mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
Paul Meyer
257be02c20
TPM2_PolicyOR() takes at most eight branch digests (the TPM's TPML_DIGEST is fixed at eight elements). pcrlock hits this limit as soon as a PCR has more than eight predicted values, for example when several kernels or boot loader versions are covered by a single policy. It then fails with E2BIG. Lift the limit by nesting PolicyORs into a balanced tree with a fanout of eight, as the TCG TSS JSON policy format prescribes for more than eight branches: the leaves are the actual branches and every layer above them contains only PolicyORs, so all leaves end up at the same depth. Each level is partitioned evenly, which avoids pointless single-branch ORs. The tree is materialized by a helper shared between the calculating (tpm2_calculate_policy_or()) and the submitting (tpm2_policy_or()) side, so sealing and unsealing derive the exact same digests from the same branch list. For eight or fewer branches the previous flat code path is used unchanged, which keeps existing policies and sealed PINs working. Every extra level costs one more TPM round trip during unseal, hence the nesting depth is capped at TPM2_POLICY_OR_MAX_DEPTH (five, i.e. up to 8^5 = 32768 alternatives per PCR). If that's not enough for SUSE, we can discuss it :-) cc @aplanas This also drops the hard "more than 8 alternatives per PCR" rejection from the super PCR policy calculation and submission. I was not able to run the integration testing yet with mkosi due to some NixOS stuff, sorry!