Skip to content

initrd: remove TPM2 primary handle hash check and creation #2153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tlaurion wants to merge 1 commit into
base: master
Choose a base branch
from
Open

initrd: remove TPM2 primary handle hash check and creation #2153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions initrd/bin/gui-init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -798,13 +798,7 @@ reset_tpm() {
# now that the TPM is reset, remove invalid TPM counter files
mount_boot
mount -o rw,remount /boot
#TODO: this is really problematic, we should really remove the primary handle hash

STATUS "Removing rollback and primary handle hashes under /boot"

DEBUG "Removing /boot/kexec_rollback.txt and /boot/kexec_primhdl_hash.txt"
rm -f /boot/kexec_rollback.txt
rm -f /boot/kexec_primhdl_hash.txt

# create Heads TPM counter before any others
check_tpm_counter /boot/kexec_rollback.txt "" "$tpm_owner_passphrase" ||
Expand Down
12 changes: 0 additions & 12 deletions initrd/bin/kexec-save-default.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ paramsdir="${paramsdir%%/}"
TMP_MENU_FILE="/tmp/kexec/kexec_menu.txt"
ENTRY_FILE="$paramsdir/kexec_default.$index.txt"
HASH_FILE="$paramsdir/kexec_default_hashes.txt"
PRIMHASH_FILE="$paramsdir/kexec_primhdl_hash.txt"
KEY_DEVICES="$paramsdir/kexec_key_devices.txt"
KEY_LVM="$paramsdir/kexec_key_lvm.txt"

Expand Down Expand Up @@ -291,17 +290,6 @@ done
cp "$bootdir/kexec_initrd_crypttab_overrides.txt" "$stagedir/"
DEBUG "Seeded $stagedir with existing config files from $paramsdir"

if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
if [ -f /tmp/secret/primary.handle ]; then
DEBUG "Hashing TPM2 primary key handle..."
sha256sum /tmp/secret/primary.handle > "$stagedir/kexec_primhdl_hash.txt" ||
DIE "ERROR: Failed to Hash TPM2 primary key handle!"
DEBUG "TPM2 primary key handle hash written to $stagedir/kexec_primhdl_hash.txt"
else
DIE "ERROR: TPM2 primary key handle file does not exist!"
fi
fi

# Remove old kexec_default.*.txt from staging; new entry written below
rm "$stagedir"/kexec_default.*.txt 2>/dev/null || true
echo "$entry" >"$stagedir/kexec_default.$index.txt"
Expand Down
18 changes: 0 additions & 18 deletions initrd/bin/kexec-select-boot.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,24 +69,6 @@ if [ -z "$_HEADS_TEST" ]; then
paramsdir="${paramsdir%%/}"
fi

PRIMHASH_FILE="$paramsdir/kexec_primhdl_hash.txt"
if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
if [ -s "$PRIMHASH_FILE" ]; then
sha256sum -c "$PRIMHASH_FILE" >/dev/null 2>&1 ||
{
WARN "Hash of TPM2 primary key handle mismatch - if you have not intentionally regenerated the TPM2 primary key, your system may have been compromised"
DEBUG "Hash of TPM2 primary key handle mismatched for $PRIMHASH_FILE"
DEBUG "Contents of $PRIMHASH_FILE:"
DEBUG "$(cat $PRIMHASH_FILE)"
DIE "Hash of TPM2 primary key handle mismatch ($PRIMHASH_FILE). If you did not intentionally regenerate the TPM2 primary key, this may indicate compromise."
}
else
WARN "Hash of TPM2 primary key handle does not exist - rebuild it by setting a default OS to boot: Options -> Boot Options -> Show OS Boot Menu -> pick OS -> Make default"
default_failed="y"
DEBUG "Hash of TPM2 primary key handle does not exist under $PRIMHASH_FILE"
fi
fi

verify_rollback_counter() {
TRACE_FUNC
TPM_COUNTER=$(grep counter $TMP_ROLLBACK_FILE | cut -d- -f2)
Expand Down
34 changes: 0 additions & 34 deletions initrd/etc/functions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2309,33 +2309,6 @@ secret_from_rom_hash() {
sha256sum "${ROM_IMAGE}" | cut -f1 -d ' ' | fromhex_plain
}

# Refresh /boot hash of the TPM2 primary handle when available.
# This prevents a follow-up prompt to "set default boot" solely to rebuild
# kexec_primhdl_hash.txt after TPM reset/reseal flows.
refresh_tpm2_primary_handle_hash() {
TRACE_FUNC
local primhash_file="${1:-/boot/kexec_primhdl_hash.txt}"

if [ "$CONFIG_TPM2_TOOLS" != "y" ]; then
DEBUG "Skipping TPM2 primary handle hash refresh: CONFIG_TPM2_TOOLS != y"
return 0
fi

if [ ! -s /tmp/secret/primary.handle ]; then
DEBUG "Skipping TPM2 primary handle hash refresh: /tmp/secret/primary.handle not available"
return 0
fi

DEBUG "Refreshing TPM2 primary key handle hash into $primhash_file"
if ! DO_WITH_DEBUG sha256sum /tmp/secret/primary.handle >"$primhash_file"; then
WARN "Failed to refresh TPM2 primary key handle hash at $primhash_file"
return 1
fi

DEBUG "TPM2 primary key handle hash saved to $primhash_file"
return 0
}

# Update the checksums of the files in /boot and sign them
update_checksums() {
TRACE_FUNC
Expand All @@ -2359,13 +2332,6 @@ update_checksums() {
fi
fi

# Keep this best-effort and run it before signing while /boot is RW.
# Running after kexec-sign-config.sh can fail because that path may remount
# /boot read-only before returning.
if ! refresh_tpm2_primary_handle_hash; then
WARN "Proceeding without refreshed TPM2 primary key handle hash"
fi

signing_targets="$(find /boot/kexec*.txt 2>/dev/null | tr '\n' ' ')"
DEBUG "update_checksums: signing targets under /boot: ${signing_targets:-<none>}"
Comment on lines 2335 to 2336
DEBUG "update_checksums: rollback marker path is $reset_required_marker"
Expand Down