From: Lennart Poettering Date: Tue, 26 Jul 2022 09:35:57 +0000 (+0200) Subject: sd-stub: measure sysext images picked up by sd-stub into PCR 13 X-Git-Tag: v252-rc1~542^2~13 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=de7ad6d4f439f912ab0ba078dd29ef21a0af3623;p=thirdparty%2Fsystemd.git sd-stub: measure sysext images picked up by sd-stub into PCR 13 Let's grab another so far unused PCR, and measure all sysext images into it that we load from the ESP. Note that this is possibly partly redundant, since sysext images should have dm-verity enabled, and that is hooked up to IMA. However, measuring this explicitly has the benefit that we can measure filenames too, easily, and that all without need for IMA or anything like that. This means: when booting a unified sd-stub kernel through sd-boot we'll now have: 1. PCR 11: unified kernel image payload (i.e. kernel, initrd, boot splash, dtb, osrelease) 2. PCR 12: kernel command line (i.e. the one embedded in the image, plus optionally an overriden one) + any credential files picked up by sd-stub 3. PCR 13: sysext images picked up by sd-stub And each of these three PCRs should carry just the above, and start from zero, thus be pre-calculatable. Thus, all components and parameters of the OS boot process (i.e. everything after the boot loader) is now nicely pre-calculable. NOTE: this actually replaces previous measuring of the syext images into PCR 4. I added this back in 845707aae23b3129db635604edb95c4048a5922a, following the train of thought, that sysext images for the initrd should be measured like the initrd itself they are for, and according to my thinking that would be a unified kernel which is measured by firmware into PCR 4 like any other UEFI executables. However, I think we should depart from that idea. First and foremost that makes it harder to pre-calculate PCR 4 (since we actually measured quite incompatible records to the TPM event log), but also I think there's great value in being able to write policies that bind to the used sysexts independently of the earlier boot chain (i.e. shim, boot loader, unified kernel), hence a separate PCR makes more sense. Strictly speaking, this is a compatibility break, but I think one we can get away with, simply because the initrd sysext images are currently not picked up by systemd-sysext yet in the initrd, and because of that we can be reasonably sure noone uses this yet, and hence relies on the PCR register used. Hence, let's clean this up before people actually do start relying on this. --- diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml index 4a5127b02d1..2aa396e3004 100644 --- a/man/systemd-cryptenroll.xml +++ b/man/systemd-cryptenroll.xml @@ -306,6 +306,11 @@ systemd-boot7 measures any specified kernel command line into this PCR. systemd-stub7 measures any manually specified kernel command line (i.e. a kernel command line that overrides the one embedded in the unified PE image) and loaded credentials into this PCR. (Note that if systemd-boot and systemd-stub are used in combination the command line might be measured twice!) + + 13 + systemd-stub7 measures any systemd-sysext8 images it loads and passed to the booted kernel into this PCR. + + 14 The shim project measures its "MOK" certificates and hashes into this PCR. diff --git a/man/systemd-stub.xml b/man/systemd-stub.xml index df7cabcf503..1e9bb5d631b 100644 --- a/man/systemd-stub.xml +++ b/man/systemd-stub.xml @@ -115,7 +115,7 @@ images to the initrd. See systemd-sysext8 for details on system extension images. The generated cpio archive containing these - system extension images is measured into TPM PCR 4 (if a TPM is present). + system extension images is measured into TPM PCR 13 (if a TPM is present). Files /loader/credentials/*.cred are packed up in a cpio archive and placed in the /.extra/global_credentials/ @@ -197,7 +197,7 @@ System Extensions (synthesized initrd from companion files) - 4 + 9 + 9 + 13 @@ -263,6 +263,15 @@ formatted as decimal ASCII string (i.e. 12). This variable is set if a measurement was successfully completed, and remains unset otherwise. + + + StubPcrInitRDSysExts + + The PCR register index the systemd extensions for the initial RAM disk image, which + are picked up from the file system the kernel image is located on. Formatted as decimal ASCII string + (i.e. 13). This variable is set if a measurement was successfully completed, and + remains unset otherwise. + Note that some of the variables above may also be set by the boot loader. The stub will only set diff --git a/src/boot/efi/measure.h b/src/boot/efi/measure.h index df7f04c9fbb..141d44aa79c 100644 --- a/src/boot/efi/measure.h +++ b/src/boot/efi/measure.h @@ -22,8 +22,8 @@ #define TPM_PCR_INDEX_KERNEL_PARAMETERS_COMPAT UINT32_MAX #endif -/* This TPM PCR is where most Linux infrastructure extends the initrd binary images into, and so do we. */ -#define TPM_PCR_INDEX_INITRD 4U +/* This TPM PCR is where we extend the initrd sysext images into which we pass to the booted kernel */ +#define TPM_PCR_INDEX_INITRD_SYSEXTS 13U #if ENABLE_TPM diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c index 1afbde32952..3b74647a18c 100644 --- a/src/boot/efi/stub.c +++ b/src/boot/efi/stub.c @@ -182,8 +182,8 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) { char *cmdline = NULL; _cleanup_free_ char *cmdline_owned = NULL; int sections_measured = -1, parameters_measured = -1; + bool sysext_measured = false, m; EFI_STATUS err; - bool m; InitializeLib(image, sys_table); debug_hook(L"systemd-stub"); @@ -298,21 +298,24 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) { &m) == EFI_SUCCESS) parameters_measured = parameters_measured < 0 ? m : (parameters_measured && m); - (void) pack_cpio(loaded_image, - NULL, - L".raw", - ".extra/sysext", - /* dir_mode= */ 0555, - /* access_mode= */ 0444, - /* tpm_pcr= */ (uint32_t[]) { TPM_PCR_INDEX_INITRD }, - /* n_tpm_pcr= */ 1, - L"System extension initrd", - &sysext_initrd, - &sysext_initrd_size, - NULL); + if (pack_cpio(loaded_image, + NULL, + L".raw", + ".extra/sysext", + /* dir_mode= */ 0555, + /* access_mode= */ 0444, + /* tpm_pcr= */ (uint32_t[]) { TPM_PCR_INDEX_INITRD_SYSEXTS }, + /* n_tpm_pcr= */ 1, + L"System extension initrd", + &sysext_initrd, + &sysext_initrd_size, + &m) == EFI_SUCCESS) + sysext_measured = m; if (parameters_measured > 0) (void) efivar_set_uint_string(LOADER_GUID, L"StubPcrKernelParameters", TPM_PCR_INDEX_KERNEL_PARAMETERS, 0); + if (sysext_measured) + (void) efivar_set_uint_string(LOADER_GUID, L"StubPcrInitRDSysExts", TPM_PCR_INDEX_INITRD_SYSEXTS, 0); linux_size = szs[SECTION_LINUX]; linux_base = POINTER_TO_PHYSICAL_ADDRESS(loaded_image->ImageBase) + addrs[SECTION_LINUX];