trustedgrub-users — Topics interesting for TrustedGRUB users

[Trustedgrub-users] help modifying menu.lst

[Salvatore C. <s.c...@ca...>]

hello!
eureka! i finally installed Trusted grub in my machine!
it says "tpm Detected" ma in does not do anything, so i 
think that i have to made changes to menu.lst! right?
i tried to stop grub to use the checkfile command,
i have a scsi hd and it is situated in /dev/sda1 (ext3) 
and i want to check the menu.lst ...so which is the 
correct syntax?
i tried checkfile (sda1, 1) /boot/grub/menu.lst
but it gaves error....

[Trustedgrub-users] help to understand trusted grub

[Salvatore C. <s.c...@ca...>]

hello everyone
i am Salvatore Caratozzolo , an italian student of the 
Bicocca University (Milano), and i'm studying the TPM chip 
in the Trusted/Secure boot for my stage!
i red your pages about your implementation of trusted grub 
and i think that that is what i'm looking for!
i have few question to you about how does it works and how 
i have to use it!
i am using Kubuntu, i have grub loader and the Intel Tpm 
chip version 1.2.
the chip has already an Endorsement Key so i don't have to 
create it!

1st list of questions:
the steps of your trusted grub are:

-after the reset, the processor loades the bios(question: 
in this step,does the cpu calls the tpm to measure the 
bios?? )

-bios execute the POST (Power On Self Test) to ensure that 
every components are ok, then measures the first part of 
grub, the stage 1 in the Master boot Of record, (question: 
is the bios to call it or is the TPM that in the first 
step controls the stage 1 after the bios measurement ??)if 
it has the same digest as the one stored in the pcr 4 it 
passes the test, so the bios loades it and transfer the 
execution to it

-the stage 1 measures the digest of stage part 1 (why the 
stage 2 has two parts? i don't understand..) stored 
somewhere in the hard disk and if it is the same of the 
one stored in PCR 8 it passes the test and load it

-the stage 2 part 1 measures the stage 2 part 2 and if it 
pass the test it will be loaded and transfer the control 
to it

-stage 2 part 2 shows the different O.S. installed and let 
the user to select what he wants to load, after that it 
measures the sha1 of kernel of the selected S.O. with its 
initrd and modules (all together right?) and if it is the 
same of the one stored in PCR 14 it transfer control to 
the O.S.

-optional: stage 2 can measures the sha1 of some files 
that i need to be trusted (example: /etc/passwd) and it 
compares the digest with the one stored in PCR 13 (and if 
i have more than 1 file it compares the digest of all 
files together with the one present in some PCR..which 
one? )

-trusted grub has finished

all these steps are repeated always at every boot?
when does TPM ask the PubEk? and how does it use it? it 
uses to encrypt the sha1 result that is sent to the tpm? 
if so...the TPM decrypt the sha1 and compares it to the 
one that it has stored previously? what does it return? 
how Trusted grub understand that it's all ok?

how i have to store the sha1 of stage1, stage2 part1 part2 
and so on.. in PCRs? when i have to do it? in the O.S. 
loaded with some application that can comunicate with the 
TPM to set up it?

i tried to install yout patch but i have the gcc 4.1 and 
the 3.4 installed, i red that i need the 3.X ... so... how 
i can use the gcc version 3.X?

i think that your grub loader it's very useful for my 
stage so please answer!!
all that i can do to repay your availability is to send to 
you my thesis when i have finished!
tnx for your help!
best regards
Salvo

[Trustedgrub-users] tGRUB error during SHA1-calculation

[Sebastian S. <pe...@hi...>]

Hi,

i got the same problem Ralf pointed out,
any hints about that?

Cheers


Sebastian 

Re: [Trustedgrub-users] Is trusted Grub necessary ?

[Oliver W. <ma...@ol...>]

Hi Giovanni


> I'd like to have one information, in particular:
> if i have a TPM can i use it without performing a trusted boot ? or i'l=
l
> receive any message errors ?

The TPM is passive, it wont give you any warnings or messages at all.
If you dont use a TPM enabled boot loader you wont have any statements
(aka measurments) of your boot process in the TPM registers - so you do
not have the certainity what you have booted. If you just want to play
around or use the TPM to seal data to the maschine, its fine to ommit
the bootloader

Oliver

--=20
Protect your environment -  close windows and adopt a penguin!
PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF  8168 CAB7 B0DD 3985 1721

[Trustedgrub-users] Is trusted Grub necessary ?

