- Update to the latest upstreaming TPM2 patches * 0001-key_protector-Add-key-protectors-framework.patch - Replace 0001-protectors-Add-key-protectors-framework.patch * 0002-tpm2-Add-TPM-Software-Stack-TSS.patch - Merge other TSS patches * 0001-tpm2-Add-TPM2-types-structures-and-command-constants.patch * 0002-tpm2-Add-more-marshal-unmarshal-functions.patch * 0003-tpm2-Implement-more-TPM2-commands.patch * 0003-key_protector-Add-TPM2-Key-Protector.patch - Replace 0003-protectors-Add-TPM2-Key-Protector.patch * 0004-cryptodisk-Support-key-protectors.patch * 0005-util-grub-protect-Add-new-tool.patch * 0001-tpm2-Support-authorized-policy.patch - Replace 0004-tpm2-Support-authorized-policy.patch * 0001-tpm2-Add-extra-RSA-SRK-types.patch * 0001-tpm2-Implement-NV-index.patch - Replace 0001-protectors-Implement-NV-index.patch * 0002-cryptodisk-Fallback-to-passphrase.patch * 0003-cryptodisk-wipe-out-the-cached-keys-from-protectors.patch * 0004-diskfilter-look-up-cryptodisk-devices-first.patch - Refresh affected patches * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch * grub2-bsc1220338-key_protector-implement-the-blocklist.patch - New manpage for grub2-protect OBS-URL: https://build.opensuse.org/request/show/1174325 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=504
1601 lines
43 KiB
Diff
1601 lines
43 KiB
Diff
From c8c567c463cbe6090e086430251efc0dd4f58164 Mon Sep 17 00:00:00 2001
|
|
From: Hernan Gatta <hegatta@linux.microsoft.com>
|
|
Date: Tue, 1 Feb 2022 05:02:57 -0800
|
|
Subject: [PATCH 5/5] util/grub-protect: Add new tool
|
|
|
|
To utilize the key protectors framework, there must be a way to protect
|
|
full-disk encryption keys in the first place. The grub-protect tool
|
|
includes support for the TPM2 key protector but other protectors that
|
|
require setup ahead of time can be supported in the future.
|
|
|
|
For the TPM2 key protector, the intended flow is for a user to have a
|
|
LUKS 1 or LUKS 2-protected fully-encrypted disk. The user then creates a
|
|
new LUKS key file, say by reading /dev/urandom into a file, and creates
|
|
a new LUKS key slot for this key. Then, the user invokes the grub-protect
|
|
tool to seal this key file to a set of PCRs using the system's TPM 2.0.
|
|
The resulting sealed key file is stored in an unencrypted partition such
|
|
as the EFI System Partition (ESP) so that GRUB may read it. The user also
|
|
has to ensure the cryptomount command is included in GRUB's boot script
|
|
and that it carries the requisite key protector (-P) parameter.
|
|
|
|
Sample usage:
|
|
|
|
$ dd if=/dev/urandom of=luks-key bs=1 count=32
|
|
$ sudo cryptsetup luksAddKey /dev/sdb1 luks-key --pbkdf=pbkdf2 --hash=sha512
|
|
|
|
To seal the key with TPM 2.0 Key File (recommended):
|
|
|
|
$ sudo grub-protect --action=add \
|
|
--protector=tpm2 \
|
|
--tpm2-pcrs=0,2,4,7,9 \
|
|
--tpm2key \
|
|
--tpm2-keyfile=luks-key \
|
|
--tpm2-outfile=/boot/efi/boot/grub2/sealed.tpm
|
|
|
|
Or, to seal the key with the raw sealed key:
|
|
|
|
$ sudo grub-protect --action=add \
|
|
--protector=tpm2 \
|
|
--tpm2-pcrs=0,2,4,7,9 \
|
|
--tpm2-keyfile=luks-key \
|
|
--tpm2-outfile=/boot/efi/boot/grub2/sealed.key
|
|
|
|
Then, in the boot script, for TPM 2.0 Key File:
|
|
|
|
tpm2_key_protector_init --tpm2key=(hd0,gpt1)/boot/grub2/sealed.tpm
|
|
cryptomount -u <SDB1_UUID> -P tpm2
|
|
|
|
Or, for the raw sealed key:
|
|
|
|
tpm2_key_protector_init --keyfile=(hd0,gpt1)/boot/grub2/sealed.key --pcrs=0,2,4,7,9
|
|
cryptomount -u <SDB1_UUID> -P tpm2
|
|
|
|
The benefit of using TPM 2.0 Key File is that the PCR set is already
|
|
written in the key file, so there is no need to specify PCRs when
|
|
invoking tpm2_key_protector_init.
|
|
|
|
Cc: Stefan Berger <stefanb@linux.ibm.com>
|
|
Signed-off-by: Hernan Gatta <hegatta@linux.microsoft.com>
|
|
Signed-off-by: Gary Lin <glin@suse.com>
|
|
---
|
|
.gitignore | 2 +
|
|
Makefile.util.def | 24 +
|
|
configure.ac | 30 +
|
|
docs/man/grub-protect.h2m | 4 +
|
|
util/grub-protect.c | 1420 +++++++++++++++++++++++++++++++++++++
|
|
5 files changed, 1480 insertions(+)
|
|
create mode 100644 docs/man/grub-protect.h2m
|
|
create mode 100644 util/grub-protect.c
|
|
|
|
Index: grub-2.12/Makefile.util.def
|
|
===================================================================
|
|
--- grub-2.12.orig/Makefile.util.def
|
|
+++ grub-2.12/Makefile.util.def
|
|
@@ -208,6 +208,30 @@ program = {
|
|
};
|
|
|
|
program = {
|
|
+ name = grub-protect;
|
|
+ mansection = 1;
|
|
+
|
|
+ common = grub-core/kern/emu/argp_common.c;
|
|
+ common = grub-core/osdep/init.c;
|
|
+ common = grub-core/tpm2/args.c;
|
|
+ common = grub-core/tpm2/buffer.c;
|
|
+ common = grub-core/tpm2/mu.c;
|
|
+ common = grub-core/tpm2/tpm2.c;
|
|
+ common = grub-core/tpm2/tpm2key_asn1_tab.c;
|
|
+ common = util/grub-protect.c;
|
|
+ common = util/probe.c;
|
|
+
|
|
+ ldadd = libgrubmods.a;
|
|
+ ldadd = libgrubgcry.a;
|
|
+ ldadd = libgrubkern.a;
|
|
+ ldadd = grub-core/lib/gnulib/libgnu.a;
|
|
+ ldadd = '$(LIBTASN1)';
|
|
+ ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)';
|
|
+
|
|
+ condition = COND_GRUB_PROTECT;
|
|
+};
|
|
+
|
|
+program = {
|
|
name = grub-mkrelpath;
|
|
mansection = 1;
