Skip to content

Commit 89c7bad

Browse files
chrisccoulsonchrisccoulson
authored
Merge pull request #48 from chrisccoulson/add-snap-model-protection-profile
Add an API to bind a PCR profile to a set of snap models. This binds a PCR profile to the brand (via the brand-id and sign-key-sha3-384 fields), model, series and grade properties of a set of model assertions and defines the format in which snap-bootstrap should perform the actual measurement of these properties.
2 parents dd1d2c4 + 92f2c93 commit 89c7bad

File tree

8 files changed

+663
-58
lines changed

8 files changed

+663
-58
lines changed

‎policy_test.go‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -546,11 +546,11 @@ duwzA18V2dm66mFx1NcqfNyRUbclhN26KAaRnTDQrAaxFIgoO+Xm
546546
// for PIN change (TPM2_NV_ChangeAuth), reading (TPM2_NV_Read) and TPM2_PolicyNV - see the first 5 calls to tpm2.ComputeAuthPolicy in
547547
// createPinNVIndex.
548548
var pinIndexAuthPolicies tpm2.DigestList
549-
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexString(t, "199c42684aafe3d9c2e18dcc162a6d3875a40ca2ab8f06228b207135281d995f"))
550-
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexString(t, "78b1915a25b400ec9a87a2830b07aaacfc440f754e0d2027d09799f894d134c0"))
551-
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexString(t, "aa83a598d93a56c9ca6fea7c3ffc4e106357ff6d93e11a9b4ac2b6aae12ba0de"))
552-
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexString(t, "47ce3032d8bad1f3089cb0c09088de43501491d460402b90cd1b7fc0b68ca92f"))
553-
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexString(t, "203e4bd5d0448c9615cc13fa18e8d39222441cc40204d99a77262068dbd55a43"))
549+
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexStringT(t, "199c42684aafe3d9c2e18dcc162a6d3875a40ca2ab8f06228b207135281d995f"))
550+
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexStringT(t, "78b1915a25b400ec9a87a2830b07aaacfc440f754e0d2027d09799f894d134c0"))
551+
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexStringT(t, "aa83a598d93a56c9ca6fea7c3ffc4e106357ff6d93e11a9b4ac2b6aae12ba0de"))
552+
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexStringT(t, "47ce3032d8bad1f3089cb0c09088de43501491d460402b90cd1b7fc0b68ca92f"))
553+
pinIndexAuthPolicies = append(pinIndexAuthPolicies, decodeHexStringT(t, "203e4bd5d0448c9615cc13fa18e8d39222441cc40204d99a77262068dbd55a43"))
554554

