[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v4 00/12] Automatic Disk Unlock with TPM2
|
From: |
Gary Lin |
|
Subject: |
[PATCH v4 00/12] Automatic Disk Unlock with TPM2 |
|
Date: |
Thu, 20 Apr 2023 15:15:36 +0800 |
GIT repo for v4: https://github.com/lcp/grub2/tree/tpm2-unlock-v4
This patch series is based on "Automatic TPM Disk Unlock"(*1) posted by
Hernan Gatta to introduce the key protector framework and TPM2 stack
to GRUB2, and this could be a useful feature for the systems to
implement full disk encryption.
To support TPM 2.0 Key File format(*2), patch 1~6 are grabbed from
Daniel Axtens's "appended signature secure boot support" (*3) to import
libtasn1 into grub2. Besides, the libtasn1 version is upgraded to
4.19.0 instead of 4.16.0 in the original patch.
Patch 7 adds the document for libtasn1 and the steps to upgrade the
library.
Patch 8~12 are Hernan Gatta's patches with the follow-up fixes and
improvements:
- Converting 8 spaces into 1 tab
- Merging the minor build fix from Michael Chang
- Replacing "lu" with "PRIuGRUB_SIZE" for grub_dprintf
- Adding "enable = efi" to the tpm2 module in grub-core/Makefile.core.def
- Rebasing "cryptodisk: Support key protectors" to the git master
- Removing the measurement on the sealed key
- Based ont the patch from Olaf Kirch <OKir@suse.com>
- Adjusting the input parameters of TPM2_EvictControl to match the order
in "TCG TPM2 Part3 Commands"
- Declaring the input arguments of TPM2 functions as const
- Resending TPM2 commands on TPM_RC_RETRY
- Adding checks for the parameters of TPM2 commands
- Packing the missing authorization command for TPM2_PCR_Read
- Tweaking the TPM2 command functions to allow some parameters to be
NULL so that we don't have to declare empty variables
- Only enabling grub-protect for "efi" since the TPM2 stack currently
relies on the EFI TCG2 protocol to send TPM2 commands
- Using grub_cpu_to_be*() in the TPM2 stack instead of grub_swap_bytes*()
which may cause problems in big-indian machines
- Changing the short name of "--protector" of "cryptomount" from "-k" to
"-P" to avoid the conflict with "--key-file"
- Supporting TPM 2.0 Key File Format besides the raw sealed key
- Adding the external libtasn1 dependency to grub-protect to write the
TPM 2.0 Key files
To utilize the TPM2 key protector to unlock the encrypted partition
(sdb1), here are the sample steps:
1. Add an extra random key for LUKS (luks-key)
$ dd if=/dev/urandom of=luks-key bs=1 count=32
$ sudo cryptsetup luksAddKey /dev/sdb1 luks-key --pbkdf=pbkdf2
2. Seal the key
$ sudo grub-protect --action=add \
--protector=tpm2 \
--tpm2key \
--tpm2-keyfile=luks-key \
--tpm2-outfile=/boot/efi/boot/grub2/sealed.tpm
3. Unseal the key with the proper commands in grub.cfg:
tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm
cryptomount -u SDB1_UUID -P tpm2
(*1) https://lists.gnu.org/archive/html/grub-devel/2022-02/msg00006.html
(*2) https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html
(*3) https://lists.gnu.org/archive/html/grub-devel/2021-06/msg00044.html
v4:
- Improving the error condition checks in cryptodisk.c
- Moving the code to unseal with the standalone policy sequence below
the code for authpolicy sequence
- The standalone policy sequence was mistakenly prepended to to the
authpolicy sequence with grub_list_push() while it should be
appended.
