On Tue, Apr 15, 2025 at 10:57:05PM +, Vladimir Serbinenko wrote:
> Signed-off-by: Vladimir Serbinenko
> ---
->8-
> @@ -281,7 +283,7 @@ for cipher_file in cipher_files:
> hold = False
> # We're optimising for size and exclude anything needing good
>
On Thu, Mar 27, 2025 at 01:02:41AM +0530, Sudhakar Kuppusamy wrote:
> To support the following trusted and distrusted commands
>
> 1. trusted_list:
> It will show the list of trusted certificates and binary hashes
> 2. distrusted_list:
> It will show the list of distrusted cert
On Thu, Mar 27, 2025 at 01:02:41AM +0530, Sudhakar Kuppusamy wrote:
> To support the following trusted and distrusted commands
>
> 1. trusted_list:
> It will show the list of trusted certificates and binary hashes
> 2. distrusted_list:
> It will show the list of distrusted cert
On Thu, Mar 27, 2025 at 01:02:31AM +0530, Sudhakar Kuppusamy wrote:
> From: Daniel Axtens
>
> Building on the parsers and the ability to embed x509 certificates, as
> well as the existing gcrypt functionality, add a module for verifying
> appended signatures.
>
> This includes a verifier that re
Add the long options of tpm2_key_protect_init along with the short
options.
Signed-off-by: Gary Lin
---
docs/grub.texi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/grub.texi b/docs/grub.texi
index cf64c54c8..2b3d536d3 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@
Previously, NV index mode only supported persistent handles which are
only for TPM objects.
On the other hand, the "NV index" handle allows the user-defined data,
so it can be an alternative to the key file and support TPM 2.0 Key
File format immediately.
The following tpm2-tools commands store t
Extract the logic to handle the file buffer from the SRK recover
function to prepare to load the sealed key from the NV index handle,
so the NV index mode can share the same code path in the later patch.
The SRK recover function now only reads the file and sends the file
buffer to the new function.
Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
replaced with one 'grub-protect' command to simplify the test script.
'tpm2_evictcontrol' is also replaced with 'grub-protect --tpm2-evict'.
Signed-off-by: Gary Lin
Reviewed-by: Stefan Berger
Reviewed-by: Daniel Kiper
---
grub_tpm2_readpublic() and grub_tpm2_testparms() didn't check
'authCommand' when marshaling the input data buffer. Currently, there is
no caller using non-NULL 'authCommand'. However, to avoid the potential
issue, the conditional check is added to insert 'authCommand' into the
input buffer if neces
This commit updates the NV index mode section and the grub-protect
section to reflect the recent changes in TPM2 key protector and
grub-protect.
Signed-off-by: Gary Lin
---
docs/grub.texi | 188 +++--
1 file changed, 166 insertions(+), 22 deletions(-)
Reset 'ret' to 0 when a test case fails so that the other test cases
could continue.
Also set the exit status to 1 when encountering a failure to reflect the
test result.
Signed-off-by: Gary Lin
---
tests/tpm2_key_protector_test.in | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
d
This commit implements the missing NV index mode support in
'grub-protect'. NV index mode stores the sealed key in the TPM
non-volatile memory (NVRAM) instead of a file. There are two supported
types of TPM handles.
1. Persistent handle (0x8100~0x81FF)
Only the raw format is supported d
Two more NV index test cases are added to test key sealing and
unsealing with the NV index handle 0x100.
Signed-off-by: Gary Lin
Reviewed-by: Stefan Berger
---
tests/tpm2_key_protector_test.in | 57 ++--
1 file changed, 40 insertions(+), 17 deletions(-)
diff --g
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
The TPM2 key protector tests require two external packages: swtpm-tools
and tpm2-tools. Add those two packages to the INSTALL file to inform
the user to install those packages before starting the TPM2 key protector
tests.
Signed-off-by: Gary Lin
Reviewed-by: Daniel Kiper
---
INSTALL | 1 +
1 fi
The following TPM 2.0 commands are introduced to tss2 to access the
TPM non-volatile memory associated with the NV index handles.
