Files
systemd/man
Lennart Poettering 72c97c19c3 efi: from the stub measure the ELF kernel + built-in initrd and so on into PCR 11
Here we grab a new – on Linux so far unused (by my Googling skills, that
is) – and measure all static components of the PE kernel image into.
This is useful since for the first time we'll have a PCR that contains
only a PCR of the booted kernel, nothing else. That allows putting
together TPM policies that bind to a specific kernel (+ builtin initrd),
without having to have booted that kernel first. PCRs can be
pre-calculated. Yay!

You might wonder, why we measure just the discovered PE sections we are
about to use, instead of the whole PE image. That's because of the next
step I have in mind: PE images should also be able to carry an
additional section that contains a signature for its own expected,
pre-calculated PCR values. This signature data should then be passed
into the booted kernel and can be used there in TPM policies. Benefit:
TPM policies can now be bound to *signatures* of PCRs, instead of the
raw hash values themselves. This makes update management a *lot* easier,
as policies don't need to be updated whenever a kernel is updated, as
long as the signature is available. Now, if the PCR signature is
embedded in the kernel PE image it cannot be of a PCR hash of the kernel
PE image itself, because that would be a chicken-and-egg problem. Hence,
by only measuring the relavent payload sections (and that means
excluding the future section that will contain the PCR hash signature)
we avoid this problem, naturally.
2022-08-02 10:28:49 +02:00
..
2022-01-07 17:37:37 +01:00
2022-06-28 13:10:05 +02:00
2021-10-07 22:13:12 +02:00
2022-06-28 16:05:31 +02:00
2022-06-28 13:10:05 +02:00
…
2022-07-20 13:15:37 +09:00
2022-07-05 21:49:12 +02:00
2022-06-28 13:10:05 +02:00
2021-08-18 13:36:14 +02:00
2022-07-20 13:15:37 +09:00
2022-06-28 13:10:05 +02:00
2022-03-07 15:32:22 +09:00
2021-06-30 23:33:00 +09:00
2022-01-06 22:20:11 +09:00
2021-11-30 13:54:27 +01:00
2022-05-26 14:29:50 +02:00
2022-07-19 10:41:13 +01:00
2021-04-19 23:16:02 +02:00
2022-07-23 11:18:23 +09:00
2022-04-12 11:02:16 +02:00
2022-08-02 02:43:38 +09:00
2022-03-21 20:06:13 +00:00
2022-07-15 10:53:45 +02:00
2022-07-19 10:41:13 +01:00
…
2022-03-13 18:30:57 +00:00
2022-05-11 19:12:24 +01:00