Blame SOURCES/0011-Add-GRUB-s-PCR-Usage-to-README.tpm.patch
|
 |
d1e1c8 |
From bd97e72f0490b2be766949f448bf6ea3ec2bba1a Mon Sep 17 00:00:00 2001
|
|
|
d1e1c8 |
From: Peter Jones <pjones@redhat.com>
|
|
|
d1e1c8 |
Date: Wed, 1 Aug 2018 09:58:09 -0500
|
|
|
d1e1c8 |
Subject: [PATCH 11/62] Add GRUB's PCR Usage to README.tpm
|
|
|
d1e1c8 |
|
|
|
d1e1c8 |
This didn't seem to get documented anywhere, and this is as good a place as any.
|
|
|
d1e1c8 |
Upstream-commit-id: 4fab7281a8c
|
|
|
d1e1c8 |
---
|
|
|
d1e1c8 |
README.tpm | 9 +++++++++
|
|
|
d1e1c8 |
1 file changed, 9 insertions(+)
|
|
|
d1e1c8 |
|
|
|
d1e1c8 |
diff --git a/README.tpm b/README.tpm
|
|
|
d1e1c8 |
index b7314f12d57..d9c7c53483b 100644
|
|
|
d1e1c8 |
--- a/README.tpm
|
|
|
d1e1c8 |
+++ b/README.tpm
|
|
|
d1e1c8 |
@@ -19,6 +19,15 @@ PCR7:
|
|
|
d1e1c8 |
- MokSBState will be extended into PCR7 if it is set, logged as
|
|
|
d1e1c8 |
"MokSBState".
|
|
|
d1e1c8 |
|
|
|
d1e1c8 |
+PCR8:
|
|
|
d1e1c8 |
+- If you're using the grub2 TPM patchset we cary in Fedora, the kernel command
|
|
|
d1e1c8 |
+ line and all grub commands (including all of grub.cfg that gets run) are
|
|
|
d1e1c8 |
+ measured into PCR8.
|
|
|
d1e1c8 |
+
|
|
|
d1e1c8 |
+PCR9:
|
|
|
d1e1c8 |
+- If you're using the grub2 TPM patchset we cary in Fedora, the kernel,
|
|
|
d1e1c8 |
+ initramfs, and any multiboot modules loaded are measured into PCR9.
|
|
|
d1e1c8 |
+
|
|
|
d1e1c8 |
PCR14:
|
|
|
d1e1c8 |
- MokList, MokListX, and MokSBState will be extended into PCR14 if they are
|
|
|
d1e1c8 |
set.
|
|
|
d1e1c8 |
--
|
|
|
d1e1c8 |
2.26.2
|
|
|
d1e1c8 |
|