|
|
|
|
Index: grub-2.12/configure.ac
|
|
===================================================================
|
|
--- grub-2.12.orig/configure.ac
|
|
+++ grub-2.12/configure.ac
|
|
@@ -76,6 +76,7 @@ grub_TRANSFORM([grub-mkpasswd-pbkdf2])
|
|
grub_TRANSFORM([grub-mkrelpath])
|
|
grub_TRANSFORM([grub-mkrescue])
|
|
grub_TRANSFORM([grub-probe])
|
|
+grub_TRANSFORM([grub-protect])
|
|
grub_TRANSFORM([grub-reboot])
|
|
grub_TRANSFORM([grub-script-check])
|
|
grub_TRANSFORM([grub-set-default])
|
|
@@ -2057,6 +2058,29 @@ fi
|
|
AC_SUBST([LIBZFS])
|
|
AC_SUBST([LIBNVPAIR])
|
|
|
|
+AC_ARG_ENABLE([grub-protect],
|
|
+ [AS_HELP_STRING([--enable-grub-protect],
|
|
+ [build and install the `grub-protect' utility (default=guessed)])])
|
|
+if test x"$enable_grub_protect" = xno ; then
|
|
+ grub_protect_excuse="explicitly disabled"
|
|
+fi
|
|
+
|
|
+LIBTASN1=
|
|
+if test x"$grub_protect_excuse" = x ; then
|
|
+ AC_CHECK_LIB([tasn1], [asn1_write_value], [LIBTASN1="-ltasn1"], [grub_protect_excuse="need libtasn1 library"])
|
|
+fi
|
|
+AC_SUBST([LIBTASN1])
|
|
+
|
|
+if test x"$enable_grub_protect" = xyes && test x"$grub_protect_excuse" != x ; then
|
|
+ AC_MSG_ERROR([grub-protect was explicitly requested but can't be compiled ($grub_protect_excuse)])
|
|
+fi
|
|
+if test x"$grub_protect_excuse" = x ; then
|
|
+enable_grub_protect=yes
|
|
+else
|
|
+enable_grub_protect=no
|
|
+fi
|
|
+AC_SUBST([enable_grub_protect])
|
|
+
|
|
LIBS=""
|
|
|
|
AC_SUBST([FONT_SOURCE])
|
|
@@ -2177,6 +2201,7 @@ AM_CONDITIONAL([COND_GRUB_EMU_SDL], [tes
|
|
AM_CONDITIONAL([COND_GRUB_EMU_PCI], [test x$enable_grub_emu_pci = xyes])
|
|
AM_CONDITIONAL([COND_GRUB_MKFONT], [test x$enable_grub_mkfont = xyes])
|
|
AM_CONDITIONAL([COND_GRUB_MOUNT], [test x$enable_grub_mount = xyes])
|
|
+AM_CONDITIONAL([COND_GRUB_PROTECT], [test x$enable_grub_protect = xyes])
|
|
AM_CONDITIONAL([COND_HAVE_FONT_SOURCE], [test x$FONT_SOURCE != x])
|
|
if test x$FONT_SOURCE != x ; then
|
|
HAVE_FONT_SOURCE=1
|
|
@@ -2304,6 +2329,11 @@ echo grub-mount: Yes
|
|
else
|
|
echo grub-mount: No "($grub_mount_excuse)"
|
|
fi
|
|
+if [ x"$grub_protect_excuse" = x ]; then
|
|
+echo grub-protect: Yes
|
|
+else
|
|
+echo grub-protect: No "($grub_protect_excuse)"
|
|
+fi
|
|
if [ x"$starfield_excuse" = x ]; then
|
|
echo starfield theme: Yes
|
|
echo With DejaVuSans font from $DJVU_FONT_SOURCE
|
|
Index: grub-2.12/docs/man/grub-protect.h2m
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ grub-2.12/docs/man/grub-protect.h2m
|
|
@@ -0,0 +1,4 @@
|
|
+[NAME]
|
|
+grub-protect \- protect a disk key with a key protector
|
|
+[DESCRIPTION]
|
|
+grub-protect helps to pretect a disk encryption key with a specified key protector.
|
|
Index: grub-2.12/util/grub-protect.c
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ grub-2.12/util/grub-protect.c
|
|
@@ -0,0 +1,1420 @@
|
|
+/*
|
|
+ * GRUB -- GRand Unified Bootloader
|
|
+ * Copyright (C) 2022 Microsoft Corporation
|
|
+ * Copyright (C) 2023 SUSE LLC
|
|
+ *
|
|
+ * GRUB is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * GRUB is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
+ */
|
|
+
|
|
+#include <config.h>
|
|
+
|
|
+#include <errno.h>
|
|
+#include <fcntl.h>
|
|
+#include <libtasn1.h>
|
|
+#include <stdio.h>
|
|
+#include <string.h>
|
|
+#include <unistd.h>
|
|
+
|
|
+#include <grub/emu/hostdisk.h>
|
|
+#include <grub/emu/misc.h>
|
|
+#include <grub/tpm2/buffer.h>
|
|
+#include <grub/tpm2/internal/args.h>
|
|
+#include <grub/tpm2/mu.h>
|
|
+#include <grub/tpm2/tcg2.h>
|
|
+#include <grub/tpm2/tpm2.h>
|
|
+#include <grub/util/misc.h>
|
|
+
|
|
+#pragma GCC diagnostic ignored "-Wmissing-prototypes"
|
|
+#pragma GCC diagnostic ignored "-Wmissing-declarations"
|
|
+#include <argp.h>
|
|
+#pragma GCC diagnostic error "-Wmissing-prototypes"
|
|
+#pragma GCC diagnostic error "-Wmissing-declarations"
|
|
+
|
|
+#include "progname.h"
|
|
+
|
|
+/* Unprintable option keys for argp */
|
|
+typedef enum grub_protect_opt
|
|
+{
|
|
+ /* General */
|
|
+ GRUB_PROTECT_OPT_ACTION = 'a',
|
|
+ GRUB_PROTECT_OPT_PROTECTOR = 'p',
|
|
+ /* TPM2 */
|
|
+ GRUB_PROTECT_OPT_TPM2_DEVICE = 0x100,
|
|
+ GRUB_PROTECT_OPT_TPM2_PCRS,
|
|
+ GRUB_PROTECT_OPT_TPM2_ASYMMETRIC,
|
|
+ GRUB_PROTECT_OPT_TPM2_BANK,
|
|
+ GRUB_PROTECT_OPT_TPM2_SRK,
|
|
+ GRUB_PROTECT_OPT_TPM2_KEYFILE,
|
|
+ GRUB_PROTECT_OPT_TPM2_OUTFILE,
|
|
+ GRUB_PROTECT_OPT_TPM2_EVICT,
|
|
+ GRUB_PROTECT_OPT_TPM2_TPM2KEY
|
|
+} grub_protect_opt;
|
|
+
|
|
+/* Option flags to keep track of specified arguments */
|
|
+typedef enum grub_protect_arg
|
|
+{
|
|
+ /* General */
|
|
+ GRUB_PROTECT_ARG_ACTION = 1 << 0,
|
|
+ GRUB_PROTECT_ARG_PROTECTOR = 1 << 1,
|
|
+ /* TPM2 */
|
|
+ GRUB_PROTECT_ARG_TPM2_DEVICE = 1 << 2,
|
|
+ GRUB_PROTECT_ARG_TPM2_PCRS = 1 << 3,
|
|
+ GRUB_PROTECT_ARG_TPM2_ASYMMETRIC = 1 << 4,
|
|
+ GRUB_PROTECT_ARG_TPM2_BANK = 1 << 5,
|
|
+ GRUB_PROTECT_ARG_TPM2_SRK = 1 << 6,
|
|
+ GRUB_PROTECT_ARG_TPM2_KEYFILE = 1 << 7,
|
|
+ GRUB_PROTECT_ARG_TPM2_OUTFILE = 1 << 8,
|
|
+ GRUB_PROTECT_ARG_TPM2_EVICT = 1 << 9,
|
|
+ GRUB_PROTECT_ARG_TPM2_TPM2KEY = 1 << 10
|
|
+} grub_protect_arg_t;
|
|
+
|
|
+typedef enum grub_protect_protector
|
|
+{
|
|
