stub: measure SMBIOS kernel-cmdline-extra in PCR12

PCR1, where SMBIOS strings are measured, is filled with data that is not
under the control of the machine owner. Measure cmdline extensions in
PCR12 too, where we measure other optional addons that are loaded by
sd-stub.

diff --git a/man/systemd-stub.xml b/man/systemd-stub.xml
index 21b79cd35f1aa51e0f525e8a2177d1b83c1bcfd7..4cbf9cde85bf368c5b0d2c7c2d68d901087b4405 100644 (file)
--- a/man/systemd-stub.xml
+++ b/man/systemd-stub.xml
@@ -63,6 +63,9 @@
       <listitem><para>A compiled binary DeviceTree will be looked for in the <literal>.dtb</literal> PE
       section.</para></listitem>
 
+      <listitem><para>Kernel version information, i.e. the output of <command>uname -r</command> for the
+      kernel included in the UKI, in the <literal>.uname</literal> PE section.</para></listitem>
+
       <listitem><para>The kernel command line to pass to the invoked kernel will be looked for in the
       <literal>.cmdline</literal> PE section.</para></listitem>
 
@@ -391,7 +394,7 @@
       <varlistentry>
         <term><varname>io.systemd.stub.kernel-cmdline-extra</varname></term>
         <listitem><para>If set, the value of this string is added to the list of kernel command line
-        arguments that are passed to the kernel.</para></listitem>
+        arguments that are measured in PCR12 and passed to the kernel.</para></listitem>
       </varlistentry>
     </variablelist>
   </refsect1>

diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c
index eb4bd77ac3ca9dc9153ccd1ac6aaf6ea92e03d79..c8bbd36f3ccc8284123838e2920dcc8c079173d9 100644 (file)
--- a/src/boot/efi/stub.c
+++ b/src/boot/efi/stub.c
@@ -277,11 +277,17 @@ static EFI_STATUS run(EFI_HANDLE image) {
                 mangle_stub_cmdline(cmdline);
         }
 
-        /* SMBIOS strings are measured in PCR1, so we do not re-measure these command line extensions. */
         const char *extra = smbios_find_oem_string("io.systemd.stub.kernel-cmdline-extra");
         if (extra) {
                 _cleanup_free_ char16_t *tmp = TAKE_PTR(cmdline), *extra16 = xstr8_to_16(extra);
                 cmdline = xasprintf("%ls %ls", tmp, extra16);
+
+                /* SMBIOS strings are measured in PCR1, but we also want to measure them in our specific
+                 * PCR12, as firmware-owned PCRs are very difficult to use as they'll contain unpredictable
+                 * measurements that are not under control of the machine owner. */
+                m = false;
+                (void) tpm_log_load_options(extra16, &m);
+                parameters_measured = parameters_measured < 0 ? m : (parameters_measured && m);
         }
 
         export_variables(loaded_image);