[tpm2] Issue Solved/Trusted Boot

[tpm2] Issue Solved/Trusted Boot

[Haydon Cardew]

[-- Attachment #1: Type: text/plain, Size: 1127 bytes --]

Hi,



Following a discussion on 01org/tpm2-tools #444 [https://github.com/01org/
tpm2-tools/issues/444] I wanted to post an update on what the issue was.



For some reason I had ‘tpm2-resourcemgr’ loaded up on my system which
stopped ‘tpm2-abrmd’ from loading. I also assumed that this previously
loaded module was the process required. However, upon stopping
‘tpm2-resourcemgr’ and loading ‘tpm2-abrmd’ I now have a tpm2 passing 25 of
the tests provided with tpm2-tools (I also believe the 2 failed tests are
the already known issues with real-world tpm2).



Wanted to say a massive thanks to those of you who replied/helped me!
Really nice community.



If I could ask one further thing (I believe this is the correct place to
post this?), I’m looking at setting up a trusted boot system on my current
setup (Ubuntu 16.04, kernel 4.4) to be used with the now working tpm2. I
have previously done this with tpm1.2 but the process seems rather
different this time, if anyone can point me to any good resources/tutorials
that would be a massive help.



Thanks,


Haydon

[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 2536 bytes --]

Re: [tpm2] Issue Solved/Trusted Boot

[Javier Martinez Canillas]

[-- Attachment #1: Type: text/plain, Size: 1730 bytes --]

Hello Haydon,

On 09/04/2017 11:27 AM, Haydon Cardew wrote:
> Hi,
> 
> 
> 
> Following a discussion on 01org/tpm2-tools #444 [https://github.com/01org/
> tpm2-tools/issues/444] I wanted to post an update on what the issue was.
>

I'm glad that your issue got solved.
 > 
> If I could ask one further thing (I believe this is the correct place to
> post this?), I’m looking at setting up a trusted boot system on my current
> setup (Ubuntu 16.04, kernel 4.4) to be used with the now working tpm2. I
> have previously done this with tpm1.2 but the process seems rather
> different this time, if anyone can point me to any good resources/tutorials
> that would be a massive help.
> 

There isn't a single way to do this, so it depends on what kind of system you
want to use and what is your threat model.

For example, do you want to boot your system in EFI or BIOS mode? do you want
to use Secure Boot or no?

For me the best way to do this is to use UEFI + Secure Boot and to seal your
secrets against PCR7 as described in this blog post [0] from Matthew Garret.

But for that you need latest shim that measures certificates into PCR7 [1] and
TPM2 measurement support in grub2 [2] that haven't landed yet.

If you want to boot your system in BIOS mode, then you have other options like
the TrustedGrub2 project [3].

[0]: https://mjg59.dreamwidth.org/48897.html
[1]: https://github.com/rhboot/shim/commit/8af7c4cacaf753f38f2564b26b962a7a2942d664
[2]: http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00003.html
[3]: https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat

Re: [tpm2] Issue Solved/Trusted Boot

[Philip Tricca]

[-- Attachment #1: Type: text/plain, Size: 2319 bytes --]

On Mon, 2017-09-04 at 12:04 +0200, Javier Martinez Canillas wrote:
> Following a discussion on 01org/tpm2-tools #444 [https://github.com
> > /01org/
> > tpm2-tools/issues/444] I wanted to post an update on what the issue
> > was.
> > 
> 
> I'm glad that your issue got solved.
>  > 
> > If I could ask one further thing (I believe this is the correct
> > place to
> > post this?), I’m looking at setting up a trusted boot system on my
> > current
> > setup (Ubuntu 16.04, kernel 4.4) to be used with the now working
> > tpm2. I
> > have previously done this with tpm1.2 but the process seems rather
> > different this time, if anyone can point me to any good
> > resources/tutorials
> > that would be a massive help.
> > 
> 
> There isn't a single way to do this, so it depends on what kind of
> system you
> want to use and what is your threat model.
> 
> For example, do you want to boot your system in EFI or BIOS mode? do
> you want
> to use Secure Boot or no?

Minor clarification: TPM2 has no support for legacy BIOS boot. UEFI
only.