+ GRUB_PROTECT_TYPE_ERROR,
|
|
+ GRUB_PROTECT_TYPE_TPM2
|
|
+} grub_protect_protector_t;
|
|
+
|
|
+typedef enum grub_protect_action
|
|
+{
|
|
+ GRUB_PROTECT_ACTION_ERROR,
|
|
+ GRUB_PROTECT_ACTION_ADD,
|
|
+ GRUB_PROTECT_ACTION_REMOVE
|
|
+} grub_protect_action_t;
|
|
+
|
|
+struct grub_protect_args
|
|
+{
|
|
+ grub_protect_arg_t args;
|
|
+ grub_protect_action_t action;
|
|
+ grub_protect_protector_t protector;
|
|
+
|
|
+ const char *tpm2_device;
|
|
+ grub_uint8_t tpm2_pcrs[TPM_MAX_PCRS];
|
|
+ grub_uint8_t tpm2_pcr_count;
|
|
+ grub_srk_type_t srk_type;
|
|
+ TPM_ALG_ID tpm2_bank;
|
|
+ TPM_HANDLE tpm2_srk;
|
|
+ const char *tpm2_keyfile;
|
|
+ const char *tpm2_outfile;
|
|
+ int tpm2_evict;
|
|
+ int tpm2_tpm2key;
|
|
+};
|
|
+
|
|
+static struct argp_option grub_protect_options[] =
|
|
+ {
|
|
+ /* Top-level options */
|
|
+ {
|
|
+ .name = "action",
|
|
+ .key = 'a',
|
|
+ .arg = "add|remove",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Add or remove a key protector to or from a key."),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "protector",
|
|
+ .key = 'p',
|
|
+ .arg = "tpm2",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Key protector to use (only tpm2 is currently supported)."),
|
|
+ .group = 0
|
|
+ },
|
|
+ /* TPM2 key protector options */
|
|
+ {
|
|
+ .name = "tpm2-device",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_DEVICE,
|
|
+ .arg = "FILE",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Path to the TPM2 device. (default: /dev/tpm0)"),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-pcrs",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_PCRS,
|
|
+ .arg = "0[,1]...",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Comma-separated list of PCRs used to authorize key release "
|
|
+ "e.g., '7,11'. Please be aware that PCR 0~7 are used by the "
|
|
+ "firmware and the measurement result may change after a "
|
|
+ "firmware update (for baremetal systems) or a package "
|
|
+ "(OVMF/SeaBIOS/SLOF) update in the VM host. This may lead to"
|
|
+ "the failure of key unsealing. (default: 7)"),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-bank",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_BANK,
|
|
+ .arg = "ALG",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Bank of PCRs used to authorize key release: "
|
|
+ "SHA1, SHA256, SHA384, or SHA512. (default: SHA256)"),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-keyfile",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_KEYFILE,
|
|
+ .arg = "FILE",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Path to a file that contains the cleartext key to protect."),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-outfile",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_OUTFILE,
|
|
+ .arg = "FILE",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Path to the file that will contain the key after sealing (must be "
|
|
+ "accessible to GRUB during boot)."),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-srk",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_SRK,
|
|
+ .arg = "NUM",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("The SRK handle if the SRK is to be made persistent."),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-asymmetric",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_ASYMMETRIC,
|
|
+ .arg = "TYPE",
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("The type of SRK: RSA (RSA2048) and ECC (ECC_NIST_P256)."
|
|
+ "(default: ECC)"),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2-evict",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_EVICT,
|
|
+ .arg = NULL,
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Evict a previously persisted SRK from the TPM, if any."),
|
|
+ .group = 0
|
|
+ },
|
|
+ {
|
|
+ .name = "tpm2key",
|
|
+ .key = GRUB_PROTECT_OPT_TPM2_TPM2KEY,
|
|
+ .arg = NULL,
|
|
+ .flags = 0,
|
|
+ .doc =
|
|
+ N_("Use TPM 2.0 Key File format instead of the raw format."),
|
|
+ .group = 0
|
|
+ },
|
|
+ /* End of list */
|
|
+ { 0, 0, 0, 0, 0, 0 }
|
|
+ };
|
|
+
|
|
+static int grub_protector_tpm2_fd = -1;
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_read_file (const char *filepath, void **buffer,
|
|
+ size_t *buffer_size)
|
|
+{
|
|
+ grub_err_t err;
|
|
+ FILE *f;
|
|
+ long len;
|
|
+ void *buf;
|
|
+
|
|
+ f = fopen (filepath, "rb");
|
|
+ if (f == NULL)
|
|
+ return GRUB_ERR_FILE_NOT_FOUND;
|
|
+
|
|
+ if (fseek (f, 0, SEEK_END))
|
|
+ {
|
|
+ err = GRUB_ERR_FILE_READ_ERROR;
|
|
+ goto exit1;
|
|
+ }
|
|
+
|
|
+ len = ftell (f);
|
|
+ if (len <= 0)
|
|
+ {
|
|
+ err = GRUB_ERR_FILE_READ_ERROR;
|
|
+ goto exit1;
|
|
+ }
|
|
+
|
|
+ rewind (f);
|
|
+
|
|
+ buf = grub_malloc (len);
|
|
+ if (buf == NULL)
|
|
+ {
|
|
+ err = GRUB_ERR_OUT_OF_MEMORY;
|
|
+ goto exit1;
|
|
+ }
|
|
+
|
|
+ if (fread (buf, len, 1, f) != 1)
|
|
+ {
|
|
+ err = GRUB_ERR_FILE_READ_ERROR;
|
|
+ goto exit2;
|
|
+ }
|
|
+
|
|
+ *buffer = buf;
|
|
+ *buffer_size = len;
|
|
+
|
|
+ buf = NULL;
|
|
+ err = GRUB_ERR_NONE;
|
|
+
|
|
+exit2:
|
|
+ grub_free (buf);
|
|
+
|
|
+exit1:
|
|
+ fclose (f);
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_write_file (const char *filepath, void *buffer, size_t buffer_size)
