system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 18:24:38 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

tpm-util: use trial session where appropriate

Browse source 
TPM2 knows two types of policy sessions: "real" ones and "trial" ones. The
latter allow you to calculate a policy hash without this enforcing any
policy, which the former do. Typically you want to use the "trial" ones
when enrolling, and you have to use the "real" ones for unlocking. So
far we used "real" ones for both cases. Which works fine – as long as
the policy put together matches the current reality (e.g. the PCR values
included in the policy are the ones currently in place in the TPM).

Let's switch to using trial sessions for enrolling. First of all this is
preparation for later work to implement further policy extensions (for
example, policies binding to literally specified PCR values, instead of
the once currently measured). But from my perspective more importantly
it actually is cleaner, as it communicates more clearly what we are
actually doing here.

No user-visible change in behaviour.
This commit is contained in:
Lennart Poettering 2022-08-15 11:44:52 +02:00 committed by Yu Watanabe
parent 599884bd9a
commit 7309690788
1 changed files with 24 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
src/shared/tpm2-util.c
View file

@ -661,6 +661,7 @@ static int tpm2_make_pcr_session(
ESYS_CONTEXT *c,
ESYS_TR primary,
ESYS_TR parent_session,
TPM2_SE session_type,
uint32_t pcr_mask,
uint16_t pcr_bank, /* If UINT16_MAX, pick best bank automatically, otherwise specify bank explicitly. */
bool use_pin,
@ -711,7 +712,7 @@ static int tpm2_make_pcr_session(
ESYS_TR_NONE,
ESYS_TR_NONE,
NULL,
TPM2_SE_POLICY,
session_type,
&symmetric,
TPM2_ALG_SHA256,
&session);
@ -880,8 +881,17 @@ int tpm2_seal(
if (r < 0)
goto finish;
r = tpm2_make_pcr_session(c.esys_context, primary, session, pcr_mask, UINT16_MAX, !!pin, NULL,
&policy_digest, &pcr_bank);
r = tpm2_make_pcr_session(
c.esys_context,
primary,
session,
TPM2_SE_TRIAL,
pcr_mask,
/* pcr_bank= */ UINT16_MAX,
!!pin,
/* ret_session= */ NULL,
&policy_digest,
&pcr_bank);
if (r < 0)
goto finish;
@ -1085,8 +1095,17 @@ int tpm2_unseal(
if (r < 0)
goto finish;
r = tpm2_make_pcr_session(c.esys_context, primary, hmac_session, pcr_mask, pcr_bank, !!pin, &session,
&policy_digest, NULL);
r = tpm2_make_pcr_session(
c.esys_context,
primary,
hmac_session,
TPM2_SE_POLICY,
pcr_mask,
pcr_bank,
!!pin,
&session,
&policy_digest,
/* ret_pcr_bank= */ NULL);
if (r < 0)
goto finish;