|
 |
00e791 |
From 0a8f7ade76ff3eede486027eaa638181e6bed3b8 Mon Sep 17 00:00:00 2001
|
|
|
00e791 |
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
00e791 |
Date: Tue, 18 Feb 2020 12:03:17 +0100
|
|
|
00e791 |
Subject: [PATCH 46/62] tpm: Include information about PE/COFF images in the
|
|
|
00e791 |
TPM Event Log
|
|
|
00e791 |
|
|
|
00e791 |
The "TCG PC Client Specific Platform Firmware Profile Specification" says
|
|
|
00e791 |
that when measuring a PE/COFF image, the TCG_PCR_EVENT2 structure Event
|
|
|
00e791 |
field MUST contain a UEFI_IMAGE_LOAD_EVENT structure.
|
|
|
00e791 |
|
|
|
00e791 |
Currently an empty UEFI_IMAGE_LOAD_EVENT structure is passed so users only
|
|
|
00e791 |
have the hash of the PE/COFF image, but not information such the file path
|
|
|
00e791 |
of the binary.
|
|
|
00e791 |
|
|
|
00e791 |
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
00e791 |
Upstream-commit-id: c252b9ee94c
|
|
|
00e791 |
---
|
|
|
00e791 |
shim.c | 7 +++++--
|
|
|
00e791 |
tpm.c | 46 ++++++++++++++++++++++++++++++++--------------
|
|
|
00e791 |
include/tpm.h | 5 +++--
|
|
|
00e791 |
3 files changed, 40 insertions(+), 18 deletions(-)
|
|
|
00e791 |
|
|
|
00e791 |
diff --git a/shim.c b/shim.c
|
|
|
00e791 |
index a4f7769b38b..b35b0ad90cc 100644
|
|
|
00e791 |
--- a/shim.c
|
|
|
00e791 |
+++ b/shim.c
|
|
|
00e791 |
@@ -1274,7 +1274,9 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
|
|
|
00e791 |
#ifdef REQUIRE_TPM
|
|
|
00e791 |
efi_status =
|
|
|
00e791 |
#endif
|
|
|
00e791 |
- tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4);
|
|
|
00e791 |
+ tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize,
|
|
|
00e791 |
+ (EFI_PHYSICAL_ADDRESS)(UINTN)context.ImageAddress,
|
|
|
00e791 |
+ li->FilePath, sha1hash, 4);
|
|
|
00e791 |
#ifdef REQUIRE_TPM
|
|
|
00e791 |
if (efi_status != EFI_SUCCESS) {
|
|
|
00e791 |
return efi_status;
|
|
|
00e791 |
@@ -1788,7 +1790,8 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
|
|
|
00e791 |
#ifdef REQUIRE_TPM
|
|
|
00e791 |
efi_status =
|
|
|
00e791 |
#endif
|
|
|
00e791 |
- tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4);
|
|
|
00e791 |
+ tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, 0, NULL,
|
|
|
00e791 |
+ sha1hash, 4);
|
|
|
00e791 |
#ifdef REQUIRE_TPM
|
|
|
00e791 |
if (EFI_ERROR(efi_status))
|
|
|
00e791 |
goto done;
|
|
|
00e791 |
diff --git a/tpm.c b/tpm.c
|
|
|
00e791 |
index 196b93c30f6..22ad148b35a 100644
|
|
|
00e791 |
--- a/tpm.c
|
|
|
00e791 |
+++ b/tpm.c
|
|
|
00e791 |
@@ -210,21 +210,39 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
|
|
|
00e791 |
strlen(description) + 1, 0xd, NULL);
|
|
|
00e791 |
}
|
|
|
00e791 |
|
|
|
00e791 |
-EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
|
|
|
00e791 |
- UINT8 pcr)
|
|
|
00e791 |
+EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size,
|
|
|
00e791 |
