new pcrlock tool for generating signed PCR policies for PCR 0, 1, 4, … #28891
Commits on Nov 3, 2023
-
-
-
-
tpm2-util: add helpers for marshalling public/private keys
Note: we export these new symbols for now. A later commit in this PR will make them static again. The only reason they are exported here is to make sure gcc doesn't complain about unused static symbols, and I really wanted to commit them in a separate commit.
-
-
-
tpm2-util: add calls for calculating/submitting PolicyAuthorizeNV + P…
…olicyOR TPM2 policies
-
tpm2-util: add helper for creating/removing/updating NV index with st…
…ored policy This is the primary core of what pcrlock is supposed to do eventually: maintain a TPM2 policy hash inside an NV index which we then can reference via a PolicyAuthorizeNV expression to lock other objects against it.
-
tpm2-util: add generic helpers for sealing/unsealing data
These helpers tpm2_seal_data()/tpm2_unseal_data() are useful for sealing/unsealing data without any further semantics around them. This is different from the existing tpm2_seal()/tpm2_unseal() which seal with a specific policy and serialize in a specific way, as we use it for disk encryption. These new helpers are more generic, they do not serialize in a specific way or imply policy, they are just the core of the sealing/unsealing. (We should look into porting tpm2_seal()/tpm2_unseal() onto these new helpers, but this isn#t trivial, since the classic serialization we use uses a merged marshalling of private/public key, which we'd have to change in one way or another)
-
tpm2-util: make various marshalling/unmarshalling calls static, as we…
… only use them internally in tpm2-util.c Note, some of these were just added in this same PR. We only exported them initially to make sure gcc doesn't complained about unused local symbols.
-
tpm2-util: add common array for TPM2 hash algorithms
This is useful to enumerate all hash algorithms we want to predict measurements for.
-
-
tree-wide: hook everything up with pcrlock policy
Make sure cryptenroll and repart can enroll TPM2 policies with pcrlock logic. Make sure cryptsetup can unlock TPM2 policies with pcrlock in effect.
-
pcrlock: add pre-defined pcrlock files
These cover well-known measurements done by the UEFI firmware or systemd.
-
units: add units that put together and install a TPM2 PCR policy at boot
(This is disabled by default, for now)
-
-
test: add pcrlock integration test
(Contains various test additions added by @mrc0mmand)
-