> For me the best way to do this is to use UEFI + Secure Boot and to
> seal your
> secrets against PCR7 as described in this blog post [0] from Matthew
> Garret.
> 
> But for that you need latest shim that measures certificates into
> PCR7 [1] and
> TPM2 measurement support in grub2 [2] that haven't landed yet.
> 
> If you want to boot your system in BIOS mode, then you have other
> options like
> the TrustedGrub2 project [3].

There is a set of patches to Grub2 that integrates TPM2 measurements
for loadable modules, kernel, initramfs & command line that was sent to
the grub2 devel list a while back. I've not seen the RSC TrustedGrub2
work before (thanks for the link by the way) but IMHO forking Grub2 for
TPM2 work in the same way the original TrustedGrub did isn't the right
way to do this. Better to get more people talking about this on the
grub devel mailing list to try to get the patches upstreamed.

Regards,
Philip

> [0]: https://mjg59.dreamwidth.org/48897.html
> [1]: https://github.com/rhboot/shim/commit/8af7c4cacaf753f38f2564b26b
> 962a7a2942d664
> [2]: http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00003.ht
> ml
> [3]: https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2

Re: [tpm2] Issue Solved/Trusted Boot

[Javier Martinez Canillas]

[-- Attachment #1: Type: text/plain, Size: 3359 bytes --]

On 09/06/2017 06:16 PM, Philip Tricca wrote:
> On Mon, 2017-09-04 at 12:04 +0200, Javier Martinez Canillas wrote:
>> Following a discussion on 01org/tpm2-tools #444 [https://github.com
>>> /01org/
>>> tpm2-tools/issues/444] I wanted to post an update on what the issue
>>> was.
>>>
>>
>> I'm glad that your issue got solved.
>>  > 
>>> If I could ask one further thing (I believe this is the correct
>>> place to
>>> post this?), I’m looking at setting up a trusted boot system on my
>>> current
>>> setup (Ubuntu 16.04, kernel 4.4) to be used with the now working
>>> tpm2. I
>>> have previously done this with tpm1.2 but the process seems rather
>>> different this time, if anyone can point me to any good
>>> resources/tutorials
>>> that would be a massive help.
>>>
>>
>> There isn't a single way to do this, so it depends on what kind of
>> system you
>> want to use and what is your threat model.
>>
>> For example, do you want to boot your system in EFI or BIOS mode? do
>> you want
>> to use Secure Boot or no?
> 
> Minor clarification: TPM2 has no support for legacy BIOS boot. UEFI
> only.
>

Right, and the TCG spec only describes an EFI interface for it in the "TCG EFI
Protocol Specification". I always get confused by this because when booting a
machine in BIOS (CSM) mode, I see a TPM2 chardev and the tpm2-tools work well.

>> For me the best way to do this is to use UEFI + Secure Boot and to
>> seal your
>> secrets against PCR7 as described in this blog post [0] from Matthew
>> Garret.
>>
>> But for that you need latest shim that measures certificates into
>> PCR7 [1] and
>> TPM2 measurement support in grub2 [2] that haven't landed yet.
>>
>> If you want to boot your system in BIOS mode, then you have other
>> options like
>> the TrustedGrub2 project [3].
> 
> There is a set of patches to Grub2 that integrates TPM2 measurements
> for loadable modules, kernel, initramfs & command line that was sent to
> the grub2 devel list a while back. I've not seen the RSC TrustedGrub2

Yes, that was my reference [2]. I tested the patches and works correctly for me.

> work before (thanks for the link by the way) but IMHO forking Grub2 for
> TPM2 work in the same way the original TrustedGrub did isn't the right

Absolutely agree, I was just trying to list the available projects out there
that have TPM support. Although I double checked and they still don't have
TPM2 support. For some reasons I thought it did, sorry for the confusion.

> way to do this. Better to get more people talking about this on the
> grub devel mailing list to try to get the patches upstreamed.
>

Yeah, the problem is that the grub2 TPM2 measurements patches depends on other
in-flight patch-set (the verifier framework) and AFAIU there are still some
discussion needed about those patches:

http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00040.html

> Regards,
> Philip
> 
>> [0]: https://mjg59.dreamwidth.org/48897.html
>> [1]: https://github.com/rhboot/shim/commit/8af7c4cacaf753f38f2564b26b
>> 962a7a2942d664
>> [2]: http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00003.ht
>> ml
>> [3]: https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat

Re: [tpm2] Issue Solved/Trusted Boot

[Haydon Cardew]

[-- Attachment #1: Type: text/plain, Size: 3754 bytes --]

Not having too much success with the suggested solutions, is it possible to
use Intel TXT to perform a measured boot?