|
|
+{
|
|
+ grub_err_t err;
|
|
+ FILE *f;
|
|
+
|
|
+ f = fopen (filepath, "wb");
|
|
+ if (f == NULL)
|
|
+ return GRUB_ERR_FILE_NOT_FOUND;
|
|
+
|
|
+ if (fwrite (buffer, buffer_size, 1, f) != 1)
|
|
+ {
|
|
+ err = GRUB_ERR_WRITE_ERROR;
|
|
+ goto exit1;
|
|
+ }
|
|
+
|
|
+ err = GRUB_ERR_NONE;
|
|
+
|
|
+exit1:
|
|
+ fclose (f);
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+grub_err_t
|
|
+grub_tcg2_get_max_output_size (grub_size_t *size)
|
|
+{
|
|
+ if (size == NULL)
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+
|
|
+ *size = GRUB_TPM2_BUFFER_CAPACITY;
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+grub_err_t
|
|
+grub_tcg2_submit_command (grub_size_t input_size, grub_uint8_t *input,
|
|
+ grub_size_t output_size, grub_uint8_t *output)
|
|
+{
|
|
+ static const grub_size_t header_size = sizeof (grub_uint16_t) +
|
|
+ (2 * sizeof(grub_uint32_t));
|
|
+
|
|
+ if (write (grub_protector_tpm2_fd, input, input_size) != input_size)
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+
|
|
+ if (read (grub_protector_tpm2_fd, output, output_size) < header_size)
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_open_device (const char *dev_node)
|
|
+{
|
|
+ if (grub_protector_tpm2_fd != -1)
|
|
+ return GRUB_ERR_NONE;
|
|
+
|
|
+ grub_protector_tpm2_fd = open (dev_node, O_RDWR);
|
|
+ if (grub_protector_tpm2_fd == -1)
|
|
+ {
|
|
+ fprintf (stderr, _("Could not open TPM device (%s).\n"), strerror (errno));
|
|
+ return GRUB_ERR_FILE_NOT_FOUND;
|
|
+ }
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_close_device (void)
|
|
+{
|
|
+ int err;
|
|
+
|
|
+ if (grub_protector_tpm2_fd == -1)
|
|
+ return GRUB_ERR_NONE;
|
|
+
|
|
+ err = close (grub_protector_tpm2_fd);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ {
|
|
+ fprintf (stderr, _("Could not close TPM device (Error: %u).\n"), errno);
|
|
+ return GRUB_ERR_IO;
|
|
+ }
|
|
+
|
|
+ grub_protector_tpm2_fd = -1;
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_get_policy_digest (struct grub_protect_args *args,
|
|
+ TPM2B_DIGEST *digest)
|
|
+{
|
|
+ TPM_RC rc;
|
|
+ TPML_PCR_SELECTION pcr_sel = {
|
|
+ .count = 1,
|
|
+ .pcrSelections = {
|
|
+ {
|
|
+ .hash = args->tpm2_bank,
|
|
+ .sizeOfSelect = 3,
|
|
+ .pcrSelect = { 0 }
|
|
+ },
|
|
+ }
|
|
+ };
|
|
+ TPML_PCR_SELECTION pcr_sel_out = { 0 };
|
|
+ TPML_DIGEST pcr_values = { 0 };
|
|
+ TPM2B_DIGEST pcr_digest = { 0 };
|
|
+ grub_size_t pcr_digest_len;
|
|
+ TPM2B_MAX_BUFFER pcr_concat = { 0 };
|
|
+ grub_size_t pcr_concat_len;
|
|
+ grub_uint8_t *pcr_cursor;
|
|
+ TPM2B_NONCE nonce = { 0 };
|
|
+ TPM2B_ENCRYPTED_SECRET salt = { 0 };
|
|
+ TPMT_SYM_DEF symmetric = { 0 };
|
|
+ TPMI_SH_AUTH_SESSION session = 0;
|
|
+ TPM2B_DIGEST policy_digest = { 0 };
|
|
+ grub_uint8_t i;
|
|
+ grub_err_t err;
|
|
+
|
|
+ /* PCR Read */
|
|
+ for (i = 0; i < args->tpm2_pcr_count; i++)
|
|
+ TPMS_PCR_SELECTION_SelectPCR (&pcr_sel.pcrSelections[0], args->tpm2_pcrs[i]);
|
|
+
|
|
+ rc = TPM2_PCR_Read (NULL, &pcr_sel, NULL, &pcr_sel_out, &pcr_values, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to read PCRs (TPM2_PCR_Read: 0x%x).\n"), rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ if ((pcr_sel_out.count != pcr_sel.count) ||
|
|
+ (pcr_sel.pcrSelections[0].sizeOfSelect !=
|
|
+ pcr_sel_out.pcrSelections[0].sizeOfSelect))
|
|
+ {
|
|
+ fprintf (stderr, _("Could not read all the specified PCRs.\n"));
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ /* Compute PCR Digest */
|
|
+ switch (args->tpm2_bank)
|
|
+ {
|
|
+ case TPM_ALG_SHA1:
|
|
+ pcr_digest_len = TPM_SHA1_DIGEST_SIZE;
|
|
+ break;
|
|
+ case TPM_ALG_SHA256:
|
|
+ pcr_digest_len = TPM_SHA256_DIGEST_SIZE;
|
|
+ break;
|
|
+ case TPM_ALG_SHA384:
|
|
+ pcr_digest_len = TPM_SHA384_DIGEST_SIZE;
|
|
+ break;
|
|
+ case TPM_ALG_SHA512:
|
|
+ pcr_digest_len = TPM_SHA512_DIGEST_SIZE;
|
|
+ break;
|
|
+ default:
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ pcr_concat_len = pcr_digest_len * args->tpm2_pcr_count;
|
|
+ if (pcr_concat_len > TPM_MAX_DIGEST_BUFFER)
|
|
+ {
|
|
+ fprintf (stderr, _("PCR concatenation buffer not enough.\n"));
|
|
+ return GRUB_ERR_OUT_OF_RANGE;
|
|
+ }
|
|
+
|
|
+ pcr_cursor = pcr_concat.buffer;
|
|
+ for (i = 0; i < args->tpm2_pcr_count; i++)
|
|
+ {
|
|
+ if (pcr_values.digests[i].size != pcr_digest_len)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("Bad PCR value size: expected %" PRIuGRUB_SIZE " bytes but got %u bytes.\n"),
|
|
+ pcr_digest_len, pcr_values.digests[i].size);
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ grub_memcpy (pcr_cursor, pcr_values.digests[i].buffer, pcr_digest_len);
|
|
+ pcr_cursor += pcr_digest_len;
|
|
+ }
|
|
+ pcr_concat.size = pcr_concat_len;
|
|
+
|
|
+ rc = TPM2_Hash (NULL, &pcr_concat, args->tpm2_bank, TPM_RH_NULL, &pcr_digest,
|
|
+ NULL, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to generate PCR digest (TPM2_Hash: 0x%x)\n"), rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ /* Start Trial Session */
|
|
+ nonce.size = TPM_SHA256_DIGEST_SIZE;
|
|
+ symmetric.algorithm = TPM_ALG_NULL;
|
|
+
|
|
+ rc = TPM2_StartAuthSession (TPM_RH_NULL, TPM_RH_NULL, 0, &nonce, &salt,
