Re: [PATCH v11 00/20] Automatic Disk Unlock with TPM2 - Gary Lin via Grub-devel

From: Gary Lin via Grub-devel <grub-devel@gnu.org>
To: Stefan Berger <stefanb@linux.ibm.com>
Cc: Gary Lin <glin@suse.com>,
	The development of GNU GRUB <grub-devel@gnu.org>,
	Hernan Gatta <hegatta@linux.microsoft.com>,
	Daniel Axtens <dja@axtens.net>,
	Daniel Kiper <daniel.kiper@oracle.com>,
	shkhisti@microsoft.com, jaskaran.khurana@microsoft.com,
	christopher.co@microsoft.com, daniel.mihai@microsoft.com,
	jaredz@redhat.com, development@efficientek.com,
	jejb@linux.ibm.com, mchang@suse.com, patrick.colp@oracle.com
Subject: Re: [PATCH v11 00/20] Automatic Disk Unlock with TPM2
Date: Tue, 16 Apr 2024 10:28:14 +0800	[thread overview]
Message-ID: <20240416022814.fr4r7gmx7rrkgkof@GaryLaptop> (raw)
In-Reply-To: <48b96885-e080-4c49-91d0-ea5b426a04dc@linux.ibm.com>

On Mon, Apr 15, 2024 at 10:26:32AM -0400, Stefan Berger wrote:
> 
> 
> On 4/15/24 05:45, Gary Lin wrote:
> > On Fri, Apr 12, 2024 at 12:24:36PM -0400, Stefan Berger wrote:
> > > 
> > > 
> > > On 4/12/24 04:39, Gary Lin via Grub-devel wrote:
> > > > GIT repo for v11: https://github.com/lcp/grub2/tree/tpm2-unlock-v11
> > > > 
> > > > This patch series is based on "Automatic TPM Disk Unlock"(*1) posted by
> > > > Hernan Gatta to introduce the key protector framework and TPM2 stack
> > > > to GRUB2, and this could be a useful feature for the systems to
> > > > implement full disk encryption.
> > > 
> > > You also need to extend the documentation with the command line steps and a
> > > IMO there has to be a warning for VM users that sealing to PCRs inside a VM
> > > is dangerous since the next packages update may bring an update to TianoCore
> > > UEFI/SeaBIOS/SLOF/... showing different PCR values and unsealing will not
> > > work then.
> > > 
> > For baremetal users, it still could happen after upgrading the firmware.
> 
> Right but this is much rarer.
> 
> > We surely need a place to notice users this situation when using PCR
> > 0~7.
> 
> PCRs 8-9 probably have to be all zeros at the time of sealing (running the
> user space application for seting this up) so they have the values at the
> time before grub measures kernel and initramfs, right?
> 
For grub-protect, yes. On the other hand, pcr-oracle can predict PCR 9
based on the current grub.cfg and the eventlog. PCR 8 is tricky because
grub measures the command with the expanded variables, and pcr-oracle has
to be improved to parse all grub config files to make the prediction.

Gary Lin

_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel