Skip to content

pcr: Add cmd to compute PCR8 from static GRUB config #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Johan-Liebert1 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

pcr: Add cmd to compute PCR8 from static GRUB config #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions cli/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,11 @@ enum Command {
)]
no_secureboot: bool,
},
/// Compute PCR 8
Pcr8 {
#[arg(default_value_t = 5, long, help = "The timeout for boot menu")]
timeout: u8,
},
/// Compute PCR 11
Pcr11 {
/// Path to a UKI
Expand Down Expand Up @@ -191,6 +196,11 @@ fn main() -> Result<()> {
println!("{}", serde_json::to_string_pretty(&pcr).unwrap());
Ok(())
}
Command::Pcr8 { timeout } => {
let pcr = compute_pcr8(*timeout);
println!("{}", serde_json::to_string_pretty(&pcr).unwrap());
Ok(())
}
Command::Pcr11 { uki } => {
let pcr = compute_pcr11(uki);
println!("{}", serde_json::to_string_pretty(&pcr).unwrap());
Expand Down
4 changes: 4 additions & 0 deletions lib/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,3 +54,7 @@ pub fn compute_pcr7(efivars_path: Option<&str>, esp_path: &str, secureboot_enabl
pub fn compute_pcr14(mok_variables: &str) -> Pcr {
Pcr::compile_from(&tpmevents::compute::pcr14_events(mok_variables))
}

pub fn compute_pcr8(timeout: u8) -> Pcr {
Pcr::compile_from(&tpmevents::compute::pcr8_events(timeout))
}
4 changes: 4 additions & 0 deletions lib/src/tpmevents.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ pub enum TPMEventID {
Pcr7GrubDbCert,
Pcr7GrubVendorDbCert,
Pcr7GrubMokListCert,
Pcr8GrubTimeout,
Pcr8GrubBlscfg,
Comment on lines +43 to +44
Copy link
Copy Markdown
Member

@travier travier Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The trick here is that it could be arbitrary long and we don't know the number of lines. So either we make this generic of we do Line1, Line2, etc.

Copy link
Copy Markdown
Author

@Johan-Liebert1 Johan-Liebert1 Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passing the grub cfg via a file should solve this. We can just parse the file and don't have to care much about the number of lines

Copy link
Copy Markdown
Contributor

@bgartzi bgartzi Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@travier do you mean something like Pcr8GrubCfgLine?

@Johan-Liebert1 seeing that it's not something we can extract from the grub PE, we need to decide whether we want to hardcode it or pass it as cfg.
Okay, we expect it to be static, but how likely will it be for this config to change in the future (e.g. from one version to another, something we forgot and needed to add later etc.)?

Copy link
Copy Markdown
Author

@Johan-Liebert1 Johan-Liebert1 Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the bootloader folks, this will only change if we ask for it to change. I have pinged them about moving this particular set of strings to a separate section altogether so that we can compute it from the binary itself (along with a few more requests).

I'll update here once I get a reply from them

Copy link
Copy Markdown
Contributor

@bgartzi bgartzi Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh! nice :)

Copy link
Copy Markdown
Contributor

@bgartzi bgartzi Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW, getting back to the original discussion. With #77 we will support "repeated" events in the combination logic. Then, it should be safe to describe only one event ID type for grub cfg; Pcr8GrubCfg for example.

Pcr11Linux,
Pcr11LinuxContent,
Pcr11Osrel,
Expand Down Expand Up @@ -79,6 +81,8 @@ impl TPMEventID {
TPMEventID::Pcr7GrubDbCert => TPMEG_SECUREBOOT | TPMEG_BOOTLOADER,
TPMEventID::Pcr7GrubVendorDbCert => TPMEG_SECUREBOOT | TPMEG_BOOTLOADER,
TPMEventID::Pcr7GrubMokListCert => TPMEG_SECUREBOOT | TPMEG_BOOTLOADER | TPMEG_MOKVARS,
TPMEventID::Pcr8GrubTimeout => TPMEG_BOOTLOADER,
TPMEventID::Pcr8GrubBlscfg => TPMEG_BOOTLOADER,
TPMEventID::Pcr11Linux => TPMEG_UKI,
TPMEventID::Pcr11LinuxContent => TPMEG_UKI,
TPMEventID::Pcr11Osrel => TPMEG_UKI,
Expand Down
20 changes: 20 additions & 0 deletions lib/src/tpmevents/compute.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@ const MODELS_MOKVARS: [TPMEventID; 3] = [
TPMEventID::Pcr14MokListTrusted,
];

const MODELS_GRUB_CFG: [TPMEventID; 2] = [TPMEventID::Pcr8GrubTimeout, TPMEventID::Pcr8GrubBlscfg];

pub fn pcr4_events(
kernels_dir: &str,
esp_path: &str,
Expand Down Expand Up @@ -278,3 +280,21 @@ pub fn pcr14_events(mok_variables: &str) -> Vec<TPMEvent> {
})
.collect()
}

pub fn pcr8_events(timeout: u8) -> Vec<TPMEvent> {
let n_pcr = 8;

let sections: Vec<String> = vec![format!("set timeout={timeout}"), "blscfg".into()];
let mut events: Vec<TPMEvent> = vec![];

sections.iter().zip(MODELS_GRUB_CFG).for_each(|(s, cid)| {
events.push(TPMEvent {
name: s.into(),
pcr: n_pcr,
hash: Sha256::digest(s).to_vec(),
id: cid,
});
});

events
}