[Giovanni F. <gio...@gm...>]

Hi all !

I'd like to have one information, in particular:
if i have a TPM can i use it without performing a trusted boot ? or i'll
receive any message errors ?

Thank you very much !!
Giovanni

[Trustedgrub-users] tGRUB error during SHA1-calculation

[Ralf R. <ral...@gm...>]

Hi!

I have installed trustedgrub on a Fujitsu-Siemens Stylistic ST5020 
Tablet-PC. The built-in TPM appears to be an Infineon supporting the 1.1 
standard.

The installation worked great, and trustedgrub shows "TPM detected!".

I wanted to try the checkfile option, but i doesnt' seem to work.

Here's my checkfile (numbers have been changed):

# less /boot/grub/check.file

1459828423145982842314598284231459828423 (hd0,0)/boot/grub/sha1-test.txt

When tgrub has started, i enter a command-line pressing 'c' and enter:

grub> checkfile (hd0,0)/boot/grub/check.file

and tgrub echoes:
----
tGRUB error during SHA1-calculation

Booting has to be stopped

Press any key ...
----

Any help will be appreciated!

Greetings,

Ralf

Re: [Trustedgrub-users] PCR values

[Marcel S. <m.s...@si...>]

Dear Maksim,

> How the Trusted Grub saves the values during reboots. Does it use
> internal TPM capabilities (like save_context) or it stores them on
> external memory?

TrustedGRUB doesn't save any values. During the boot process, all
files are freshly measured during the loading process and the
calculated hash values are then extended into the according PCRs.

Best regards,
Marcel Selhorst

[Trustedgrub-users] PCR values

[Maksim D. <dja...@lu...>]

Hi!

I have a question regarding the PCR values for comparison during the boot.

How the Trusted Grub saves the values during reboots. Does it use
internal TPM capabilities (like save_context) or it stores them on
external memory?


Thanks!

Maksim.

Re: [Trustedgrub-users] Trusted GRUB bug!!

[Marcel S. <ma...@se...>]

TrustedGRUB does not compile with GCC 4 and this is stated in the Readme.tGRUB.
Please take a look there, before posting on the mailing list.

And please do not double post!

Thanks,
Marcel Selhorst

Alper Somuncu schrieb:
> Hello,
> I'm using Pardus(http://www.pardus.org.tr/eng/index.html),  I wanna using
> tGRUB, but i have a error during the installation:
> 
> pardus TrustedGRUB # tar -xzf TrustedGRUB-1.0.1.tgz
> pardus TrustedGRUB # cd  TrustedGRUB-1.0.1
> pardus TrustedGRUB-1.0.1 # ./build_tgrub.sh
> Wrong gcc-version, please use GCC 3.x
> 
> My tGRUB versiyon 1.0.1, and gcc versiyon is 4.1.2, these are latest
> versiyons..
> 
> I think that's a bug.. How I can fix this?
> 
> 
> 

[Trustedgrub-users] Trusted GRUB bug!!

[Alper S. <alp...@gm...>]

Hello,
I'm using Pardus(http://www.pardus.org.tr/eng/index.html),  I wanna using
tGRUB, but i have a error during the installation:

pardus TrustedGRUB # tar -xzf TrustedGRUB-1.0.1.tgz
pardus TrustedGRUB # cd  TrustedGRUB-1.0.1
pardus TrustedGRUB-1.0.1 # ./build_tgrub.sh
Wrong gcc-version, please use GCC 3.x

My tGRUB versiyon 1.0.1, and gcc versiyon is 4.1.2, these are latest
versiyons..

I think that's a bug.. How I can fix this?



-- 
Alper Somuncu
+90 536 231 3300
www.alpersomuncu.com

Re: [Trustedgrub-users] need TPM Emulator for Trusted GRUB?

[Marcel S. <tg...@se...>]

Hi Alper,

> I'm using Pardus OS on my laptop. I have a project with TrustedGRUB. For
> using the TrustedGRUB, must i install the TPM emulator?
> thx..

you have to have a TPM and a PC with the CRTM-features in the BIOS in order to use
most of the features of TrustedGRUB. Since TrustedGRUB is started before your OS, you
cannot use an emulator with TrustedGRUB.

