summaryrefslogtreecommitdiffstats
path: root/src/pcrlock (follow)
Commit message (Collapse)AuthorAgeFilesLines
* various: check meson feature flag earlyMike Yuan2024-11-131-19/+17
| | | | Prompted by https://github.com/systemd/systemd/pull/35110#discussion_r1835885340
* pcrlock: Move pe_hash() and uki_hash() to pe-binary.hDaan De Meyer2024-11-054-277/+1
| | | | | Let's move these to shared so we can reuse pe_hash() in the upcoming systemd-sbsign.
* pcrlock: Pad pe hash to a multiple of 8 bytesDaan De Meyer2024-11-041-0/+4
| | | | | All other tools (sbsigntools, osslsigncode, sbctl, goblin) do this as well so let's follow suite.
* sd-json,tree-wide: add sd_json_format_enabled() and use it everwhereZbigniew Jędrzejewski-Szmek2024-10-281-9/+9
| | | | | | | | | | | | | | | | | | | We often used a pattern like if (!FLAGS_SET(flags, SD_JSON_FORMAT_OFF)), which is rather verbose and also contains a double negative, which we try to avoid. Add a little helper to avoid an explicit bit check. This change clarifies an aditional thing: in some cases we treated SD_JSON_FORMAT_OFF as a flag (flags & SD_JSON_FORMAT_OFF), while in other cases we treated it as an independent enum value (flags == SD_JSON_FORMAT_OFF). In the first form, flags like SD_JSON_FORMAT_SSE do _not_ turn the json output on, while in the second form they do. Let's use the first form everywhere. No functional change intended. Initially I wasn't sure if this helper should be made public or just internal, but it seems such a common pattern that if we expose the flags, we might just as well expose it too, to make life easier for any consumers.
* pcrlock: Take VirtualSize > SizeOfRawData into accountDaan De Meyer2024-10-211-1/+15
| | | | | If VirtualSize > SizeOfRawData, measure extra zeros to take into account the extra zeros also measured by the stub.
* tree-wide: drop doubled empty linesYu Watanabe2024-10-071-1/+0
|
* tree-wide: Fix Wformat warningsDaan De Meyer2024-10-021-1/+1
| | | | | | The latest clang has started catching more integer promotions which cause us to pass the wrong type to printf() format specifiers so let's fix those.
* pcrlock: remove empty components from our listLennart Poettering2024-09-111-14/+30
| | | | | | | This is a rework of e7a93e75219b22424bab95fe45982f5eef21d581: instead of handling components with n_variants being zero at every step of the way, we instead remove it from our list after loading all components, given that such a component simply makes not sense for the rest of our logic.
* pcrlock: correct --help text regarding recovery pinLennart Poettering2024-09-111-1/+1
| | | | Fixes: #33917
* pcrlock: log if we generate an "empty" policyLennart Poettering2024-09-111-0/+3
| | | | | | | | | | Such a policy won't provide any protection, but it's still entirely fine to have it like this in various contexts, for example at OS install time, to allocate the nvindex and reference it in enrollments. However, it does deserve mention, hence log about it at LOG_NOTICE level. This is based on a similar patch by Arnaud Patard <arnaud.patard@collabora.com> proposed at #33663.
* pcrlock: be more careful when preparing credential name for pcrlock policyLennart Poettering2024-09-061-23/+36
| | | | | | | | The .cred suffix is stripped from a credential as it is imported from the ESP, hence it should not be included in the credential name embedded in the credential. Fixes: #33497
* src/pcrlock/pcrlock.c: Handle empty pcrlock.d directoriesArnaud Patard2024-08-051-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running the following commands: # mkdir -p /var/lib/pcrlock.d/123-empty.pcrlock.d # /usr/lib/systemd/systemd-pcrlock predict --pcr=1+2+3+4+5+16 Will result in: ... Floating point exception Running the following commands: # mkdir -p /var/lib/pcrlock.d/123-empty.pcrlock.d # /usr/lib/systemd/systemd-pcrlock make-policy --pcr=1+2+3+4+5+16 Will result to this (partial) log: ... Predicted future PCRs in 133us. [] ... Written policy digest 0000000000000000000000000000000000000000000000000000000000000000 to NV index 0x1921da6 ... So, add missing checks to handle gracefully cases where there's no variant inside the component. Signed-off-by: Arnaud Patard <arnaud.patard@collabora.com>
* sd-varlink: make our internal Varlink API public as sd-varlink.[ch]Lennart Poettering2024-07-161-18/+18
| | | | | | | | | | It's time. sd-json was already done earlier in this cycle, let's now make sd-varlink public too. This is mostly just a search/replace job of epical proportions. I left some functions internal (mostly IDL handling), and I turned some static inline calls into regular calls.
