pcrphase: add $SYSTEMD_PCRPHASE_STUB_VERIFY env var for overriding stub check

diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index 61ad07508545cb00b0ea6837c9dbb6ed57178366..b4aaf10100bdc209b57e0f6e5bb6aa98b1cba04d 100644 (file)
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -473,7 +473,12 @@ SYSTEMD_HOME_DEBUG_SUFFIX=foo \
 
 `systemd-journald`:
 
-* `$SYSTEMD_JOURNAL_COMPACT` - Takes a boolean. If enabled, journal files are written
+* `$SYSTEMD_JOURNAL_COMPACT` – Takes a boolean. If enabled, journal files are written
   in a more compact format that reduces the amount of disk space required by the
   journal. Note that journal files in compact mode are limited to 4G to allow use of
   32-bit offsets. Enabled by default.
+
+`systemd-pcrphase`:
+
+* `$SYSTEMD_PCRPHASE_STUB_VERIFY` – Takes a boolean. If false the requested
+  measurement is done even if no EFI stub usage was reported via EFI variables.

diff --git a/src/boot/pcrphase.c b/src/boot/pcrphase.c
index a77a85fb2e87905de026060c164634d2f1a2a05d..9ae17092530d93430e6e2a00d759f0d80f5f7ef8 100644 (file)
--- a/src/boot/pcrphase.c
+++ b/src/boot/pcrphase.c
@@ -6,6 +6,7 @@
 
 #include "build.h"
 #include "efivars.h"
+#include "env-util.h"
 #include "main-func.h"
 #include "openssl-util.h"
 #include "parse-util.h"
@@ -175,21 +176,33 @@ static int run(int argc, char *argv[]) {
 
         length = strlen(word);
 
+        int b = getenv_bool("SYSTEMD_PCRPHASE_STUB_VERIFY");
+        if (b < 0 && b != -ENXIO)
+                log_warning_errno(b, "Unable to parse $SYSTEMD_PCRPHASE_STUB_VERIFY value, ignoring.");
+
         /* Skip logic if sd-stub is not used, after all PCR 11 might have a very different purpose then. */
         r = efi_get_variable_string(EFI_LOADER_VARIABLE(StubPcrKernelImage), &pcr_string);
         if (r == -ENOENT) {
-                log_info("Kernel stub did not measure kernel image into PCR %u, skipping measurement.", TPM_PCR_INDEX_KERNEL_IMAGE);
-                return EXIT_SUCCESS;
-        }
-        if (r < 0)
+                if (b != 0) {
+                        log_info("Kernel stub did not measure kernel image into PCR %u, skipping measurement.", TPM_PCR_INDEX_KERNEL_IMAGE);
+                        return EXIT_SUCCESS;
+                } else
+                        log_notice("Kernel stub did not measure kernel image into PCR %u, but told to measure anyway, hence proceeding.", TPM_PCR_INDEX_KERNEL_IMAGE);
+        } else if (r < 0)
                 return log_error_errno(r, "Failed to read StubPcrKernelImage EFI variable: %m");
-
-        /* Let's validate that the stub announced PCR 11 as we expected. */
-        r = safe_atou(pcr_string, &pcr_nr);
-        if (r < 0)
-                return log_error_errno(r, "Failed to parse StubPcrKernelImage EFI variable: %s", pcr_string);
-        if (pcr_nr != TPM_PCR_INDEX_KERNEL_IMAGE)
-                return log_error_errno(SYNTHETIC_ERRNO(EREMOTE), "Kernel stub measured kernel image into PCR %u, which is different than expected %u.", pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE);
+        else {
+                /* Let's validate that the stub announced PCR 11 as we expected. */
+                r = safe_atou(pcr_string, &pcr_nr);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to parse StubPcrKernelImage EFI variable: %s", pcr_string);
+                if (pcr_nr != TPM_PCR_INDEX_KERNEL_IMAGE) {
+                        if (b != 0)
+                                return log_error_errno(SYNTHETIC_ERRNO(EREMOTE), "Kernel stub measured kernel image into PCR %u, which is different than expected %u.", pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE);
+                        else
+                                log_notice("Kernel stub measured kernel image into PCR %u, which is different than expected %u, but told to measure anyway, hence proceeding.", pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE);
+                } else
+                        log_debug("Kernel stub reported same PCR %u as we want to use, proceeding.", TPM_PCR_INDEX_KERNEL_IMAGE);
+        }
 
         r = dlopen_tpm2();
         if (r < 0)