- Pushing the error messages from the authpolicy sequence into the
grub_error stack so that we can list all errors from the sequence
- Improving the error messages in the TPM2 protector
- Amending the calculation of the max string lengths of 'Policy',
'CommandCode' and 'CommandPolicy'
- Skipping the error path in grub_tpm2key_get_authpolicy_seq() on
success to avoid freeing the authpolicy sequence
v3:
- https://lists.gnu.org/archive/html/grub-devel/2023-04/msg00055.html
- GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v3
- Adding the document for libtasn1
- Improving the error condition checks
ex: "if (!ptr)" ==> "if (ptr == NULL)"
"if (err)" ==> "if (err != GRUB_ERR_NONE)"
"if (rc)" ==> "if (rc != TPM_RC_SUCCESS)"
- Supporting the "TPMPolicy" and "TPMAuthPolicy" sequence in the TPM 2.0
key File
- Refactoring the key recover function to support "TPMPolicy" and
"TPMAuthPolicy" sequence
- Using TPMS_PCR_SELECTION_SelectPCR() to set the PCR bit mask
- Also dropping TPM2_PCR_TO_SELECT() and TPM2_PCR_TO_BIT() which are
not necessary anymore
- Removing the redundant variable, 'crd', from
grub_cryptodisk_scan_device_real()
- Fixing the spaces/tabs in cryptodisk.c
- Fixing the comment format in cryptodisk.h
- Adding the defensive check for "cargs->protectors" in
grub_cryptodisk_scan_device()
- Improving 'grub-protect' for the better support of TPM 2.0 Key File
- Adding more comments
v2:
- https://lists.gnu.org/archive/html/grub-devel/2023-03/msg00094.html
- GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock-v2
v1:
- https://lists.gnu.org/archive/html/grub-devel/2023-02/msg00130.html
- GIT repo: https://github.com/lcp/grub2/tree/tpm2-unlock
Daniel Axtens (6):
posix_wrap: tweaks in preparation for libtasn1
libtasn1: import libtasn1-4.19.0
libtasn1: disable code not needed in grub
libtasn1: changes for grub compatibility
libtasn1: compile into asn1 module
test_asn1: test module for libtasn1
Gary Lin (1):
libtasn1: Add the documentation
Hernan Gatta (5):
protectors: Add key protectors framework
tpm2: Add TPM Software Stack (TSS)
protectors: Add TPM2 Key Protector
cryptodisk: Support key protectors
util/grub-protect: Add new tool
.gitignore | 2 +
Makefile.util.def | 29 +
configure.ac | 9 +
docs/grub-dev.texi | 27 +
grub-core/Makefile.am | 1 +
grub-core/Makefile.core.def | 42 +
grub-core/disk/cryptodisk.c | 172 +-
grub-core/kern/protectors.c | 75 +
...asn1-disable-code-not-needed-in-grub.patch | 311 ++
...tasn1-changes-for-grub-compatibility.patch | 209 ++
grub-core/lib/libtasn1/COPYING | 16 +
grub-core/lib/libtasn1/README.md | 98 +
grub-core/lib/libtasn1/lib/coding.c | 1433 ++++++++++
grub-core/lib/libtasn1/lib/decoding.c | 2504 +++++++++++++++++
grub-core/lib/libtasn1/lib/element.c | 1110 ++++++++
grub-core/lib/libtasn1/lib/element.h | 42 +
grub-core/lib/libtasn1/lib/errors.c | 103 +
grub-core/lib/libtasn1/lib/gstr.c | 74 +
grub-core/lib/libtasn1/lib/gstr.h | 50 +
grub-core/lib/libtasn1/lib/int.h | 221 ++
grub-core/lib/libtasn1/lib/parser_aux.c | 1179 ++++++++
grub-core/lib/libtasn1/lib/parser_aux.h | 172 ++
grub-core/lib/libtasn1/lib/structure.c | 1227 ++++++++
grub-core/lib/libtasn1/lib/structure.h | 46 +
.../tests/CVE-2018-1000654-1_asn1_tab.h | 32 +
.../tests/CVE-2018-1000654-2_asn1_tab.h | 36 +
.../libtasn1_wrap/tests/CVE-2018-1000654.c | 61 +
.../lib/libtasn1_wrap/tests/Test_overflow.c | 138 +
.../lib/libtasn1_wrap/tests/Test_simple.c | 207 ++