* tree-wide: port over to new builder apisLennart Poettering2024-06-191-89/+78
|
* creds-util: add common helper for determinign global boot credentials pathLennart Poettering2024-06-151-29/+7
| | | | | It's very useful being able to determine the directory where to write global boot credentials to, that are picked up by all kernels.
* pcrlock: move event_log_reduce_to_safe_pcrs() down a bitLennart Poettering2024-06-141-63/+63
| | | | | | Let's keep the verb_lock_xyz() and verb_unlock_xyz() calls together, and move event_log_reduce_to_safe_pcrs() which so far was in betwee them all further down closer to where the function is actually used.
* pcrlock: don't override conf_root parameter for boot_entry_token_ensure()Lennart Poettering2024-06-141-1/+1
| | | | | | if we pass NULL boot_entry_token_ensure() will use its own default, which is the same as what we passed so far explicitly, hence let's make use of that.
* fileio: add new helper write_base64_file_at() which encodes a binary object ↵Lennart Poettering2024-06-141-8/+3
| | | | into base64 and writes it to a file
* libsystemd: turn json.[ch] into a public APILennart Poettering2024-06-121-205/+207
| | | | | | | | | | | | | | | This is preparation for making our Varlink API a public API. Since our Varlink API is built on top of our JSON API we need to make that public first (it's a nice API, but JSON APIs there are already enough, this is purely about the Varlink angle). I made most of the json.h APIs public, and just placed them in sd-json.h. Sometimes I wasn't so sure however, since the underlying data structures would have to be made public too. If in doubt I didn#t risk it, and moved the relevant API to src/libsystemd/sd-json/json-util.h instead (without any sd_* symbol prefixes). This is mostly a giant search/replace patch.
* pcrlock: tweak error messages when we are not looking at a TPM2 event logLennart Poettering2024-05-301-4/+4
| | | | | | | If we are looking at a TPM1.2 event log the first log record will not be the "EfiSpecIdEvent" but something else. Let's improve the log messages about this, and say explicitly that this is likely not a TPM2.0 event log.
* tree-wise: several cleanups for loggingYu Watanabe2024-04-301-21/+21
| | | | | | | | | | | - drop unnecessary SYNTHETIC_ERRNO() when the logger does not propagate error code, - drop unnecessary '%m' in error message when the error code is specified with SYNTHETIC_ERRNO(), - add missing full stop at the end of log message, - use RET_GATHER(), - add missing ", ignoring.", - upeercase the first letter, etc., etc...
* treewide: fix a few typos in NEWS, docs, comments, and log messagesDmitry V. Levin2024-04-271-1/+1
|
* tpm2-util: add generic wrapper tpm2_context_new_or_warn() that wrpas ↵Lennart Poettering2024-04-221-4/+4
| | | | | | | | | | tpm2_context_new and logs about errors We so far just print a short log message that is not very useful, let's add some recognizable error codes, and output better log messages if we can't get TPM stuff to work. Fixes: #31925
* pcrlock: add make_pcrlock_record_from_streamAlberto Planas2024-04-191-35/+104
| | | | | | | | | | To hash long files (like initrd) add the funcion make_pcrlock_record_from_stream, that will read a long file (or stdin) to generate the digests of multiple hashes, redading block by block. Use this new function in verb_lock_raw and verb_lock_kernel_initrd. Signed-off-by: Alberto Planas <aplanas@suse.com>
* Merge pull request #31790 from poettering/pcrlock-policy-fixLennart Poettering2024-04-181-25/+51
|\ | | | | Replace PolicyAuthValue by PolicySigned as access policy for pcrlock policy nvindex
| * pcrlock: rework --recovery-pin= to take three different argumentsLennart Poettering2024-04-181-7/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reworkds --recovery-pin= from a parameter that takes a boolean to an enum supporting one of "hide", "show", "query". If "hide" (default behaviour) we'll generate a recovery pin automatically, but never show it, and thus just seal it and good. If "show" we'll generate a recovery pin automatically, but display it in the output, so the user can write it down. If "query" we'll ask the user for a recovery pin, and not automatically generate any. For compatibility the old boolean behaviour is kept. With this you can now do "systemd-pcrlock make-policy --recovery-pin=show" to set up the first policy, write down the recovery PIN. Later, if the PCR prediction didn't work out one day you can then do "systemd-pcrlock make-policy --recovery-pin=query" and enter the recovery key and write a new policy.
