No device_path information when extending PCR4 done by shim_verify

Open
#642 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
c
Domain
security

Research direction

Start by tracing the shim_verify() communication path and the tpm_log_pe() call mentioned in the issue, focusing on where DevicePath information could be passed to the TPM event log. Review the proposed shim_verify2() mechanism and related discussion before defining the API. Done means a kernel PCR4 extension produces an EV_EFI_BOOT_SERVICES_APPLICATION event containing the correct DevicePath without relying on pathless extensions.

Written by the indexing model from the issue text.

Description

When secure boot gets enabled we found that the TPM2 event log does not contain the "DevicePath" information related to the EV_EFI_BOOT_SERVICES_APPLICATION event during the PCR 4 extension for the kernel.

After some debugging (see cc) the cause seems to be that the communication between systemd-boot and shim is done via shim_verify(), that does not accept any "DevicePath" information that can be later be communicated to tpm_log_pe()

This is an issue because some tools, like pcr-oracle use the "DevicePath" form the event log to locate the PE binary and do a rehash to calculate new predictions and policies. The proposed workaround is very brittle and will be invalidated if more that one pathless extension happens in PCR4, so we are looking for a more robust solution.

Do makes sense to have a shim_verify2() or some other mechanism that can be used to pass the device path information?

cc: @lnussel, @arvidjaar

Dominant language
C
Stars
1.1k
Forks
348
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rhboot/shim

All issues in rhboot/shim

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.