Re: [PATCH v4 1/1] tpm: add sysfs exports for all banks of PCR registers

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Tue, 2020-08-18 at 14:17 -0300, Jason Gunthorpe wrote:
> On Tue, Aug 18, 2020 at 09:44:30AM -0700, James Bottomley wrote:
> 
> > The question you should be asking isn't whether the information
> > *could*
> > be obtained by other means, but whether providing it in this form
> > facilitates current operations and whether the interface would have
> > users.
> 
> Sure. What are the use cases that need PCRs but no other TPM
> operations?
> 
> The cover letter didn't say. As PCR is really only useful in the
> context of the local TPM I'm not thinking of anything..

The three use cases I picked up at the Boot and Security MC were:

   1. local log verification: a script can run through the IMA ascii log
      and construct the PCR 10 hash which can then be verified
   2. Knowing what the PCR values actually are for sealed keys.  With the
      current trusted key infrastructure you have to calculate and supply
      the hash yourself.  With the new proposed infrastructure, the hash
      would be calculated by the seal operation, but you're still going to
      need the actual PCR values to debug unseal failures.
   3. As a stability check for log shipping: you read the PCR take the log
      then read the PCR: if the two reads are the same the PCR backing the
      log is stable for quoting.

James