From 82923679a898e74672a4cdaf4d3c878d56b671e4 Mon Sep 17 00:00:00 2001 From: Frederic Hoerni Date: Tue, 7 Jul 2026 14:48:17 +0200 Subject: [PATCH 1/4] efi/preinstall: add option --event-log --- cmd/test_efi_fde_compat/main.go | 8 ++++++++ internal/efi/default_env.go | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/cmd/test_efi_fde_compat/main.go b/cmd/test_efi_fde_compat/main.go index 8df39da3..107b50bc 100644 --- a/cmd/test_efi_fde_compat/main.go +++ b/cmd/test_efi_fde_compat/main.go @@ -8,6 +8,7 @@ import ( "github.com/jessevdk/go-flags" secboot_efi "github.com/snapcore/secboot/efi" "github.com/snapcore/secboot/efi/preinstall" + efi "github.com/snapcore/secboot/internal/efi" "github.com/snapcore/snapd/snap/snapdir" "github.com/snapcore/snapd/snap/squashfs" ) @@ -36,6 +37,8 @@ type options struct { Action preinstall.Action `long:"action" description:"What action to run"` + EventLog string `long:"event-log" description:"Alternate TCG event log" value-name:"EVENT-LOG"` + Positional struct { BootImages []string `positional-arg-name:"ordered paths to the EFI boot components for the current boot"` } `positional-args:"true"` @@ -80,6 +83,11 @@ func run() error { checkFlags |= preinstall.PermitNoHardwareRootOfTrust } + if opts.EventLog != "" { + efi.SetEventLogPath(opts.EventLog) + } + fmt.Println("Using TCG event log:", efi.EventLogPath()) + var bootImages []secboot_efi.Image for _, img := range opts.Positional.BootImages { var snapPath string diff --git a/internal/efi/default_env.go b/internal/efi/default_env.go index 8d0484ec..20e851fc 100644 --- a/internal/efi/default_env.go +++ b/internal/efi/default_env.go @@ -45,6 +45,14 @@ var ( eventLogPath = "/sys/kernel/security/tpm0/binary_bios_measurements" // Path of the TCG event log for the default TPM, in binary form ) +func SetEventLogPath(path string) { + eventLogPath = path +} + +func EventLogPath() string { + return eventLogPath +} + // decodeKernelUeventParams decodes the uevent attribute for the device associated // with the supplied sysfs path, and returns a map of variables. // From a3183ef65af0d4d7c5b49bc028e2bbbc30ebe3a9 Mon Sep 17 00:00:00 2001 From: Frederic Hoerni Date: Tue, 7 Jul 2026 14:48:41 +0200 Subject: [PATCH 2/4] efi: add pcr number on panic message --- efi/efi.go | 9 ++++++--- efi/preinstall/errors.go | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/efi/efi.go b/efi/efi.go index 4815ed1b..3cb7724a 100644 --- a/efi/efi.go +++ b/efi/efi.go @@ -19,7 +19,10 @@ package efi -import "github.com/canonical/go-tpm2" +import ( + "fmt" + "github.com/canonical/go-tpm2" +) const ( kernelConfigPCR tpm2.Handle = 12 @@ -34,7 +37,7 @@ func makePcrFlags(pcrs ...tpm2.Handle) pcrFlags { var out pcrFlags for _, pcr := range pcrs { if pcr >= 32 { - panic("invalid PCR") + panic(fmt.Sprintf("invalid PCR: %v", pcr)) } out |= 1 << pcr } @@ -54,7 +57,7 @@ func (f pcrFlags) PCRs() (out tpm2.HandleList) { func (f pcrFlags) Contains(pcrs ...tpm2.Handle) bool { for _, pcr := range pcrs { if pcr >= 32 { - panic("invalid PCR") + panic(fmt.Sprintf("invalid PCR: %v", pcr)) } if f&(1< Date: Mon, 13 Jul 2026 10:00:15 +0200 Subject: [PATCH 3/4] Makefile: add check-efi --- Makefile | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 839a0010..def34d60 100644 --- a/Makefile +++ b/Makefile @@ -3,17 +3,18 @@ help: # make build Build companion tools # make check Run all tests # make check-efi-preinstall Run tests of package efi/preinstall + # make check-efi Run tests of package efi # make list-packages List Go packages +.PHONY: build check check-tpm2-simulator FORCE +FORCE: + # Build command line programs build: go build -o test_efi_fde_compat cmd/test_efi_fde_compat/main.go go build -o run_argon2 cmd/run_argon2/main.go -.PHONY: check check-tpm2-simulator FORCE -FORCE: - # Disable optimization and inlining (to facilitate step-by-step debugging) GCFLAGS = -gcflags "-N -l" @@ -33,5 +34,15 @@ check-efi-preinstall: check-efi-preinstall.bin check-tpm2-simulator # go tool cover -func=coverage.out # or: go tool cover -html=coverage.out +check-efi.bin: FORCE + go test -cover -c -o $@ $(GCFLAGS) ./efi -v -ldflags '-X github.com/snapcore/secboot/internal/testenv.testBinary=enabled' -race -p 1 + +check-efi: check-efi.bin check-tpm2-simulator + @# cd to efi/. as testdata is expected in . + cd efi && ../$< -test.coverprofile=coverage.out -check.v + +fmt: + go fmt ./... + list-packages: go list ./... From 7c20b150dde1dd1472668832db062202b60da920 Mon Sep 17 00:00:00 2001 From: Frederic Hoerni Date: Mon, 13 Jul 2026 10:00:57 +0200 Subject: [PATCH 4/4] efi/pcr_profile: minor quality improvements - fix call to deprecated func - fix typo - remove an item of a list that was not used --- efi/pcr_profile.go | 2 +- efi/pcr_profile_test.go | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/efi/pcr_profile.go b/efi/pcr_profile.go index c336f4a7..b45a3122 100644 --- a/efi/pcr_profile.go +++ b/efi/pcr_profile.go @@ -76,7 +76,7 @@ func WithPlatformFirmwareProfile() PCRProfileEnablePCRsOption { // WithDriversAndAppsProfile adds the UEFI Drivers and UEFI Applications profile // (measured to PCR2). This is copied directly from the current host environment -// configiguration. +// configuration. func WithDriversAndAppsProfile() PCRProfileEnablePCRsOption { return newPcrProfileSetPcrOption(internal_efi.DriversAndAppsPCR) } diff --git a/efi/pcr_profile_test.go b/efi/pcr_profile_test.go index b6848f28..27e0033c 100644 --- a/efi/pcr_profile_test.go +++ b/efi/pcr_profile_test.go @@ -28,8 +28,8 @@ import ( efi "github.com/canonical/go-efilib" "github.com/canonical/go-tpm2" + "github.com/canonical/go-tpm2/policyutil" tpm2_testutil "github.com/canonical/go-tpm2/testutil" - "github.com/canonical/go-tpm2/util" "github.com/canonical/tcglog-parser" . "gopkg.in/check.v1" @@ -121,7 +121,7 @@ func (s *pcrProfileMockedSuite) TestAddPCRProfileSimple(c *C) { profile := secboot_tpm2.NewPCRProtectionProfile() var digests tpm2.DigestList - for i := 0; i <= 2; i++ { + for i := 0; i <= 1; i++ { h := crypto.SHA256.New() io.WriteString(h, strconv.Itoa(i)) digests = append(digests, h.Sum(nil)) @@ -633,7 +633,7 @@ func (s *pcrProfileSuite) testAddPCRProfile(c *C, data *testAddPCRProfileData, o var expectedPcrs tpm2.PCRSelectionList var expectedDigests tpm2.DigestList for i, v := range data.expected { - pcrs, digest, err := util.ComputePCRDigestFromAllValues(tpm2.HashAlgorithmSHA256, v) + pcrs, digest, err := policyutil.ComputePCRDigestFromAllValues(tpm2.HashAlgorithmSHA256, v) c.Assert(err, IsNil) if i == 0 { expectedPcrs = pcrs