| * pcrlock: generate recovery PINs via make_recovery_key()Lennart Poettering2024-04-181-8/+1
| | | | | | | | | | | | | | | | | | | | | | We already have infrastructure for generating nice recovery keys, for the usual cryptenroll recovery keys. Let's reuse them here, as they are nicer to read and type than the base64 encoded randomness we so far used. Previously valid recovery keys remain valid, in their original format. For future enrollments we'll however have nicer, easier recovery keys to deal with.
| * tpm2-util: now that we don't use PolicyAuthValue anymore, let's not set an ↵Lennart Poettering2024-04-181-2/+0
| | | | | | | | | | | | | | | | authValue anymore for the policy nvindex We have now switched from PolicyAuthValue to PolicySigned to control access to the policy nvindex to. This means there's no point in setting an authValue on the nvindex anymore, hence drop this.
| * pcrlock: switch access policy for nvindex to store policy in from ↵Lennart Poettering2024-04-181-8/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PolicyAuthValue to PolicySigned (with an HMAC-SHA256 key) So far the nvindex to store the pcrlock policy in was protected via a PolicyAuthValue policy (i.e. with a simple PIN set on the nvindex). That's a bad idea however, as it means an attacker can simply remove and re-create the nvindex and the "name" of the nvindex does not change, thus defeating the logic. (This is because the authValue is *not* part of the "name" of an nvindex!). Fix this by switching from PolicyAuthValue to PolicySigned with an HMAC-SHA256 key. Behaviour is very similar: however, the PIN is now part of of the access policy hash, which *is* part of the "name" of an nvindex. Thus, if an attacker removes and recreates the nvindex it has to provide the same PIN again or the "name" of the nvindex will change. Mission accomplished. I'd like to thank Chris Coulson for finding this issue (and helping me address it). Thank you!
| * tpm2-util: rename tpm2_get_pin_auth() → tpm2_auth_value_from_pin()Lennart Poettering2024-04-181-1/+1
| | | | | | | | | | | | | | Just some renaming. I found the old name a bit confusing since it sounds as if this would get the pin from somewhere, but it really doesn't. It just converts a PIN into an auth_value, and I think saying so explicitly makes things easier to grok.
* | use FOREACH_ELEMENTMatteo Croce2024-04-181-1/+1
|/ | | | | | | | Use FOREACH_ELEMENT where possible. Generated with this command, and checked manually: git grep -l 'FOREACH_ARRAY.*ELEMENTSOF' | \ xargs sed -ri 's/FOREACH_ARRAY\((.*), (.*), (ELEMENTSOF.*)\)/FOREACH_ELEMENT(\1, \2)/'
* pcrlock: handle measurement logs where hash algs in header are announced in ↵Lennart Poettering2024-02-211-7/+14
| | | | | | | | different order than in records Apparently on HyperV the measurement logs announce the hash algs in a different order in the header than the records have them. Let's handle this gracefully
* pcrlock: normalize credential name for TPM2 PINLennart Poettering2024-02-201-1/+1
| | | | | | | | Let's drop the "systemd-" prefix from the credential name. We do not prefix credentials that way so far. Don't do so here either. The name is not really API, it's not documented, hence change it now where we still can.
* ask-password: rework how we pass request meta info when asking passwordsLennart Poettering2024-02-201-5/+7
| | | | | | | | | | | Rather than adding more and more parameters to ask_password_auto(), let's pass a structure of the fields that often are constant anyway. This way, callers can fill in what they need, and we take the filled structure which we can pass around internally as one. This is in particular preparation for adding one more field in one of the next commits.
