) {
3533 TPML_PCR_SELECTION pcr_selection
;
3534 tpm2_tpml_pcr_selection_from_mask(hash_pcr_mask
, (TPMI_ALG_HASH
)pcr_bank
, &pcr_selection
);
3535 r
= tpm2_policy_pcr(c
, session
, &pcr_selection
, NULL
);
3541 r
= tpm2_policy_auth_value(c
, session
, NULL
);
3546 r
= tpm2_get_policy_digest(c
, session
, ret_policy_digest
);
3554 static const struct {
3555 TPM2_ECC_CURVE tpm2_ecc_curve_id
;
3556 int openssl_ecc_curve_id
;
3557 } tpm2_openssl_ecc_curve_table
[] = {
3558 { TPM2_ECC_NIST_P192
, NID_X9_62_prime192v1
, },
3559 { TPM2_ECC_NIST_P224
, NID_secp224r1
, },
3560 { TPM2_ECC_NIST_P256
, NID_X9_62_prime256v1
, },
3561 { TPM2_ECC_NIST_P384
, NID_secp384r1
, },
3562 { TPM2_ECC_NIST_P521
, NID_secp521r1
, },
3563 { TPM2_ECC_SM2_P256
, NID_sm2
, },
3566 static int tpm2_ecc_curve_from_openssl_curve_id(int openssl_ecc_curve_id
, TPM2_ECC_CURVE
*ret
) {
3569 FOREACH_ARRAY(t
, tpm2_openssl_ecc_curve_table
, ELEMENTSOF(tpm2_openssl_ecc_curve_table
))
3570 if (t
->openssl_ecc_curve_id
== openssl_ecc_curve_id
) {
3571 *ret
= t
->tpm2_ecc_curve_id
;
3575 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
3576 "Openssl ECC curve id %d not supported.", openssl_ecc_curve_id
);
3579 static int tpm2_ecc_curve_to_openssl_curve_id(TPM2_ECC_CURVE tpm2_ecc_curve_id
, int *ret
) {
3582 FOREACH_ARRAY(t
, tpm2_openssl_ecc_curve_table
, ELEMENTSOF(tpm2_openssl_ecc_curve_table
))
3583 if (t
->tpm2_ecc_curve_id
== tpm2_ecc_curve_id
) {
3584 *ret
= t
->openssl_ecc_curve_id
;
3588 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
3589 "TPM2 ECC curve %u not supported.", tpm2_ecc_curve_id
);
3592 #define TPM2_RSA_DEFAULT_EXPONENT UINT32_C(0x10001)
3594 int tpm2_tpm2b_public_to_openssl_pkey(const TPM2B_PUBLIC
*public, EVP_PKEY
**ret
) {
3600 const TPMT_PUBLIC
*p
= &public->publicArea
;
3602 case TPM2_ALG_ECC
: {
3604 r
= tpm2_ecc_curve_to_openssl_curve_id(p
->parameters
.eccDetail
.curveID
, &curve_id
);
3608 const TPMS_ECC_POINT
*point
= &p
->unique
.ecc
;
3609 return ecc_pkey_from_curve_x_y(
3617 case TPM2_ALG_RSA
: {
3618 /* TPM specification Part 2 ("Structures") section for TPMS_RSA_PARAMS states "An exponent of
3619 * zero indicates that the exponent is the default of 2^16 + 1". */
3620 uint32_t exponent
= htobe32(p
->parameters
.rsaDetail
.exponent
?: TPM2_RSA_DEFAULT_EXPONENT
);
3621 return rsa_pkey_from_n_e(
3622 p
->unique
.rsa
.buffer
,
3629 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
3630 "TPM2 asymmetric algorithm 0x%" PRIx16
" not supported.", p
->type
);
3634 int tpm2_tpm2b_public_from_openssl_pkey(const EVP_PKEY
*pkey
, TPM2B_PUBLIC
*ret
) {
3640 TPMT_PUBLIC
public = {
3641 .nameAlg
= TPM2_ALG_SHA256
,
3642 .objectAttributes
= TPMA_OBJECT_DECRYPT
| TPMA_OBJECT_SIGN_ENCRYPT
| TPMA_OBJECT_USERWITHAUTH
,
3643 .parameters
.asymDetail
= {
3644 .symmetric
.algorithm
= TPM2_ALG_NULL
,
3645 .scheme
.scheme
= TPM2_ALG_NULL
,
3649 #if OPENSSL_VERSION_MAJOR >= 3
3650 key_id
= EVP_PKEY_get_id(pkey
);
3652 key_id
= EVP_PKEY_id(pkey
);
3657 public.type
= TPM2_ALG_ECC
;
3660 _cleanup_free_
void *x
= NULL
, *y
= NULL
;
3661 size_t x_size
, y_size
;
3662 r
= ecc_pkey_to_curve_x_y(pkey
, &curve_id
, &x
, &x_size
, &y
, &y_size
);
3664 return log_debug_errno(r
, "Could not get ECC key curve/x/y: %m");
3666 TPM2_ECC_CURVE curve
;
3667 r
= tpm2_ecc_curve_from_openssl_curve_id(curve_id
, &curve
);
3671 public.parameters
.eccDetail
.curveID
= curve
;
3673 public.parameters
.eccDetail
.kdf
.scheme
= TPM2_ALG_NULL
;
3675 r
= TPM2B_ECC_PARAMETER_CHECK_SIZE(x_size
);
3677 return log_debug_errno(r
, "ECC key x size %zu too large.", x_size
);
3679 public.unique
.ecc
.x
= TPM2B_ECC_PARAMETER_MAKE(x
, x_size
);
3681 r
= TPM2B_ECC_PARAMETER_CHECK_SIZE(y_size
);
3683 return log_debug_errno(r
, "ECC key y size %zu too large.", y_size
);
3685 public.unique
.ecc
.y
= TPM2B_ECC_PARAMETER_MAKE(y
, y_size
);
3689 case EVP_PKEY_RSA
: {
3690 public.type
= TPM2_ALG_RSA
;
3692 _cleanup_free_
void *n
= NULL
, *e
= NULL
;
3693 size_t n_size
, e_size
;
3694 r
= rsa_pkey_to_n_e(pkey
, &n
, &n_size
, &e
, &e_size
);
3696 return log_debug_errno(r
, "Could not get RSA key n/e: %m");
3698 r
= TPM2B_PUBLIC_KEY_RSA_CHECK_SIZE(n_size
);
3700 return log_debug_errno(r
, "RSA key n size %zu too large.", n_size
);
3702 public.unique
.rsa
= TPM2B_PUBLIC_KEY_RSA_MAKE(n
, n_size
);
3703 public.parameters
.rsaDetail
.keyBits
= n_size
* 8;
3705 if (sizeof(uint32_t) < e_size
)
3706 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
3707 "RSA key e size %zu too large.", e_size
);
3709 uint32_t exponent
= 0;
3710 memcpy(&exponent
, e
, e_size
);
3711 exponent
= be32toh(exponent
) >> (32 - e_size
* 8);
3712 if (exponent
== TPM2_RSA_DEFAULT_EXPONENT
)
3714 public.parameters
.rsaDetail
.exponent
= exponent
;
3719 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
3720 "EVP_PKEY type %d not supported.", key_id
);
3723 *ret
= (TPM2B_PUBLIC
) {
3724 .size
= sizeof(public),
3725 .publicArea
= public,
3732 int tpm2_tpm2b_public_to_fingerprint(
3733 const TPM2B_PUBLIC
*public,
3734 void **ret_fingerprint
,
3735 size_t *ret_fingerprint_size
) {
3741 assert(ret_fingerprint
);
3742 assert(ret_fingerprint_size
);
3744 _cleanup_(EVP_PKEY_freep
) EVP_PKEY
*pkey
= NULL
;
3745 r
= tpm2_tpm2b_public_to_openssl_pkey(public, &pkey
);
3749 /* Hardcode fingerprint to SHA256 */
3750 return pubkey_fingerprint(pkey
, EVP_sha256(), ret_fingerprint
, ret_fingerprint_size
);
3752 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "OpenSSL support is disabled.");
3756 int tpm2_tpm2b_public_from_pem(const void *pem
, size_t pem_size
, TPM2B_PUBLIC
*ret
) {
3763 _cleanup_(EVP_PKEY_freep
) EVP_PKEY
*pkey
= NULL
;
3764 r
= openssl_pkey_from_pem(pem
, pem_size
, &pkey
);
3768 return tpm2_tpm2b_public_from_openssl_pkey(pkey
, ret
);
3770 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "OpenSSL support is disabled.");
3774 /* Marshal the public and private objects into a single nonstandard 'blob'. This is not a (publicly) standard
3775 * format, this is specific to how we currently store the sealed object. This 'blob' can be unmarshalled by
3776 * tpm2_unmarshal_blob(). */
3777 int tpm2_marshal_blob(
3778 const TPM2B_PUBLIC
*public,
3779 const TPM2B_PRIVATE
*private,
3781 size_t *ret_blob_size
) {
3788 assert(ret_blob_size
);
3790 size_t max_size
= sizeof(*private) + sizeof(*public);
