Skip to content

Commit

Permalink
secboot: use latest secboot with tpm legacy platform and v2 fully opt…
Browse files Browse the repository at this point in the history 
…ional (#10946)

this bumps the secboot version to the one with

tpm "legacy" platform key data support, this means using the
ActivateVolumeWithKeyData APIs even with TPM but still using
the non-JSON keys

v2 sealed keys use only when strictly necessary, otherwise
v1 keys are written

to prepare for this we reapply the changes from #10715 that were reverted in #10930
  • Loading branch information
@pedronis @anonymouse64
pedronis authored and anonymouse64 committed Oct 21, 2021
1 parent b8a6483 commit 15a07d8
Show file tree
Hide file tree
Showing 6 changed files with 320 additions and 256 deletions.
8 changes: 4 additions & 4 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@ module github.com/snapcore/snapd
go 1.13

require (
github.com/canonical/go-efilib v0.0.0-20210909101908-41435fa545d4 // indirect
github.com/canonical/go-sp800.90a-drbg v0.0.0-20210314144037-6eeb1040d6c3 // indirect
github.com/canonical/go-tpm2 v0.0.0-20210314160024-32171bd353b1
github.com/canonical/tcglog-parser v0.0.0-20200908165021-12a3a7bcf5a1 // indirect
github.com/canonical/go-tpm2 v0.0.0-20210827151749-f80ff5afff61
github.com/canonical/tcglog-parser v0.0.0-20210824131805-69fa1e9f0ad2 // indirect
github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2
github.com/gorilla/mux v1.7.4-0.20190701202633-d83b6ffe499a
Expand All @@ -17,8 +18,7 @@ require (
github.com/mvo5/libseccomp-golang v0.9.1-0.20180308152521-f4de83b52afb
github.com/snapcore/bolt v1.3.2-0.20210908134111-63c8bfcf7af8
github.com/snapcore/go-gettext v0.0.0-20191107141714-82bbea49e785
github.com/snapcore/secboot v0.0.0-20210805184555-c9f2139ee92b
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
github.com/snapcore/secboot v0.0.0-20211018143212-802bb19ca263
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
Expand Down
20 changes: 13 additions & 7 deletions go.sum
View file
Original file line number Diff line number Diff line change
@@ -1,9 +1,13 @@
github.com/canonical/go-efilib v0.0.0-20210909101908-41435fa545d4 h1:rSWREoNHHbcIC1iQeKKraBlsDm7cmKg8eS+N48jMVKA=
github.com/canonical/go-efilib v0.0.0-20210909101908-41435fa545d4/go.mod h1:9Sr9kd7IhQPYqaU5nut8Ky97/CtlhHDzQncQnrULgDM=
github.com/canonical/go-sp800.108-kdf v0.0.0-20210314145419-a3359f2d21b9 h1:USzKjrfWo/ESzozv2i3OMM7XDgxrZRvaHFrKkIKRtwU=
github.com/canonical/go-sp800.108-kdf v0.0.0-20210314145419-a3359f2d21b9/go.mod h1:Zrs3YjJr+w51u0R/dyLh/oWt/EcBVdLPCVFYC4daW5s=
github.com/canonical/go-sp800.90a-drbg v0.0.0-20210314144037-6eeb1040d6c3 h1:oe6fCvaEpkhyW3qAicT0TnGtyht/UrgvOwMcEgLb7Aw=
github.com/canonical/go-sp800.90a-drbg v0.0.0-20210314144037-6eeb1040d6c3/go.mod h1:qdP0gaj0QtgX2RUZhnlVrceJ+Qln8aSlDyJwelLLFeM=
github.com/canonical/go-tpm2 v0.0.0-20210314160024-32171bd353b1 h1:FGWb/opVaD42utMEAkDgO9QqXiTlwESSr7VAirVtW/Q=
github.com/canonical/go-tpm2 v0.0.0-20210314160024-32171bd353b1/go.mod h1:j23KcThy5uN+suQ1HiKSpQxuR54apc2EF2P8C/FHSuE=