.../lib/libtasn1_wrap/tests/Test_strings.c | 150 +
.../libtasn1_wrap/tests/object-id-decoding.c | 116 +
.../libtasn1_wrap/tests/object-id-encoding.c | 120 +
.../lib/libtasn1_wrap/tests/octet-string.c | 211 ++
.../lib/libtasn1_wrap/tests/reproducers.c | 81 +
grub-core/lib/libtasn1_wrap/wrap.c | 26 +
grub-core/lib/libtasn1_wrap/wrap_tests.c | 75 +
grub-core/lib/libtasn1_wrap/wrap_tests.h | 38 +
grub-core/lib/posix_wrap/limits.h | 1 +
grub-core/lib/posix_wrap/stdlib.h | 8 +
grub-core/lib/posix_wrap/sys/types.h | 1 +
grub-core/tpm2/args.c | 131 +
grub-core/tpm2/buffer.c | 145 +
grub-core/tpm2/module.c | 1033 +++++++
grub-core/tpm2/mu.c | 807 ++++++
grub-core/tpm2/tcg2.c | 143 +
grub-core/tpm2/tpm2.c | 761 +++++
grub-core/tpm2/tpm2key.asn | 31 +
grub-core/tpm2/tpm2key.c | 440 +++
grub-core/tpm2/tpm2key_asn1_tab.c | 41 +
include/grub/cryptodisk.h | 16 +
include/grub/libtasn1.h | 645 +++++
include/grub/protector.h | 48 +
include/grub/tpm2/buffer.h | 65 +
include/grub/tpm2/internal/args.h | 39 +
include/grub/tpm2/internal/functions.h | 117 +
include/grub/tpm2/internal/structs.h | 675 +++++
include/grub/tpm2/internal/types.h | 372 +++
include/grub/tpm2/mu.h | 292 ++
include/grub/tpm2/tcg2.h | 34 +
include/grub/tpm2/tpm2.h | 34 +
include/grub/tpm2/tpm2key.h | 83 +
tests/test_asn1.in | 12 +
util/grub-protect.c | 1508 ++++++++++
63 files changed, 17894 insertions(+), 31 deletions(-)
create mode 100644 grub-core/kern/protectors.c
create mode 100644
grub-core/lib/libtasn1-patches/0001-libtasn1-disable-code-not-needed-in-grub.patch
create mode 100644
grub-core/lib/libtasn1-patches/0002-libtasn1-changes-for-grub-compatibility.patch
create mode 100644 grub-core/lib/libtasn1/COPYING
create mode 100644 grub-core/lib/libtasn1/README.md
create mode 100644 grub-core/lib/libtasn1/lib/coding.c
create mode 100644 grub-core/lib/libtasn1/lib/decoding.c
create mode 100644 grub-core/lib/libtasn1/lib/element.c
create mode 100644 grub-core/lib/libtasn1/lib/element.h
create mode 100644 grub-core/lib/libtasn1/lib/errors.c
create mode 100644 grub-core/lib/libtasn1/lib/gstr.c
create mode 100644 grub-core/lib/libtasn1/lib/gstr.h
create mode 100644 grub-core/lib/libtasn1/lib/int.h
create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.c
create mode 100644 grub-core/lib/libtasn1/lib/parser_aux.h
create mode 100644 grub-core/lib/libtasn1/lib/structure.c
create mode 100644 grub-core/lib/libtasn1/lib/structure.h
create mode 100644
grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-1_asn1_tab.h
create mode 100644
grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654-2_asn1_tab.h
create mode 100644 grub-core/lib/libtasn1_wrap/tests/CVE-2018-1000654.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/Test_overflow.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/Test_simple.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/Test_strings.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/object-id-decoding.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/object-id-encoding.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/octet-string.c
create mode 100644 grub-core/lib/libtasn1_wrap/tests/reproducers.c
create mode 100644 grub-core/lib/libtasn1_wrap/wrap.c
create mode 100644 grub-core/lib/libtasn1_wrap/wrap_tests.c
create mode 100644 grub-core/lib/libtasn1_wrap/wrap_tests.h
create mode 100644 grub-core/tpm2/args.c
