Quality improvements

Makefile

@@ -3,17 +3,18 @@ help:
 	# make build                  Build companion tools
 	# make check                  Run all tests
 	# make check-efi-preinstall   Run tests of package efi/preinstall
+	# make check-efi              Run tests of package efi
 	# make list-packages          List Go packages
 
 
+.PHONY: build check check-tpm2-simulator FORCE
+FORCE:
+
 # Build command line programs
 build:
 	go build -o test_efi_fde_compat cmd/test_efi_fde_compat/main.go
 	go build -o run_argon2 cmd/run_argon2/main.go
 
-.PHONY: check check-tpm2-simulator FORCE
-FORCE:
-
 # Disable optimization and inlining (to facilitate step-by-step debugging)
 GCFLAGS = -gcflags "-N -l"
 
@@ -33,5 +34,15 @@ check-efi-preinstall: check-efi-preinstall.bin check-tpm2-simulator
 	#     go tool cover -func=coverage.out
 	# or: go tool cover -html=coverage.out
 
+check-efi.bin: FORCE
+	go test -cover -c -o $@ $(GCFLAGS) ./efi -v -ldflags '-X github.com/snapcore/secboot/internal/testenv.testBinary=enabled' -race -p 1
+
+check-efi: check-efi.bin check-tpm2-simulator
+	@# cd to efi/. as testdata is expected in .
+	cd efi && ../$< -test.coverprofile=coverage.out -check.v
+
+fmt:
+	go fmt ./...
+
 list-packages:
 	go list ./...

cmd/test_efi_fde_compat/main.go

@@ -8,6 +8,7 @@ import (
 	"github.com/jessevdk/go-flags"
 	secboot_efi "github.com/snapcore/secboot/efi"
 	"github.com/snapcore/secboot/efi/preinstall"
+	efi "github.com/snapcore/secboot/internal/efi"
 	"github.com/snapcore/snapd/snap/snapdir"
 	"github.com/snapcore/snapd/snap/squashfs"
 )
@@ -36,6 +37,8 @@ type options struct {
 
 	Action preinstall.Action `long:"action" description:"What action to run"`
 
+	EventLog string `long:"event-log" description:"Alternate TCG event log" value-name:"EVENT-LOG"`
+
 	Positional struct {
 		BootImages []string `positional-arg-name:"ordered paths to the EFI boot components for the current boot"`
 	} `positional-args:"true"`
@@ -80,6 +83,11 @@ func run() error {
 		checkFlags |= preinstall.PermitNoHardwareRootOfTrust
 	}
 
+	if opts.EventLog != "" {
+		efi.SetEventLogPath(opts.EventLog)
+	}
+	fmt.Println("Using TCG event log:", efi.EventLogPath())
+
 	var bootImages []secboot_efi.Image
 	for _, img := range opts.Positional.BootImages {
 		var snapPath string

efi/efi.go

@@ -19,7 +19,10 @@
 
 package efi
 
-import "github.com/canonical/go-tpm2"
+import (
+	"fmt"
+	"github.com/canonical/go-tpm2"
+)
 
 const (
 	kernelConfigPCR tpm2.Handle = 12
@@ -34,7 +37,7 @@ func makePcrFlags(pcrs ...tpm2.Handle) pcrFlags {
 	var out pcrFlags
 	for _, pcr := range pcrs {
 		if pcr >= 32 {
-			panic("invalid PCR")
+			panic(fmt.Sprintf("invalid PCR: %v", pcr))
 		}
 		out |= 1 << pcr
 	}
@@ -54,7 +57,7 @@ func (f pcrFlags) PCRs() (out tpm2.HandleList) {
 func (f pcrFlags) Contains(pcrs ...tpm2.Handle) bool {
 	for _, pcr := range pcrs {
 		if pcr >= 32 {
-			panic("invalid PCR")
+			panic(fmt.Sprintf("invalid PCR: %v", pcr))
 		}
 		if f&(1<<pcr) == 0 {
 			return false

efi/pcr_profile.go

@@ -76,7 +76,7 @@ func WithPlatformFirmwareProfile() PCRProfileEnablePCRsOption {
 
 // WithDriversAndAppsProfile adds the UEFI Drivers and UEFI Applications profile
 // (measured to PCR2). This is copied directly from the current host environment
-// configiguration.
+// configuration.
 func WithDriversAndAppsProfile() PCRProfileEnablePCRsOption {
 	return newPcrProfileSetPcrOption(internal_efi.DriversAndAppsPCR)
 }

efi/pcr_profile_test.go

@@ -28,8 +28,8 @@ import (
 
 	efi "github.com/canonical/go-efilib"
 	"github.com/canonical/go-tpm2"
+	"github.com/canonical/go-tpm2/policyutil"
 	tpm2_testutil "github.com/canonical/go-tpm2/testutil"
-	"github.com/canonical/go-tpm2/util"
 	"github.com/canonical/tcglog-parser"
 	. "gopkg.in/check.v1"
 
@@ -121,7 +121,7 @@ func (s *pcrProfileMockedSuite) TestAddPCRProfileSimple(c *C) {
 	profile := secboot_tpm2.NewPCRProtectionProfile()
 
 	var digests tpm2.DigestList
-	for i := 0; i <= 2; i++ {
+	for i := 0; i <= 1; i++ {
 		h := crypto.SHA256.New()
 		io.WriteString(h, strconv.Itoa(i))
 		digests = append(digests, h.Sum(nil))
@@ -633,7 +633,7 @@ func (s *pcrProfileSuite) testAddPCRProfile(c *C, data *testAddPCRProfileData, o
 	var expectedPcrs tpm2.PCRSelectionList
 	var expectedDigests tpm2.DigestList
 	for i, v := range data.expected {
-		pcrs, digest, err := util.ComputePCRDigestFromAllValues(tpm2.HashAlgorithmSHA256, v)
+		pcrs, digest, err := policyutil.ComputePCRDigestFromAllValues(tpm2.HashAlgorithmSHA256, v)
 		c.Assert(err, IsNil)
 		if i == 0 {
 			expectedPcrs = pcrs

efi/preinstall/errors.go

@@ -974,7 +974,7 @@ func wrapPCRError(pcr tpm2.Handle, err error) error {
 	case 7:
 		return &SecureBootPolicyPCRError{err}
 	default:
-		panic("invalid PCR")
+		panic(fmt.Sprintf("invalid PCR: %v", pcr))
 	}
 }
 

internal/efi/default_env.go

@@ -45,6 +45,14 @@ var (
 	eventLogPath = "/sys/kernel/security/tpm0/binary_bios_measurements" // Path of the TCG event log for the default TPM, in binary form
 )
 
+func SetEventLogPath(path string) {
+	eventLogPath = path
+}
+
+func EventLogPath() string {
+	return eventLogPath
+}
+
 // decodeKernelUeventParams decodes the uevent attribute for the device associated
 // with the supplied sysfs path, and returns a map of variables.
 //