3792 _cleanup_free_
void *blob
= malloc(max_size
);
3794 return log_oom_debug();
3796 size_t blob_size
= 0;
3797 rc
= sym_Tss2_MU_TPM2B_PRIVATE_Marshal(private, blob
, max_size
, &blob_size
);
3798 if (rc
!= TSS2_RC_SUCCESS
)
3799 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3800 "Failed to marshal private key: %s", sym_Tss2_RC_Decode(rc
));
3802 rc
= sym_Tss2_MU_TPM2B_PUBLIC_Marshal(public, blob
, max_size
, &blob_size
);
3803 if (rc
!= TSS2_RC_SUCCESS
)
3804 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3805 "Failed to marshal public key: %s", sym_Tss2_RC_Decode(rc
));
3807 *ret_blob
= TAKE_PTR(blob
);
3808 *ret_blob_size
= blob_size
;
3813 /* Unmarshal the 'blob' into public and private objects. This is not a (publicly) standard format, this is
3814 * specific to how we currently store the sealed object. This expects the 'blob' to have been created by
3815 * tpm2_marshal_blob(). */
3816 int tpm2_unmarshal_blob(
3819 TPM2B_PUBLIC
*ret_public
,
3820 TPM2B_PRIVATE
*ret_private
) {
3826 assert(ret_private
);
3828 TPM2B_PRIVATE
private = {};
3830 rc
= sym_Tss2_MU_TPM2B_PRIVATE_Unmarshal(blob
, blob_size
, &offset
, &private);
3831 if (rc
!= TSS2_RC_SUCCESS
)
3832 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3833 "Failed to unmarshal private key: %s", sym_Tss2_RC_Decode(rc
));
3835 TPM2B_PUBLIC
public = {};
3836 rc
= sym_Tss2_MU_TPM2B_PUBLIC_Unmarshal(blob
, blob_size
, &offset
, &public);
3837 if (rc
!= TSS2_RC_SUCCESS
)
3838 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3839 "Failed to unmarshal public key: %s", sym_Tss2_RC_Decode(rc
));
3841 *ret_public
= public;
3842 *ret_private
= private;
3847 /* Serialize a handle. This produces a binary object that can be later deserialized (by the same TPM), even
3848 * across restarts of the TPM or reboots (assuming the handle is persistent). */
3849 static int tpm2_serialize(
3851 const Tpm2Handle
*handle
,
3852 void **ret_serialized
,
3853 size_t *ret_serialized_size
) {
3859 assert(ret_serialized
);
3860 assert(ret_serialized_size
);
3862 _cleanup_(Esys_Freep
) unsigned char *serialized
= NULL
;
3864 rc
= sym_Esys_TR_Serialize(c
->esys_context
, handle
->esys_handle
, &serialized
, &size
);
3865 if (rc
!= TSS2_RC_SUCCESS
)
3866 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3867 "Failed to serialize: %s", sym_Tss2_RC_Decode(rc
));
3869 *ret_serialized
= TAKE_PTR(serialized
);
3870 *ret_serialized_size
= size
;
3875 static int tpm2_deserialize(
3877 const void *serialized
,
3878 size_t serialized_size
,
3879 Tpm2Handle
**ret_handle
) {
3888 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*handle
= NULL
;
3889 r
= tpm2_handle_new(c
, &handle
);
3893 /* Since this is an existing handle in the TPM we should not implicitly flush it. */
3894 handle
->flush
= false;
3896 rc
= sym_Esys_TR_Deserialize(c
->esys_context
, serialized
, serialized_size
, &handle
->esys_handle
);
3897 if (rc
!= TSS2_RC_SUCCESS
)
3898 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
3899 "Failed to deserialize: %s", sym_Tss2_RC_Decode(rc
));
3901 *ret_handle
= TAKE_PTR(handle
);
3906 int tpm2_seal(Tpm2Context
*c
,
3907 const TPM2B_DIGEST
*policy
,
3910 size_t *ret_secret_size
,
3912 size_t *ret_blob_size
,
3913 uint16_t *ret_primary_alg
,
3915 size_t *ret_srk_buf_size
) {
3917 uint16_t primary_alg
= 0;
3921 assert(ret_secret_size
);
3923 assert(ret_blob_size
);
3925 /* So here's what we do here: we connect to the TPM2 chip. It persistently contains a "seed" key that
3926 * is randomized when the TPM2 is first initialized or reset and remains stable across boots. We
3927 * generate a "primary" key pair derived from that (ECC if possible, RSA as fallback). Given the seed
3928 * remains fixed this will result in the same key pair whenever we specify the exact same parameters
3929 * for it. We then create a PCR-bound policy session, which calculates a hash on the current PCR
3930 * values of the indexes we specify. We then generate a randomized key on the host (which is the key
3931 * we actually enroll in the LUKS2 keyslots), which we upload into the TPM2, where it is encrypted
3932 * with the "primary" key, taking the PCR policy session into account. We then download the encrypted
3933 * key from the TPM2 ("sealing") and marshall it into binary form, which is ultimately placed in the
3934 * LUKS2 JSON header.
3936 * The TPM2 "seed" key and "primary" keys never leave the TPM2 chip (and cannot be extracted at
3937 * all). The random key we enroll in LUKS2 we generate on the host using the Linux random device. It
3938 * is stored in the LUKS2 JSON only in encrypted form with the "primary" key of the TPM2 chip, thus
3939 * binding the unlocking to the TPM2 chip. */
3941 usec_t start
= now(CLOCK_MONOTONIC
);
3943 /* We use a keyed hash object (i.e. HMAC) to store the secret key we want to use for unlocking the
3944 * LUKS2 volume with. We don't ever use for HMAC/keyed hash operations however, we just use it
3945 * because it's a key type that is universally supported and suitable for symmetric binary blobs. */
3946 TPMT_PUBLIC hmac_template
= {
3947 .type
= TPM2_ALG_KEYEDHASH
,
3948 .nameAlg
= TPM2_ALG_SHA256
,
3949 .objectAttributes
= TPMA_OBJECT_FIXEDTPM
| TPMA_OBJECT_FIXEDPARENT
,
3950 .parameters
.keyedHashDetail
.scheme
.scheme
= TPM2_ALG_NULL
,
3951 .unique
.keyedHash
.size
= SHA256_DIGEST_SIZE
,
3952 .authPolicy
= policy
? *policy
: TPM2B_DIGEST_MAKE(NULL
, TPM2_SHA256_DIGEST_SIZE
),
3955 TPMS_SENSITIVE_CREATE hmac_sensitive
= {
3956 .data
.size
= hmac_template
.unique
.keyedHash
.size
,
3959 CLEANUP_ERASE(hmac_sensitive
);
3962 r
= tpm2_get_pin_auth(TPM2_ALG_SHA256
, pin
, &hmac_sensitive
.userAuth
);
3967 assert(sizeof(hmac_sensitive
.data
.buffer
) >= hmac_sensitive
.data
.size
);
3969 (void) tpm2_credit_random(c
);
3971 log_debug("Generating secret key data.");
3973 r
= crypto_random_bytes(hmac_sensitive
.data
.buffer
, hmac_sensitive
.data
.size
);
3975 return log_debug_errno(r
, "Failed to generate secret key: %m");
3977 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*primary_handle
= NULL
;
3979 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*primary_public
= NULL
;
3980 r
= tpm2_get_or_create_srk(
3982 /* session= */ NULL
,
3984 /* ret_name= */ NULL
,
3985 /* ret_qname= */ NULL
,
3990 primary_alg
= primary_public