create mode 100644 grub-core/tpm2/buffer.c
create mode 100644 grub-core/tpm2/module.c
create mode 100644 grub-core/tpm2/mu.c
create mode 100644 grub-core/tpm2/tcg2.c
create mode 100644 grub-core/tpm2/tpm2.c
create mode 100644 grub-core/tpm2/tpm2key.asn
create mode 100644 grub-core/tpm2/tpm2key.c
create mode 100644 grub-core/tpm2/tpm2key_asn1_tab.c
create mode 100644 include/grub/libtasn1.h
create mode 100644 include/grub/protector.h
create mode 100644 include/grub/tpm2/buffer.h
create mode 100644 include/grub/tpm2/internal/args.h
create mode 100644 include/grub/tpm2/internal/functions.h
create mode 100644 include/grub/tpm2/internal/structs.h
create mode 100644 include/grub/tpm2/internal/types.h
create mode 100644 include/grub/tpm2/mu.h
create mode 100644 include/grub/tpm2/tcg2.h
create mode 100644 include/grub/tpm2/tpm2.h
create mode 100644 include/grub/tpm2/tpm2key.h
create mode 100644 tests/test_asn1.in
create mode 100644 util/grub-protect.c
Range-diff against v3:
1: f2a39b639 = 1: 9167c663e posix_wrap: tweaks in preparation for libtasn1
2: 493f2dc86 = 2: 1b4a9c12b libtasn1: import libtasn1-4.19.0
3: c1c345915 = 3: 2821434ad libtasn1: disable code not needed in grub
4: 5d84feb27 = 4: 98ec778a1 libtasn1: changes for grub compatibility
5: 21441d802 = 5: e3aa6f3f9 libtasn1: compile into asn1 module
6: 7064cf0bc = 6: de837eca0 test_asn1: test module for libtasn1
7: 5485acfb8 = 7: 4b1507c28 libtasn1: Add the documentation
8: 327bb228f = 8: 5affde982 protectors: Add key protectors framework
9: ced33130b = 9: a4f5c4aa6 tpm2: Add TPM Software Stack (TSS)
10: 2249db295 ! 10: ab730e5bc protectors: Add TPM2 Key Protector
@@ grub-core/tpm2/module.c (new)
+ if (sealed_key_size > buf.cap)
+ {
+ grub_dprintf ("tpm2", "Sealed key file is larger than decode buffer
"
-+ "(%" PRIuGRUB_SIZE " vs %" PRIuGRUB_SIZE "
bytes).\n", sealed_key_size, buf.cap);
++ "(%" PRIuGRUB_SIZE " vs %" PRIuGRUB_SIZE "
bytes).\n",
++ sealed_key_size, buf.cap);
+ return GRUB_ERR_BAD_ARGUMENT;
+ }
+
@@ grub-core/tpm2/module.c (new)
+ if (sealed_pub_size + sealed_priv_size > buf.cap)
+ {
+ grub_dprintf ("tpm2", "Sealed key is larger than decode buffer "
-+ "(%" PRIuGRUB_SIZE " vs %" PRIuGRUB_SIZE "
bytes).\n", sealed_pub_size, buf.cap);
++ "(%" PRIuGRUB_SIZE " vs %" PRIuGRUB_SIZE "
bytes).\n",
++ sealed_pub_size, buf.cap);
+ err = GRUB_ERR_BAD_ARGUMENT;
+ goto error;
+ }
@@ grub-core/tpm2/module.c (new)
+ &creationData, &creationHash, &creationTicket,
+ &srkName, NULL);
+ if (rc != TPM_RC_SUCCESS)
-+ {
-+ grub_dprintf ("tpm2", "Could not create SRK (TPM2_CreatePrimary
failed "
-+ "with TSS/TPM error %u).\n", rc);
-+ return GRUB_ERR_BAD_DEVICE;
-+ }
++ return grub_error (GRUB_ERR_BAD_DEVICE,
++ N_("Could not create SRK (TPM2_CreatePrimary: 0x%x)"),
++ rc);
+
+ *srk = srkHandle;
+
@@ grub-core/tpm2/module.c (new)
+ TPM2B_DIGEST pcr_digest;
+ TPML_PCR_SELECTION pcr_sel;
+ TPM_RC rc;
-+ grub_err_t err;
+
+ grub_tpm2_mu_TPM2B_DIGEST_Unmarshal (cmd_buf, &pcr_digest);
+ grub_tpm2_mu_TPML_PCR_SELECTION_Unmarshal (cmd_buf, &pcr_sel);
+ if (cmd_buf->error)
-+ {
-+ err = GRUB_ERR_BAD_ARGUMENT;
-+ return grub_error (err, N_("Failed to unmarshal the buffer for "
-+ "TPM2_PolicyPCR"));
-+ }
++ return grub_error (GRUB_ERR_BAD_ARGUMENT,
++ N_("Failed to unmarshal CommandPolicy for
TPM2_PolicyPCR"));
+
+ rc = TPM2_PolicyPCR (session, NULL, &pcr_digest, &pcr_sel, NULL);
+ if (rc != TPM_RC_SUCCESS)
