google / google/go-tpm-tools

Support linux userspace eventlog

Open
#360 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
C
Stars
309
Forks
118
Avg merge
1d 16h
Merged PRs (30d)
33

Description

Systemd measures into various PCRs from userspace.
An up to date list can be found [here](https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/).
Interesting entries are those marked as `Userspace`.

For some time, those measurements were not logged into any eventlog, making it cumbersome to use new systemd versions with go-tpm-tools since the eventlog would not match up with the actual measurements in the PCRs. However, they recently decided to log measurments to a separate eventlog with a similar but slightly different format to what is used in the UEFI boot phase (different location, json encoded).
The implementation can be found here: https://github.com/systemd/systemd/pull/29004

My proposal is that go-tpm-tools could combine the uefi tpm eventlog from `/sys/kernel/security/tpm0/binary_bios_measurements` with the userspace eventlog in `/var/log/systemd/tpm2-measure.log` when [reading the eventlog](https://github.com/google/go-tpm-tools/blob/053cd817d3652026b414bf7a7bd404b3643821b2/client/eventlog.go#L7).

This would allow `parsePCClientEventLog` to succeed with newer versions of systemd.

Contributor guide

Open the contributing guide

Research direction

Start in client/eventlog.go, especially the eventlog-reading path and parsePCClientEventLog. Read the systemd userspace eventlog format and compare it with the UEFI log from /sys/kernel/security/tpm0/binary_bios_measurements and /var/log/systemd/tpm2-measure.log. Done means newer systemd measurements can be combined and parsePCClientEventLog succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.