mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-21 06:49:35 +00:00
Gary Lin
afddba0127
To prevent a sealed key from being unsealed again, a common and straightforward method is to "cap" the key by extending the associated PCRs. When the PCRs associated with the sealed key are extended, TPM will be unable to unseal the key, as the PCR values required for unsealing no longer match, effectively rendering the key unusable until the next system boot or a state where the PCRs are reset to their expected values. To cap a specific set of PCRs, simply append the argument '-c pcr_list' to the tpm2_key_protector command. Upon successfully unsealing the key, the TPM2 key protector will then invoke tpm2_protector_cap_pcrs(). This function extends the selected PCRs with an EV_SEPARATOR event, effectively "capping" them. Consequently, the associated key cannot be unsealed in any subsequent attempts until these PCRs are reset to their original, pre-capped state, typically occurring upon the next system boot. Signed-off-by: Gary Lin <glin@suse.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>