Best regards,
Marcel Selhorst

[Trustedgrub-users] need TPM Emulator for Trusted GRUB?

[Alper S. <alp...@gm...>]

Hi all,
I'm using Pardus OS on my laptop. I have a project with TrustedGRUB. For
using the TrustedGRUB, must i install the TPM emulator?
thx..

-- 
Alper Somuncu
+90 536 231 3300
www.alpersomuncu.com

Re: [Trustedgrub-users] No values in PCR

[Marcel S. <tg...@se...>]

Dear Saurabh,

thanks for testing TrustedGRUB.
The PCRs are zero, because the BIOS of your HP notebook does not provide the complete
CRTM-functionality, i.e., the BIOS does not offer the needed functionality to hash
data and to extend them in to PCRs. In this case, the only security functionality you
can use is the checkfile-option, which measures files via a software-sha1 and
compares them to the reference-values...

Regarding your checkfile-problem:

You have to create a file and add the files, which shall be checked and their
regarding sha1-hash values (calculatable via sha1sum), e.g.:

acme selhorst # cat /boot/checkfile
2865c43108a249cc0ce3b5ff6f0b2a4bb19d0bc8 (hd0,1)/etc/passwd
c151c1e02e01582e0235090c970cd3fddd1bccfe (hd0,1)/etc/shadow

In your /boot/grub/menu.lst you simply then add the line:

acme selhorst # cat /boot/grub/menu.lst
default 0
timeout 15

title=Some title
checkfile (hd0,0)/boot/checkfile
root (hd0,0)
kernel...

Then TrustedGRUB will open the checkfile and will measure any file and compare the
result with the reference value (and extend in a PCR, but this will not work for you,
 due to your BIOS-problem).

Best regards,
Marcel Selhorst

Saurabh Arora schrieb:
> Hi
> 
> I have installed the TrustedGrub latest build.
> My system specs:
> - HP dc7600 with 1.2 Broadcom/Infineon chip
> - gentoo 2.6.20 with IMA
> - gcc 3.4.6
> when grub loads up at boot, it detects the TPM, but in the grub
> command menu, 'checkfile' gives the following error :
> 
> --------
> grub> checkfile <file>
> 
> tGRUB error : Could not open checkfile ( error code 0)
> Booting has to be stopped
> Press any key ...
> ---------
> 
> and then it hangs and i have to cntrl+alt+del the machine..
> 
> and after booting, when i cat the pcrs .. i get all 0s except pcr 10
> 
> am i missing sumthing ??
> 
> 
> saurabh
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Trustedgrub-users mailing list
> Tru...@li...
> https://lists.sourceforge.net/lists/listinfo/trustedgrub-users
> 

[Trustedgrub-users] No values in PCR

[Saurabh A. <tan...@gm...>]

Hi

I have installed the TrustedGrub latest build.
My system specs:
- HP dc7600 with 1.2 Broadcom/Infineon chip
- gentoo 2.6.20 with IMA
- gcc 3.4.6
when grub loads up at boot, it detects the TPM, but in the grub
command menu, 'checkfile' gives the following error :

--------
grub> checkfile <file>

tGRUB error : Could not open checkfile ( error code 0)
Booting has to be stopped
Press any key ...
---------

and then it hangs and i have to cntrl+alt+del the machine..

and after booting, when i cat the pcrs .. i get all 0s except pcr 10

am i missing sumthing ??


saurabh

Re: [Trustedgrub-users] Unable to build trusted-grub

[Marcel S. <tg...@se...>]

Hi,

> My TPM is active, and uses the tpm_tis driver (with the force=1 option
> for ACPI) included in the linux 2.6.19 kernel.  It's a Dell 380.

Good to see, that your TPM is working under Linux. But as you can see, Dell didn't
add the TPM into their ACPI-table, which is why you have to use the force=1 option.

Additionally, Dell does not provide the necessary CRTM-functionality in their BIOS.
Therefore, TrustedGRUB is not able to make use of the TPM and works as a regular
GRUB. The only functionality you can then use is the "checkfile"-option to verify
files prior booting. But the measurements will not be extended into any PCR.

> Any ideas on how to fix this?

You can't, Dell has to provide a BIOS with CRTM-functionality.

