Re: [PATCH v2] tpm2_key_protector: dump PCRs on policy fail

2024-12-17 Thread Gary Lin via Grub-devel
On Tue, Dec 17, 2024 at 03:29:02PM +0100, Daniel Kiper wrote: > On Tue, Dec 17, 2024 at 11:45:32AM +0800, Gary Lin wrote: > > On Tue, Dec 17, 2024 at 09:35:34AM +0800, Gary Lin wrote: > > > On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote: > > > > On Thu, Dec 12, 2024 at 02:11:24PM +080

Re: [PATCH v2] tpm2_key_protector: dump PCRs on policy fail

2024-12-17 Thread Daniel Kiper via Grub-devel
On Tue, Dec 17, 2024 at 11:45:32AM +0800, Gary Lin wrote: > On Tue, Dec 17, 2024 at 09:35:34AM +0800, Gary Lin wrote: > > On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote: > > > On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote: > > > > PCR mismatching is one common cause of TPM

Re: [PATCH v2] tpm2_key_protector: dump PCRs on policy fail

2024-12-16 Thread Gary Lin via Grub-devel
On Tue, Dec 17, 2024 at 09:35:34AM +0800, Gary Lin wrote: > On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote: > > On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote: > > > PCR mismatching is one common cause of TPM key unsealing fail. Since the > > > system may be compromised, it

Re: [PATCH v2] tpm2_key_protector: dump PCRs on policy fail

2024-12-16 Thread Gary Lin via Grub-devel
On Mon, Dec 16, 2024 at 05:28:34PM +0100, Daniel Kiper wrote: > On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote: > > PCR mismatching is one common cause of TPM key unsealing fail. Since the > > system may be compromised, it is not safe to boot into OS to get the PCR > > values and TPM even

Re: [PATCH v2] tpm2_key_protector: dump PCRs on policy fail

2024-12-16 Thread Daniel Kiper via Grub-devel
On Thu, Dec 12, 2024 at 02:11:24PM +0800, Gary Lin wrote: > PCR mismatching is one common cause of TPM key unsealing fail. Since the > system may be compromised, it is not safe to boot into OS to get the PCR > values and TPM eventlog for the further investigation. > > To provide some hints, GRUB no