github.com/canonical/tcglog-parser v0.0.0-20200908165021-12a3a7bcf5a1 h1:8uxbbF6v0M9G9sadgaGYnmTlhYXN6vDTahXnKsEdz00=
github.com/canonical/tcglog-parser v0.0.0-20200908165021-12a3a7bcf5a1/go.mod h1:QoW2apR2tBl6T/4czdND/EHjL1Ia9cCmQnIj9Xe0Kt8=
github.com/canonical/go-tpm2 v0.0.0-20210827151749-f80ff5afff61 h1:DsyeCtFXqOdukmhPOunohjSlyxDHTqWSW1O4rD9N3L8=
github.com/canonical/go-tpm2 v0.0.0-20210827151749-f80ff5afff61/go.mod h1:vG41hdbBjV4+/fkubTT1ENBBqSkLwLr7mCeW9Y6kpZY=
github.com/canonical/tcglog-parser v0.0.0-20210824131805-69fa1e9f0ad2 h1:CbwVq64ruNLx/S3XA0LO6QMsw6Vc2inK+RcS6D2c4Ns=
github.com/canonical/tcglog-parser v0.0.0-20210824131805-69fa1e9f0ad2/go.mod h1:QoW2apR2tBl6T/4czdND/EHjL1Ia9cCmQnIj9Xe0Kt8=
github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7 h1:u9SHYsPQNyt5tgDm3YN7+9dYrpK96E5wFilTFWIDZOM=
github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
github.com/frankban/quicktest v1.2.2 h1:xfmOhhoH5fGPgbEAlhLpJH9p0z/0Qizio9osmvn9IUY=
Expand Down Expand Up @@ -38,8 +42,10 @@ github.com/snapcore/bolt v1.3.2-0.20210908134111-63c8bfcf7af8 h1:WmyDfH38e3MaMWr
github.com/snapcore/bolt v1.3.2-0.20210908134111-63c8bfcf7af8/go.mod h1:Z6z3sf12AMDjT/4tbT/PmzzdACAxkWGhkuKWiVpTWLM=
github.com/snapcore/go-gettext v0.0.0-20191107141714-82bbea49e785 h1:PaunR+BhraKSLxt2awQ42zofkP+NKh/VjQ0PjIMk/y4=
github.com/snapcore/go-gettext v0.0.0-20191107141714-82bbea49e785/go.mod h1:D3SsWAXK7wCCBZu+Vk5hc1EuKj/L3XN1puEMXTU4LrQ=
github.com/snapcore/secboot v0.0.0-20210805184555-c9f2139ee92b h1:r8G3o2em2zKDyMDdHthy+FARm9qEiyGtIsJIkGVBMYo=
github.com/snapcore/secboot v0.0.0-20210805184555-c9f2139ee92b/go.mod h1:72paVOkm4sJugXt+v9ItmnjXgO921D8xqsbH2OekouY=
github.com/snapcore/secboot v0.0.0-20210909111405-e3a397e2da90 h1:XCbqRVVmFztGHPWN+wdPcRahQY7moJBRd/g/zMXLJmA=
github.com/snapcore/secboot v0.0.0-20210909111405-e3a397e2da90/go.mod h1:72paVOkm4sJugXt+v9ItmnjXgO921D8xqsbH2OekouY=
github.com/snapcore/secboot v0.0.0-20211018143212-802bb19ca263 h1:cq2rG4JcNBCwHvo7iNdJL4nb8Ns7L/aOUd1EFs2toFs=
github.com/snapcore/secboot v0.0.0-20211018143212-802bb19ca263/go.mod h1:72paVOkm4sJugXt+v9ItmnjXgO921D8xqsbH2OekouY=
github.com/snapcore/snapd v0.0.0-20201005140838-501d14ac146e/go.mod h1:3xrn7QDDKymcE5VO2rgWEQ5ZAUGb9htfwlXnoel6Io8=
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 h1:A/5uWzF44DlIgdm/PQFwfMkW0JX+cIcQi/SwLAmZP5M=
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
Expand All @@ -52,6 +58,7 @@ golang.org/x/net v0.0.0-20201002202402-0a1ea396d57c/go.mod h1:iQL9McJNjoIa5mjH6n
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365 h1:6wSTsvPddg9gc/mVEEyk9oOAoxn+bT4Z9q1zx+4RwA4=
golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
Expand All @@ -60,7 +67,6 @@ golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
gopkg.in/macaroon.v1 v1.0.0-20150121114231-ab3940c6c165 h1:85xqOSyTpSzplW7fyO9bOZpSsemJc9UKzEQR2L4k32k=
Expand Down
69 changes: 39 additions & 30 deletions secboot/export_sb_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,78 +24,88 @@ import (
"io"

