From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E49B4C433E6 for ; Mon, 22 Feb 2021 07:43:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 99D8E64DDC for ; Mon, 22 Feb 2021 07:43:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230178AbhBVHnV (ORCPT ); Mon, 22 Feb 2021 02:43:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230240AbhBVHnS (ORCPT ); Mon, 22 Feb 2021 02:43:18 -0500 Received: from cavan.codon.org.uk (cavan.codon.org.uk [IPv6:2a00:1098:84:22e::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E860FC061786; Sun, 21 Feb 2021 23:42:17 -0800 (PST) Received: by cavan.codon.org.uk (Postfix, from userid 1000) id 90F3C40A2F; Mon, 22 Feb 2021 07:41:10 +0000 (UTC) Date: Mon, 22 Feb 2021 07:41:10 +0000 From: Matthew Garrett To: Jarkko Sakkinen Cc: Matthew Garrett , linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-pm@vger.kernel.org, keyrings@vger.kernel.org, zohar@linux.ibm.com, jejb@linux.ibm.com, corbet@lwn.net, rjw@rjwysocki.net, Matthew Garrett Subject: Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data Message-ID: <20210222074110.GC30403@codon.org.uk> References: <20210220013255.1083202-1-matthewgarrett@google.com> <20210220013255.1083202-6-matthewgarrett@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On Sat, Feb 20, 2021 at 05:09:07AM +0200, Jarkko Sakkinen wrote: > Something popped into mind: could we make PCR 23 reservation dynamic > instead of a config option. > > E.g. if the user space uses it, then it's dirty and hibernate will > fail. I really dislike the static compilation time firewall on it. We can fail hibernation if userland hasn't flagged things, but the concern is that if you hibernate with PCR 23 blocking enabled and then reboot with the blocking disabled, userland can obtain the blob from the hibernation image, extend PCR 23, modify the image and use the key they've recovered to make it look legitimate, enable PCR 23 blocking again and then resume into their own code.