Implement forward sealing with new tpm2-tools

New tpm2-tools version supports forward sealing, and is implemented here. Conforms to new output format (tpm2_policypcr uses a '=' separator, so convert the ':' used in seal-system). Accounts for systems that may have the extra 'Calling EFI Application from Boot Option' string extended into PCR bank 4.

Author: shahs-ais

recipes-openxt/openxt-measuredlaunch/openxt-measuredlaunch/seal-system

@@ -156,21 +156,48 @@ forward)
     pcr_forward=()
     if ! contains_only "${pcr8}" "0"; then
         # PCR4 is first extended with the digest of EV_SEPARATOR
+        # It may also first extend the "Calling EFI Application from Boot Option" string, depending on the system
         # See TCG EFI Protocol Specification 5.2 Crypto Agile Log Entry Format
         ev_separator="$(tpm_get_ev_separator)"
 
-        pcr4=$(hash_extend 0 "${ev_separator}" "${hashalg}")
+        # Get current PCR4 value to check if ev_string should be extended
+        current_pcr4="$(tpm_get_pcr 4)"
+        
+        # Calculate PCR4 with ev_string extension
+        ev_string="$(printf "Calling EFI Application from Boot Option" | sha256sum | awk '{print $1}')"
+        pcr4_with_ev=$(hash_extend 0 "${ev_string}" "${hashalg}")
+        pcr4_with_ev=$(hash_extend "${pcr4_with_ev}" "${ev_separator}" "${hashalg}")
 
         hash=$(pesign -h -d "${hashalg}" -i "${pcr4_objs[0]}" | awk '{ print $2 }')
-        pcr4=$(hash_extend "${pcr4}" "${hash}" "${hashalg}") ||
+        pcr4_with_ev=$(hash_extend "${pcr4_with_ev}" "${hash}" "${hashalg}") ||
             err "failed to calculate pcr4"
 
         for o in ${pcr4_objs[@]:1}; do
             hash=$(${hashalg}sum "${o}" | awk '{ print $1 }')
-            pcr4=$(hash_extend "${pcr4}" "${hash}" "${hashalg}") ||
+            pcr4_with_ev=$(hash_extend "${pcr4_with_ev}" "${hash}" "${hashalg}") ||
                 err "failed to calculate pcr4"
         done
 
+        # Use the PCR4 calculation with string extended only if it matches the current PCR value
+        # Rather than checking the value and "guessing", it would be better to check the PCR4 event log to see if the ev_string was extended.
+        # This log is currently not available to us, but it may be worth it in the future to investigate this further.
+        if [[ "${pcr4_with_ev}" == *"${current_pcr4}"* ]]; then
+            pcr4="${pcr4_with_ev}"
+        else
+            # Calculate PCR4 without ev_string extension
+            pcr4=$(hash_extend 0 "${ev_separator}" "${hashalg}")
+
+            hash=$(pesign -h -d "${hashalg}" -i "${pcr4_objs[0]}" | awk '{ print $2 }')
+            pcr4=$(hash_extend "${pcr4}" "${hash}" "${hashalg}") ||
+                err "failed to calculate pcr4"
+
+            for o in ${pcr4_objs[@]:1}; do
+                hash=$(${hashalg}sum "${o}" | awk '{ print $1 }')
+                pcr4=$(hash_extend "${pcr4}" "${hash}" "${hashalg}") ||
+                    err "failed to calculate pcr4"
+            done
+        fi
+
         pcr8="0"
 
         for o in ${pcr8_objs[@]}; do
@@ -186,8 +213,8 @@ forward)
                 err "failed to calculate pcr8"
         done
 
-        pcr_forward[4]=":${pcr4}"
-        pcr_forward[8]=":${pcr8}"
+        pcr_forward[4]="=${pcr4}"
+        pcr_forward[8]="=${pcr8}"
     fi
 
     if pcr_in_selection 15 ; then
@@ -208,7 +235,7 @@ forward)
         pcr15=$(hash_extend 0 ${root_hash} ${hashalg}) ||
                 err "failed to hash root device"
 
-        pcr_forward[15]=":${pcr15}"
+        pcr_forward[15]="=${pcr15}"
     fi
 
     # Calculate DRTM PCRs if set (ie. PCR17 is not all f)
@@ -225,9 +252,9 @@ forward)
         pcr18=$(echo $pcrs | awk '{ print $2 }')
         pcr19=$(echo $pcrs | awk '{ print $3 }')
 
-        pcr_forward[17]=":${pcr17}"
-        pcr_forward[18]=":${pcr18}"
-        pcr_forward[19]=":${pcr19}"
+        pcr_forward[17]="=${pcr17}"
+        pcr_forward[18]="=${pcr18}"
+        pcr_forward[19]="=${pcr19}"
     fi
 
     rm -f /boot/system/tpm/forward_pcr.lst

recipes-openxt/xenclient-tpm-scripts/xenclient-tpm-scripts/tpm-functions

@@ -714,7 +714,7 @@ tpm_get_ev_separator() {
     local evs
 
     if is_tpm_2_0; then
-        # TPM 2.0: `printf "\xff\xff\xff\xff" | sha256sum`, best guess...
+        # TPM 2.0: `printf "\x00\x00\x00\x00" | sha256sum`, best guess...
         evs="df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
     else
         # TPM 1.2 will expose a securityfs node with ASCII values.
@@ -744,10 +744,11 @@ tpm_pcrlist_save() {
     local file="$1"
     shift 1
     local pcrlist=""
+    local p
 