-+ {
-+ err = GRUB_ERR_BAD_DEVICE;
-+ grub_error (err, N_("Failed to submit PCR policy (TPM2_PolicyPCR "
-+ "failed with TSS/TPM error %u)"), rc);
-+ return err;
-+ }
++ return grub_error (GRUB_ERR_BAD_DEVICE,
++ N_("Failed to submit PCR policy (TPM2_PolicyPCR: 0x%x)"),
++ rc);
+
+ return GRUB_ERR_NONE;
+}
@@ grub-core/tpm2/module.c (new)
+
+ grub_tpm2_buffer_init (&buf);
+ if (policy->cmd_policy_len > buf.cap)
-+ {
-+ return GRUB_ERR_BAD_ARGUMENT;
-+ }
++ return grub_error (GRUB_ERR_BAD_ARGUMENT,
++ N_("CommandPolicy larger than TPM buffer"));
+
+ grub_memcpy (buf.data, policy->cmd_policy, policy->cmd_policy_len);
+ buf.size = policy->cmd_policy_len;
@@ grub-core/tpm2/module.c (new)
+ err = grub_tpm2_protector_policypcr (session, &buf);
+ break;
+ default:
-+ err = GRUB_ERR_BAD_ARGUMENT;
-+ grub_error (err, N_("Unknown TPM Command: %x"), policy->cmd_code);
++ return grub_error (GRUB_ERR_BAD_ARGUMENT,
++ N_("Unknown TPM Command: 0x%x"), policy->cmd_code);
+ }
+
+ return err;
@@ grub-core/tpm2/module.c (new)
+ TPM_RC rc;
+ grub_err_t err;
+
-+ err = GRUB_ERR_BAD_DEVICE;
-+
+ /* Start Auth Session */
+ nonceCaller.size = TPM_SHA256_DIGEST_SIZE;
+ symmetric.algorithm = TPM_ALG_NULL;
@@ grub-core/tpm2/module.c (new)
+ TPM_SE_POLICY, &symmetric, TPM_ALG_SHA256,
+ &session, NULL, NULL);
+ if (rc != TPM_RC_SUCCESS)
-+ {
-+ grub_error (err, N_("Failed to start auth session
(TPM2_StartAuthSession "
-+ "failed with TSS/TPM error %u)"), rc);
-+ goto error;
-+ }
++ return grub_error (GRUB_ERR_BAD_DEVICE,
++ N_("Failed to start auth session (TPM2_StartAuthSession:
"
++ "0x%x)"), rc);
+
+ /* Enforce the policy command sequence */
+ err = grub_tpm2_protector_enforce_policy_seq (policy_seq, session);
@@ grub-core/tpm2/module.c (new)
+ rc = TPM2_Unseal (sealed_handle, &authCmd, &data, NULL);
+ if (rc != TPM_RC_SUCCESS)
+ {
-+ grub_error (err, N_("Failed to unseal sealed key (TPM2_Unseal
failed "
-+ "with TSS/TPM error %u)"), rc);
++ err = GRUB_ERR_BAD_DEVICE;
++ grub_error (err, N_("Failed to unseal sealed key (TPM2_Unseal:
0x%x)"),
++ rc);
+ goto error;
+ }
+
@@ grub-core/tpm2/module.c (new)
+ grub_uint8_t **key, grub_size_t *key_size)
+{
+ TPMS_AUTH_COMMAND authCmd = { 0 };
-+ TPM2_SEALED_KEY sealed_key;
-+ TPM2B_NAME name;
-+ void *file_bytes;
-+ grub_size_t file_size;
++ TPM2_SEALED_KEY sealed_key = { 0 };
++ TPM2B_NAME name = { 0 };
++ void *file_bytes = NULL;
++ grub_size_t file_size = 0;
+ TPM_HANDLE parent_handle = 0;
-+ TPM_HANDLE srk_handle;
-+ TPM_HANDLE sealed_handle;
++ TPM_HANDLE srk_handle = 0;
++ TPM_HANDLE sealed_handle = 0;
+ tpm2key_policy_t policy_seq = NULL;
+ tpm2key_authpolicy_t authpol = NULL;
+ tpm2key_authpolicy_t authpol_seq = NULL;
@@ grub-core/tpm2/module.c (new)
+ }
+ }
+
-+ /*
-+ * Create a basic policy sequence based on the given PCR selection if
the
-+ * key file doesn't provide any policy or authpolicy sequence
-+ */
-+ if (policy_seq == NULL)
-+ {
-+ err = grub_tpm2_protector_simple_policy_seq (ctx, &policy_seq);
-+ if (err != GRUB_ERR_NONE)
-+ goto exit1;
-+ }
-+
-+ /*
-+ * Append the standalone policy sequence into the authpolicy sequence as
-+ * the fallback
-+ */
-+ authpol = grub_malloc (sizeof (struct tpm2key_authpolicy));
-+ if (authpol == NULL)
-+ {
-+ /*
-+ * Free policy_seq here since it's not included in authpol_seq
-+ * yet, and grub_tpm2key_free_policy_seq() won't be able to
-+ * free it.
