SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pcrlock: add --strict option

Browse Source 
Add a --strict option that makes sure all PCRs for which components were
found are indeed included in the set of predicted PCRs. Instead throw an
error. Avoids creating a policy less secure than requested.

Co-authored-by: Akarithos <277667353+Akarithos@users.noreply.github.com>
This commit is contained in:
Ludwig Nussel
2026-08-04 14:11:43 -07:00
committed by Akarithos
co-authored by Akarithos
parent dcde7c750d
commit d1cec47900
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-pcrlock.xml
+9
View File
@@ -601,6 +601,15 @@
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--strict=</option></term>
<listitem><para>Takes a boolean. Defaults to false. Honoured by <command>make-policy</command> and <command>predict</command>. If
true all specified PCRs must be included in the policy otherwise the command returns failure.</para>
<xi:include href="version-info.xml" xpointer="v262"/></listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="json" />
<xi:include href="standard-options.xml" xpointer="no-pager" />
<xi:include href="standard-options.xml" xpointer="help" />
src/pcrlock/pcrlock.c
+14 -2
View File
@@ -91,6 +91,7 @@ static RecoveryPinMode arg_recovery_pin = RECOVERY_PIN_HIDE;
static char *arg_policy_path = NULL;
static bool arg_force = false;
static BootEntryTokenType arg_entry_token_type = BOOT_ENTRY_TOKEN_AUTO;
static bool arg_strict = false;
static char *arg_entry_token = NULL;
static bool arg_varlink = false;
static bool arg_quiet = false;
@@ -3068,6 +3069,7 @@ static int unlink_pcrlock(const char *default_pcrlock_path) {
static int event_log_reduce_to_safe_pcrs(EventLog *el, uint32_t *pcrs) {
_cleanup_free_ char *dropped = NULL, *kept = NULL;
bool dropped_relevant_pcr = false;
assert(el);
assert(pcrs);
@@ -3110,6 +3112,9 @@ static int event_log_reduce_to_safe_pcrs(EventLog *el, uint32_t *pcrs) {
continue;
drop:
if (arg_strict)
dropped_relevant_pcr = true;
*pcrs &= ~(UINT32_C(1) << pcr);
if (strextendf_with_separator(&dropped, ", ", "%" PRIu32 " (%s)", pcr, tpm2_pcr_index_to_string(pcr)) < 0)
@@ -3117,7 +3122,7 @@ static int event_log_reduce_to_safe_pcrs(EventLog *el, uint32_t *pcrs) {
}
if (dropped)
log_notice("PCRs dropped from protection mask: %s", dropped);
log_full(dropped_relevant_pcr ? LOG_ERR : LOG_NOTICE, "PCRs dropped from protection mask: %s", dropped);
else
log_debug("No PCRs dropped from protection mask.");
@@ -3126,7 +3131,7 @@ static int event_log_reduce_to_safe_pcrs(EventLog *el, uint32_t *pcrs) {
else
log_notice("No PCRs kept in protection mask.");
return 0;
return dropped_relevant_pcr ? -ENOEXEC : 0;
}
static int pcr_prediction_add_result(
@@ -5503,6 +5508,13 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
return r;
break;
OPTION_LONG("strict", "BOOL",
"Require all PCRs configured via --pcr= included in policy"):
r = parse_boolean_argument("--strict", opts.arg, &arg_strict);
if (r < 0)
return r;
break;
OPTION('q', "quiet", NULL, "Suppress unnecessary output"):
arg_quiet = true;
break;