- TPM2_NV_DefineSpace
- TPM2_NV_UndefineSpace
- TPM2_NV_ReadPublic
- TPM2_NV_Read
- TPM2_NV_Write
The related marshal/unmarshal functions are also introduced.
Signed-
The user may need to inspect the TPM 2.0 PCR values with the GRUB shell,
so the new 'tpm2_dump_pcr' command is added to print all PCRs of the
specified bank.
Also update the document for the new command.
Signed-off-by: Gary Lin
Tested-by: Stefan Berger
Reviewed-by: Daniel Kiper
---
docs/grub.
git: https://github.com/lcp/grub2/tree/tpm2-follow-up-v5
This patchset is the collection of several enhancements for TPM2 key
protector.
* Patch 1 introduces the PCR dump to help debugging policy fail.
* Patch 2 adds the new command to dump PCRs in GRUB shell and the
* documentation of the comman
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
On Tue, Mar 25, 2025 at 04:37:43PM +0100, Daniel Kiper wrote:
> On Mon, Jan 13, 2025 at 11:07:08AM +0800, Gary Lin wrote:
> > The following TPM 2.0 commands are introduced to tss2 to access the
> > TPM non-volatile memory associated with the NV index handles.
> >
> > - TPM2_NV_DefineSpace
> > - TPM
This commit updates the NV index mode section and the grub-protect
section to reflect the recent changes in TPM2 key protector and
grub-protect.
Signed-off-by: Gary Lin
---
docs/grub.texi | 188 +++--
1 file changed, 166 insertions(+), 22 deletions(-)
This commit implements the missing NV index mode support in
'grub-protect'. NV index mode stores the sealed key in the TPM
non-volatile memory (NVRAM) instead of a file. There are two supported
types of TPM handles.
1. Persistent handle (0x8100~0x81FF)
Only the raw format is supported d
Two more NV index test cases are added to test key sealing and
unsealing with the NV index handle 0x100.
Signed-off-by: Gary Lin
---
tests/tpm2_key_protector_test.in | 55 ++--
1 file changed, 39 insertions(+), 16 deletions(-)
diff --git a/tests/tpm2_key_protecto
version.
Gary Lin
> > ven. 21 mars 2025, 11: 01, Gary Lin via Grub-devel > org> a écrit : Reset 'ret'
> >
> > Is there a risk here of missing the failures? It's common that no one
> > looks at the output unless it causes a failed build on some
Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
replaced with one 'grub-protect' command to simplify the test script.
'tpm2_evictcontrol' is also replaced with 'grub-protect --tpm2-evict'.
Signed-off-by: Gary Lin
---
tests/tpm2_key_protector_test.in | 108 +---
On Tue, Mar 25, 2025 at 05:01:02PM +0100, Daniel Kiper wrote:
> On Fri, Mar 21, 2025 at 03:59:01PM +0800, Gary Lin wrote:
> > Extract the logic to handle the file buffer from the SRK recover
> > function to prepare to load the sealed key from the NV index handle,
> > so the NV index mode can share
The TPM2 key protector tests require two external packages: swtpm-tools
and tpm2-tools. Add those two packages to the INSTALL file to inform
the user to install those packages before starting the TPM2 key protector
tests.
Signed-off-by: Gary Lin
---
INSTALL | 1 +
1 file changed, 1 insertion(+)
The user may need to inspect the TPM 2.0 PCR values with the GRUB shell,
so the new 'tpm2_dump_pcr' command is added to print all PCRs of the
specified bank.
Also update the document for the new command.
Signed-off-by: Gary Lin
Tested-by: Stefan Berger
Reviewed-by: Daniel Kiper
---
docs/grub.
On Fri, Mar 14, 2025 at 02:58:48PM +0100, Yann Diorcet wrote:
> For the moment only the system-tpm2 token type is supported.
>
Hi Yann,
Could you consider creating a cover letter for this patch set?