->publicArea
.type
;
3992 /* TODO: force all callers to provide ret_srk_buf, so we can stop sealing with the legacy templates. */
3993 primary_alg
= TPM2_ALG_ECC
;
3995 TPM2B_PUBLIC
template = { .size
= sizeof(TPMT_PUBLIC
), };
3996 r
= tpm2_get_legacy_template(primary_alg
, &template.publicArea
);
3998 return log_debug_errno(r
, "Could not get legacy ECC template: %m");
4000 if (!tpm2_supports_tpmt_public(c
, &template.publicArea
)) {
4001 primary_alg
= TPM2_ALG_RSA
;
4003 r
= tpm2_get_legacy_template(primary_alg
, &template.publicArea
);
4005 return log_debug_errno(r
, "Could not get legacy RSA template: %m");
4007 if (!tpm2_supports_tpmt_public(c
, &template.publicArea
))
4008 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
4009 "TPM does not support either ECC or RSA legacy template.");
4012 r
= tpm2_create_primary(
4014 /* session= */ NULL
,
4016 /* sensitive= */ NULL
,
4017 /* ret_public= */ NULL
,
4023 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*encryption_session
= NULL
;
4024 r
= tpm2_make_encryption_session(c
, primary_handle
, &TPM2_HANDLE_NONE
, &encryption_session
);
4028 _cleanup_(Esys_Freep
) TPM2B_PUBLIC
*public = NULL
;
4029 _cleanup_(Esys_Freep
) TPM2B_PRIVATE
*private = NULL
;
4030 r
= tpm2_create(c
, primary_handle
, encryption_session
, &hmac_template
, &hmac_sensitive
, &public, &private);
4034 _cleanup_(erase_and_freep
) void *secret
= NULL
;
4035 secret
= memdup(hmac_sensitive
.data
.buffer
, hmac_sensitive
.data
.size
);
4037 return log_oom_debug();
4039 log_debug("Marshalling private and public part of HMAC key.");
4041 _cleanup_free_
void *blob
= NULL
;
4043 r
= tpm2_marshal_blob(public, private, &blob
, &blob_size
);
4045 return log_debug_errno(r
, "Could not create sealed blob: %m");
4048 log_debug("Completed TPM2 key sealing in %s.", FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - start
, 1));
4050 _cleanup_free_
void *srk_buf
= NULL
;
4051 size_t srk_buf_size
= 0;
4053 _cleanup_(Esys_Freep
) void *tmp
= NULL
;
4054 r
= tpm2_serialize(c
, primary_handle
, &tmp
, &srk_buf_size
);
4059 * make a copy since we don't want the caller to understand that
4060 * ESYS allocated the pointer. It would make tracking what deallocator
4061 * to use for srk_buf in which context a PITA.
4063 srk_buf
= memdup(tmp
, srk_buf_size
);
4065 return log_oom_debug();
4067 *ret_srk_buf
= TAKE_PTR(srk_buf
);
4068 *ret_srk_buf_size
= srk_buf_size
;
4071 *ret_secret
= TAKE_PTR(secret
);
4072 *ret_secret_size
= hmac_sensitive
.data
.size
;
4073 *ret_blob
= TAKE_PTR(blob
);
4074 *ret_blob_size
= blob_size
;
4076 if (ret_primary_alg
)
4077 *ret_primary_alg
= primary_alg
;
4082 #define RETRY_UNSEAL_MAX 30u
4084 int tpm2_unseal(const char *device
,
4085 uint32_t hash_pcr_mask
,
4089 uint32_t pubkey_pcr_mask
,
4090 JsonVariant
*signature
,
4092 uint16_t primary_alg
,
4095 const void *known_policy_hash
,
4096 size_t known_policy_hash_size
,
4097 const void *srk_buf
,
4098 size_t srk_buf_size
,
4100 size_t *ret_secret_size
) {
4106 assert(blob_size
> 0);
4107 assert(known_policy_hash_size
== 0 || known_policy_hash
);
4108 assert(pubkey_size
== 0 || pubkey
);
4110 assert(ret_secret_size
);
4112 assert(TPM2_PCR_MASK_VALID(hash_pcr_mask
));
4113 assert(TPM2_PCR_MASK_VALID(pubkey_pcr_mask
));
4119 /* So here's what we do here: We connect to the TPM2 chip. As we do when sealing we generate a
4120 * "primary" key on the TPM2 chip, with the same parameters as well as a PCR-bound policy session.
4121 * Given we pass the same parameters, this will result in the same "primary" key, and same policy
4122 * hash (the latter of course, only if the PCR values didn't change in between). We unmarshal the
4123 * encrypted key we stored in the LUKS2 JSON token header and upload it into the TPM2, where it is
4124 * decrypted if the seed and the PCR policy were right ("unsealing"). We then download the result,
4125 * and use it to unlock the LUKS2 volume. */
4127 usec_t start
= now(CLOCK_MONOTONIC
);
4129 TPM2B_PUBLIC
public;
4130 TPM2B_PRIVATE
private;
4131 r
= tpm2_unmarshal_blob(blob
, blob_size
, &public, &private);
4133 return log_debug_errno(r
, "Could not extract parts from blob: %m");
4135 _cleanup_(tpm2_context_unrefp
) Tpm2Context
*c
= NULL
;
4136 r
= tpm2_context_new(device
, &c
);
4140 /* Older code did not save the pcr_bank, and unsealing needed to detect the best pcr bank to use,
4141 * so we need to handle that legacy situation. */
4142 if (pcr_bank
== UINT16_MAX
) {
4143 r
= tpm2_get_best_pcr_bank(c
, hash_pcr_mask
|pubkey_pcr_mask
, &pcr_bank
);
4148 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*primary_handle
= NULL
;
4150 r
= tpm2_deserialize(c
, srk_buf
, srk_buf_size
, &primary_handle
);
4153 } else if (primary_alg
!= 0) {
4154 TPM2B_PUBLIC
template = { .size
= sizeof(TPMT_PUBLIC
), };
4155 r
= tpm2_get_legacy_template(primary_alg
, &template.publicArea
);
4157 return log_debug_errno(r
, "Could not get legacy template: %m");
4159 r
= tpm2_create_primary(
4161 /* session= */ NULL
,
4163 /* sensitive= */ NULL
,
4164 /* ret_public= */ NULL
,
4169 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
),
4170 "No SRK or primary alg provided.");
4172 log_debug("Loading HMAC key into TPM.");
4175 * Nothing sensitive on the bus, no need for encryption. Even if an attacker
4176 * gives you back a different key, the session initiation will fail. In the
4177 * SRK model, the tpmKey is verified. In the non-srk model, with pin, the bindKey
4178 * provides protections.
4180 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*hmac_key
= NULL
;
4181 r
= tpm2_load(c
, primary_handle
, NULL
, &public, &private, &hmac_key
);
4185 TPM2B_PUBLIC pubkey_tpm2b
;
4186 _cleanup_free_
void *fp
= NULL
;
4189 r
= tpm2_tpm2b_public_from_pem(pubkey
, pubkey_size
, &pubkey_tpm2b
);
4191 return log_debug_errno(r
, "Could not create TPMT_PUBLIC: %m");
4193 r
= tpm2_tpm2b_public_to_fingerprint(&pubkey_tpm2b
, &fp
, &fp_size
);
4195 return log_debug_errno(r
, "Could not get key fingerprint: %m");
4199 * if a pin is set for the seal object, use it to bind the session
4200 * key to that object. This prevents active bus interposers from
4201 * faking a TPM and seeing the unsealed value. An active interposer
4202 * could fake a TPM, satisfying the encrypted session, and just
4203 * forward everything to the *real* TPM.
