diff options
author | Lennart Poettering <lennart@poettering.net> | 2022-10-14 15:54:09 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2023-01-17 09:42:16 +0100 |
commit | ff386f985bb51a48a11f74f6370dedf1bbfb4658 (patch) | |
tree | defb7790818b16371a6921928e4ecc412b1ef92c /src/gpt-auto-generator | |
parent | 572f78767f9958559aa4a3060fc5c9a006766240 (diff) | |
download | systemd-ff386f985bb51a48a11f74f6370dedf1bbfb4658.tar.gz |
gpt-auto-generator: automatically measure root/var volume keys into PCR 15
let's enable PCR 15 measurements automatically if gpt-auto discovery is
used and systemd-stub is also used.
Diffstat (limited to 'src/gpt-auto-generator')
-rw-r--r-- | src/gpt-auto-generator/gpt-auto-generator.c | 36 |
1 files changed, 31 insertions, 5 deletions
diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c index 98c0ca0810..1fc7586524 100644 --- a/src/gpt-auto-generator/gpt-auto-generator.c +++ b/src/gpt-auto-generator/gpt-auto-generator.c @@ -52,10 +52,11 @@ static int add_cryptsetup( const char *what, bool rw, bool require, + bool measure, char **ret_device) { #if HAVE_LIBCRYPTSETUP - _cleanup_free_ char *e = NULL, *n = NULL, *d = NULL; + _cleanup_free_ char *e = NULL, *n = NULL, *d = NULL, *options = NULL; _cleanup_fclose_ FILE *f = NULL; int r; @@ -89,7 +90,28 @@ static int add_cryptsetup( "After=%s\n", d, d); - r = generator_write_cryptsetup_service_section(f, id, what, NULL, rw ? NULL : "read-only"); + if (!rw) { + options = strdup("read-only"); + if (!options) + return log_oom(); + } + + if (measure) { + /* We only measure the root volume key into PCR 15 if we are booted with sd-stub (i.e. in a + * UKI), and sd-stub measured the UKI. We do this in order not to step into people's own PCR + * assignment, under the assumption that people who are fine to use sd-stub with its PCR + * assignments are also OK with our PCR 15 use here. */ + + r = efi_get_variable(EFI_LOADER_VARIABLE(StubPcrKernelImage), NULL, NULL, NULL); /* we don't actually care which PCR the UKI used for itself */ + if (r == -ENOENT) + log_debug_errno(r, "Will not measure volume key of volume '%s', because not booted via systemd-stub with measurements enabled.", id); + else if (r < 0) + log_debug_errno(r, "Failed to determine whether booted via systemd-stub with measurements enabled, ignoring: %m"); + else if (!strextend_with_separator(&options, ",", "tpm2-measure-pcr=yes")) + return log_oom(); + } + + r = generator_write_cryptsetup_service_section(f, id, what, NULL, options); if (r < 0) return r; @@ -144,6 +166,7 @@ static int add_mount( const char *fstype, bool rw, bool growfs, + bool measure, const char *options, const char *description, const char *post) { @@ -164,7 +187,7 @@ static int add_mount( log_debug("Adding %s: %s fstype=%s", where, what, fstype ?: "(any)"); if (streq_ptr(fstype, "crypto_LUKS")) { - r = add_cryptsetup(id, what, rw, true, &crypto_what); + r = add_cryptsetup(id, what, rw, /* require= */ true, measure, &crypto_what); if (r < 0) return r; @@ -291,6 +314,7 @@ static int add_partition_mount( p->fstype, p->rw, p->growfs, + /* measure= */ STR_IN_SET(id, "root", "var"), /* by default measure rootfs and /var, since they contain the "identity" of the system */ NULL, description, SPECIAL_LOCAL_FS_TARGET); @@ -315,7 +339,7 @@ static int add_partition_swap(DissectedPartition *p) { } if (streq_ptr(p->fstype, "crypto_LUKS")) { - r = add_cryptsetup("swap", p->node, true, true, &crypto_what); + r = add_cryptsetup("swap", p->node, /* rw= */ true, /* require= */ true, /* measure= */ false, &crypto_what); if (r < 0) return r; what = crypto_what; @@ -384,6 +408,7 @@ static int add_automount( fstype, rw, growfs, + /* measure= */ false, options, description, NULL); @@ -592,7 +617,7 @@ static int add_root_cryptsetup(void) { /* If a device /dev/gpt-auto-root-luks appears, then make it pull in systemd-cryptsetup-root.service, which * sets it up, and causes /dev/gpt-auto-root to appear which is all we are looking for. */ - return add_cryptsetup("root", "/dev/gpt-auto-root-luks", true, false, NULL); + return add_cryptsetup("root", "/dev/gpt-auto-root-luks", /* rw= */ true, /* require= */ false, /* measure= */ true, NULL); #else return 0; #endif @@ -639,6 +664,7 @@ static int add_root_mount(void) { arg_root_fstype, /* rw= */ arg_root_rw > 0, /* growfs= */ false, + /* measure= */ true, arg_root_options, "Root Partition", in_initrd() ? SPECIAL_INITRD_ROOT_FS_TARGET : SPECIAL_LOCAL_FS_TARGET); |