d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libsecureboot: allow control of when pseudo pcr is updated

Browse Source 
During boot we only want to measure things which *must*
be verified - this should provide more deterministic ordering.

Reviewed by:	stevek
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org/D20297
This commit is contained in:
sjg 2019-05-19 20:28:49 +00:00
parent d8da000647
commit 633b0421a3
4 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/libsecureboot/h/libsecureboot.h
View File

@ -81,6 +81,8 @@ unsigned char *verify_asc(const char *, int); /* OpenPGP */
void ve_pcr_init(void);
void ve_pcr_update(unsigned char *, size_t);
ssize_t ve_pcr_get(unsigned char *, size_t);
int ve_pcr_updating_get(void);
void ve_pcr_updating_set(int);
/* flags for verify_{asc,sig,signed} */
#define VEF_VERBOSE 1

7
lib/libsecureboot/tests/tvo.c
View File

@ -74,6 +74,9 @@ main(int argc, char *argv[])
}
}
#ifdef VE_PCR_SUPPORT
ve_pcr_updating_set(1);
#endif
ve_self_tests();
for ( ; optind < argc; optind++) {
@ -176,6 +179,10 @@ main(int argc, char *argv[])
}
}
}
#ifdef VE_PCR_SUPPORT
verify_pcr_export();
printf("pcr=%s\n", getenv("loader.ve.pcr"));
#endif
return (0);
}

22
lib/libsecureboot/vepcr.c
View File

@ -43,6 +43,7 @@ __FBSDID("$FreeBSD$");
static const br_hash_class *pcr_md = NULL;
static br_hash_compat_context pcr_ctx;
static size_t pcr_hlen = 0;
static int pcr_updating;
/**
* @brief initialize pcr context
@ -53,18 +54,37 @@ static size_t pcr_hlen = 0;
void
ve_pcr_init(void)
{
pcr_updating = 0;
pcr_hlen = br_sha256_SIZE;
pcr_md = &br_sha256_vtable;
pcr_md->init(&pcr_ctx.vtable);
}
/**
* @brief get pcr_updating state
*/
int
ve_pcr_updating_get(void)
{
return (pcr_updating);
}
/**
* @brief set pcr_updating state
*/
void
ve_pcr_updating_set(int updating)
{
pcr_updating = updating;
}
/**
* @brief update pcr context
*/
void
ve_pcr_update(unsigned char *data, size_t dlen)
{
if (pcr_md)
if (pcr_updating != 0 && pcr_md != NULL)
pcr_md->update(&pcr_ctx.vtable, data, dlen);
}

8
lib/libsecureboot/verify_file.c
View File

@ -340,6 +340,14 @@ verify_file(int fd, const char *filename, off_t off, int severity)
if (rc != VE_FINGERPRINT_WRONG && loaded_manifests) {
if (severity <= VE_GUESS)
severity = severity_guess(filename);
#ifdef VE_PCR_SUPPORT
/*
* Only update pcr with things that must verify
* these tend to be processed in a more deterministic
* order, which makes our pseudo pcr more useful.
*/
ve_pcr_updating_set((severity == VE_MUST));
#endif
if ((rc = verify_fd(fd, filename, off, &st)) >= 0) {
if (verbose || severity > VE_WANT) {
#if defined(VE_DEBUG_LEVEL) && VE_DEBUG_LEVEL > 0