-+ */
-+ grub_tpm2key_free_policy_seq (policy_seq);
-+ err = GRUB_ERR_OUT_OF_MEMORY;
-+ goto exit1;
-+ }
-+ authpol->policy_seq = policy_seq;
-+ grub_list_push (GRUB_AS_LIST_P (&authpol_seq), GRUB_AS_LIST (authpol));
-+
+ /* Get the SRK to unseal the sealed key */
+ err = grub_tpm2_protector_srk_get (ctx, parent_handle, &srk_handle);
+ if (err != GRUB_ERR_NONE)
@@ grub-core/tpm2/module.c (new)
+ &sealed_handle, &name, NULL);
+ if (rc != TPM_RC_SUCCESS)
+ {
-+ grub_error (err, N_("Failed to load sealed key (TPM2_Load failed "
-+ "with TSS/TPM error %u)"), rc);
++ err = GRUB_ERR_BAD_DEVICE;
++ grub_error (err, N_("Failed to load sealed key (TPM2_Load: 0x%x)"),
rc);
+ goto exit2;
+ }
+
++ err = GRUB_ERR_READ_ERROR;
++
+ /* Iterate the authpolicy sequence to find one that unseals the key */
+ FOR_LIST_ELEMENTS (authpol, authpol_seq)
+ {
@@ grub-core/tpm2/module.c (new)
+ key, key_size);
+ if (err == GRUB_ERR_NONE)
+ break;
++
++ /*
++ * Push the error message into the grub_error stack
++ * Note: The grub_error stack may overflow if there are too many
policy
++ * sequences. Anyway, we still can keep the error messages
from
++ * the first few policy sequences which are usually most
likely to
++ * unseal the key.
++ */
++ grub_error_push();
+ }
+
++ /* Give the standalone policy sequence a try */
++ if (err != GRUB_ERR_NONE)
++ {
++ /*
++ * Create a basic policy sequence based on the given PCR selection
if the
++ * key file doesn't provide one
++ */
++ if (policy_seq == NULL)
++ {
++ err = grub_tpm2_protector_simple_policy_seq (ctx, &policy_seq);
++ if (err != GRUB_ERR_NONE)
++ goto exit3;
++ }
++
++ err = grub_tpm2_protector_unseal (policy_seq, sealed_handle, key,
key_size);
++ }
++
++ /* Pop error messages on success */
++ if (err == GRUB_ERR_NONE)
++ while (grub_error_pop ());
++
++exit3:
+ TPM2_FlushContext (sealed_handle);
+
+exit2:
+ TPM2_FlushContext (srk_handle);
+
+exit1:
++ grub_tpm2key_free_policy_seq (policy_seq);
+ grub_tpm2key_free_authpolicy_seq (authpol_seq);
+ grub_free (file_bytes);
+ return err;
@@ grub-core/tpm2/tpm2key.c (new)
+}
+
+/*
++ * The string to fetch 'Policy' from 'authPolicy':
++ * authPolicy.?XX.Policy
++ */
++#define AUTHPOLICY_POL_MAX_STR "authPolicy.?XX.Policy"
++#define AUTHPOLICY_POL_MAX (sizeof (AUTHPOLICY_POL_MAX_STR))
++
++/*
+ * Expected strings for CommandCode and CommandPolicy:
+ * policy.?XX.CommandCode
+ * policy.?XX.CommandPolicy
+ * authPolicy.?XX.Policy.?YY.CommandCode
+ * authPolicy.?XX.Policy.?YY.CommandPolicy
+ */
-+#define CMD_CODE_MAX (sizeof ("authPolicy.?XX.Policy.?YY.CommandCode"))
-+#define CMD_POL_MAX (sizeof ("authPolicy.?XX.Policy.?YY.CommandPolicy"))
++#define CMD_CODE_MAX_STR AUTHPOLICY_POL_MAX_STR".?YY.CommandCode"
++#define CMD_POL_MAX_STR AUTHPOLICY_POL_MAX_STR".?YY.CommandPolicy"