Sorry, for the bad news and best regards,
Marcel

Re: [Trustedgrub-users] Unable to build trusted-grub

[Luke <sec...@gm...>]

Marcel Selhorst wrote:
> OK, fine, does it work for you?

Not really - I get a "TPM not found" message at the top of the screen
with the grub> prompt.

My TPM is active, and uses the tpm_tis driver (with the force=1 option
for ACPI) included in the linux 2.6.19 kernel.  It's a Dell 380.

Any ideas on how to fix this?

Re: [Trustedgrub-users] Unable to build trusted-grub

[Marcel S. <tg...@se...>]

Hi Luke,

> Enabling verbose output
> ./build_tgrub.sh: 157: [[: not found
> [: 158: ==: unexpected operator
> Wrong gcc-version, please use GCC 3.x
> exit: 158: Illegal number: -1

Ah, I see, which version of BASH do you use? I have:

GNU bash, version 3.2.9(1)-release (i686-pc-linux-gnu)
Copyright (C) 2005 Free Software Foundation, Inc.

Probably, there are some changes... :)

> It looks like there's a problem with the brackets somewhere... I'll
> debug it later if I get the time.

thanks!

> I was able to compile, however.

OK, fine, does it work for you?

Re: [Trustedgrub-users] Unable to build trusted-grub

[Luke <sec...@gm...>]

Marcel Selhorst wrote:
> > Hi Luke,
> >
>> >> I can't seem to build trusted-grub on an ubuntu system, using gcc-3.4
>> >> builtins.c:5566: error: invalid storage class for function
�process_var�
>> >> builtins.c:5566: warning: no previous prototype for �process_var�
>> >> builtins.c:5626: error: invalid storage class for function
�process_block�
>> >> builtins.c:5626: warning: no previous prototype for �process_block�
> >
> > these error messages look exactly like mine, when I compile
TrustedGRUB with gcc-4.
> > Can you check again, whether you really are using gcc-3.4.?
> >
>> >> The build script seems to be broken in a number of places, so I'm just
>> >> stepping through, and running the build commands individually.
> >
> > Can you describe what is broken on the build-script? Did you try to
run it with the
> > option "-v" for more verbosity?
> >
> >

Enabling verbose output
./build_tgrub.sh: 157: [[: not found
[: 158: ==: unexpected operator
Wrong gcc-version, please use GCC 3.x
exit: 158: Illegal number: -1

gcc --version:
gcc (GCC) 3.4.6 (Ubuntu 3.4.6-3ubuntu1)
Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

It looks like there's a problem with the brackets somewhere... I'll
debug it later if I get the time.

I was able to compile, however.

Re: [Trustedgrub-users] Unable to build trusted-grub

[Marcel S. <tg...@se...>]

Hi Luke,

> I can't seem to build trusted-grub on an ubuntu system, using gcc-3.4
> builtins.c:5566: error: invalid storage class for function �process_var�
> builtins.c:5566: warning: no previous prototype for �process_var�
> builtins.c:5626: error: invalid storage class for function �process_block�
> builtins.c:5626: warning: no previous prototype for �process_block�

these error messages look exactly like mine, when I compile TrustedGRUB with gcc-4.
Can you check again, whether you really are using gcc-3.4.?

> The build script seems to be broken in a number of places, so I'm just
> stepping through, and running the build commands individually.

Can you describe what is broken on the build-script? Did you try to run it with the
option "-v" for more verbosity?

Best regards,
Marcel Selhorst

[Trustedgrub-users] unable to build trusted-grub

[Luke <sec...@gm...>]

I can't seem to build trusted-grub on an ubuntu system, using gcc-3.4

The build script seems to be broken in a number of places, so I'm just
stepping through, and running the build commands individually.