555555
trial, _ := tpm2.ComputeAuthPolicy(tpm2.HashAlgorithmSHA256)
556556
trial.PolicyOR(pinIndexAuthPolicies)
@@ -578,12 +578,12 @@ duwzA18V2dm66mFx1NcqfNyRUbclhN26KAaRnTDQrAaxFIgoO+Xm
578578
{
579579
desc: "SHA256",
580580
alg: tpm2.HashAlgorithmSHA256,
581-
policy: decodeHexString(t, "6996f631d4ff9ebe51aaf91f155446ea3b845f9d7f3c33d70efc3b44cbf9fde4"),
581+
policy: decodeHexStringT(t, "6996f631d4ff9ebe51aaf91f155446ea3b845f9d7f3c33d70efc3b44cbf9fde4"),
582582
},
583583
{
584584
desc: "SHA1",
585585
alg: tpm2.HashAlgorithmSHA1,
586-
policy: decodeHexString(t, "97859d33468dd99d02449128b5c0cda40fc2c272"),
586+
policy: decodeHexStringT(t, "97859d33468dd99d02449128b5c0cda40fc2c272"),
587587
},
588588
} {
589589
t.Run(data.desc, func(t *testing.T) {
@@ -693,7 +693,7 @@ func TestComputePolicyORData(t *testing.T) {
693693
inputDigests: tpm2.DigestList{
694694
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo")).end(),
695695
},
696-
outputPolicy: decodeHexString(t, "fd7451c024bafe5f117cab2841c2dd81f5304350bd8b17ef1f667bceda1ffcf9"),
696+
outputPolicy: decodeHexStringT(t, "fd7451c024bafe5f117cab2841c2dd81f5304350bd8b17ef1f667bceda1ffcf9"),
697697
},
698698
{
699699
desc: "MultipleDigests",
@@ -704,7 +704,7 @@ func TestComputePolicyORData(t *testing.T) {
704704
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "abc")).end(),
705705
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "1234")).end(),
706706
},
707-
outputPolicy: decodeHexString(t, "4088de0181ede03662fabce88ba4385b16448a981f6b399da861dfe6cc955b68"),
707+
outputPolicy: decodeHexStringT(t, "4088de0181ede03662fabce88ba4385b16448a981f6b399da861dfe6cc955b68"),
708708
},
709709
{
710710
desc: "2Rows",
@@ -736,7 +736,7 @@ func TestComputePolicyORData(t *testing.T) {
736736
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "bar4")).end(),
737737
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "bar5")).end(),
738738
},
739-
outputPolicy: decodeHexString(t, "0a023c5b9182d2456407c39bf0ab62f6b86f90a4cec61e594c026a087c43e84c"),
739+
outputPolicy: decodeHexStringT(t, "0a023c5b9182d2456407c39bf0ab62f6b86f90a4cec61e594c026a087c43e84c"),
740740
},
741741
{
742742
desc: "3Rows",
@@ -868,7 +868,7 @@ func TestComputePolicyORData(t *testing.T) {
868868
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 8, 12}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "abc5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "bar4")).end(),
869869
buildPCRDigest(t, tpm2.HashAlgorithmSHA256, tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 8, 12}}}).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "abc5")).addDigest(makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "bar5")).end(),
870870
},
871-
outputPolicy: decodeHexString(t, "447f411c3cedd453e53e9b95958774413bea32267a75db8545cd258ed4968575"),
871+
outputPolicy: decodeHexStringT(t, "447f411c3cedd453e53e9b95958774413bea32267a75db8545cd258ed4968575"),
872872
},
873873
} {
874874
t.Run(data.desc, func(t *testing.T) {
@@ -952,7 +952,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
952952
},
953953
policyCount: 10,
954954
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}},
955-
policy: decodeHexString(t, "3cbe37896850d15904508ddf7a28f776642fe60e10b8c9b35e22f50bdc3a53dc"),
955+
policy: decodeHexStringT(t, "3cbe37896850d15904508ddf7a28f776642fe60e10b8c9b35e22f50bdc3a53dc"),
956956
},
957957
{
958958
desc: "Single/2",
@@ -968,7 +968,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
968968
},
969969
policyCount: 10,
970970
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 8}}},
971-
policy: decodeHexString(t, "86affbdd808f57ef16c369fc2cc099a3bfa4de6d39a5c4a2cba83710c555ecbe"),
971+
policy: decodeHexStringT(t, "86affbdd808f57ef16c369fc2cc099a3bfa4de6d39a5c4a2cba83710c555ecbe"),
972972
},
973973
{
974974
desc: "SHA1Session",
@@ -984,7 +984,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
984984
},
985985
policyCount: 4551,
986986
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}},
987-
policy: decodeHexString(t, "28ac61ddced6e86df127edebeea647b9dc5ca84d"),
987+
policy: decodeHexStringT(t, "28ac61ddced6e86df127edebeea647b9dc5ca84d"),
988988
},
989989
{
990990
desc: "SHA256SessionWithSHA512PCRs",
@@ -1000,7 +1000,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
10001000
},
10011001
policyCount: 403,
10021002
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA512, Select: []int{7, 12}}},
1003-
policy: decodeHexString(t, "3600c82daa5035cd43270f3bc3d0e54beb5c822068ba1951e1bb8757f9dd1d15"),
1003+
policy: decodeHexStringT(t, "3600c82daa5035cd43270f3bc3d0e54beb5c822068ba1951e1bb8757f9dd1d15"),
10041004
},
10051005
{
10061006
desc: "MultiplePCRValues/1",
@@ -1022,7 +1022,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
10221022
},
10231023
policyCount: 5,
10241024
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}},
1025-
policy: decodeHexString(t, "512b6a11965b51f1e5d7eef556bbe1d10a944e5151ed152632f51cb14a326949"),
1025+
policy: decodeHexStringT(t, "512b6a11965b51f1e5d7eef556bbe1d10a944e5151ed152632f51cb14a326949"),
10261026
},
10271027
{
10281028
desc: "MultiplePCRValues/2",
@@ -1040,7 +1040,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
10401040
}),
10411041
policyCount: 5,
10421042
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}},
1043-
policy: decodeHexString(t, "a17b393df59e27da3052bce83dbd8d97e777c4967c2ffa9ea9cc096a65944eed"),
1043+
policy: decodeHexStringT(t, "a17b393df59e27da3052bce83dbd8d97e777c4967c2ffa9ea9cc096a65944eed"),
10441044
},
10451045
{
10461046
desc: "SHA512AuthKey",
@@ -1056,7 +1056,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
10561056
},
10571057
policyCount: 10,
10581058
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 12}}},
1059-
policy: decodeHexString(t, "3cbe37896850d15904508ddf7a28f776642fe60e10b8c9b35e22f50bdc3a53dc"),
1059+
policy: decodeHexStringT(t, "3cbe37896850d15904508ddf7a28f776642fe60e10b8c9b35e22f50bdc3a53dc"),
10601060
},
10611061
{
10621062
desc: "MultiplePCRAlgorithms",
@@ -1074,7 +1074,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
10741074
},
10751075
policyCount: 10,
10761076
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{8}}, {Hash: tpm2.HashAlgorithmSHA512, Select: []int{7}}},
1077-
policy: decodeHexString(t, "adacb43d5f894bf05b6153c16743251a1896ab92d88c9032a7e94095372869dd"),
1077+
policy: decodeHexStringT(t, "adacb43d5f894bf05b6153c16743251a1896ab92d88c9032a7e94095372869dd"),
10781078
},
10791079
{
10801080
desc: "LotsOfPCRValues",
@@ -1105,7 +1105,7 @@ func TestComputeDynamicPolicy(t *testing.T) {
11051105
}),
11061106
policyCount: 15,
11071107
pcrSelection: tpm2.PCRSelectionList{{Hash: tpm2.HashAlgorithmSHA256, Select: []int{7, 8, 12}}},
1108-
policy: decodeHexString(t, "92a8744419642bd0c72195ec681fcc03a6f4dd3c644837c7f0eb8394d729f9d5"),
1108+
policy: decodeHexStringT(t, "92a8744419642bd0c72195ec681fcc03a6f4dd3c644837c7f0eb8394d729f9d5"),
11091109
},
11101110
{
11111111
desc: "IncompletePCRValues",