sb "github.com/snapcore/secboot"
sb_efi "github.com/snapcore/secboot/efi"
sb_tpm2 "github.com/snapcore/secboot/tpm2"
)

var (
EFIImageFromBootFile = efiImageFromBootFile
LockTPMSealedKeys = lockTPMSealedKeys
)

func MockSbConnectToDefaultTPM(f func() (*sb.TPMConnection, error)) (restore func()) {
func MockSbConnectToDefaultTPM(f func() (*sb_tpm2.Connection, error)) (restore func()) {
old := sbConnectToDefaultTPM
sbConnectToDefaultTPM = f
return func() {
sbConnectToDefaultTPM = old
}
}

func MockProvisionTPM(f func(tpm *sb.TPMConnection, mode sb.ProvisionMode, newLockoutAuth []byte) error) (restore func()) {
func MockProvisionTPM(f func(tpm *sb_tpm2.Connection, mode sb_tpm2.ProvisionMode, newLockoutAuth []byte) error) (restore func()) {
old := provisionTPM
provisionTPM = f
return func() {
provisionTPM = old
}
}

func MockSbAddEFISecureBootPolicyProfile(f func(profile *sb.PCRProtectionProfile, params *sb.EFISecureBootPolicyProfileParams) error) (restore func()) {
old := sbAddEFISecureBootPolicyProfile
sbAddEFISecureBootPolicyProfile = f
func MockSbEfiAddSecureBootPolicyProfile(f func(profile *sb_tpm2.PCRProtectionProfile, params *sb_efi.SecureBootPolicyProfileParams) error) (restore func()) {
old := sbefiAddSecureBootPolicyProfile
sbefiAddSecureBootPolicyProfile = f
return func() {
sbAddEFISecureBootPolicyProfile = old
sbefiAddSecureBootPolicyProfile = old
}
}

func MockSbAddEFIBootManagerProfile(f func(profile *sb.PCRProtectionProfile, params *sb.EFIBootManagerProfileParams) error) (restore func()) {
old := sbAddEFIBootManagerProfile
sbAddEFIBootManagerProfile = f
func MockSbEfiAddBootManagerProfile(f func(profile *sb_tpm2.PCRProtectionProfile, params *sb_efi.BootManagerProfileParams) error) (restore func()) {
old := sbefiAddBootManagerProfile
sbefiAddBootManagerProfile = f
return func() {
sbAddEFIBootManagerProfile = old
sbefiAddBootManagerProfile = old
}
}

func MockSbAddSystemdEFIStubProfile(f func(profile *sb.PCRProtectionProfile, params *sb.SystemdEFIStubProfileParams) error) (restore func()) {
old := sbAddSystemdEFIStubProfile
sbAddSystemdEFIStubProfile = f
func MockSbEfiAddSystemdStubProfile(f func(profile *sb_tpm2.PCRProtectionProfile, params *sb_efi.SystemdStubProfileParams) error) (restore func()) {
old := sbefiAddSystemdStubProfile
sbefiAddSystemdStubProfile = f
return func() {
sbAddSystemdEFIStubProfile = old
sbefiAddSystemdStubProfile = old
}
}

func MockSbAddSnapModelProfile(f func(profile *sb.PCRProtectionProfile, params *sb.SnapModelProfileParams) error) (restore func()) {
func MockSbAddSnapModelProfile(f func(profile *sb_tpm2.PCRProtectionProfile, params *sb_tpm2.SnapModelProfileParams) error) (restore func()) {
old := sbAddSnapModelProfile
sbAddSnapModelProfile = f
return func() {
sbAddSnapModelProfile = old
}
}

func MockSbSealKeyToTPMMultiple(f func(tpm *sb.TPMConnection, keys []*sb.SealKeyRequest, params *sb.KeyCreationParams) (sb.TPMPolicyAuthKey, error)) (restore func()) {
func MockSbSealKeyToTPMMultiple(f func(tpm *sb_tpm2.Connection, keys []*sb_tpm2.SealKeyRequest, params *sb_tpm2.KeyCreationParams) (sb_tpm2.PolicyAuthKey, error)) (restore func()) {
old := sbSealKeyToTPMMultiple
sbSealKeyToTPMMultiple = f
return func() {
sbSealKeyToTPMMultiple = old
}
}