+ EFI_PHYSICAL_ADDRESS addr, EFI_DEVICE_PATH *path,
|
|
|
00e791 |
+ UINT8 *sha1hash, UINT8 pcr)
|
|
|
00e791 |
{
|
|
|
00e791 |
- EFI_IMAGE_LOAD_EVENT ImageLoad;
|
|
|
00e791 |
-
|
|
|
00e791 |
- // All of this is informational and forces us to do more parsing before
|
|
|
00e791 |
- // we can generate it, so let's just leave it out for now
|
|
|
00e791 |
- ImageLoad.ImageLocationInMemory = 0;
|
|
|
00e791 |
- ImageLoad.ImageLengthInMemory = 0;
|
|
|
00e791 |
- ImageLoad.ImageLinkTimeAddress = 0;
|
|
|
00e791 |
- ImageLoad.LengthOfDevicePath = 0;
|
|
|
00e791 |
-
|
|
|
00e791 |
- return tpm_log_event_raw(buf, size, pcr, (CHAR8 *)&ImageLoad,
|
|
|
00e791 |
- sizeof(ImageLoad),
|
|
|
00e791 |
- EV_EFI_BOOT_SERVICES_APPLICATION, sha1hash);
|
|
|
00e791 |
+ EFI_IMAGE_LOAD_EVENT *ImageLoad = NULL;
|
|
|
00e791 |
+ EFI_STATUS efi_status;
|
|
|
00e791 |
+ UINTN path_size = 0;
|
|
|
00e791 |
+
|
|
|
00e791 |
+ if (path)
|
|
|
00e791 |
+ path_size = DevicePathSize(path);
|
|
|
00e791 |
+
|
|
|
00e791 |
+ ImageLoad = AllocateZeroPool(sizeof(*ImageLoad) + path_size);
|
|
|
00e791 |
+ if (!ImageLoad) {
|
|
|
00e791 |
+ perror(L"Unable to allocate image load event structure\n");
|
|
|
00e791 |
+ return EFI_OUT_OF_RESOURCES;
|
|
|
00e791 |
+ }
|
|
|
00e791 |
+
|
|
|
00e791 |
+ ImageLoad->ImageLocationInMemory = buf;
|
|
|
00e791 |
+ ImageLoad->ImageLengthInMemory = size;
|
|
|
00e791 |
+ ImageLoad->ImageLinkTimeAddress = addr;
|
|
|
00e791 |
+
|
|
|
00e791 |
+ if (path_size > 0) {
|
|
|
00e791 |
+ CopyMem(ImageLoad->DevicePath, path, path_size);
|
|
|
00e791 |
+ ImageLoad->LengthOfDevicePath = path_size;
|
|
|
00e791 |
+ }
|
|
|
00e791 |
+
|
|
|
00e791 |
+ efi_status = tpm_log_event_raw(buf, size, pcr, (CHAR8 *)ImageLoad,
|
|
|
00e791 |
+ sizeof(*ImageLoad) + path_size,
|
|
|
00e791 |
+ EV_EFI_BOOT_SERVICES_APPLICATION,
|
|
|
00e791 |
+ sha1hash);
|
|
|
00e791 |
+ FreePool(ImageLoad);
|
|
|
00e791 |
+
|
|
|
00e791 |
+ return efi_status;
|
|
|
00e791 |
}
|
|
|
00e791 |
|
|
|
00e791 |
typedef struct {
|
|
|
00e791 |
diff --git a/include/tpm.h b/include/tpm.h
|
|
|
00e791 |
index 746e871ff22..a05c24949e5 100644
|
|
|
00e791 |
--- a/include/tpm.h
|
|
|
00e791 |
+++ b/include/tpm.h
|
|
|
00e791 |
@@ -10,8 +10,9 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
|
|
|
00e791 |
const CHAR8 *description);
|
|
|
00e791 |
EFI_STATUS fallback_should_prefer_reset(void);
|
|
|
00e791 |
|
|
|
00e791 |
-EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
|
|
|
00e791 |
- UINT8 pcr);
|
|
|
00e791 |
+EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size,
|
|
|
00e791 |
+ EFI_PHYSICAL_ADDRESS addr, EFI_DEVICE_PATH *path,
|
|
|
00e791 |
+ UINT8 *sha1hash, UINT8 pcr);
|
|
|
00e791 |
|
|
|
00e791 |
EFI_STATUS tpm_measure_variable(CHAR16 *dbname, EFI_GUID guid, UINTN size, void *data);
|
|
|
00e791 |
|
|
|
00e791 |
--
|
|
|
00e791 |
2.26.2
|
|
|
00e791 |
|