Support linux userspace eventlog
- Dominant language
- C
- Stars
- 309
- Forks
- 118
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 33
Description
Systemd measures into various PCRs from userspace.
An up to date list can be found [here](https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/).
Interesting entries are those marked as `Userspace`.
For some time, those measurements were not logged into any eventlog, making it cumbersome to use new systemd versions with go-tpm-tools since the eventlog would not match up with the actual measurements in the PCRs. However, they recently decided to log measurments to a separate eventlog with a similar but slightly different format to what is used in the UEFI boot phase (different location, json encoded).
The implementation can be found here: https://github.com/systemd/systemd/pull/29004
My proposal is that go-tpm-tools could combine the uefi tpm eventlog from `/sys/kernel/security/tpm0/binary_bios_measurements` with the userspace eventlog in `/var/log/systemd/tpm2-measure.log` when [reading the eventlog](https://github.com/google/go-tpm-tools/blob/053cd817d3652026b414bf7a7bd404b3643821b2/client/eventlog.go#L7).
This would allow `parsePCClientEventLog` to succeed with newer versions of systemd.
Contributor guide
Research direction
Start in client/eventlog.go, especially the eventlog-reading path and parsePCClientEventLog. Read the systemd userspace eventlog format and compare it with the UEFI log from /sys/kernel/security/tpm0/binary_bios_measurements and /var/log/systemd/tpm2-measure.log. Done means newer systemd measurements can be combined and parsePCClientEventLog succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100