mirror of
https://github.com/siderolabs/talos.git
synced 2025-10-27 14:31:11 +01:00
166d75fe88
The previous flow was using TPM PCR 11 values to bound the policy which means TPM cannot unseal when UKI changes. Now it's fixed to use PCR 7 which is bound to the SecureBoot state (SecureBoot status and Certificates). This provides a full chain of trust bound to SecureBoot state and signed PCR signature. Also the code has been refactored to use PolicyCalculator from the TPM library. Signed-off-by: Noel Georgi <git@frezbo.dev>
51 lines
1.3 KiB
Go
51 lines
1.3 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
// Package tpm2 provides TPM2.0 related functionality helpers.
|
|
package tpm2
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/siderolabs/talos/pkg/machinery/constants"
|
|
)
|
|
|
|
// PCRData is the data structure for PCR signature json.
|
|
type PCRData struct {
|
|
SHA1 []BankData `json:"sha1,omitempty"`
|
|
SHA256 []BankData `json:"sha256,omitempty"`
|
|
SHA384 []BankData `json:"sha384,omitempty"`
|
|
SHA512 []BankData `json:"sha512,omitempty"`
|
|
}
|
|
|
|
// BankData constains data for a specific PCR bank.
|
|
type BankData struct {
|
|
// list of PCR banks
|
|
PCRs []int `json:"pcrs"`
|
|
// Public key of the TPM
|
|
PKFP string `json:"pkfp"`
|
|
// Policy digest
|
|
Pol string `json:"pol"`
|
|
// Signature of the policy digest in base64
|
|
Sig string `json:"sig"`
|
|
}
|
|
|
|
// ParsePCRSignature parses the PCR signature json file.
|
|
func ParsePCRSignature() (*PCRData, error) {
|
|
pcrSignature, err := os.ReadFile(constants.PCRSignatureJSON)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read pcr signature: %v", err)
|
|
}
|
|
|
|
pcrData := &PCRData{}
|
|
|
|
if err = json.Unmarshal(pcrSignature, pcrData); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal pcr signature: %v", err)
|
|
}
|
|
|
|
return pcrData, nil
|
|
}
|