Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upWip/hughsie/tpm event log replay #1735
Conversation
This comment has been minimized.
This comment has been minimized.
|
It's probably worth taking this the step further of comparing that the calculated hash actually matches and making some noise if it doesn't. |
This comment has been minimized.
This comment has been minimized.
I guess we should do that in |
This comment has been minimized.
This comment has been minimized.
|
Looks like one of the CI problems is probably this fix: We can probably turn off -Wtypedef-redefinition for the failing builds for it for now. |
This comment has been minimized.
This comment has been minimized.
I think it's most interesting in the uefi plugin. Let it get calculated in tpm event log plugin and let uefi pick up a signal and make noise when there's a problem then and they don't add up. That means that if you can't calculate event log (such as on Dell system that has secure boot turned off) you just don't send the signal to uefi plugin. |
This comment has been minimized.
This comment has been minimized.
I think I implemented it the other way around, but I don't think it matters much. |
This comment has been minimized.
This comment has been minimized.
I don't know how scary it is. I guess the TPM could be doing the wrong thing in a non-scary way, but @mjg59 is the expert here.
I don't think anyone looks at the daemon log in reality. If it's really that serious we ought to add a new |
This comment has been minimized.
This comment has been minimized.
mjg59
commented
Jan 31, 2020
|
There are machines that only produce sha256 hashes, so I think you need to handle that case. I also haven't checked the backend code, so I don't know whether you handle TCG2 format event logs (which would be a prerequisite for the first point). There are definitely firmwares out there that generate incomplete event logs and I think it's worth logging that, but right now I wouldn't recommend expressing that to the user until we have a reasonable idea of how common it is. |
This comment has been minimized.
This comment has been minimized.
Right, will fix.
We do!
Do you know why? e.g. out of space etc? |
5b07721
to
f49eb69
This comment has been minimized.
This comment has been minimized.
mjg59
commented
Feb 1, 2020
The most common example I've seen is measuring the TXT ACM but failing to include it in the event log. |
This comment has been minimized.
This comment has been minimized.
|
@superm1 do you want to re-review given i've rewritten a lot of the string handling? |
|
I haven't tested it on an actual system that is populating an event log, but I think things look good right now, thanks. |
This means we use half the amount of memory to store the event hashes, and also means we can process the raw data in future patches without parsing back out of ASCII format.
In theory, these should always match the reported PCRx values from the TPM. If the reconstructed event log checksum does not match the TPM value then something is either implemented wrongly, or something bad has happened.
f49eb69
to
2b967ae
This comment has been minimized.
This comment has been minimized.
|
Just as an FYI, I did confirm on an XPS 7390 with secure boot enabled that this is working properly:
|
hughsie commentedJan 31, 2020
No description provided.