Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Andy Lutomirski <luto@amacapital.net>
Mime-Version: 1.0 (1.0)
Subject: Re: [GRUB PATCH RFC 00/18] i386: Intel TXT secure launcher
Date:   Mon, 1 Jun 2020 17:49:03 -0700
Message-Id: <C6007C2B-AEFF-4A48-B791-323CDC04266D@amacapital.net>
References: <f954e9ef-295a-a8ce-0ff8-a88ad81b01a3@apertussolutions.com>
Cc:     Andy Lutomirski <luto@kernel.org>,
        Daniel Kiper <daniel.kiper@oracle.com>,
        Lukasz Hawrylko <lukasz.hawrylko@linux.intel.com>,
        grub-devel@gnu.org, LKML <linux-kernel@vger.kernel.org>,
        trenchboot-devel@googlegroups.com, X86 ML <x86@kernel.org>,
        alexander.burmashev@oracle.com,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Ard Biesheuvel <ard.biesheuvel@linaro.org>,
        eric.snowberg@oracle.com, javierm@redhat.com,
        kanth.ghatraju@oracle.com,
        Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
        krystian.hebel@3mdeb.com, michal.zygowski@3mdeb.com,
        Matthew Garrett <mjg59@google.com>, phcoder@gmail.com,
        piotr.krol@3mdeb.com, Peter Jones <pjones@redhat.com>,
        Ross Philipson <ross.philipson@oracle.com>
In-Reply-To: <f954e9ef-295a-a8ce-0ff8-a88ad81b01a3@apertussolutions.com>
To:     "Daniel P. Smith" <dpsmith@apertussolutions.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Jun 1, 2020, at 5:14 PM, Daniel P. Smith <dpsmith@apertussolutions.com>=
 wrote:
>=20
> =EF=BB=BFOn 6/1/20 3:39 PM, Andy Lutomirski wrote:
>>>> .
>=20
> In other words, the log for the relaunch to attest what is currently
> running is really no less useful than using the first launch log to
> attest to the what was running in the first launch.
>=20

Maybe it would help if you give some examples of what=E2=80=99s actually in t=
his log and why anyone, Linux or otherwise, cares for any purpose other than=
 debugging.  We=E2=80=99re talking about a log written by something like GRU=
B, right?  If so, I=E2=80=99m imagining things like:

GRUB: loading such-and-such module
GRUB: loading the other module
GRUB: loading Linux at /boot/vmlinuz-whatever
GRUB: about to do the DRTM launch. Bye-bye.

This is surely useful for debugging.  But, if I understand your security mod=
el correctly, it=E2=80=99s untrustworthy in the sense that this all comes fr=
om before the DRTM launch and it could have been tampered with by SMM code o=
r even just a malicious USB stick.  Or even a malicious compromised kernel o=
n the same machine. So you could hash this log into a PCR, but I don=E2=80=99=
t see what you=E2=80=99ve accomplished by doing so.

Or have I misunderstood what this log is?  Perhaps you=E2=80=99re talking ab=
out something else entirely.=