4205 r
= tpm2_set_auth(c
, hmac_key
, pin
);
4209 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*encryption_session
= NULL
;
4210 r
= tpm2_make_encryption_session(c
, primary_handle
, hmac_key
, &encryption_session
);
4214 _cleanup_(Esys_Freep
) TPM2B_SENSITIVE_DATA
* unsealed
= NULL
;
4215 for (unsigned i
= RETRY_UNSEAL_MAX
;; i
--) {
4216 _cleanup_(tpm2_handle_freep
) Tpm2Handle
*policy_session
= NULL
;
4217 _cleanup_(Esys_Freep
) TPM2B_DIGEST
*policy_digest
= NULL
;
4218 r
= tpm2_make_policy_session(
4226 r
= tpm2_build_sealing_policy(
4231 pubkey
? &pubkey_tpm2b
: NULL
,
4240 /* If we know the policy hash to expect, and it doesn't match, we can shortcut things here, and not
4241 * wait until the TPM2 tells us to go away. */
4242 if (known_policy_hash_size
> 0 &&
4243 memcmp_nn(policy_digest
->buffer
, policy_digest
->size
, known_policy_hash
, known_policy_hash_size
) != 0)
4244 return log_debug_errno(SYNTHETIC_ERRNO(EPERM
),
4245 "Current policy digest does not match stored policy digest, cancelling "
4246 "TPM2 authentication attempt.");
4248 log_debug("Unsealing HMAC key.");
4250 rc
= sym_Esys_Unseal(
4252 hmac_key
->esys_handle
,
4253 policy_session
->esys_handle
,
4254 encryption_session
->esys_handle
, /* use HMAC session to enable parameter encryption */
4257 if (rc
== TSS2_RC_SUCCESS
)
4259 if (rc
!= TPM2_RC_PCR_CHANGED
|| i
== 0)
4260 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
4261 "Failed to unseal HMAC key in TPM: %s", sym_Tss2_RC_Decode(rc
));
4262 log_debug("A PCR value changed during the TPM2 policy session, restarting HMAC key unsealing (%u tries left).", i
);
4265 _cleanup_(erase_and_freep
) char *secret
= NULL
;
4266 secret
= memdup(unsealed
->buffer
, unsealed
->size
);
4267 explicit_bzero_safe(unsealed
->buffer
, unsealed
->size
);
4269 return log_oom_debug();
4272 log_debug("Completed TPM2 key unsealing in %s.", FORMAT_TIMESPAN(now(CLOCK_MONOTONIC
) - start
, 1));
4274 *ret_secret
= TAKE_PTR(secret
);
4275 *ret_secret_size
= unsealed
->size
;
4282 int tpm2_list_devices(void) {
4284 _cleanup_(table_unrefp
) Table
*t
= NULL
;
4285 _cleanup_closedir_
DIR *d
= NULL
;
4290 return log_error_errno(r
, "TPM2 support is not installed.");
4292 t
= table_new("path", "device", "driver");
4296 d
= opendir("/sys/class/tpmrm");
4298 log_full_errno(errno
== ENOENT
? LOG_DEBUG
: LOG_ERR
, errno
, "Failed to open /sys/class/tpmrm: %m");
4299 if (errno
!= ENOENT
)
4303 _cleanup_free_
char *device_path
= NULL
, *device
= NULL
, *driver_path
= NULL
, *driver
= NULL
, *node
= NULL
;
4306 de
= readdir_no_dot(d
);
4310 device_path
= path_join("/sys/class/tpmrm", de
->d_name
, "device");
4314 r
= readlink_malloc(device_path
, &device
);
4316 log_debug_errno(r
, "Failed to read device symlink %s, ignoring: %m", device_path
);
4318 driver_path
= path_join(device_path
, "driver");
4322 r
= readlink_malloc(driver_path
, &driver
);
4324 log_debug_errno(r
, "Failed to read driver symlink %s, ignoring: %m", driver_path
);
4327 node
= path_join("/dev", de
->d_name
);
4334 TABLE_STRING
, device
? last_path_component(device
) : NULL
,
4335 TABLE_STRING
, driver
? last_path_component(driver
) : NULL
);
4337 return table_log_add_error(r
);
4341 if (table_get_rows(t
) <= 1) {
4342 log_info("No suitable TPM2 devices found.");
4346 r
= table_print(t
, stdout
);
4348 return log_error_errno(r
, "Failed to show device table: %m");
4352 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
4353 "TPM2 not supported on this build.");
4357 int tpm2_find_device_auto(char **ret
) {
4359 _cleanup_closedir_
DIR *d
= NULL
;
4364 return log_debug_errno(r
, "TPM2 support is not installed.");
4366 d
= opendir("/sys/class/tpmrm");
4368 log_debug_errno(errno
, "Failed to open /sys/class/tpmrm: %m");
4369 if (errno
!= ENOENT
)
4372 _cleanup_free_
char *node
= NULL
;
4377 de
= readdir_no_dot(d
);
4382 return log_debug_errno(SYNTHETIC_ERRNO(ENOTUNIQ
),
4383 "More than one TPM2 (tpmrm) device found.");
4385 node
= path_join("/dev", de
->d_name
);
4387 return log_oom_debug();
4391 *ret
= TAKE_PTR(node
);
4396 return log_debug_errno(SYNTHETIC_ERRNO(ENODEV
), "No TPM2 (tpmrm) device found.");
4398 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
),
4399 "TPM2 not supported on this build.");
4404 static const char* tpm2_userspace_event_type_table
[_TPM2_USERSPACE_EVENT_TYPE_MAX
] = {
4405 [TPM2_EVENT_PHASE
] = "phase",
4406 [TPM2_EVENT_FILESYSTEM
] = "filesystem",
4407 [TPM2_EVENT_VOLUME_KEY
] = "volume-key",
4408 [TPM2_EVENT_MACHINE_ID
] = "machine-id",
4411 DEFINE_STRING_TABLE_LOOKUP(tpm2_userspace_event_type
, Tpm2UserspaceEventType
);
4413 const char *tpm2_userspace_log_path(void) {
4414 return secure_getenv("SYSTEMD_MEASURE_LOG_USERSPACE") ?: "/run/log/systemd/tpm2-measure.log";
4417 static int tpm2_userspace_log_open(void) {
4418 _cleanup_close_
int fd
= -EBADF
;
4423 e
= tpm2_userspace_log_path();
4424 (void) mkdir_parents(e
, 0755);
4426 /* We use access mode 0600 here (even though the measurements should not strictly be confidential),
4427 * because we use BSD file locking on it, and if anyone but root can access the file they can also
4428 * lock it, which we want to avoid. */
4429 fd
= open(e
, O_CREAT
|O_WRONLY
|O_CLOEXEC
|O_NOCTTY
|O_NOFOLLOW
, 0600);
4431 return log_debug_errno(errno
, "Failed to open TPM log file '%s' for writing, ignoring: %m", e
);
4433 if (flock(fd
, LOCK_EX
) < 0)
4434 return log_debug_errno(errno
, "Failed to lock TPM log file '%s', ignoring: %m", e
);
4436 if (fstat(fd
, &st
) < 0)
4437 return log_debug_errno(errno
, "Failed to fstat TPM log file '%s', ignoring: %m", e
);
4439 r
= stat_verify_regular(&st
);
4441 return log_debug_errno(r
, "TPM log file '%s' is not regular, ignoring: %m", e
);
4443 /* We set the sticky bit when we are about to append to the log file. We'll unset it afterwards
4444 * again. If we manage to take a lock on a file that has it set we know we didn't write it fully and
4445 * it is corrupted. Ideally we'd like to use user xattrs for this, but unfortunately tmpfs (which is
4446 * our assumed backend fs) doesn't know user xattrs. */
4447 if (st
.st_mode
& S_ISVTX
)
4448 return log_debug_errno(SYNTHETIC_ERRNO(ESTALE
), "TPM log file '%s' aborted, ignoring.", e
);
4450 if (fchmod(fd
, 0600 | S_ISVTX
) < 0)
4451 return log_debug_errno(errno
, "Failed to chmod() TPM log file '%s', ignoring: %m", e
);
4456 static int tpm2_userspace_log(
4459 const TPML_DIGEST_VALUES
*values
,
4460 Tpm2UserspaceEventType event_type
,
4461 const char *description
) {
4463 _cleanup_(json_variant_unrefp
) JsonVariant
*v
= NULL
, *array
= NULL
;
4464 _cleanup_free_
char *f
= NULL
;
4469 assert(values
->count
> 0);
4471 /* We maintain a local PCR measurement log. This implements a subset of the TCG Canonical Event Log
4472 * Format – the JSON flavour –
4473 * (https://trustedcomputinggroup.org/resource/canonical-event-log-format/), but departs in certain
4474 * ways from it, specifically:
4476 * - We don't write out a recnum. It's a bit too vaguely defined which means we'd have to read
4477 * through the whole logs (include firmware logs) before knowing what the next value is we should
4478 * use. Hence we simply don't write this out as append-time, and instead expect a consumer to add
4479 * it in when it uses the data.
