diff options
| -rw-r--r-- | src/boot/pcrphase.c | 4 | ||||
| -rw-r--r-- | src/cryptsetup/cryptsetup.c | 4 | ||||
| -rw-r--r-- | src/fstab-generator/fstab-generator.c | 8 | ||||
| -rw-r--r-- | src/gpt-auto-generator/gpt-auto-generator.c | 12 | ||||
| -rw-r--r-- | src/shared/efi-loader.c | 12 | ||||
| -rw-r--r-- | src/shared/efi-loader.h | 7 |
6 files changed, 27 insertions, 20 deletions
diff --git a/src/boot/pcrphase.c b/src/boot/pcrphase.c index 003e0b8ad8..2add7f1f89 100644 --- a/src/boot/pcrphase.c +++ b/src/boot/pcrphase.c @@ -334,9 +334,9 @@ static int run(int argc, char *argv[]) { length = strlen(word); /* Skip logic if sd-stub is not used, after all PCR 11 might have a very different purpose then. */ - r = efi_stub_measured(); + r = efi_stub_measured(LOG_ERR); if (r < 0) - return log_error_errno(r, "Failed to detect if we are running on a kernel image with TPM measurement enabled: %m"); + return r; if (r == 0) { log_info("Kernel stub did not measure kernel image into PCR %u, skipping userspace measurement, too.", TPM_PCR_INDEX_KERNEL_IMAGE); return EXIT_SUCCESS; diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 38ee7f8935..819d5bbb97 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -828,9 +828,9 @@ static int measure_volume_key( return 0; } - r = efi_stub_measured(); + r = efi_stub_measured(LOG_WARNING); if (r < 0) - return log_warning_errno(r, "Failed to detect if we are running on a kernel image with TPM measurement enabled: %m"); + return r; if (r == 0) { log_debug("Kernel stub did not measure kernel image into the expected PCR, skipping userspace measurement, too."); return 0; diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c index ed34e0a32f..efc553b698 100644 --- a/src/fstab-generator/fstab-generator.c +++ b/src/fstab-generator/fstab-generator.c @@ -530,12 +530,10 @@ static int add_mount( } if (flags & MOUNT_PCRFS) { - r = efi_stub_measured(); - if (r < 0) - log_warning_errno(r, "Failed to detect if we are running on a kernel image with TPM measurement enabled, assuming not: %m"); - else if (r == 0) + r = efi_stub_measured(LOG_WARNING); + if (r == 0) log_debug("Kernel stub did not measure kernel image into PCR, skipping userspace measurement, too."); - else { + else if (r > 0) { r = generator_hook_up_pcrfs(dest, where, target_unit); if (r < 0) return r; diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c index dcf95a3ee1..21b9284f8a 100644 --- a/src/gpt-auto-generator/gpt-auto-generator.c +++ b/src/gpt-auto-generator/gpt-auto-generator.c @@ -102,13 +102,13 @@ static int add_cryptsetup( * assignment, under the assumption that people who are fine to use sd-stub with its PCR * assignments are also OK with our PCR 15 use here. */ - r = efi_stub_measured(); - if (r < 0) - log_warning_errno(r, "Failed to determine whether booted via systemd-stub with measurements enabled, ignoring: %m"); - else if (r == 0) + r = efi_stub_measured(LOG_WARNING); + if (r == 0) log_debug("Will not measure volume key of volume '%s', because not booted via systemd-stub with measurements enabled.", id); - else if (!strextend_with_separator(&options, ",", "tpm2-measure-pcr=yes")) - return log_oom(); + else if (r > 0) { + if (!strextend_with_separator(&options, ",", "tpm2-measure-pcr=yes")) + return log_oom(); + } } r = generator_write_cryptsetup_service_section(f, id, what, NULL, options); diff --git a/src/shared/efi-loader.c b/src/shared/efi-loader.c index 621fa082ba..f77f8351cf 100644 --- a/src/shared/efi-loader.c +++ b/src/shared/efi-loader.c @@ -238,7 +238,7 @@ int efi_stub_get_features(uint64_t *ret) { return 0; } -int efi_stub_measured(void) { +int efi_stub_measured(int log_level) { _cleanup_free_ char *pcr_string = NULL; unsigned pcr_nr; int r; @@ -264,13 +264,17 @@ int efi_stub_measured(void) { if (r == -ENOENT) return 0; if (r < 0) - return r; + return log_full_errno(log_level, r, + "Failed to get StubPcrKernelImage EFI variable: %m"); r = safe_atou(pcr_string, &pcr_nr); if (r < 0) - return log_debug_errno(r, "Failed to parse StubPcrKernelImage EFI variable: %s", pcr_string); + return log_full_errno(log_level, r, + "Failed to parse StubPcrKernelImage EFI variable: %s", pcr_string); if (pcr_nr != TPM_PCR_INDEX_KERNEL_IMAGE) - return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE), "Kernel stub measured kernel image into PCR %u, which is different than expected %u.", pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE); + return log_full_errno(log_level, SYNTHETIC_ERRNO(EREMOTE), + "Kernel stub measured kernel image into PCR %u, which is different than expected %u.", + pcr_nr, TPM_PCR_INDEX_KERNEL_IMAGE); return 1; } diff --git a/src/shared/efi-loader.h b/src/shared/efi-loader.h index 56ccdee9c1..834362292a 100644 --- a/src/shared/efi-loader.h +++ b/src/shared/efi-loader.h @@ -18,7 +18,7 @@ int efi_loader_get_entries(char ***ret); int efi_loader_get_features(uint64_t *ret); int efi_stub_get_features(uint64_t *ret); -int efi_stub_measured(void); +int efi_stub_measured(int log_level); int efi_loader_get_config_timeout_one_shot(usec_t *ret); int efi_loader_update_entry_one_shot_cache(char **cache, struct stat *cache_stat); @@ -45,6 +45,11 @@ static inline int efi_stub_get_features(uint64_t *ret) { return -EOPNOTSUPP; } +static inline int efi_stub_measured(int log_level) { + return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP), + "Compiled without support for EFI"); +} + static inline int efi_loader_get_config_timeout_one_shot(usec_t *ret) { return -EOPNOTSUPP; } |