On 6 September 2017 at 20:28, Javier Martinez Canillas <javierm(a)redhat.com>
wrote:

> On 09/06/2017 06:16 PM, Philip Tricca wrote:
> > On Mon, 2017-09-04 at 12:04 +0200, Javier Martinez Canillas wrote:
> >> Following a discussion on 01org/tpm2-tools #444 [https://github.com
> >>> /01org/
> >>> tpm2-tools/issues/444] I wanted to post an update on what the issue
> >>> was.
> >>>
> >>
> >> I'm glad that your issue got solved.
> >>  >
> >>> If I could ask one further thing (I believe this is the correct
> >>> place to
> >>> post this?), I’m looking at setting up a trusted boot system on my
> >>> current
> >>> setup (Ubuntu 16.04, kernel 4.4) to be used with the now working
> >>> tpm2. I
> >>> have previously done this with tpm1.2 but the process seems rather
> >>> different this time, if anyone can point me to any good
> >>> resources/tutorials
> >>> that would be a massive help.
> >>>
> >>
> >> There isn't a single way to do this, so it depends on what kind of
> >> system you
> >> want to use and what is your threat model.
> >>
> >> For example, do you want to boot your system in EFI or BIOS mode? do
> >> you want
> >> to use Secure Boot or no?
> >
> > Minor clarification: TPM2 has no support for legacy BIOS boot. UEFI
> > only.
> >
>
> Right, and the TCG spec only describes an EFI interface for it in the "TCG
> EFI
> Protocol Specification". I always get confused by this because when
> booting a
> machine in BIOS (CSM) mode, I see a TPM2 chardev and the tpm2-tools work
> well.
>
> >> For me the best way to do this is to use UEFI + Secure Boot and to
> >> seal your
> >> secrets against PCR7 as described in this blog post [0] from Matthew
> >> Garret.
> >>
> >> But for that you need latest shim that measures certificates into
> >> PCR7 [1] and
> >> TPM2 measurement support in grub2 [2] that haven't landed yet.
> >>
> >> If you want to boot your system in BIOS mode, then you have other
> >> options like
> >> the TrustedGrub2 project [3].
> >
> > There is a set of patches to Grub2 that integrates TPM2 measurements
> > for loadable modules, kernel, initramfs & command line that was sent to
> > the grub2 devel list a while back. I've not seen the RSC TrustedGrub2
>
> Yes, that was my reference [2]. I tested the patches and works correctly
> for me.
>
> > work before (thanks for the link by the way) but IMHO forking Grub2 for
> > TPM2 work in the same way the original TrustedGrub did isn't the right
>
> Absolutely agree, I was just trying to list the available projects out
> there
> that have TPM support. Although I double checked and they still don't have
> TPM2 support. For some reasons I thought it did, sorry for the confusion.
>
> > way to do this. Better to get more people talking about this on the
> > grub devel mailing list to try to get the patches upstreamed.
> >
>
> Yeah, the problem is that the grub2 TPM2 measurements patches depends on
> other
> in-flight patch-set (the verifier framework) and AFAIU there are still some
> discussion needed about those patches:
>
> http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00040.html
>
> > Regards,
> > Philip
> >
> >> [0]: https://mjg59.dreamwidth.org/48897.html
> >> [1]: https://github.com/rhboot/shim/commit/8af7c4cacaf753f38f2564b26b
> >> 962a7a2942d664
> >> [2]: http://lists.gnu.org/archive/html/grub-devel/2017-07/msg00003.ht
> >> ml
> >> [3]: https://github.com/Rohde-Schwarz-Cybersecurity/TrustedGRUB2
>
> Best regards,
> --
> Javier Martinez Canillas
> Software Engineer - Desktop Hardware Enablement
> Red Hat
>

[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 5360 bytes --]