4481 * - We write this out in RFC 7464 application/json-seq rather than as a JSON array. Writing this as
4482 * JSON array would mean that for each appending we'd have to read the whole log file fully into
4483 * memory before writing it out again. We prefer a strictly append-only write pattern however. (RFC
4484 * 7464 is what jq --seq eats.) Conversion into a proper JSON array is trivial.
4486 * It should be possible to convert this format in a relatively straight-forward way into the
4487 * official TCG Canonical Event Log Format on read, by simply adding in a few more fields that can be
4488 * determined from the full dataset.
4490 * We set the 'content_type' field to "systemd" to make clear this data is generated by us, and
4491 * include various interesting fields in the 'content' subobject, including a CLOCK_BOOTTIME
4492 * timestamp which can be used to order this measurement against possibly other measurements
4493 * independently done by other subsystems on the system.
4496 if (fd
< 0) /* Apparently tpm2_local_log_open() failed earlier, let's not complain again */
4499 for (size_t i
= 0; i
< values
->count
; i
++) {
4500 const EVP_MD
*implementation
;
4503 assert_se(a
= tpm2_hash_alg_to_string(values
->digests
[i
].hashAlg
));
4504 assert_se(implementation
= EVP_get_digestbyname(a
));
4506 r
= json_variant_append_arrayb(
4507 &array
, JSON_BUILD_OBJECT(
4508 JSON_BUILD_PAIR_STRING("hashAlg", a
),
4509 JSON_BUILD_PAIR("digest", JSON_BUILD_HEX(&values
->digests
[i
].digest
, EVP_MD_size(implementation
)))));
4511 return log_debug_errno(r
, "Failed to append digest object to JSON array: %m");
4516 r
= sd_id128_get_boot(&boot_id
);
4518 return log_debug_errno(r
, "Failed to acquire boot ID: %m");
4520 r
= json_build(&v
, JSON_BUILD_OBJECT(
4521 JSON_BUILD_PAIR("pcr", JSON_BUILD_UNSIGNED(pcr_index
)),
4522 JSON_BUILD_PAIR("digests", JSON_BUILD_VARIANT(array
)),
4523 JSON_BUILD_PAIR("content_type", JSON_BUILD_STRING("systemd")),
4524 JSON_BUILD_PAIR("content", JSON_BUILD_OBJECT(
4525 JSON_BUILD_PAIR_CONDITION(description
, "string", JSON_BUILD_STRING(description
)),
4526 JSON_BUILD_PAIR("bootId", JSON_BUILD_ID128(boot_id
)),
4527 JSON_BUILD_PAIR("timestamp", JSON_BUILD_UNSIGNED(now(CLOCK_BOOTTIME
))),
4528 JSON_BUILD_PAIR_CONDITION(event_type
>= 0, "eventType", JSON_BUILD_STRING(tpm2_userspace_event_type_to_string(event_type
)))))));
4530 return log_debug_errno(r
, "Failed to build log record JSON: %m");
4532 r
= json_variant_format(v
, JSON_FORMAT_SEQ
, &f
);
4534 return log_debug_errno(r
, "Failed to format JSON: %m");
4536 if (lseek(fd
, 0, SEEK_END
) == (off_t
) -1)
4537 return log_debug_errno(errno
, "Failed to seek to end of JSON log: %m");
4539 r
= loop_write(fd
, f
, SIZE_MAX
);
4541 return log_debug_errno(r
, "Failed to write JSON data to log: %m");
4544 return log_debug_errno(errno
, "Failed to sync JSON data: %m");
4546 /* Unset S_ISVTX again */
4547 if (fchmod(fd
, 0600) < 0)
4548 return log_debug_errno(errno
, "Failed to chmod() TPM log file, ignoring: %m");
4552 return log_debug_errno(r
, "Failed to sync JSON log: %m");
4557 int tpm2_extend_bytes(
4565 Tpm2UserspaceEventType event_type
,
4566 const char *description
) {
4569 _cleanup_close_
int log_fd
= -EBADF
;
4570 TPML_DIGEST_VALUES values
= {};
4574 assert(data
|| data_size
== 0);
4575 assert(secret
|| secret_size
== 0);
4577 if (data_size
== SIZE_MAX
)
4578 data_size
= strlen(data
);
4579 if (secret_size
== SIZE_MAX
)
4580 secret_size
= strlen(secret
);
4582 if (pcr_index
>= TPM2_PCRS_MAX
)
4583 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "Can't measure into unsupported PCR %u, refusing.", pcr_index
);
4585 if (strv_isempty(banks
))
4588 STRV_FOREACH(bank
, banks
) {
4589 const EVP_MD
*implementation
;
4592 assert_se(implementation
= EVP_get_digestbyname(*bank
));
4594 if (values
.count
>= ELEMENTSOF(values
.digests
))
4595 return log_debug_errno(SYNTHETIC_ERRNO(E2BIG
), "Too many banks selected.");
4597 if ((size_t) EVP_MD_size(implementation
) > sizeof(values
.digests
[values
.count
].digest
))
4598 return log_debug_errno(SYNTHETIC_ERRNO(E2BIG
), "Hash result too large for TPM2.");
4600 id
= tpm2_hash_alg_from_string(EVP_MD_name(implementation
));
4602 return log_debug_errno(id
, "Can't map hash name to TPM2.");
4604 values
.digests
[values
.count
].hashAlg
= id
;
4606 /* So here's a twist: sometimes we want to measure secrets (e.g. root file system volume
4607 * key), but we'd rather not leak a literal hash of the secret to the TPM (given that the
4608 * wire is unprotected, and some other subsystem might use the simple, literal hash of the
4609 * secret for other purposes, maybe because it needs a shorter secret derived from it for
4610 * some unrelated purpose, who knows). Hence we instead measure an HMAC signature of a
4611 * private non-secret string instead. */
4612 if (secret_size
> 0) {
4613 if (!HMAC(implementation
, secret
, secret_size
, data
, data_size
, (unsigned char*) &values
.digests
[values
.count
].digest
, NULL
))
4614 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "Failed to calculate HMAC of data to measure.");
4615 } else if (EVP_Digest(data
, data_size
, (unsigned char*) &values
.digests
[values
.count
].digest
, NULL
, implementation
, NULL
) != 1)
4616 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "Failed to hash data to measure.");
4621 /* Open + lock the log file *before* we start measuring, so that noone else can come between our log
4622 * and our measurement and change either */
4623 log_fd
= tpm2_userspace_log_open();
4625 rc
= sym_Esys_PCR_Extend(
4627 ESYS_TR_PCR0
+ pcr_index
,
4632 if (rc
!= TSS2_RC_SUCCESS
)
4633 return log_debug_errno(
4634 SYNTHETIC_ERRNO(ENOTRECOVERABLE
),
4635 "Failed to measure into PCR %u: %s",
4637 sym_Tss2_RC_Decode(rc
));
4639 /* Now, write what we just extended to the log, too. */
4640 (void) tpm2_userspace_log(log_fd
, pcr_index
, &values
, event_type
, description
);
4643 #else /* HAVE_OPENSSL */
4644 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "OpenSSL support is disabled.");
4649 char *tpm2_pcr_mask_to_string(uint32_t mask
) {
4650 _cleanup_free_
char *s
= NULL
;
4652 FOREACH_PCR_IN_MASK(n
, mask
)
4653 if (strextendf_with_separator(&s
, "+", "%d", n
) < 0)
4662 int tpm2_make_pcr_json_array(uint32_t pcr_mask
, JsonVariant
**ret
) {
4663 _cleanup_(json_variant_unrefp
) JsonVariant
*a
= NULL
;
4668 for (size_t i
= 0; i
< TPM2_PCRS_MAX
; i
++) {
4669 _cleanup_(json_variant_unrefp
) JsonVariant
*e
= NULL
;
4671 if ((pcr_mask
& (UINT32_C(1) << i
)) == 0)
4674 r
= json_variant_new_integer(&e
, i
);
4678 r