func MockSbUpdateKeyPCRProtectionPolicyMultiple(f func(tpm *sb.TPMConnection, keyPaths []string, authKey sb.TPMPolicyAuthKey, pcrProfile *sb.PCRProtectionProfile) error) (restore func()) {
func MockSbUpdateKeyPCRProtectionPolicyMultiple(f func(tpm *sb_tpm2.Connection, keys []*sb_tpm2.SealedKeyObject, authKey sb_tpm2.PolicyAuthKey, pcrProfile *sb_tpm2.PCRProtectionProfile) error) (restore func()) {
old := sbUpdateKeyPCRProtectionPolicyMultiple
sbUpdateKeyPCRProtectionPolicyMultiple = f
return func() {
sbUpdateKeyPCRProtectionPolicyMultiple = old
}
}

func MockSbBlockPCRProtectionPolicies(f func(tpm *sb.TPMConnection, pcrs []int) error) (restore func()) {
func MockSbSealedKeyObjectRevokeOldPCRProtectionPolicies(f func(sko *sb_tpm2.SealedKeyObject, tpm *sb_tpm2.Connection, authKey sb_tpm2.PolicyAuthKey) error) (restore func()) {
old := sbSealedKeyObjectRevokeOldPCRProtectionPolicies
sbSealedKeyObjectRevokeOldPCRProtectionPolicies = f
return func() {
sbSealedKeyObjectRevokeOldPCRProtectionPolicies = old
}
}

func MockSbBlockPCRProtectionPolicies(f func(tpm *sb_tpm2.Connection, pcrs []int) error) (restore func()) {
old := sbBlockPCRProtectionPolicies
sbBlockPCRProtectionPolicies = f
return func() {
Expand All @@ -112,15 +122,6 @@ func MockSbActivateVolumeWithRecoveryKey(f func(volumeName, sourceDevicePath str
}
}

func MockSbActivateVolumeWithTPMSealedKey(f func(tpm *sb.TPMConnection, volumeName, sourceDevicePath, keyPath string,
pinReader io.Reader, options *sb.ActivateVolumeOptions) (bool, error)) (restore func()) {
old := sbActivateVolumeWithTPMSealedKey
sbActivateVolumeWithTPMSealedKey = f
return func() {
sbActivateVolumeWithTPMSealedKey = old
}
}

func MockSbActivateVolumeWithKey(f func(volumeName, sourceDevicePath string, key []byte,
options *sb.ActivateVolumeOptions) error) (restore func()) {
old := sbActivateVolumeWithKey
Expand All @@ -138,15 +139,15 @@ func MockSbActivateVolumeWithKeyData(f func(volumeName, sourceDevicePath string,
}
}

func MockSbMeasureSnapSystemEpochToTPM(f func(tpm *sb.TPMConnection, pcrIndex int) error) (restore func()) {
func MockSbMeasureSnapSystemEpochToTPM(f func(tpm *sb_tpm2.Connection, pcrIndex int) error) (restore func()) {
old := sbMeasureSnapSystemEpochToTPM
sbMeasureSnapSystemEpochToTPM = f
return func() {
sbMeasureSnapSystemEpochToTPM = old
}
}

func MockSbMeasureSnapModelToTPM(f func(tpm *sb.TPMConnection, pcrIndex int, model sb.SnapModel) error) (restore func()) {
func MockSbMeasureSnapModelToTPM(f func(tpm *sb_tpm2.Connection, pcrIndex int, model sb.SnapModel) error) (restore func()) {
old := sbMeasureSnapModelToTPM
sbMeasureSnapModelToTPM = f
return func() {
Expand Down Expand Up @@ -179,7 +180,7 @@ func MockSbAddRecoveryKeyToLUKS2Container(f func(devicePath string, key []byte,
}
}

func MockIsTPMEnabled(f func(tpm *sb.TPMConnection) bool) (restore func()) {
func MockIsTPMEnabled(f func(tpm *sb_tpm2.Connection) bool) (restore func()) {
old := isTPMEnabled
isTPMEnabled = f
return func() {
Expand All @@ -202,3 +203,11 @@ func MockSbDeactivateVolume(f func(volumeName string) error) (restore func()) {
sbDeactivateVolume = old
}
}

func MockSbReadSealedKeyObjectFromFile(f func(string) (*sb_tpm2.SealedKeyObject, error)) (restore func()) {
old := sbReadSealedKeyObjectFromFile
sbReadSealedKeyObjectFromFile = f
return func() {
sbReadSealedKeyObjectFromFile = old
}
}
Loading

0 comments on commit 15a07d8

Please sign in to comment.