A cover letter is useful for the reviewer to have the overview of the
patches before diving into th
The following TPM 2.0 commands are introduced to tss2 to access the
TPM non-volatile memory associated with the NV index handles.
- TPM2_NV_DefineSpace
- TPM2_NV_UndefineSpace
- TPM2_NV_ReadPublic
- TPM2_NV_Read
- TPM2_NV_Write
The related marshal/unmarshal functions are also introduced.
Signed-
grub_tpm2_readpublic() and grub_tpm2_testparms() didn't check
'authCommand' when marshaling the input data buffer. Currently, there is
no caller using non-NULL 'authCommand'. However, to avoid the potential
issue, the conditional check is added to insert 'authCommand' into the
input buffer if neces
git: https://github.com/lcp/grub2/tree/tpm2-follow-up-v4
This patchset is the collection of several enhancements for TPM2 key
protector.
* Patch 1 introduces the PCR dump to help debugging policy fail.
* Patch 2 adds the new command to dump PCRs in GRUB shell and the
* documentation of the comman
Previously, NV index mode only supported persistent handles which are
only for TPM objects.
On the other hand, the "NV index" handle allows the user-defined data,
so it can be an alternative to the key file and support TPM 2.0 Key
File format immediately.
The following tpm2-tools commands store t
Extract the logic to handle the file buffer from the SRK recover
function to prepare to load the sealed key from the NV index handle,
so the NV index mode can share the same code path in the later patch.
The SRK recover function now only reads the file and sends the file
buffer to the new function.
Reset 'ret' to 0 when a test case fails so that the other test cases
could continue.
Signed-off-by: Gary Lin
---
tests/tpm2_key_protector_test.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/tpm2_key_protector_test.in b/tests/tpm2_key_protector_test.in
index 07477ba2a..0d1115e02 1
On Sat, Mar 15, 2025 at 03:45:14AM -0500, Glenn Washburn wrote:
> On Mon, 13 Jan 2025 11:07:12 +0800
> Gary Lin via Grub-devel wrote:
>
> > Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
> > replaced with one 'grub-protect&
On Thu, Mar 13, 2025 at 03:27:47PM +0100, Daniel Kiper wrote:
> On Mon, Jan 13, 2025 at 11:07:13AM +0800, Gary Lin via Grub-devel wrote:
> > This commit updates the NV index mode section and the grub-protect
> > section to reflect the recent changes in TPM2 key protector and
&
On Thu, Mar 13, 2025 at 03:17:24PM +0100, Daniel Kiper wrote:
> On Mon, Jan 13, 2025 at 11:07:11AM +0800, Gary Lin via Grub-devel wrote:
> > This commit implements the missing NV index mode support in
> > 'grub-protect'. NV index mode stores the sealed key in the TPM
>
On Thu, Mar 13, 2025 at 02:59:18PM +0100, Daniel Kiper wrote:
> On Mon, Jan 13, 2025 at 11:07:09AM +0800, Gary Lin via Grub-devel wrote:
> > Extract the logic to handle the file buffer from the SRK recover
> > function to prepare to load the sealed key from the NV index handle.
>
On Thu, Mar 13, 2025 at 02:49:29PM +0100, Daniel Kiper wrote:
> On Thu, Mar 13, 2025 at 02:45:25PM +0100, Daniel Kiper wrote:
> > On Mon, Jan 13, 2025 at 11:07:05AM +0800, Gary Lin via Grub-devel wrote:
> > > The user may need to inspect the TPM 2.0 PCR values with the GRUB shell
On Thu, Mar 13, 2025 at 02:42:15PM +0100, Daniel Kiper wrote:
> On Mon, Jan 13, 2025 at 11:07:04AM +0800, Gary Lin via Grub-devel wrote:
> > PCR mismatching is one common cause of TPM key unsealing fail. Since the
> > system may be compromised, it is not safe to boot into OS
On Thu, Mar 06, 2025 at 10:15:09PM +0100, Diorcet Yann wrote:
> The systemd TPM2 key protector is a module that enables the automatic
> retrieval
> of a fully-encrypted disk's unlocking key from a systemd token in luks2
> partition header.