++#define CMD_CODE_MAX (sizeof (CMD_CODE_MAX_STR))
++#define CMD_POL_MAX (sizeof (CMD_POL_MAX_STR))
+
+static int
+tpm2key_get_policy_seq (asn1_node tpm2key, const char *prefix,
@@ grub-core/tpm2/tpm2key.c (new)
+ }
+}
+
-+#define AUTHPOLICY_POL_MAX (sizeof ("authPolicy.?XX.Policy"))
-+
+grub_err_t
+grub_tpm2key_get_authpolicy_seq (asn1_node tpm2key, tpm2key_authpolicy_t
*authpol_seq)
+{
@@ grub-core/tpm2/tpm2key.c (new)
+
+ *authpol_seq = tmp_seq;
+
++ return GRUB_ERR_NONE;
++
+error:
+ if (authpol)
+ {
11: 9ad473fd8 ! 11: d7c38672a cryptodisk: Support key protectors
@@ Commit message
Signed-off-by: Hernan Gatta <hegatta@linux.microsoft.com>
Signed-off-by: Michael Chang <mchang@suse.com>
Signed-off-by: Gary Lin <glin@suse.com>
+ Reviewed-by: Glenn Washburn <development@efficientek.com>
## Makefile.util.def ##
@@ Makefile.util.def: library = {
@@ grub-core/disk/cryptodisk.c: grub_cryptodisk_scan_device_real (const
char *name,
- }
- cargs->key_len = grub_strlen ((char *) cargs->key_data);
- }
-+ if (!dev)
++ if (dev == NULL)
+ {
+ grub_error (GRUB_ERR_BAD_MODULE,
+ "no cryptodisk module can handle this device");
@@ grub-core/disk/cryptodisk.c: grub_cryptodisk_scan_device_real (const
char *name,
+ if (cargs->key_cache[i].invalid)
+ continue;
+
-+ if (!cargs->key_cache[i].key)
++ if (cargs->key_cache[i].key == NULL)
+ {
+ ret = grub_key_protector_recover_key (cargs->protectors[i],
+ &cargs->key_cache[i].key,
@@ grub-core/disk/cryptodisk.c: grub_cmd_cryptomount (grub_extcmd_context_t
ctxt, i
+ if (state[OPTION_PROTECTOR].set) /* key protector(s) */
+ {
+ cargs.key_cache = grub_zalloc (state[OPTION_PROTECTOR].set * sizeof
(*cargs.key_cache));
-+ if (!cargs.key_cache)
++ if (cargs.key_cache == NULL)
+ return grub_error (GRUB_ERR_OUT_OF_MEMORY,
+ "no memory for key protector key cache");
+ cargs.protectors = state[OPTION_PROTECTOR].args;
12: aa6210c44 = 12: 38ebade13 util/grub-protect: Add new tool
--
2.35.3
- [PATCH v4 00/12] Automatic Disk Unlock with TPM2,
Gary Lin <=
- [PATCH v4 01/12] posix_wrap: tweaks in preparation for libtasn1, Gary Lin, 2023/04/20
- [PATCH v4 03/12] libtasn1: disable code not needed in grub, Gary Lin, 2023/04/20
- [PATCH v4 02/12] libtasn1: import libtasn1-4.19.0, Gary Lin, 2023/04/20
- [PATCH v4 04/12] libtasn1: changes for grub compatibility, Gary Lin, 2023/04/20
- [PATCH v4 05/12] libtasn1: compile into asn1 module, Gary Lin, 2023/04/20
- [PATCH v4 06/12] test_asn1: test module for libtasn1, Gary Lin, 2023/04/20
- [PATCH v4 07/12] libtasn1: Add the documentation, Gary Lin, 2023/04/20
- [PATCH v4 08/12] protectors: Add key protectors framework, Gary Lin, 2023/04/20
- [PATCH v4 09/12] tpm2: Add TPM Software Stack (TSS), Gary Lin, 2023/04/20
- [PATCH v4 10/12] protectors: Add TPM2 Key Protector, Gary Lin, 2023/04/20