     # Sanity check list of number in PCR id range ([0-23])
     for p in "$@"; do
-        pcrid="${p%%:*}"
+        pcrid="${p%%=*}"
         if [ "$(expr "${pcrid}" : '^[[:digit:]]\+$')" -a \
              "${pcrid}" -gt 23 -o "${pcrid}" -lt 0 ]; then
             return 1
@@ -764,26 +765,29 @@ tpm_pcrlist_save() {
 tpm_pcrs_to_opts() {
     local tss_opt
     local pcr_opts
+    local p
 
     if is_tpm_2_0; then
-        tss_opt="-r"
+        pcr_opts="sha256:$1"
+        shift
+        tss_opt=","
     else
-        tss_opt="-p"
+        tss_opt=" -p"
     fi
     for p in "$@"; do
-        pcr_opts="${pcr_opts} ${tss_opt} ${p}"
+        pcr_opts="$pcr_opts$tss_opt$p"
     done
     echo "${pcr_opts}"
 }
 
 # Usage: tpm_pcr_value_normalize PCR-VALUE
 # Print the PCR-VALUE, from TPM-TSS output, normalized on stdout.
-# Normalized here means no space, all lowercase, no PCR identifier, and only
+# Normalized here means no space, all lowercase, no PCR identifier, no 0x prefix, and only
 # the last line.
 # This is relevant for to be consistent across TSS versions and keeps format
 # sanitizing in one centralized place, should it require to be amended.
 tpm_pcr_value_normalize() {
-    echo "$1" | awk -F ':' 'END{ gsub(" ", "", $2); print tolower($2) }'
+    echo "$1" | awk -F ':' 'END{ gsub(" ", "", $2); gsub("^0x", "", $2); print tolower($2) }'
 }
 
 # Usage: tpm_get_hash_algorithm
@@ -879,14 +883,14 @@ tpm_seal() {
     local secret="${root}/$1"
     local tss="${root}/$2"
 
+    local pcr_opts="$(tpm_pcrs_to_opts ${pcrs})"
+
     if ! tpm_pcrlist_save "${tss}.pcrs" ${pcrs}; then
         echo "tpm_seal: Failed to save PCR ID list." >&2
         return 1
     fi
 
     if is_tpm_2_0; then
-        # Get comma separated list of PCR banks for use in tpm2 utilities
-        local pcrs_arg="$(echo "${pcrs}" | xargs | tr ' ' ',')"
         local alg="$(hashalg_to_alg "${hashalg}")"
         local handle="$(alg_to_handle "${alg}")"
 
@@ -909,7 +913,7 @@ tpm_seal() {
             return 1
         fi
 
-        tpm2_policypcr -S "${session_ctx}" -l "${hashalg}:${pcrs_arg}" -L "${policy_file}" > /dev/null
+        tpm2_policypcr -S "${session_ctx}" -l "${pcr_opts}" -L "${policy_file}" > /dev/null
         if [ $? -ne 0 ]; then
             echo "tpm_seal: Failed to bind PCRs to policy" >&2
             tpm2_flushcontext "${session_ctx}" > /dev/null
@@ -936,7 +940,7 @@ tpm_seal() {
             tss_bin="${tss_bin}_sa"
         fi
         tpm_save_keyfiles "${tss}"
-        allout="$(${tss_bin} -i "${secret}" -o "${tss}.sha1" -z $(tpm_pcrs_to_opts ${pcrs}) 2>&1)"
+        allout="$(${tss_bin} -i "${secret}" -o "${tss}.sha1" -z ${pcr_opts} 2>&1)"
         if [ $? -ne 0 ]; then
             echo "tpm_seal: Failed to seal data (TPM 1.2):" >&2
             echo "${allout}" >&2
@@ -974,10 +978,9 @@ tpm_unseal() {
 
     local tss="${root}/$1"
 
+    local pcr_opts="$(tpm_pcrs_to_opts $(cat "${tss}.pcrs"))"
+
     if is_tpm_2_0; then
-        # Get comma separated list of PCR banks for use in tpm2 utilities
-        local pcrs="$(echo $(cat "${tss}.pcrs"))"
-        local pcrs_arg="$(echo "${pcrs}" | xargs | tr ' ' ',')"
         local alg="$(hashalg_to_alg "${hashalg}")"
         local handle="$(alg_to_handle "${alg}")"
 
@@ -997,7 +1000,7 @@ tpm_unseal() {
 
         # Unseal
         tpm2_startauthsession --policy-session -S "${tss}.session.ctx"
-        tpm2_policypcr -S "${session_ctx}" -l "${hashalg}:${pcrs_arg}" -L "${tss}.policy.dat" > /dev/null
+        tpm2_policypcr -S "${session_ctx}" -l "${pcr_opts}" -L "${tss}.policy.dat" > /dev/null
         { stderr="$(tpm2_unseal -psession:${session_ctx} -c "${obj_ctx}" 2>&1 1>&3 3>&-)"; } 3>&1
         if [ $? -ne 0 ]; then
             echo "tpm_unseal: Failed to unseal data (TPM 2.0) using ${hashalg} algorithm, ${stderr}" >&2