>
> Inspired by the tpm2_key_protector module and the cryp
On Thu, Mar 06, 2025 at 08:46:52PM +0100, Yann Diorcet wrote:
> When tpm2_submit_command_real is called for a retry, the content of
> out buffer can already be set with previous grub_tcg2_submit_command
> call's reply. Restore previous offset allowing the next
> tpm2_submit_command_real calls to su
On Sun, Mar 02, 2025 at 10:54:04AM -0600, Andrew Hamilton wrote:
> tss2_structs.h contains a duplicate typedef as follows:
> typedef TPMS_SCHEME_HASH_t TPMS_SCHEME_KDF2_t;
>
> This causes a build failure when compiling with clang.
> Remove the duplicate typedef which allows successfully
> building
grub_tpm2_readpublic() and grub_tpm2_testparms() didn't check
'authCommand' when marshaling the input data buffer. Currently, there is
no caller using non-NULL 'authCommand'. However, to avoid the potential
issue, the conditional check is added to insert 'authCommand' into the
input buffer if neces
Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
replaced with one 'grub-protect' command to simplify the test script.
Two more NV index test cases are also added to test key sealing and
unsealing with the NV index handle 0x100.
Also, there is a minor fix to reset 'ret'
This commit implements the missing NV index mode support in
'grub-protect'. NV index mode stores the sealed key in the TPM
non-volatile memory (NVRAM) instead of a file. There are two supported
types of TPM handles.
1. Persistent handle (0x8100~0x81FF)
TPM 2.0 Key File format (--tpm2key
Extract the logic to handle the file buffer from the SRK recover
function to prepare to load the sealed key from the NV index handle.
The SRK recover function now only reads the file and sends the file
buffer to the new function. Besides this, the file format is detected
automatically before unmars
Previously, NV index mode only supported persistent handles which are
only for TPM objects.
On the other hand, the "NV index" handle allows the user-defined data,
so it can be an alternative to the key file and support TPM 2.0 Key
File format immediately.
The following tpm2-tools commands store t
This commit updates the NV index mode section and the grub-protect
section to reflect the recent changes in TPM2 key protector and
grub-protect.
Signed-off-by: Gary Lin
---
docs/grub.texi | 189 +++--
1 file changed, 167 insertions(+), 22 deletions(-)
The user may need to inspect the TPM 2.0 PCR values with the GRUB shell,
so the new 'tpm2_dump_pcr' command is added to print all PCRs of the
specified bank.
Signed-off-by: Gary Lin
Tested-by: Stefan Berger
---
.../commands/tpm2_key_protector/module.c | 35 +++
1 file chang
Update the documentation to address tpm2_dump_pcr.
Signed-off-by: Gary Lin
Reviewed-by: Stefan Berger
---
docs/grub.texi | 13 +
1 file changed, 13 insertions(+)
diff --git a/docs/grub.texi b/docs/grub.texi
index 200e747af..aba43e35e 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
The following TPM 2.0 commands are introduced to tss2 to access the
TPM non-volatile memory associated with the NV index handles.
- TPM2_NV_DefineSpace
- TPM2_NV_UndefineSpace
- TPM2_NV_ReadPublic
- TPM2_NV_Read
- TPM2_NV_Write
The related marshal/unmarshal functions are also introduced.
Signed-
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
git: https://github.com/lcp/grub2/tree/tpm2-follow-up-v3
This patchset is the collection of several enhancements for TPM2 key
protector.
* Patch 1 introduces the PCR dump to help debugging policy fail.
* Patch 2~3 adds the new command to dump PCRs in GRUB shell and the
* documentation of the comm
On Thu, Jan 09, 2025 at 02:13:02PM -0500, Stefan Berger wrote:
>
>
> On 1/8/25 10:58 PM, Gary Lin wrote:
> > Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
> > replaced with one 'grub-protect' command to simplify the test script.