= json_variant_append_array(&a
, e
);
4684 return json_variant_new_array(ret
, NULL
, 0);
4690 int tpm2_parse_pcr_json_array(JsonVariant
*v
, uint32_t *ret
) {
4694 if (!json_variant_is_array(v
))
4695 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 PCR array is not a JSON array.");
4697 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
4700 if (!json_variant_is_unsigned(e
))
4701 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 PCR is not an unsigned integer.");
4703 u
= json_variant_unsigned(e
);
4704 if (u
>= TPM2_PCRS_MAX
)
4705 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 PCR number out of range: %" PRIu64
, u
);
4707 mask
|= UINT32_C(1) << u
;
4716 int tpm2_make_luks2_json(
4718 uint32_t hash_pcr_mask
,
4722 uint32_t pubkey_pcr_mask
,
4723 uint16_t primary_alg
,
4726 const void *policy_hash
,
4727 size_t policy_hash_size
,
4730 const void *srk_buf
,
4731 size_t srk_buf_size
,
4733 JsonVariant
**ret
) {
4735 _cleanup_(json_variant_unrefp
) JsonVariant
*v
= NULL
, *hmj
= NULL
, *pkmj
= NULL
;
4736 _cleanup_free_
char *keyslot_as_string
= NULL
;
4739 assert(blob
|| blob_size
== 0);
4740 assert(policy_hash
|| policy_hash_size
== 0);
4741 assert(pubkey
|| pubkey_size
== 0);
4743 if (asprintf(&keyslot_as_string
, "%i", keyslot
) < 0)
4746 r
= tpm2_make_pcr_json_array(hash_pcr_mask
, &hmj
);
4750 if (pubkey_pcr_mask
!= 0) {
4751 r
= tpm2_make_pcr_json_array(pubkey_pcr_mask
, &pkmj
);
4756 /* Note: We made the mistake of using "-" in the field names, which isn't particular compatible with
4757 * other programming languages. Let's not make things worse though, i.e. future additions to the JSON
4758 * object should use "_" rather than "-" in field names. */
4762 JSON_BUILD_PAIR("type", JSON_BUILD_CONST_STRING("systemd-tpm2")),
4763 JSON_BUILD_PAIR("keyslots", JSON_BUILD_ARRAY(JSON_BUILD_STRING(keyslot_as_string
))),
4764 JSON_BUILD_PAIR("tpm2-blob", JSON_BUILD_BASE64(blob
, blob_size
)),
4765 JSON_BUILD_PAIR("tpm2-pcrs", JSON_BUILD_VARIANT(hmj
)),
4766 JSON_BUILD_PAIR_CONDITION(!!tpm2_hash_alg_to_string(pcr_bank
), "tpm2-pcr-bank", JSON_BUILD_STRING(tpm2_hash_alg_to_string(pcr_bank
))),
4767 JSON_BUILD_PAIR_CONDITION(!!tpm2_asym_alg_to_string(primary_alg
), "tpm2-primary-alg", JSON_BUILD_STRING(tpm2_asym_alg_to_string(primary_alg
))),
4768 JSON_BUILD_PAIR("tpm2-policy-hash", JSON_BUILD_HEX(policy_hash
, policy_hash_size
)),
4769 JSON_BUILD_PAIR("tpm2-pin", JSON_BUILD_BOOLEAN(flags
& TPM2_FLAGS_USE_PIN
)),
4770 JSON_BUILD_PAIR_CONDITION(pubkey_pcr_mask
!= 0, "tpm2_pubkey_pcrs", JSON_BUILD_VARIANT(pkmj
)),
4771 JSON_BUILD_PAIR_CONDITION(pubkey_pcr_mask
!= 0, "tpm2_pubkey", JSON_BUILD_BASE64(pubkey
, pubkey_size
)),
4772 JSON_BUILD_PAIR_CONDITION(salt
, "tpm2_salt", JSON_BUILD_BASE64(salt
, salt_size
)),
4773 JSON_BUILD_PAIR_CONDITION(srk_buf
, "tpm2_srk", JSON_BUILD_BASE64(srk_buf
, srk_buf_size
))));
4783 int tpm2_parse_luks2_json(
4786 uint32_t *ret_hash_pcr_mask
,
4787 uint16_t *ret_pcr_bank
,
4789 size_t *ret_pubkey_size
,
4790 uint32_t *ret_pubkey_pcr_mask
,
4791 uint16_t *ret_primary_alg
,
4793 size_t *ret_blob_size
,
4794 void **ret_policy_hash
,
4795 size_t *ret_policy_hash_size
,
4797 size_t *ret_salt_size
,
4799 size_t *ret_srk_buf_size
,
4800 TPM2Flags
*ret_flags
) {
4802 _cleanup_free_
void *blob
= NULL
, *policy_hash
= NULL
, *pubkey
= NULL
, *salt
= NULL
, *srk_buf
= NULL
;
4803 size_t blob_size
= 0, policy_hash_size
= 0, pubkey_size
= 0, salt_size
= 0, srk_buf_size
= 0;
4804 uint32_t hash_pcr_mask
= 0, pubkey_pcr_mask
= 0;
4805 uint16_t primary_alg
= TPM2_ALG_ECC
; /* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */
4806 uint16_t pcr_bank
= UINT16_MAX
; /* default: pick automatically */
4807 int r
, keyslot
= -1;
4808 TPM2Flags flags
= 0;
4814 keyslot
= cryptsetup_get_keyslot_from_token(v
);
4816 /* Return a recognizable error when parsing this field, so that callers can handle parsing
4817 * errors of the keyslots field gracefully, since it's not 'owned' by us, but by the LUKS2
4819 log_debug_errno(keyslot
, "Failed to extract keyslot index from TPM2 JSON data token, skipping: %m");
4824 w
= json_variant_by_key(v
, "tpm2-pcrs");
4826 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 token data lacks 'tpm2-pcrs' field.");
4828 r
= tpm2_parse_pcr_json_array(w
, &hash_pcr_mask
);
4830 return log_debug_errno(r
, "Failed to parse TPM2 PCR mask: %m");
4832 /* The bank field is optional, since it was added in systemd 250 only. Before the bank was hardcoded
4834 w
= json_variant_by_key(v
, "tpm2-pcr-bank");
4836 /* The PCR bank field is optional */
4838 if (!json_variant_is_string(w
))
4839 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 PCR bank is not a string.");
4841 r
= tpm2_hash_alg_from_string(json_variant_string(w
));
4843 return log_debug_errno(r
, "TPM2 PCR bank invalid or not supported: %s", json_variant_string(w
));
4848 /* The primary key algorithm field is optional, since it was also added in systemd 250 only. Before
4849 * the algorithm was hardcoded to ECC. */
4850 w
= json_variant_by_key(v
, "tpm2-primary-alg");
4852 /* The primary key algorithm is optional */
4854 if (!json_variant_is_string(w
))
4855 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 primary key algorithm is not a string.");
4857 r
= tpm2_asym_alg_from_string(json_variant_string(w
));
4859 return log_debug_errno(r
, "TPM2 asymmetric algorithm invalid or not supported: %s", json_variant_string(w
));
4864 w
= json_variant_by_key(v
, "tpm2-blob");
4866 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 token data lacks 'tpm2-blob' field.");
4868 r
= json_variant_unbase64(w
, &blob
, &blob_size
);
4870 return log_debug_errno(r
, "Invalid base64 data in 'tpm2-blob' field.");
4872 w
= json_variant_by_key(v
, "tpm2-policy-hash");
4874 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 token data lacks 'tpm2-policy-hash' field.");
4876 r
= json_variant_unhex(w
, &policy_hash
, &policy_hash_size
);
4878 return log_debug_errno(r
, "Invalid base64 data in 'tpm2-policy-hash' field.");
4880 w
= json_variant_by_key(v
, "tpm2-pin");
4882 if (!json_variant_is_boolean(w
))
4883 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "TPM2 PIN policy is not a boolean.");
4885 SET_FLAG(flags
, TPM2_FLAGS_USE_PIN
, json_variant_boolean(w
));
4888 w
= json_variant_by_key(v
, "tpm2_salt");
4890 r
= json_variant_unbase64(w
, &salt
, &salt_size
);
4892 return log_debug_errno(r
, "Invalid base64 data in 'tpm2_salt' field.");
4895 w
= json_variant_by_key(v
, "tpm2_pubkey_pcrs");
4897 r
= tpm2_parse_pcr_json_array(w
, &pubkey_pcr_mask
);
4902 w
= json_variant_by_key(v
, "tpm2_pubkey");