|
|
+ TPM_SE_TRIAL, &symmetric, TPM_ALG_SHA256,
|
|
+ &session, NULL, 0);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("Failed to start trial policy session (TPM2_StartAuthSession: 0x%x).\n"),
|
|
+ rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ /* PCR Policy */
|
|
+ rc = TPM2_PolicyPCR (session, NULL, &pcr_digest, &pcr_sel, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to submit PCR policy (TPM2_PolicyPCR: 0x%x).\n"),
|
|
+ rc);
|
|
+ err = GRUB_ERR_BAD_DEVICE;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Retrieve Policy Digest */
|
|
+ rc = TPM2_PolicyGetDigest (session, NULL, &policy_digest, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to get policy digest (TPM2_PolicyGetDigest: 0x%x).\n"),
|
|
+ rc);
|
|
+ err = GRUB_ERR_BAD_DEVICE;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Epilogue */
|
|
+ *digest = policy_digest;
|
|
+ err = GRUB_ERR_NONE;
|
|
+
|
|
+error:
|
|
+ TPM2_FlushContext (session);
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_get_srk (struct grub_protect_args *args, TPM_HANDLE *srk)
|
|
+{
|
|
+ TPM_RC rc;
|
|
+ TPM2B_PUBLIC public;
|
|
+ TPMS_AUTH_COMMAND authCommand = { 0 };
|
|
+ TPM2B_SENSITIVE_CREATE inSensitive = { 0 };
|
|
+ TPM2B_PUBLIC inPublic = { 0 };
|
|
+ TPM2B_DATA outsideInfo = { 0 };
|
|
+ TPML_PCR_SELECTION creationPcr = { 0 };
|
|
+ TPM2B_PUBLIC outPublic = { 0 };
|
|
+ TPM2B_CREATION_DATA creationData = { 0 };
|
|
+ TPM2B_DIGEST creationHash = { 0 };
|
|
+ TPMT_TK_CREATION creationTicket = { 0 };
|
|
+ TPM2B_NAME srkName = { 0 };
|
|
+ TPM_HANDLE srkHandle;
|
|
+
|
|
+ if (args->tpm2_srk != 0)
|
|
+ {
|
|
+ /* Find SRK */
|
|
+ rc = TPM2_ReadPublic (args->tpm2_srk, NULL, &public);
|
|
+ if (rc == TPM_RC_SUCCESS)
|
|
+ {
|
|
+ printf (_("Read SRK from 0x%x\n"), args->tpm2_srk);
|
|
+ *srk = args->tpm2_srk;
|
|
+ return GRUB_ERR_NONE;
|
|
+ }
|
|
+
|
|
+ /* The handle exists but its public area could not be read. */
|
|
+ if ((rc & ~TPM_RC_N_MASK) != TPM_RC_HANDLE)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("Failed to retrieve SRK from 0x%x (TPM2_ReadPublic: 0x%x).\n"),
|
|
+ args->tpm2_srk, rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ /* Create SRK */
|
|
+ authCommand.sessionHandle = TPM_RS_PW;
|
|
+ inPublic.publicArea.type = args->srk_type.type;
|
|
+ inPublic.publicArea.nameAlg = TPM_ALG_SHA256;
|
|
+ inPublic.publicArea.objectAttributes.restricted = 1;
|
|
+ inPublic.publicArea.objectAttributes.userWithAuth = 1;
|
|
+ inPublic.publicArea.objectAttributes.decrypt = 1;
|
|
+ inPublic.publicArea.objectAttributes.fixedTPM = 1;
|
|
+ inPublic.publicArea.objectAttributes.fixedParent = 1;
|
|
+ inPublic.publicArea.objectAttributes.sensitiveDataOrigin = 1;
|
|
+ inPublic.publicArea.objectAttributes.noDA = 1;
|
|
+
|
|
+ switch (args->srk_type.type)
|
|
+ {
|
|
+ case TPM_ALG_RSA:
|
|
+ inPublic.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES;
|
|
+ inPublic.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128;
|
|
+ inPublic.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB;
|
|
+ inPublic.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL;
|
|
+ inPublic.publicArea.parameters.rsaDetail.keyBits = args->srk_type.detail.rsa_bits;
|
|
+ inPublic.publicArea.parameters.rsaDetail.exponent = 0;
|
|
+ break;
|
|
+
|
|
+ case TPM_ALG_ECC:
|
|
+ inPublic.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES;
|
|
+ inPublic.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128;
|
|
+ inPublic.publicArea.parameters.eccDetail.symmetric.mode.aes = TPM_ALG_CFB;
|
|
+ inPublic.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL;
|
|
+ inPublic.publicArea.parameters.eccDetail.curveID = args->srk_type.detail.ecc_curve;
|
|
+ inPublic.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL;
|
|
+ break;
|
|
+
|
|
+ default:
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ rc = TPM2_CreatePrimary (TPM_RH_OWNER, &authCommand, &inSensitive, &inPublic,
|
|
+ &outsideInfo, &creationPcr, &srkHandle, &outPublic,
|
|
+ &creationData, &creationHash, &creationTicket,
|
|
+ &srkName, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to create SRK (TPM2_CreatePrimary: 0x%x).\n"), rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ /* Persist SRK */
|
|
+ if (args->tpm2_srk != 0)
|
|
+ {
|
|
+ rc = TPM2_EvictControl (TPM_RH_OWNER, srkHandle, &authCommand,
|
|
+ args->tpm2_srk, NULL);
|
|
+ if (rc == TPM_RC_SUCCESS)
|
|
+ {
|
|
+ TPM2_FlushContext (srkHandle);
|
|
+ srkHandle = args->tpm2_srk;
|
|
+ }
|
|
+ else
|
|
+ fprintf (stderr,
|
|
+ _("Warning: Failed to persist SRK (0x%x) (TPM2_EvictControl: 0x%x\n). "
|
|
+ "Continuing anyway...\n"), args->tpm2_srk, rc);
|
|
+ }
|
|
+
|
|
+ /* Epilogue */
|
|
+ *srk = srkHandle;
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_seal (TPM2B_DIGEST *policyDigest, TPM_HANDLE srk,
|
|
+ grub_uint8_t *clearText, grub_size_t clearTextLength,
|
|
+ TPM2_SEALED_KEY *sealed_key)
|
|
+{
|
|
+ TPM_RC rc;
|
|
+ TPMS_AUTH_COMMAND authCommand = { 0 };
|
|
+ TPM2B_SENSITIVE_CREATE inSensitive = { 0 };
|
|
+ TPM2B_PUBLIC inPublic = { 0 };
|
|
+ TPM2B_DATA outsideInfo = { 0 };
|
|
+ TPML_PCR_SELECTION pcr_sel = { 0 };
|