* pcrlock: add basic Varlink interfaceLennart Poettering2024-02-121-6/+135
| | | | | This can be used to make or delete a PCR policy via Varlink. It can also be used to query the current event log in CEL format.
* pcrlock: split out generation of CEL objects into helper funcLennart Poettering2024-02-121-56/+74
| | | | | | This way, we can reuse it later to generate Varlink replies No change in behaviour, just some trivial split out.
* pcrlock: use log_setup()Lennart Poettering2024-02-121-3/+1
|
* creds-util: add a concept of "user-scoped" credentialsLennart Poettering2024-01-301-0/+1
| | | | | | | | | | | | | | | | | | | So far credentials are a concept for system services only: to encrypt or decrypt credential you must be privileged, as only then you can access the TPM and the host key. Let's break this up a bit: let's add a "user-scoped" credential, that are specific to users. Internally this works by adding another step to the acquisition of the symmetric encryption key for the credential: if a "user-scoped" credential is used we'll generate an symmetric encryption key K as usual, but then we'll use it to calculate K' = HMAC(K, flags || uid || machine-id || username) and then use the resulting K' as encryption key instead. This basically includes the (public) user's identity in the encryption key, ensuring that only if the right user credentials are specified the correct key can be acquired.
* pcrlock: also write pcrlock policy as unencrypted credential to XBOOTLDR/ESPLennart Poettering2024-01-221-12/+156
|
* Measure empty PK and KEK EFI varsAlberto Planas2024-01-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | The OVMF UEFI firmware is measuring PK and KEK when secure boot is disabled, and those variables are absent. This can be checked via the event log to see that there are extensions for PCR 7 associated with PK and KEK events of type EV_EFI_VARIABLE_DRIVER_CONFIG. When running the "lock-secureboot-policy" verb, pcrlock complains that those variables are not found and refuse to generate the 240-secureboot-policy.pcrlock.d/generated.pcrlock file. The "TCG PC Client Platform Firmware Profile Specification Version 1.05 Revision 23"[1] from May 7, 2021, in section "3.3.4.8 PCR[7] - Secure Boot Policy Measurements", point 10.b: If reading a UEFI variable returns UEFI_NOT_FOUND, platform firmware SHALL measure the absence of the variable. The UEFI_VARIABLE_DATA.VariableDataLength field MUST be set to zero and UEFI_VARIABLE_DATA.VariableData field will have a size of zero. This patch mark those variables to be marked as "synthesize empty", generating the correct hash for those variables. Signed-off-by: Alberto Planas <aplanas@suse.com>
* Merge pull request #30728 from polarina/nodaLennart Poettering2024-01-051-1/+1
|\ | | | | Assign noDA attribute to TPM2 objects not dependant on a PIN
| * pcrlock: Print correct NV index when writing new policyGabríel Arthúr Pétursson2024-01-041-1/+1
| |
* | Use .d path for PCRLOCK_KERNEL_*_PATHAlberto Planas2024-01-051-2/+2
| | | | | | | | | | | | | | | | | | Fix the path for the generated.pcrlock files for the cmdline and initrd cases. Without it the tool complains with: Failed to parse component file /var/lib/pcrlock.d/720-kernel-initrd.pcrlock, ignoring: Is a directory Signed-off-by: Alberto Planas <aplanas@suse.com>
* | Fix typo in verb_make_policy explanationAlberto Planas2024-01-041-1/+1
|/ | | | Signed-off-by: Alberto Planas <aplanas@suse.com>
* format-table: introduce table_isempty and use it where appropriateMike Yuan2023-12-251-4/+4
|
* color-util: split out HSV color conversion into color-util.[ch]Lennart Poettering2023-12-211-34/+1
|
* pcrlock: use empty_or_dash() moreFrantisek Sumsal2023-12-181-2/+2
|
* pcrlock: check for embedded NUL bytesLennart Poettering2023-11-201-0/+5
|
* pcrlock: make sure we don't choke on empty recordsLennart Poettering2023-11-201-1/+5
| | | | | | Follow-up for a43427013949 CID#1523832
* pcrlock: show emojis for each PCR lineLennart Poettering2023-11-061-15/+25
| | | | | | I am sorry, I totally forgot adding emojis reflecting the state of each PCR. I hope I can do better in future, and hereby I'd like to rectify the situation a bit.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 23:53:03 +0100