dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-13 17:08:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

creds-util: only lock against public key PCR stuff if we are booted with UEFI supporting TPMs

Browse Source 
The UKI public key PCR stuff only works if we get PCR measurements from
the pre-boot environment, hence automatically disable the logic by
default if we don't have that.

(cherry picked from commit 3b20cc4526)
This commit is contained in:
Lennart Poettering
2026-03-10 18:17:04 +01:00
committed by Luca Boccassi
parent cc6e1a87c6
commit 34010a283b
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/shared/creds-util.c
View File

@@ -901,7 +901,10 @@ int encrypt_credential_and_warn(
try_tpm2 = CRED_KEY_REQUIRES_TPM2(with_key);
if (try_tpm2) {
if (CRED_KEY_WANTS_TPM2_PK(with_key) || CRED_KEY_REQUIRES_TPM2_PK(with_key)) {
/* If the firmware does not support TPMs, then UKI measurements are not going to work, hence
* PCR 11 public key stuff cannot work. Because of that, if PK is only wanted (but not
* required) we won't try it. */
if ((CRED_KEY_WANTS_TPM2_PK(with_key) && tpm2_is_fully_supported()) || CRED_KEY_REQUIRES_TPM2_PK(with_key)) {
/* Load public key for PCR policies, if one is specified, or explicitly requested */
@@ -926,6 +929,8 @@ int encrypt_credential_and_warn(
if (r < 0)
return log_error_errno(r, "Could not find best pcr bank: %m");
log_debug("Selected literal PCR mask: 0x%x, PK PCR mask: 0x%x", tpm2_hash_pcr_mask, tpm2_pubkey_pcr_mask);
TPML_PCR_SELECTION tpm2_hash_pcr_selection;
tpm2_tpml_pcr_selection_from_mask(tpm2_hash_pcr_mask, tpm2_pcr_bank, &tpm2_hash_pcr_selection);