|
+ TPM2B_PRIVATE outPrivate = { 0 };
|
|
+ TPM2B_PUBLIC outPublic = { 0 };
|
|
+
|
|
+ /* Seal Data */
|
|
+ authCommand.sessionHandle = TPM_RS_PW;
|
|
+
|
|
+ inSensitive.sensitive.data.size = clearTextLength;
|
|
+ memcpy(inSensitive.sensitive.data.buffer, clearText, clearTextLength);
|
|
+
|
|
+ inPublic.publicArea.type = TPM_ALG_KEYEDHASH;
|
|
+ inPublic.publicArea.nameAlg = TPM_ALG_SHA256;
|
|
+ inPublic.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_NULL;
|
|
+ inPublic.publicArea.authPolicy = *policyDigest;
|
|
+
|
|
+ rc = TPM2_Create (srk, &authCommand, &inSensitive, &inPublic, &outsideInfo,
|
|
+ &pcr_sel, &outPrivate, &outPublic, NULL, NULL, NULL, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to seal key (TPM2_Create: 0x%x).\n"), rc);
|
|
+ return GRUB_ERR_BAD_DEVICE;
|
|
+ }
|
|
+
|
|
+ /* Epilogue */
|
|
+ sealed_key->public = outPublic;
|
|
+ sealed_key->private = outPrivate;
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+extern asn1_static_node tpm2key_asn1_tab[];
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_export_tpm2key (const struct grub_protect_args *args,
|
|
+ TPM2_SEALED_KEY *sealed_key)
|
|
+{
|
|
+ const char *sealed_key_oid = "2.23.133.10.1.5";
|
|
+ asn1_node asn1_def = NULL;
|
|
+ asn1_node tpm2key = NULL;
|
|
+ grub_uint32_t parent;
|
|
+ grub_uint32_t cmd_code;
|
|
+ struct grub_tpm2_buffer pol_buf;
|
|
+ TPML_PCR_SELECTION pcr_sel = {
|
|
+ .count = 1,
|
|
+ .pcrSelections = {
|
|
+ {
|
|
+ .hash = args->tpm2_bank,
|
|
+ .sizeOfSelect = 3,
|
|
+ .pcrSelect = { 0 }
|
|
+ },
|
|
+ }
|
|
+ };
|
|
+ struct grub_tpm2_buffer pub_buf;
|
|
+ struct grub_tpm2_buffer priv_buf;
|
|
+ void *der_buf = NULL;
|
|
+ int der_buf_size = 0;
|
|
+ int i;
|
|
+ int ret;
|
|
+ grub_err_t err;
|
|
+
|
|
+ for (i = 0; i < args->tpm2_pcr_count; i++)
|
|
+ TPMS_PCR_SELECTION_SelectPCR (&pcr_sel.pcrSelections[0], args->tpm2_pcrs[i]);
|
|
+
|
|
+ /*
|
|
+ * Prepare the parameters for TPM_CC_PolicyPCR:
|
|
+ * empty pcrDigest and the user selected PCRs
|
|
+ */
|
|
+ grub_tpm2_buffer_init (&pol_buf);
|
|
+ grub_tpm2_buffer_pack_u16 (&pol_buf, 0);
|
|
+ grub_tpm2_mu_TPML_PCR_SELECTION_Marshal (&pol_buf, &pcr_sel);
|
|
+
|
|
+ grub_tpm2_buffer_init (&pub_buf);
|
|
+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&pub_buf, &sealed_key->public);
|
|
+ grub_tpm2_buffer_init (&priv_buf);
|
|
+ grub_tpm2_mu_TPM2B_Marshal (&priv_buf, sealed_key->private.size,
|
|
+ sealed_key->private.buffer);
|
|
+ if (pub_buf.error != 0 || priv_buf.error != 0)
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+
|
|
+ ret = asn1_array2tree (tpm2key_asn1_tab, &asn1_def, NULL);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+
|
|
+ ret = asn1_create_element (asn1_def, "TPM2KEY.TPMKey" , &tpm2key);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+
|
|
+ /* Set 'type' to "sealed key" */
|
|
+ ret = asn1_write_value (tpm2key, "type", sealed_key_oid, 1);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'type': 0x%u\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Set 'emptyAuth' to TRUE */
|
|
+ ret = asn1_write_value (tpm2key, "emptyAuth", "TRUE", 1);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'emptyAuth': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Set 'policy' */
|
|
+ ret = asn1_write_value (tpm2key, "policy", "NEW", 1);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'policy': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+ cmd_code = grub_cpu_to_be32 (TPM_CC_PolicyPCR);
|
|
+ ret = asn1_write_value (tpm2key, "policy.?LAST.CommandCode", &cmd_code,
|
|
+ sizeof (cmd_code));
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'policy CommandCode': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+ ret = asn1_write_value (tpm2key, "policy.?LAST.CommandPolicy", &pol_buf.data,
|
|
+ pol_buf.size);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'policy CommandPolicy': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Remove 'secret' */
|
|
+ ret = asn1_write_value (tpm2key, "secret", NULL, 0);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to remove 'secret': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Remove 'authPolicy' */
|
|
+ ret = asn1_write_value (tpm2key, "authPolicy", NULL, 0);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to remove 'authPolicy': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Remove 'description' */
|
|
+ ret = asn1_write_value (tpm2key, "description", NULL, 0);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to remove 'description': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * Use the SRK handle as the parent handle if specified
|
|
+ * Otherwise, Use TPM_RH_OWNER as the default parent handle
|
|
+ */
|
|
+ if (args->tpm2_srk != 0)
|
|
+ parent = grub_cpu_to_be32 (args->tpm2_srk);
|
|
+ else
|
|
+ parent = grub_cpu_to_be32 (TPM_RH_OWNER);
|
|
+ ret = asn1_write_value (tpm2key, "parent", &parent, sizeof (parent));
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'parent': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * Set 'rsaParent' to TRUE if the RSA SRK is specified and the SRK
|
|
+ * handle is not persistent. Otherwise, remove 'rsaParent'.