> >
> > Two more NV index test cases are a
On Thu, Jan 09, 2025 at 02:03:47PM -0500, Stefan Berger wrote:
>
>
> On 1/8/25 10:58 PM, Gary Lin wrote:
> > This commit implements the missing NV index mode support in
> > 'grub-protect'. NV index mode stores the sealed key in the TPM
> > non-volatile memory (NVRAM) instead of a file. There are
On Thu, Jan 09, 2025 at 01:03:54PM -0500, Stefan Berger wrote:
>
>
> On 1/8/25 10:58 PM, Gary Lin wrote:
> > Previously, NV index mode only supported persistent handles which are
> > only for TPM objects.
> >
> > On the other hand, the "NV index" handle allows the user-defined data,
> > so it ca
Previously, NV index mode only supported persistent handles which are
only for TPM objects.
On the other hand, the "NV index" handle allows the user-defined data,
so it can be an alternative to the key file and support TPM 2.0 Key
File format immediately.
The following tpm2-tools commands store t
git: https://github.com/lcp/grub2/tree/tpm2-follow-up-v2
This patchset is the collection of several enhancements for TPM2 key
protector.
* Patch 1 introduces the PCR dump to help debugging policy fail.
* Patch 2~3 adds the new command to dump PCRs in GRUB shell and the
* documentation of the comm
This commit updates the NV index mode section and the grub-protect
section to reflect the recent changes in TPM2 key protector and
grub-protect.
Signed-off-by: Gary Lin
---
docs/grub.texi | 188 +++--
1 file changed, 166 insertions(+), 22 deletions(-)
The user may need to inspect the TPM 2.0 PCR values with the GRUB shell,
so the new 'tpm2_dump_pcr' command is added to print all PCRs of the
specified bank.
Signed-off-by: Gary Lin
Tested-by: Stefan Berger
---
.../commands/tpm2_key_protector/module.c | 35 +++
1 file chang
Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
replaced with one 'grub-protect' command to simplify the test script.
Two more NV index test cases are also added to test key sealing and
unsealing with the NV index handle 0x100.
Also, there is a minor fix to reset 'ret'
grub_tpm2_readpublic() and grub_tpm2_testparms() didn't check
'authCommand' when marshaling the input data buffer. Currently, there is
no caller using non-NULL 'authCommand'. However, to avoid the potential
issue, the conditional check is added to insert 'authCommand' into the
input buffer if neces
Update the documentation to address tpm2_dump_pcr.
Signed-off-by: Gary Lin
Reviewed-by: Stefan Berger
---
docs/grub.texi | 13 +
1 file changed, 13 insertions(+)
diff --git a/docs/grub.texi b/docs/grub.texi
index 200e747af..aba43e35e 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
Extract the logic to handle the file buffer from the SRK recover
function to prepare to load the sealed key from the NV index handle.
The SRK recover function now only reads the file and sends the file
buffer to the new function. Besides this, the file format is detected
automatically before unmars
This commit implements the missing NV index mode support in
'grub-protect'. NV index mode stores the sealed key in the TPM
non-volatile memory (NVRAM) instead of a file. There are two supported
types of TPM handles.
1. Persistent handle (0x8100~0x81FF)
TPM 2.0 Key File format (--tpm2key
The following TPM 2.0 commands are introduced to tss2 to access the
TPM non-volatile memory associated with the NV index handles.
- TPM2_NV_DefineSpace
- TPM2_NV_UndefineSpace
- TPM2_NV_ReadPublic
- TPM2_NV_Read
- TPM2_NV_Write
The related marshal/unmarshal functions are also introduced.
Signed-
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
On Thu, Jan 02, 2025 at 04:50:53PM -0500, Stefan Berger wrote:
>
>
> On 12/19/24 3:12 AM, Gary Lin via Grub-devel wrote:
> > This commit updates the NV index mode section and the grub-protect
> > section to reflect the recent changes in TPM2 key protector and
> > gr
On Thu, Jan 02, 2025 at 04:11:42PM -0500, Stefan Berger wrote:
>
>
> On 12/19/24 3:12 AM, Gary Lin wrote:
> > Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
> > replaced with one 'grub-protect' command to simplify the test script.