Here are the errors I'm getting.

        then mv -f ".deps/pre_stage2_exec-boot.Tpo"
".deps/pre_stage2_exec-boot.Po"; else rm -f
".deps/pre_stage2_exec-boot.Tpo"; exit 1; fi
boot.c: In function =91load_checkfile=92:
boot.c:163: warning: pointer targets in passing argument 1 of
=91grub_read=92 differ in signedness
boot.c:219: warning: pointer targets in passing argument 1 of
=91calculate_sha1=92 differ in signedness
boot.c:236: warning: pointer targets in passing argument 1 of
=91grub_sprintf=92 differ in signedness
boot.c:248: warning: pointer targets in passing argument 1 of
=91grub_strcmp=92 differ in signedness
boot.c:248: warning: pointer targets in passing argument 2 of
=91grub_strcmp=92 differ in signedness
boot.c: In function =91load_image=92:
boot.c:345: warning: pointer targets in passing argument 1 of
=91grub_read=92 differ in signedness
boot.c:388: warning: pointer targets in passing argument 1 of
=91grub_strcmp=92 differ in signedness
boot.c:1107: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1119: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1160: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1169: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c: In function =91bsd_boot=92:
boot.c:1574: warning: pointer targets in assignment differ in signedness
if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../stage1  -Wall
-Wmissing-prototypes -Wunused -Wshadow -Wpointer-arith -falign-jumps=3D1
-falign-loops=3D1 -falign-functions=3D1 -Wundef -I../stage1 -fno-builtin
-nostdinc  -DSUPPORT_SERIAL=3D1 -DSUPPORT_HERCULES=3D1 -DFSYS_EXT2FS=3D1
-DFSYS_FAT=3D1 -DFSYS_NTFS=3D1 -DFSYS_FFS=3D1 -DFSYS_UFS2=3D1 -DFSYS_MINI=
X=3D1
-DFSYS_REISERFS=3D1 -DFSYS_VSTAFS=3D1 -DFSYS_JFS=3D1 -DFSYS_XFS=3D1
-DFSYS_ISO9660=3D1 -DUSE_MD5_PASSWORDS=3D1 -g -MT pre_stage2_exec-builtin=
s.o
-MD -MP -MF ".deps/pre_stage2_exec-builtins.Tpo" -c -o
pre_stage2_exec-builtins.o `test -f 'builtins.c' || echo './'`builtins.c;=
 \
        then mv -f ".deps/pre_stage2_exec-builtins.Tpo"
".deps/pre_stage2_exec-builtins.Po"; else rm -f
".deps/pre_stage2_exec-builtins.Tpo"; exit 1; fi
builtins.c: In function =91vbeset_func=92:
builtins.c:4994: warning: pointer targets in passing argument 1 of
=91get_vbe_pmif=92 differ in signedness
builtins.c:4994: warning: pointer targets in passing argument 2 of
=91get_vbe_pmif=92 differ in signedness
builtins.c: In function =91toggle_func=92:
builtins.c:5566: error: invalid storage class for function =91process_var=
=92
builtins.c:5566: warning: no previous prototype for =91process_var=92
builtins.c:5626: error: invalid storage class for function =91process_blo=
ck=92
builtins.c:5626: warning: no previous prototype for =91process_block=92
builtins.c: In function =91toggle_trigger_init=92:
builtins.c:5847: error: invalid storage class for function =91detect_vmwa=
re=92
builtins.c:5847: warning: no previous prototype for =91detect_vmware=92
builtins.c:6040:3: warning: no newline at end of file
make[2]: *** [pre_stage2_exec-builtins.o] Error 1

--=20
Luke St.Clair
http://www.lukestclair.org

[Trustedgrub-users] Unable to build trusted-grub

[Luke St.C. <lst...@cs...>]

I can't seem to build trusted-grub on an ubuntu system, using gcc-3.4

The build script seems to be broken in a number of places, so I'm just
stepping through, and running the build commands individually.


Here are the errors I'm getting.