|
|
+ */
|
|
+ if (args->tpm2_srk == 0 && args->srk_type.type == TPM_ALG_RSA)
|
|
+ ret = asn1_write_value (tpm2key, "rsaParent", "TRUE", 1);
|
|
+ else
|
|
+ ret = asn1_write_value (tpm2key, "rsaParent", NULL, 0);
|
|
+
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'rsaParent': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Set the pubkey */
|
|
+ ret = asn1_write_value (tpm2key, "pubkey", pub_buf.data, pub_buf.size);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'pubkey': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Set the privkey */
|
|
+ ret = asn1_write_value (tpm2key, "privkey", priv_buf.data, priv_buf.size);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to set 'privkey': 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ /* Create the DER binary */
|
|
+ der_buf_size = 0;
|
|
+ ret = asn1_der_coding (tpm2key, "", NULL, &der_buf_size, NULL);
|
|
+ if (ret != ASN1_MEM_ERROR)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to get DER size: 0x%x\n"), ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ der_buf = grub_malloc (der_buf_size);
|
|
+ if (der_buf == NULL)
|
|
+ {
|
|
+ fprintf (stderr, _("Failed to allocate memory for DER encoding\n"));
|
|
+ err = GRUB_ERR_OUT_OF_MEMORY;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ ret = asn1_der_coding (tpm2key, "", der_buf, &der_buf_size, NULL);
|
|
+ if (ret != ASN1_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, "DER coding error: 0x%x\n", ret);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ err = grub_protect_write_file (args->tpm2_outfile, der_buf, der_buf_size);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ fprintf (stderr, _("Could not write tpm2key file (Error: %u).\n"),
|
|
+ errno);
|
|
+
|
|
+error:
|
|
+ grub_free (der_buf);
|
|
+
|
|
+ if (tpm2key)
|
|
+ asn1_delete_structure (&tpm2key);
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_export_sealed_key (const char *filepath,
|
|
+ TPM2_SEALED_KEY *sealed_key)
|
|
+{
|
|
+ grub_err_t err;
|
|
+ struct grub_tpm2_buffer buf;
|
|
+
|
|
+ grub_tpm2_buffer_init (&buf);
|
|
+ grub_tpm2_mu_TPM2B_PUBLIC_Marshal (&buf, &sealed_key->public);
|
|
+ grub_tpm2_mu_TPM2B_Marshal (&buf, sealed_key->private.size,
|
|
+ sealed_key->private.buffer);
|
|
+ if (buf.error != 0)
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+
|
|
+ err = grub_protect_write_file (filepath, buf.data, buf.size);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ fprintf (stderr, _("Could not write sealed key file (Error: %u).\n"),
|
|
+ errno);
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_add (struct grub_protect_args *args)
|
|
+{
|
|
+ grub_err_t err;
|
|
+ grub_uint8_t *key = NULL;
|
|
+ grub_size_t key_size;
|
|
+ TPM_HANDLE srk;
|
|
+ TPM2B_DIGEST policy_digest;
|
|
+ TPM2_SEALED_KEY sealed_key;
|
|
+
|
|
+ err = grub_protect_tpm2_open_device (args->tpm2_device);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ return err;
|
|
+
|
|
+ err = grub_protect_read_file (args->tpm2_keyfile, (void **)&key, &key_size);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit1;
|
|
+
|
|
+ if (key_size > TPM_MAX_SYM_DATA)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("Input key is too long, maximum allowed size is %u bytes.\n"),
|
|
+ TPM_MAX_SYM_DATA);
|
|
+ err = GRUB_ERR_OUT_OF_RANGE;
|
|
+ goto exit2;
|
|
+ }
|
|
+
|
|
+ err = grub_protect_tpm2_get_srk (args, &srk);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit2;
|
|
+
|
|
+ err = grub_protect_tpm2_get_policy_digest (args, &policy_digest);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit3;
|
|
+
|
|
+ err = grub_protect_tpm2_seal (&policy_digest, srk, key, key_size,
|
|
+ &sealed_key);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit3;
|
|
+
|
|
+ if (args->tpm2_tpm2key)
|
|
+ err = grub_protect_tpm2_export_tpm2key (args, &sealed_key);
|
|
+ else
|
|
+ err = grub_protect_tpm2_export_sealed_key (args->tpm2_outfile, &sealed_key);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit3;
|
|
+
|
|
+exit3:
|
|
+ TPM2_FlushContext (srk);
|
|
+
|
|
+exit2:
|
|
+ grub_free (key);
|
|
+
|
|
+exit1:
|
|
+ grub_protect_tpm2_close_device ();
|
|
+
|
|
+ return err;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_remove (struct grub_protect_args *args)
|
|
+{
|
|
+ TPM_RC rc;
|
|
+ TPM2B_PUBLIC public;
|
|
+ TPMS_AUTH_COMMAND authCommand = { 0 };
|
|
+ grub_err_t err;
|
|
+
|
|
+ if (args->tpm2_evict == 0)
|
|
+ {
|
|
+ printf (_("--tpm2-evict not specified, nothing to do.\n"));
|
|
+ return GRUB_ERR_NONE;
|
|
+ }
|
|
+
|
|
+ err = grub_protect_tpm2_open_device (args->tpm2_device);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ return err;
|
|
+
|
|
+ /* Find SRK */
|
|
+ rc = TPM2_ReadPublic (args->tpm2_srk, NULL, &public);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr, _("SRK with handle 0x%x not found.\n"), args->tpm2_srk);
|
|
+ err = GRUB_ERR_BAD_ARGUMENT;
|
|
+ goto exit1;
|
|
+ }
|
|
+
|
|
+ /* Evict SRK */
|
|
+ authCommand.sessionHandle = TPM_RS_PW;
|
|
+
|
|
+ rc = TPM2_EvictControl (TPM_RH_OWNER, args->tpm2_srk, &authCommand,
|
|
+ args->tpm2_srk, NULL);
|
|
+ if (rc != TPM_RC_SUCCESS)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("Failed to evict SRK with handle 0x%x (TPM2_EvictControl: 0x%x).\n"),
|
|
+ args->tpm2_srk, rc);
|
|
+ err = GRUB_ERR_BAD_DEVICE;
|
|
+ goto exit2;
|
|
+ }
|
|
+
|
|
+ err = GRUB_ERR_NONE;
|
|
+
|
|
+exit2:
|
|
+ TPM2_FlushContext (args->tpm2_srk);
|
|
+
|
|
+exit1:
|
|
+ grub_protect_tpm2_close_device ();
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_run (struct grub_protect_args *args)
|
|
+{
|
|
+ switch (args->action)
|
|
+ {
|
|
+ case GRUB_PROTECT_ACTION_ADD:
|
|
+ return grub_protect_tpm2_add (args);
|
|
+
|
|
+ case GRUB_PROTECT_ACTION_REMOVE:
|
|
+ return grub_protect_tpm2_remove (args);
|
|
+
|
|
+ default:
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_tpm2_args_verify (struct grub_protect_args *args)
|
|
+{
|
|
+ switch (args->action)
|
|
+ {
|
|
+ case GRUB_PROTECT_ACTION_ADD:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_EVICT)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-evict is invalid when --action is 'add'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_keyfile == NULL)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-keyfile must be specified.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_outfile == NULL)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-outfile must be specified.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_device == NULL)
|
|
+ args->tpm2_device = "/dev/tpm0";
|
|
+
|
|
+ if (args->tpm2_pcr_count == 0)
|
|
+ {
|
|
+ args->tpm2_pcrs[0] = 7;
|
|
+ args->tpm2_pcr_count = 1;
|
|
+ }
|
|
+
|
|
+ if (args->srk_type.type == TPM_ALG_ERROR)
|
|
+ {
|
|
+ args->srk_type.type = TPM_ALG_ECC;
|
|
+ args->srk_type.detail.ecc_curve = TPM_ECC_NIST_P256;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_bank == TPM_ALG_ERROR)
|
|
+ args->tpm2_bank = TPM_ALG_SHA256;
|
|
+
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_ACTION_REMOVE:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_ASYMMETRIC)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-asymmetric is invalid when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_BANK)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-bank is invalid when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_KEYFILE)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-keyfile is invalid when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_OUTFILE)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-outfile is invalid when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_PCRS)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-pcrs is invalid when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_srk == 0)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--tpm2-srk is not specified when --action is 'remove'.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ if (args->tpm2_device == NULL)