> >
> > Two more NV index test cases are
On Thu, Jan 02, 2025 at 03:59:22PM -0500, Stefan Berger wrote:
>
>
> On 12/19/24 3:12 AM, Gary Lin wrote:
> > This commit implements the missing NV index mode support in
> > 'grub-protect'. NV index mode stores the sealed key in the TPM
> > non-volatile memory (NVRAM) instead of a file. There are
On Thu, Jan 02, 2025 at 02:54:51PM -0500, Stefan Berger wrote:
>
>
> On 12/19/24 3:12 AM, Gary Lin wrote:
> > Previously, NV index mode only supported persistent handles which are
> > only for the TPM objects. Without introducing new parameters, it is
>
> for TPM objects.
>
Will fix it in v2.
On Thu, Jan 02, 2025 at 02:12:57PM -0500, Stefan Berger wrote:
>
>
> On 12/19/24 3:12 AM, Gary Lin wrote:
> > As the preparation to load the sealed key from the NV index handle,
>
> Extract the logic to handle the file buffer from ... to prepare to load the
> sealed key from the NV index handle.
grub_tpm2_readpublic() and grub_tpm2_testparms() didn't check
'authCommand' when marshaling the input data buffer. Currently, there is
no caller using non-NULL 'authCommand'. However, to avoid the potential
issue, the conditional check is added to insert 'authCommand' into the
input buffer if neces
The following TPM 2.0 commands are introduced to tss2 to access the
TPM non-volatile memory associated with the NV index handles.
- TPM2_NV_DefineSpace
- TPM2_NV_UndefineSpace
- TPM2_NV_ReadPublic
- TPM2_NV_Read
- TPM2_NV_Write
The related marshal/unmarshal functions are also introduced.
Signed-
Update the documentation to address tpm2_dump_pcr.
Signed-off-by: Gary Lin
---
docs/grub.texi | 13 +
1 file changed, 13 insertions(+)
diff --git a/docs/grub.texi b/docs/grub.texi
index 200e747af..aba43e35e 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -6433,6 +6433,7 @@ you f
Previously, NV index mode only supported persistent handles which are
only for the TPM objects. Without introducing new parameters, it is
difficult to support authorized policy.
On the other hand, the "NV index" handle allows the user-defined data,
so it can be an alternative to the key file and s
This commit updates the NV index mode section and the grub-protect
section to reflect the recent changes in TPM2 key protector and
grub-protect.
Signed-off-by: Gary Lin
---
docs/grub.texi | 185 +++--
1 file changed, 163 insertions(+), 22 deletions(-)
This commit implements the missing NV index mode support in
'grub-protect'. NV index mode stores the sealed key in the TPM
non-volatile memory (NVRAM) instead of a file. There are two supported
types of TPM handles.
1. Persistent handle (0x8100~0x81FF)
TPM 2.0 Key File format (--tpm2key
The user may need to inspect the TPM 2.0 PCR values with the GRUB shell,
so the new 'tpm2_dump_pcr' command is added to print all PCRs of the
specified bank.
Signed-off-by: Gary Lin
---
.../commands/tpm2_key_protector/module.c | 35 +++
1 file changed, 35 insertions(+)
diff
Since 'grub-protect' already supports NV index mode, tpm2_seal_nv() is
replaced with one 'grub-protect' command to simplify the test script.
Two more NV index test cases are also added to test key sealing and
unsealing with the NV index handle, 0x100.
Signed-off-by: Gary Lin
---
tests/tpm2_
git: https://github.com/lcp/grub2/tree/tpm2-follow-up
This patchset is the collection of several enhancements for TPM2 key
protector.
* Patch 1 introduces the PCR dump to help debugging policy fail.
