4cf8c08cf7
Since GRUB 2.04 there is support for TPM measurements in a tpm module that uses the verifiers framework. So this is used now instead of the previous downstream patches that we were carrying. But we forgot to enable this module when rebasing to 2.04 which leads to GRUB no longer measuring the kernel, initrd and command line parameters. One side effect of using the verifiers framework is that if measurements fail, GRUB won't be able to open the files since the errors from the tpm module are propagated. This means that a firmware with a buggy tpm support will prevent the machine to boot, which was not the case with the previous downstream patches. Don't propagate the measurement errors to prevent this. Resolves: rhbz#1836433 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
63 lines
2.2 KiB
Diff
63 lines
2.2 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
Date: Sat, 16 May 2020 11:33:18 +0200
|
|
Subject: [PATCH] tpm: Don't propagate TPM measurement errors to the verifiers
|
|
layer
|
|
|
|
Currently if the EFI firmware fails to do a TPM measurement for a file,
|
|
the error will be propagated to the verifiers framework and so opening
|
|
the file will not succeed.
|
|
|
|
This mean that buggy firmwares will prevent the system to boot since the
|
|
loader won't be able to open any file. But failing to do TPM measurements
|
|
shouldn't be a fatal error and the system should still be able to boot.
|
|
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
---
|
|
grub-core/commands/tpm.c | 14 +++++++-------
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c
|
|
index 1441c494d81..dbaeae46dfa 100644
|
|
--- a/grub-core/commands/tpm.c
|
|
+++ b/grub-core/commands/tpm.c
|
|
@@ -49,7 +49,8 @@ grub_tpm_verify_init (grub_file_t io,
|
|
static grub_err_t
|
|
grub_tpm_verify_write (void *context, void *buf, grub_size_t size)
|
|
{
|
|
- return grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
|
|
+ grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
|
|
+ return GRUB_ERR_NONE;
|
|
}
|
|
|
|
static grub_err_t
|
|
@@ -57,7 +58,6 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type)
|
|
{
|
|
const char *prefix = NULL;
|
|
char *description;
|
|
- grub_err_t status;
|
|
|
|
switch (type)
|
|
{
|
|
@@ -73,15 +73,15 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type)
|
|
}
|
|
description = grub_malloc (grub_strlen (str) + grub_strlen (prefix) + 1);
|
|
if (!description)
|
|
- return grub_errno;
|
|
+ return GRUB_ERR_NONE;
|
|
grub_memcpy (description, prefix, grub_strlen (prefix));
|
|
grub_memcpy (description + grub_strlen (prefix), str,
|
|
grub_strlen (str) + 1);
|
|
- status =
|
|
- grub_tpm_measure ((unsigned char *) str, grub_strlen (str),
|
|
- GRUB_STRING_PCR, description);
|
|
+
|
|
+ grub_tpm_measure ((unsigned char *) str, grub_strlen (str), GRUB_STRING_PCR,
|
|
+ description);
|
|
grub_free (description);
|
|
- return status;
|
|
+ return GRUB_ERR_NONE;
|
|
}
|
|
|
|
struct grub_file_verifier grub_tpm_verifier = {
|