|
|
+ args->tpm2_device = "/dev/tpm0";
|
|
+
|
|
+ break;
|
|
+
|
|
+ default:
|
|
+ fprintf (stderr,
|
|
+ _("The TPM2 key protector only supports the following actions: "
|
|
+ "add, remove.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static error_t
|
|
+grub_protect_argp_parser (int key, char *arg, struct argp_state *state)
|
|
+{
|
|
+ grub_err_t err;
|
|
+ struct grub_protect_args *args = state->input;
|
|
+
|
|
+ switch (key)
|
|
+ {
|
|
+ case GRUB_PROTECT_OPT_ACTION:
|
|
+ if (args->args & GRUB_PROTECT_ARG_ACTION)
|
|
+ {
|
|
+ fprintf (stderr, _("--action|-a can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ if (grub_strcmp (arg, "add") == 0)
|
|
+ args->action = GRUB_PROTECT_ACTION_ADD;
|
|
+ else if (grub_strcmp (arg, "remove") == 0)
|
|
+ args->action = GRUB_PROTECT_ACTION_REMOVE;
|
|
+ else
|
|
+ {
|
|
+ fprintf (stderr, _("'%s' is not a valid action.\n"), arg);
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_ACTION;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_PROTECTOR:
|
|
+ if (args->args & GRUB_PROTECT_ARG_PROTECTOR)
|
|
+ {
|
|
+ fprintf (stderr, _("--protector|-p can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ if (grub_strcmp (arg, "tpm2") == 0)
|
|
+ args->protector = GRUB_PROTECT_TYPE_TPM2;
|
|
+ else
|
|
+ {
|
|
+ fprintf (stderr, _("'%s' is not a valid protector.\n"), arg);
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_PROTECTOR;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_DEVICE:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_DEVICE)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-device can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->tpm2_device = xstrdup(arg);
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_DEVICE;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_PCRS:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_PCRS)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-pcrs can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ err = grub_tpm2_protector_parse_pcrs (arg, args->tpm2_pcrs,
|
|
+ &args->tpm2_pcr_count);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ {
|
|
+ if (grub_errno != GRUB_ERR_NONE)
|
|
+ grub_print_error ();
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_PCRS;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_SRK:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_SRK)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-srk can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ err = grub_tpm2_protector_parse_tpm_handle (arg, &args->tpm2_srk);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ {
|
|
+ if (grub_errno != GRUB_ERR_NONE)
|
|
+ grub_print_error ();
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_SRK;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_ASYMMETRIC:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_ASYMMETRIC)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-asymmetric can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ err = grub_tpm2_protector_parse_asymmetric (arg, &args->srk_type);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ {
|
|
+ if (grub_errno != GRUB_ERR_NONE)
|
|
+ grub_print_error ();
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_ASYMMETRIC;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_BANK:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_BANK)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-bank can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ err = grub_tpm2_protector_parse_bank (arg, &args->tpm2_bank);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ {
|
|
+ if (grub_errno != GRUB_ERR_NONE)
|
|
+ grub_print_error ();
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_BANK;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_KEYFILE:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_KEYFILE)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-keyfile can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->tpm2_keyfile = xstrdup(arg);
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_KEYFILE;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_OUTFILE:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_OUTFILE)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-outfile can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->tpm2_outfile = xstrdup(arg);
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_OUTFILE;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_EVICT:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_EVICT)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-evict can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->tpm2_evict = 1;
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_EVICT;
|
|
+ break;
|
|
+
|
|
+ case GRUB_PROTECT_OPT_TPM2_TPM2KEY:
|
|
+ if (args->args & GRUB_PROTECT_ARG_TPM2_TPM2KEY)
|
|
+ {
|
|
+ fprintf (stderr, _("--tpm2-tpm2key can only be specified once.\n"));
|
|
+ return EINVAL;
|
|
+ }
|
|
+
|
|
+ args->tpm2_tpm2key = 1;
|
|
+ args->args |= GRUB_PROTECT_ARG_TPM2_TPM2KEY;
|
|
+ break;
|
|
+
|
|
+ default:
|
|
+ return ARGP_ERR_UNKNOWN;
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_args_verify (struct grub_protect_args *args)
|
|
+{
|
|
+ if (args->action == GRUB_PROTECT_ACTION_ERROR)
|
|
+ {
|
|
+ fprintf (stderr, "--action is mandatory.\n");
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ /* At the moment, the only configurable key protector is the TPM2 one, so it
|
|
+ * is the only key protector supported by this tool. */
|
|
+ if (args->protector != GRUB_PROTECT_TYPE_TPM2)
|
|
+ {
|
|
+ fprintf (stderr,
|
|
+ _("--protector is mandatory and only 'tpm2' is currently "
|
|
+ "supported.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ switch (args->protector)
|
|
+ {
|
|
+ case GRUB_PROTECT_TYPE_TPM2:
|
|
+ return grub_protect_tpm2_args_verify (args);
|
|
+ default:
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ return GRUB_ERR_NONE;
|
|
+}
|
|
+
|
|
+static grub_err_t
|
|
+grub_protect_dispatch (struct grub_protect_args *args)
|
|
+{
|
|
+ switch (args->protector)
|
|
+ {
|
|
+ case GRUB_PROTECT_TYPE_TPM2:
|
|
+ return grub_protect_tpm2_run (args);
|
|
+ default:
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+}
|
|
+
|
|
+static void
|
|
+grub_protect_init (int *argc, char **argv[])
|
|
+{
|
|
+ grub_util_host_init (argc, argv);
|
|
+
|
|
+ grub_util_biosdisk_init (NULL);
|
|
+
|
|
+ grub_init_all ();
|
|
+
|
|
+ grub_lvm_fini ();
|
|
+ grub_mdraid09_fini ();
|
|
+ grub_mdraid1x_fini ();
|
|
+ grub_diskfilter_fini ();
|
|
+ grub_diskfilter_init ();
|
|
+ grub_mdraid09_init ();
|
|
+ grub_mdraid1x_init ();
|
|
+ grub_lvm_init ();
|
|
+}
|
|
+
|
|
+static void
|
|
+grub_protect_fini (void)
|
|
+{
|
|
+ grub_fini_all ();
|
|
+ grub_util_biosdisk_fini ();
|
|
+}
|
|
+
|
|
+static struct argp grub_protect_argp =
|
|
+{
|
|
+ .options = grub_protect_options,
|
|
+ .parser = grub_protect_argp_parser,
|
|
+ .args_doc = NULL,
|
|
+ .doc =
|
|
+ N_("Protect a cleartext key using a GRUB key protector that can retrieve "
|
|
+ "the key during boot to unlock fully-encrypted disks automatically."),
|
|
+ .children = NULL,
|
|
+ .help_filter = NULL,
|
|
+ .argp_domain = NULL
|
|
+};
|
|
+
|
|
+int
|
|
+main (int argc, char *argv[])
|
|
+{
|
|
+ grub_err_t err;
|
|
+ struct grub_protect_args args = { 0 };
|
|
+
|
|
+ if (argp_parse (&grub_protect_argp, argc, argv, 0, 0, &args) != 0)
|
|
+ {
|
|
+ fprintf (stderr, _("Could not parse arguments.\n"));
|
|
+ return GRUB_ERR_BAD_ARGUMENT;
|
|
+ }
|
|
+
|
|
+ grub_protect_init (&argc, &argv);
|
|
+
|
|
+ err = grub_protect_args_verify (&args);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit;
|
|
+
|
|
+ err = grub_protect_dispatch (&args);
|
|
+ if (err != GRUB_ERR_NONE)
|
|
+ goto exit;
|
|
+
|
|
+exit:
|
|
+ grub_protect_fini ();
|
|
+
|
|
+ return err;
|
|
+}
|