4904 r
= json_variant_unbase64(w
, &pubkey
, &pubkey_size
);
4906 return log_debug_errno(r
, "Failed to decode PCR public key.");
4907 } else if (pubkey_pcr_mask
!= 0)
4908 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Public key PCR mask set, but not public key included in JSON data, refusing.");
4910 w
= json_variant_by_key(v
, "tpm2_srk");
4912 r
= json_variant_unbase64(w
, &srk_buf
, &srk_buf_size
);
4914 return log_debug_errno(r
, "Invalid base64 data in 'tpm2_srk' field.");
4918 *ret_keyslot
= keyslot
;
4919 if (ret_hash_pcr_mask
)
4920 *ret_hash_pcr_mask
= hash_pcr_mask
;
4922 *ret_pcr_bank
= pcr_bank
;
4924 *ret_pubkey
= TAKE_PTR(pubkey
);
4925 if (ret_pubkey_size
)
4926 *ret_pubkey_size
= pubkey_size
;
4927 if (ret_pubkey_pcr_mask
)
4928 *ret_pubkey_pcr_mask
= pubkey_pcr_mask
;
4929 if (ret_primary_alg
)
4930 *ret_primary_alg
= primary_alg
;
4932 *ret_blob
= TAKE_PTR(blob
);
4934 *ret_blob_size
= blob_size
;
4935 if (ret_policy_hash
)
4936 *ret_policy_hash
= TAKE_PTR(policy_hash
);
4937 if (ret_policy_hash_size
)
4938 *ret_policy_hash_size
= policy_hash_size
;
4940 *ret_salt
= TAKE_PTR(salt
);
4942 *ret_salt_size
= salt_size
;
4946 *ret_srk_buf
= TAKE_PTR(srk_buf
);
4947 if (ret_srk_buf_size
)
4948 *ret_srk_buf_size
= srk_buf_size
;
4953 int tpm2_hash_alg_to_size(uint16_t alg
) {
4957 case TPM2_ALG_SHA256
:
4959 case TPM2_ALG_SHA384
:
4961 case TPM2_ALG_SHA512
:
4964 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Unknown hash algorithm id 0x%" PRIx16
, alg
);
4968 const char *tpm2_hash_alg_to_string(uint16_t alg
) {
4972 case TPM2_ALG_SHA256
:
4974 case TPM2_ALG_SHA384
:
4976 case TPM2_ALG_SHA512
:
4979 log_debug("Unknown hash algorithm id 0x%" PRIx16
, alg
);
4984 int tpm2_hash_alg_from_string(const char *alg
) {
4985 if (strcaseeq_ptr(alg
, "sha1"))
4986 return TPM2_ALG_SHA1
;
4987 if (strcaseeq_ptr(alg
, "sha256"))
4988 return TPM2_ALG_SHA256
;
4989 if (strcaseeq_ptr(alg
, "sha384"))
4990 return TPM2_ALG_SHA384
;
4991 if (strcaseeq_ptr(alg
, "sha512"))
4992 return TPM2_ALG_SHA512
;
4993 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Unknown hash algorithm name '%s'", alg
);
4996 const char *tpm2_asym_alg_to_string(uint16_t alg
) {
5003 log_debug("Unknown asymmetric algorithm id 0x%" PRIx16
, alg
);
5008 int tpm2_asym_alg_from_string(const char *alg
) {
5009 if (strcaseeq_ptr(alg
, "ecc"))
5010 return TPM2_ALG_ECC
;
5011 if (strcaseeq_ptr(alg
, "rsa"))
5012 return TPM2_ALG_RSA
;
5013 return log_debug_errno(SYNTHETIC_ERRNO(EINVAL
), "Unknown asymmetric algorithm name '%s'", alg
);
5016 Tpm2Support
tpm2_support(void) {
5017 Tpm2Support support
= TPM2_SUPPORT_NONE
;
5020 if (detect_container() <= 0) {
5021 /* Check if there's a /dev/tpmrm* device via sysfs. If we run in a container we likely just
5022 * got the host sysfs mounted. Since devices are generally not virtualized for containers,
5023 * let's assume containers never have a TPM, at least for now. */
5025 r
= dir_is_empty("/sys/class/tpmrm", /* ignore_hidden_or_backup= */ false);
5028 log_debug_errno(r
, "Unable to test whether /sys/class/tpmrm/ exists and is populated, assuming it is not: %m");
5029 } else if (r
== 0) /* populated! */
5030 support
|= TPM2_SUPPORT_SUBSYSTEM
|TPM2_SUPPORT_DRIVER
;
5032 /* If the directory exists but is empty, we know the subsystem is enabled but no
5033 * driver has been loaded yet. */
5034 support
|= TPM2_SUPPORT_SUBSYSTEM
;
5038 support
|= TPM2_SUPPORT_FIRMWARE
;
5041 support
|= TPM2_SUPPORT_SYSTEM
;
5045 support
|= TPM2_SUPPORT_LIBRARIES
;
5052 static void tpm2_pcr_values_apply_default_hash_alg(Tpm2PCRValue
*pcr_values
, size_t n_pcr_values
) {
5053 TPMI_ALG_HASH default_hash
= 0;
5054 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
5056 default_hash
= v
->hash
;
5060 if (default_hash
!= 0)
5061 FOREACH_ARRAY(v
, pcr_values
, n_pcr_values
)
5063 v
->hash
= default_hash
;
5067 /* The following tpm2_parse_pcr_argument*() functions all log errors, to match the behavior of system-wide
5068 * parse_*_argument() functions. */
5070 /* Parse the PCR selection/value arg(s) and return a corresponding array of Tpm2PCRValue objects.
5072 * The format is the same as tpm2_pcr_values_from_string(). The first provided entry with a hash algorithm
5073 * set will be used as the 'default' hash algorithm. All entries with an unset hash algorithm will be updated
5074 * with the 'default' hash algorithm. The resulting array will be sorted and checked for validity.
5076 * This will replace *ret_pcr_values with the new array of pcr values; to append to an existing array, use
5077 * tpm2_parse_pcr_argument_append(). */
5078 int tpm2_parse_pcr_argument(const char *arg
, Tpm2PCRValue
**ret_pcr_values
, size_t *ret_n_pcr_values
) {
5083 assert(ret_pcr_values
);
5084 assert(ret_n_pcr_values
);
5086 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
5087 size_t n_pcr_values
= 0;
5088 r
= tpm2_pcr_values_from_string(arg
, &pcr_values
, &n_pcr_values
);
5090 return log_error_errno(r
, "Could not parse PCR values from '%s': %m", arg
);
5092 tpm2_pcr_values_apply_default_hash_alg(pcr_values
, n_pcr_values
);
5094 tpm2_sort_pcr_values(pcr_values
, n_pcr_values
);
5096 if (!tpm2_pcr_values_valid(pcr_values
, n_pcr_values
))
5097 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Parsed PCR values are not valid.");
5099 *ret_pcr_values
= TAKE_PTR(pcr_values
);
5100 *ret_n_pcr_values
= n_pcr_values
;
5104 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "TPM2 support is disabled.");
5108 /* Same as tpm2_parse_pcr_argument(), but the pcr values array is appended to. If the provided pcr values
5109 * array is not NULL, it must point to an allocated pcr values array and the provided number of pcr values
5112 * Note that 'arg' is parsed into a new array of pcr values independently of any previous pcr values,
5113 * including application of the default hash algorithm. Then the two arrays are combined, the default hash
5114 * algorithm check applied again (in case either the previous or current array had no default hash
5115 * algorithm), and then the resulting array is sorted and rechecked for validity. */
5116 int tpm2_parse_pcr_argument_append(const char *arg
, Tpm2PCRValue
**pcr_values
, size_t *n_pcr_values
) {
5122 assert(n_pcr_values
);
5124 _cleanup_free_ Tpm2PCRValue
*more_pcr_values
= NULL
;
5125 size_t n_more_pcr_values
;
5126 r
= tpm2_parse_pcr_argument(arg
, &more_pcr_values
, &n_more_pcr_values
);
5130 /* If we got previous values, append them. */
5131 if (*pcr_values
&& !GREEDY_REALLOC_APPEND(more_pcr_values
, n_more_pcr_values
, *pcr_values
, *n_pcr_values
))
