hup: signed-update: print predicted PCR values after creating a policy

Change-type: patch Signed-off-by: Joseph Kogut <joseph@balena.io>
balena-os · Apr 24, 2024 · a3b2b9b · a3b2b9b
1 parent cd7b142
commit a3b2b9b
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/meta-balena-common/recipes-support/hostapp-update-hooks/files/0-signed-update b/meta-balena-common/recipes-support/hostapp-update-hooks/files/0-signed-update
@@ -155,10 +155,12 @@ updateKeys() {
             measured)
                 info "Using PCR7 digest with EFI binary measurements"
                 POLICY="${POLICY_EFIBIN}"
+                print_pcr_val_bin "${PCRS}" "${PCR_VAL_BIN_EFIBIN}"
                 ;;
             unmeasured)
                 info "Using PCR7 digest without EFI binary measurements"
                 POLICY="${POLICY_UPDATED}"
+                print_pcr_val_bin "${PCRS}" "${PCR_VAL_BIN_UPDATED}"
                 ;;
             unknown)
                 # we don't have access to the TPM event log, and can't
@@ -170,6 +172,10 @@ updateKeys() {
                               "sha256:$(find "${POLICY_PATH}" -type f | sort | xargs | sed 's/ /,/g')"
                 POLICY="${POLICY_COMBINED}"
                 cp -rf "${POLICY_PATH}" "${EFI_MOUNT_DIR}"
+
+                print_pcr_val_bin "${PCRS}" "${PCR_VAL_BIN_EFIBIN}"
+                printf "\nOR\n"
+                print_pcr_val_bin "${PCRS}" "${PCR_VAL_BIN_UPDATED}"
                 ;;
         esac
 

diff --git a/meta-balena-common/recipes-support/os-helpers/os-helpers/os-helpers-tpm2 b/meta-balena-common/recipes-support/os-helpers/os-helpers/os-helpers-tpm2
@@ -125,7 +125,19 @@ firmware_measures_efibins() {
     fi
 }
 
-
+print_pcr_val_bin() {
+    PCRS=$1
+    PCR_VAL_BIN=$2
+    DIGEST_SIZE=32
+    SKIP=0
+    printf " %s:\n" "sha256"
+    for pcr in $(echo "${PCRS}" | sed 's/,/ /g'); do
+        digest=$(dd if="${PCR_VAL_BIN}" bs=1 count=$DIGEST_SIZE status=none skip=$SKIP | _hexencode)
+        SKIP=$((SKIP + DIGEST_SIZE))
+        printf "   %s : %s\n" "$pcr" "$digest"
+    done
+    printf "\n"
+}
 
 hw_gen_passphrase() {
     tpm2_getrandom 32