‎sdefistub_policy_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,12 +47,12 @@ func TestAddSystemdEFIStubProfile(t *testing.T) {
4747
values: []tpm2.PCRValues{
4848
{
4949
tpm2.HashAlgorithmSHA256: {
50-
12: decodeHexString(t, "fc433eaf039c6261f496a2a5bf2addfd8ff1104b0fc98af3fe951517e3bde824"),
50+
12: decodeHexStringT(t, "fc433eaf039c6261f496a2a5bf2addfd8ff1104b0fc98af3fe951517e3bde824"),
5151
},
5252
},
5353
{
5454
tpm2.HashAlgorithmSHA256: {
55-
12: decodeHexString(t, "b3a29076eeeae197ae721c254da40480b76673038045305cfa78ec87421c4eea"),
55+
12: decodeHexStringT(t, "b3a29076eeeae197ae721c254da40480b76673038045305cfa78ec87421c4eea"),
5656
},
5757
},
5858
},
@@ -70,12 +70,12 @@ func TestAddSystemdEFIStubProfile(t *testing.T) {
7070
values: []tpm2.PCRValues{
7171
{
7272
tpm2.HashAlgorithmSHA1: {
73-
12: decodeHexString(t, "eb6312b7db70fe16206c162326e36b2fcda74b68"),
73+
12: decodeHexStringT(t, "eb6312b7db70fe16206c162326e36b2fcda74b68"),
7474
},
7575
},
7676
{
7777
tpm2.HashAlgorithmSHA1: {
78-
12: decodeHexString(t, "bd612bea9efa582fcbfae97973c89b163756fe0b"),
78+
12: decodeHexStringT(t, "bd612bea9efa582fcbfae97973c89b163756fe0b"),
7979
},
8080
},
8181
},
@@ -92,7 +92,7 @@ func TestAddSystemdEFIStubProfile(t *testing.T) {
9292
values: []tpm2.PCRValues{
9393
{
9494
tpm2.HashAlgorithmSHA256: {
95-
8: decodeHexString(t, "74fe9080b798f9220c18d0fcdd0ccb82d50ce2a317bc6cdaa2d8715d02d0efbe"),
95+
8: decodeHexStringT(t, "74fe9080b798f9220c18d0fcdd0ccb82d50ce2a317bc6cdaa2d8715d02d0efbe"),
9696
},
9797
},
9898
},
@@ -115,7 +115,7 @@ func TestAddSystemdEFIStubProfile(t *testing.T) {
115115
{
116116
tpm2.HashAlgorithmSHA256: {
117117
7: makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo"),
118-
8: decodeHexString(t, "3d39c0db757b47b484006003724d990403d533044ed06e8798ab374bd73f32dc"),
118+
8: decodeHexStringT(t, "3d39c0db757b47b484006003724d990403d533044ed06e8798ab374bd73f32dc"),
119119
},
120120
},
121121
},

‎secboot_test.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
package secboot_test
2121

2222
import (
23+
"encoding/hex"
2324
"math/rand"
2425
"testing"
2526

@@ -143,3 +144,9 @@ func (r *testRng) Read(p []byte) (int, error) {
143144
}
144145

145146
var testRandReader = &testRng{}
147+
148+
func decodeHexString(c *C, s string) []byte {
149+
b, err := hex.DecodeString(s)
150+
c.Assert(err, IsNil)
151+
return b
152+
}

0 commit comments

Comments
 (0)