5134 tpm2_pcr_values_apply_default_hash_alg(more_pcr_values
, n_more_pcr_values
);
5136 tpm2_sort_pcr_values(more_pcr_values
, n_more_pcr_values
);
5138 if (!tpm2_pcr_values_valid(more_pcr_values
, n_more_pcr_values
))
5139 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Parsed PCR values are not valid.");
5141 SWAP_TWO(*pcr_values
, more_pcr_values
);
5142 *n_pcr_values
= n_more_pcr_values
;
5146 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "TPM2 support is disabled.");
5150 /* Same as tpm2_parse_pcr_argument() but converts the pcr values to a pcr mask. If more than one hash
5151 * algorithm is included in the pcr values array this results in error. This retains the previous behavior of
5152 * tpm2_parse_pcr_argument() of clearing the mask if 'arg' is empty, replacing the mask if it is set to
5153 * UINT32_MAX, and or-ing the mask otherwise. */
5154 int tpm2_parse_pcr_argument_to_mask(const char *arg
, uint32_t *ret_mask
) {
5156 _cleanup_free_ Tpm2PCRValue
*pcr_values
= NULL
;
5157 size_t n_pcr_values
;
5163 r
= tpm2_parse_pcr_argument(arg
, &pcr_values
, &n_pcr_values
);
5167 if (n_pcr_values
== 0) {
5168 /* This retains the previous behavior of clearing the mask if the arg is empty */
5174 r
= tpm2_pcr_values_hash_count(pcr_values
, n_pcr_values
, &hash_count
);
5176 return log_error_errno(r
, "Could not get hash count from pcr values: %m");
5179 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Multiple PCR hash banks selected.");
5182 r
= tpm2_pcr_values_to_mask(pcr_values
, n_pcr_values
, pcr_values
[0].hash
, &new_mask
);
5184 return log_error_errno(r
, "Could not get pcr values mask: %m");
5186 if (*ret_mask
== UINT32_MAX
)
5187 *ret_mask
= new_mask
;
5189 *ret_mask
|= new_mask
;
5193 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "TPM2 support is disabled.");
5197 int tpm2_load_pcr_signature(const char *path
, JsonVariant
**ret
) {
5198 _cleanup_strv_free_
char **search
= NULL
;
5199 _cleanup_free_
char *discovered_path
= NULL
;
5200 _cleanup_fclose_
FILE *f
= NULL
;
5203 /* Tries to load a JSON PCR signature file. Takes an absolute path, a simple file name or NULL. In
5204 * the latter two cases searches in /etc/, /usr/lib/, /run/, as usual. */
5206 search
= strv_split_nulstr(CONF_PATHS_NULSTR("systemd"));
5208 return log_oom_debug();
5211 /* If no path is specified, then look for "tpm2-pcr-signature.json" automatically. Also, in
5212 * this case include /.extra/ in the search path, but only in this case, and if we run in the
5213 * initrd. We don't want to be too eager here, after all /.extra/ is untrusted territory. */
5215 path
= "tpm2-pcr-signature.json";
5218 if (strv_extend(&search
, "/.extra") < 0)
5219 return log_oom_debug();
5222 r
= search_and_fopen(path
, "re", NULL
, (const char**) search
, &f
, &discovered_path
);
5224 return log_debug_errno(r
, "Failed to find TPM PCR signature file '%s': %m", path
);
5226 r
= json_parse_file(f
, discovered_path
, 0, ret
, NULL
, NULL
);
5228 return log_debug_errno(r
, "Failed to parse TPM PCR signature JSON object '%s': %m", discovered_path
);
5233 int tpm2_load_pcr_public_key(const char *path
, void **ret_pubkey
, size_t *ret_pubkey_size
) {
5234 _cleanup_free_
char *discovered_path
= NULL
;
5235 _cleanup_fclose_
FILE *f
= NULL
;
5238 /* Tries to load a PCR public key file. Takes an absolute path, a simple file name or NULL. In the
5239 * latter two cases searches in /etc/, /usr/lib/, /run/, as usual. */
5242 path
= "tpm2-pcr-public-key.pem";
5244 r
= search_and_fopen(path
, "re", NULL
, (const char**) CONF_PATHS_STRV("systemd"), &f
, &discovered_path
);
5246 return log_debug_errno(r
, "Failed to find TPM PCR public key file '%s': %m", path
);
5248 r
= read_full_stream(f
, (char**) ret_pubkey
, ret_pubkey_size
);
5250 return log_debug_errno(r
, "Failed to load TPM PCR public key PEM file '%s': %m", discovered_path
);
5255 #define PBKDF2_HMAC_SHA256_ITERATIONS 10000
5258 * Implements PBKDF2 HMAC SHA256 for a derived keylen of 32
5259 * bytes and for PBKDF2_HMAC_SHA256_ITERATIONS count.
5260 * I found the wikipedia entry relevant and it contains links to
5262 * - https://en.wikipedia.org/wiki/PBKDF2
5263 * - https://www.rfc-editor.org/rfc/rfc2898#section-5.2
5265 int tpm2_util_pbkdf2_hmac_sha256(const void *pass
,
5269 uint8_t ret_key
[static SHA256_DIGEST_SIZE
]) {
5271 uint8_t _cleanup_(erase_and_freep
) *buffer
= NULL
;
5272 uint8_t u
[SHA256_DIGEST_SIZE
];
5274 /* To keep this simple, since derived KeyLen (dkLen in docs)
5275 * Is the same as the hash output, we don't need multiple
5276 * blocks. Part of the algorithm is to add the block count
5277 * in, but this can be hardcoded to 1.
5279 static const uint8_t block_cnt
[] = { 0, 0, 0, 1 };
5282 assert (saltlen
> 0);
5283 assert (saltlen
<= (SIZE_MAX
- sizeof(block_cnt
)));
5284 assert (passlen
> 0);
5287 * Build a buffer of salt + block_cnt and hmac_sha256 it we
5288 * do this as we don't have a context builder for HMAC_SHA256.
5290 buffer
= malloc(saltlen
+ sizeof(block_cnt
));
5294 memcpy(buffer
, salt
, saltlen
);
5295 memcpy(&buffer
[saltlen
], block_cnt
, sizeof(block_cnt
));
5297 hmac_sha256(pass
, passlen
, buffer
, saltlen
+ sizeof(block_cnt
), u
);
5299 /* dk needs to be an unmodified u as u gets modified in the loop */
5300 memcpy(ret_key
, u
, SHA256_DIGEST_SIZE
);
5301 uint8_t *dk
= ret_key
;
5303 for (size_t i
= 1; i
< PBKDF2_HMAC_SHA256_ITERATIONS
; i
++) {
5304 hmac_sha256(pass
, passlen
, u
, sizeof(u
), u
);
5306 for (size_t j
=0; j
< sizeof(u
); j
++)
5313 static const char* const tpm2_pcr_index_table
[_TPM2_PCR_INDEX_MAX_DEFINED
] = {
5314 [TPM2_PCR_PLATFORM_CODE
] = "platform-code",
5315 [TPM2_PCR_PLATFORM_CONFIG
] = "platform-config",
5316 [TPM2_PCR_EXTERNAL_CODE
] = "external-code",
5317 [TPM2_PCR_EXTERNAL_CONFIG
] = "external-config",
5318 [TPM2_PCR_BOOT_LOADER_CODE
] = "boot-loader-code",
5319 [TPM2_PCR_BOOT_LOADER_CONFIG
] = "boot-loader-config",
5320 [TPM2_PCR_HOST_PLATFORM
] = "host-platform",
5321 [TPM2_PCR_SECURE_BOOT_POLICY
] = "secure-boot-policy",
5322 [TPM2_PCR_KERNEL_INITRD
] = "kernel-initrd",
5323 [TPM2_PCR_IMA
] = "ima",
5324 [TPM2_PCR_KERNEL_BOOT
] = "kernel-boot",
5325 [TPM2_PCR_KERNEL_CONFIG
] = "kernel-config",
5326 [TPM2_PCR_SYSEXTS
] = "sysexts",
5327 [TPM2_PCR_SHIM_POLICY
] = "shim-policy",
5328 [TPM2_PCR_SYSTEM_IDENTITY
] = "system-identity",
5329 [TPM2_PCR_DEBUG
] = "debug",
5330 [TPM2_PCR_APPLICATION_SUPPORT
] = "application-support",
5333 DEFINE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_FALLBACK(tpm2_pcr_index
, int, TPM2_PCRS_MAX
- 1);
5334 DEFINE_STRING_TABLE_LOOKUP_TO_STRING(tpm2_pcr_index
, int);