morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 08:25:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #30728 from polarina/noda

Browse Source 
Assign noDA attribute to TPM2 objects not dependant on a PIN
This commit is contained in:
Lennart Poettering
2024-01-05 11:04:11 +01:00
committed by GitHub
parent cc51085a41 9bf91584c8
commit 35a7dd4834
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/pcrlock/pcrlock.c
View File

@@ -4560,7 +4560,7 @@ static int verb_make_policy(int argc, char *argv[], void *userdata) {
return r;
}
log_info("Written new policy to '%s' and digest to TPM2 NV index 0x%" PRIu32 ".", path, nv_index);
log_info("Written new policy to '%s' and digest to TPM2 NV index 0x%x.", path, nv_index);
log_info("Overall time spent: %s", FORMAT_TIMESPAN(usec_sub_unsigned(now(CLOCK_MONOTONIC), start_usec), 1));

11
src/shared/tpm2-util.c
View File

@@ -5227,13 +5227,22 @@ int tpm2_seal(Tpm2Context *c,
usec_t start = now(CLOCK_MONOTONIC);
TPMA_OBJECT hmac_attributes =
TPMA_OBJECT_FIXEDTPM |
TPMA_OBJECT_FIXEDPARENT;
/* If protected by PIN, a user-selected low-entropy password, enable DA protection.
Without a PIN, the key's left protected only by a PCR policy, which does not benefit
from DA protection. */
hmac_attributes |= pin ? 0 : TPMA_OBJECT_NODA;
/* We use a keyed hash object (i.e. HMAC) to store the secret key we want to use for unlocking the
* LUKS2 volume with. We don't ever use for HMAC/keyed hash operations however, we just use it
* because it's a key type that is universally supported and suitable for symmetric binary blobs. */
TPMT_PUBLIC hmac_template = {
.type = TPM2_ALG_KEYEDHASH,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = TPMA_OBJECT_FIXEDTPM | TPMA_OBJECT_FIXEDPARENT,
.objectAttributes = hmac_attributes,
.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL,
.unique.keyedHash.size = SHA256_DIGEST_SIZE,
.authPolicy = policy ? *policy : TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE),