dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-13 17:08:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

analyze: properly handle nvpcrs that have not been initialized yet

Browse Source 
Let's explicitly check if NvPCRs are fully set up (allocated, anchored)
before we try to show them.

Alternative to: #40184
This commit is contained in:
Lennart Poettering
2025-12-24 08:37:22 +01:00
committed by Yu Watanabe
parent e67ad3e586
commit 855b4cd731
2 changed files with 36 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/analyze/analyze-nvpcrs.c
View File

@@ -27,10 +27,11 @@ static int add_nvpcr_to_table(Tpm2Context **c, Table *t, const char *name) {
r = tpm2_nvpcr_read(*c, /* session= */ NULL, name, &digest, &nv_index);
if (r < 0)
return log_error_errno(r, "Failed to read NvPCR '%s': %m", name);
h = hexmem(digest.iov_base, digest.iov_len);
if (!h)
return log_oom();
if (r > 0) { /* set? */
h = hexmem(digest.iov_base, digest.iov_len);
if (!h)
return log_oom();
}
} else {
r = tpm2_nvpcr_get_index(name, &nv_index);
if (r < 0)

40
src/shared/tpm2-util.c
View File

@@ -7474,6 +7474,21 @@ int tpm2_nvpcr_read(
if (r < 0)
return r;
/* Check if the NvPCR is already anchored */
const char *anchor_fname = strjoina("/run/systemd/nvpcr/", name, ".anchor");
r = access_nofollow(anchor_fname, F_OK);
if (r < 0) {
if (r != -ENOENT)
return log_debug_errno(r, "Failed to check if '%s' exists: %m", anchor_fname);
/* valid, but not anchored */
*ret_value = (struct iovec) {};
if (ret_nv_index)
*ret_nv_index = p.nv_index;
return 0;
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *nv_handle = NULL;
r = tpm2_index_to_handle(
c,
@@ -7488,19 +7503,26 @@ int tpm2_nvpcr_read(
log_debug("Successfully acquired handle to NV index 0x%" PRIx32 ".", p.nv_index);
r = tpm2_read_nv_index(
c,
/* session= */ NULL,
p.nv_index,
nv_handle,
ret_value);
if (r < 0)
return r;
if (r > 0) {
r = tpm2_read_nv_index(
c,
/* session= */ NULL,
p.nv_index,
nv_handle,
ret_value);
if (r < 0)
return r;
r = 1;
} else {
*ret_value = (struct iovec) {};
r = 0;
}
if (ret_nv_index)
*ret_nv_index = p.nv_index;
return 0;
return r;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif