proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-06-13 18:40:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm: Include information about PE/COFF images in the TPM Event Log

Browse Source 
The "TCG PC Client Specific Platform Firmware Profile Specification" says
that when measuring a PE/COFF image, the TCG_PCR_EVENT2 structure Event
field MUST contain a UEFI_IMAGE_LOAD_EVENT structure.

Currently an empty UEFI_IMAGE_LOAD_EVENT structure is passed so users only
have the hash of the PE/COFF image, but not information such the file path
of the binary.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Upstream-commit-id: c252b9ee94c
This commit is contained in:
Javier Martinez Canillas 2020-02-18 12:03:17 +01:00 committed by Peter Jones
parent 89d72301aa
commit 0a8f7ade76
3 changed files with 38 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/tpm.h
View File

@ -10,8 +10,9 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
const CHAR8 *description);
EFI_STATUS fallback_should_prefer_reset(void);
EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
UINT8 pcr);
EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size,
EFI_PHYSICAL_ADDRESS addr, EFI_DEVICE_PATH *path,
UINT8 *sha1hash, UINT8 pcr);
EFI_STATUS tpm_measure_variable(CHAR16 *dbname, EFI_GUID guid, UINTN size, void *data);

7
shim.c
View File

@ -1274,7 +1274,9 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
#ifdef REQUIRE_TPM
efi_status =
#endif
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize, sha1hash, 4);
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)data, datasize,
(EFI_PHYSICAL_ADDRESS)(UINTN)context.ImageAddress,
li->FilePath, sha1hash, 4);
#ifdef REQUIRE_TPM
if (efi_status != EFI_SUCCESS) {
return efi_status;
@ -1788,7 +1790,8 @@ EFI_STATUS shim_verify (void *buffer, UINT32 size)
#ifdef REQUIRE_TPM
efi_status =
#endif
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, sha1hash, 4);
tpm_log_pe((EFI_PHYSICAL_ADDRESS)(UINTN)buffer, size, 0, NULL,
sha1hash, 4);
#ifdef REQUIRE_TPM
if (EFI_ERROR(efi_status))
goto done;

42
tpm.c
View File

@ -210,21 +210,39 @@ EFI_STATUS tpm_log_event(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 pcr,
strlen(description) + 1, 0xd, NULL);
}
EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size, UINT8 *sha1hash,
UINT8 pcr)
EFI_STATUS tpm_log_pe(EFI_PHYSICAL_ADDRESS buf, UINTN size,
EFI_PHYSICAL_ADDRESS addr, EFI_DEVICE_PATH *path,
UINT8 *sha1hash, UINT8 pcr)
{
EFI_IMAGE_LOAD_EVENT ImageLoad;
EFI_IMAGE_LOAD_EVENT *ImageLoad = NULL;
EFI_STATUS efi_status;
UINTN path_size = 0;
// All of this is informational and forces us to do more parsing before
// we can generate it, so let's just leave it out for now
ImageLoad.ImageLocationInMemory = 0;
ImageLoad.ImageLengthInMemory = 0;
ImageLoad.ImageLinkTimeAddress = 0;
ImageLoad.LengthOfDevicePath = 0;
if (path)
path_size = DevicePathSize(path);
return tpm_log_event_raw(buf, size, pcr, (CHAR8 *)&ImageLoad,
sizeof(ImageLoad),
EV_EFI_BOOT_SERVICES_APPLICATION, sha1hash);
ImageLoad = AllocateZeroPool(sizeof(*ImageLoad) + path_size);
if (!ImageLoad) {
perror(L"Unable to allocate image load event structure\n");
return EFI_OUT_OF_RESOURCES;
}
ImageLoad->ImageLocationInMemory = buf;
ImageLoad->ImageLengthInMemory = size;
ImageLoad->ImageLinkTimeAddress = addr;
if (path_size > 0) {
CopyMem(ImageLoad->DevicePath, path, path_size);
ImageLoad->LengthOfDevicePath = path_size;
}
efi_status = tpm_log_event_raw(buf, size, pcr, (CHAR8 *)ImageLoad,
sizeof(*ImageLoad) + path_size,
EV_EFI_BOOT_SERVICES_APPLICATION,
sha1hash);
FreePool(ImageLoad);
return efi_status;
}
typedef struct {