* Patch 2~3 adds the new command to dump PCRs in GRUB shell and the
* documentation of the command
As the preparation to load the sealed key from the NV index handle,
the logic to handle the file buffer is extracted as an independent
function and the SRK recover function only reads the file and sends the
file buffer to the new function. Besides, the file format is detected
automatically before u
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
On Tue, Dec 17, 2024 at 03:29:02PM +0100, Daniel Kiper wrote:
> On Tue, Dec 17, 2024 at 11:45:32AM +0800, Gary Lin wrote:
> > On Tue, Dec 17, 2024 at 09:35:34AM +0800, Gary Lin wrote:
> > > On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote:
> > > > On Thu, Dec 12, 2024 at 02:11:24PM +080
On Tue, Dec 17, 2024 at 09:35:34AM +0800, Gary Lin wrote:
> On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote:
> > On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote:
> > > PCR mismatching is one common cause of TPM key unsealing fail. Since the
> > > system may be compromised, it
On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote:
> On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote:
> > PCR mismatching is one common cause of TPM key unsealing fail. Since the
> > system may be compromised, it is not safe to boot into OS to get the PCR
> > values and TPM even
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
On Tue, Dec 10, 2024 at 12:22:07PM -0500, Stefan Berger wrote:
>
>
> On 12/3/24 3:45 AM, Gary Lin wrote:
> > PCR mismatching is one common cause of TPM key unsealing fail. Since the
> > system may be compromised, it is not safe to boot into OS to get the PCR
> > values and TPM eventlog for the fu
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
Sorry, I forgot to push an updated string before sending this patch.
Will send the updated patch later. Please ignore this one.
Gary Lin
On Tue, Dec 03, 2024 at 04:36:39PM +0800, Gary Lin wrote:
> PCR mismatching is one common cause of TPM key unsealing fail. Since the
> system may be compromised
PCR mismatching is one common cause of TPM key unsealing fail. Since the
system may be compromised, it is not safe to boot into OS to get the PCR
values and TPM eventlog for the further investigation.
To provide some hints, GRUB now dumps PCRs on policy fail, so the user
can check the current PCR
On Tue, Nov 26, 2024 at 03:39:39PM -0500, Stefan Berger wrote:
> This series of patches enables the 'Automatic Disk Unlock with TPM2'
> support for ieee1275 PowerPC platforms. It adds a TCG2 driver for this
> platform, which has the same API as the one for EFI. Further, it adjusts
> the definition
An attacker may insert a malicious disk with the same crypto UUID and
trick GRUB to mount the fake root. Even though the key from the key
protector fails to unlock the fake root, it's not wiped out cleanly so
the attacker could dump the memory to retrieve the secret key. To defend
such attack, wipe
Since libtasn1.h is the header to be included by users, including the
standard POSIX headers in libtasn1.h would force the user to add the
CFLAGS/CPPFLAGS for the POSIX headers.
This commit adjusts the header paths to use the grub headers instead of
the standard POSIX headers, so that users only n
From: Patrick Colp
If a protector is specified, but it fails to unlock the disk, fall back
to asking for the passphrase.
Before requesting the passphrase, the error from the key protector(s)
has to be cleared, or the later code (e.g., LUKS code) may stop as
'grub_errno' is set. This commit print
Update the user manual to address TPM2 key protector including the two
related commands, tpm2_key_protector_init and tpm2_key_protector_clear,
and the user-space utility: grub-protect.
Signed-off-by: Gary Lin
Reviewed-by: Daniel Kiper
Reviewed-by: Stefan Berger
---
docs/grub.texi | 525 +++
A Trusted Platform Module (TPM) Software Stack (TSS) provides logic to
compose and submit TPM commands and parse reponses.
A limited number of TPM commands may be accessed via the EFI TCG2
protocol. This protocol exposes functionality that is primarily geared
toward TPM usage within the context of
From: Daniel Axtens
Create a wrapper file that specifies the module license.
Set up the makefile so it is built.
Signed-off-by: Daniel Axtens
Signed-off-by: Gary Lin
Reviewed-by: Daniel Kiper
---
autogen.sh | 19 +++
grub-core/Makefile.core.def
1 - 100 of 690 matches
Mail list logo