        then mv -f ".deps/pre_stage2_exec-boot.Tpo"
".deps/pre_stage2_exec-boot.Po"; else rm -f
".deps/pre_stage2_exec-boot.Tpo"; exit 1; fi
boot.c: In function =91load_checkfile=92:
boot.c:163: warning: pointer targets in passing argument 1 of
=91grub_read=92 differ in signedness
boot.c:219: warning: pointer targets in passing argument 1 of
=91calculate_sha1=92 differ in signedness
boot.c:236: warning: pointer targets in passing argument 1 of
=91grub_sprintf=92 differ in signedness
boot.c:248: warning: pointer targets in passing argument 1 of
=91grub_strcmp=92 differ in signedness
boot.c:248: warning: pointer targets in passing argument 2 of
=91grub_strcmp=92 differ in signedness
boot.c: In function =91load_image=92:
boot.c:345: warning: pointer targets in passing argument 1 of
=91grub_read=92 differ in signedness
boot.c:388: warning: pointer targets in passing argument 1 of
=91grub_strcmp=92 differ in signedness
boot.c:1107: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1119: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1160: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c:1169: warning: pointer targets in passing argument 2 of
=91sha1_update=92 differ in signedness
boot.c: In function =91bsd_boot=92:
boot.c:1574: warning: pointer targets in assignment differ in signedness
if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../stage1  -Wall
-Wmissing-prototypes -Wunused -Wshadow -Wpointer-arith -falign-jumps=3D1
-falign-loops=3D1 -falign-functions=3D1 -Wundef -I../stage1 -fno-builtin
-nostdinc  -DSUPPORT_SERIAL=3D1 -DSUPPORT_HERCULES=3D1 -DFSYS_EXT2FS=3D1
-DFSYS_FAT=3D1 -DFSYS_NTFS=3D1 -DFSYS_FFS=3D1 -DFSYS_UFS2=3D1 -DFSYS_MINI=
X=3D1
-DFSYS_REISERFS=3D1 -DFSYS_VSTAFS=3D1 -DFSYS_JFS=3D1 -DFSYS_XFS=3D1
-DFSYS_ISO9660=3D1 -DUSE_MD5_PASSWORDS=3D1 -g -MT pre_stage2_exec-builtin=
s.o
-MD -MP -MF ".deps/pre_stage2_exec-builtins.Tpo" -c -o
pre_stage2_exec-builtins.o `test -f 'builtins.c' || echo './'`builtins.c;=
 \
        then mv -f ".deps/pre_stage2_exec-builtins.Tpo"
".deps/pre_stage2_exec-builtins.Po"; else rm -f
".deps/pre_stage2_exec-builtins.Tpo"; exit 1; fi
builtins.c: In function =91vbeset_func=92:
builtins.c:4994: warning: pointer targets in passing argument 1 of
=91get_vbe_pmif=92 differ in signedness
builtins.c:4994: warning: pointer targets in passing argument 2 of
=91get_vbe_pmif=92 differ in signedness
builtins.c: In function =91toggle_func=92:
builtins.c:5566: error: invalid storage class for function =91process_var=
=92
builtins.c:5566: warning: no previous prototype for =91process_var=92
builtins.c:5626: error: invalid storage class for function =91process_blo=
ck=92
builtins.c:5626: warning: no previous prototype for =91process_block=92
builtins.c: In function =91toggle_trigger_init=92:
builtins.c:5847: error: invalid storage class for function =91detect_vmwa=
re=92
builtins.c:5847: warning: no previous prototype for =91detect_vmware=92
builtins.c:6040:3: warning: no newline at end of file
make[2]: *** [pre_stage2_exec-builtins.o] Error 1

--=20
Luke St.Clair
http://www.lukestclair.org

[Trustedgrub-users] Meassuring Kernel integrity with TG

[Oliver W. <ma...@ol...>]

Hi List,

I am new to the project and have a somewhat theoretical question...

If I understand this correctly, than TrustedGRUB will create a SHA-1 
checksum of my bzImage and write this into one of the PCRs - right ?

So, second stage: I want to seal a Filesystem-Encryption Key with the 
TPM - so I can mount the FS only when the kernel was verified - right ?

Problem: I have to apply a new kernel due to security issues - so the 
SHA-1 and with it the PCR will change and I cannot access the encrpytion 
keys any longer.

Approach: Using not SHA-1 but Public Key crypto to verify the kernel.
Anybody alread went this direction ??? Any other ideas on the problem

TIA

Oliver
-- 
Diese Nachricht wurde digital unterschrieben
oliwel's public key: http://www.oliwel.de/oliwel.crt
Basiszertifikat: http://www.ldv.ei.tum.de/page72

Re: [Trustedgrub-users] Newbie question

[<de...@de...>]

Replying to my own post...

I've been experimenting with the TPM lately; I set TrustedGRUB aside, =20=

thinking it was buggy, and tried to write my own code to extend =20
LILO's first stage bootloader to hash the second stage -- I know =20
there's a project that did this already (http://enforcer.sf.net), but =20=

the project is abandoned, and the patch was against an old version of =20=

LILO which won't compile on a recent system.

I was able to verify that, when an INT 0x1A instruction is issued =20
with AH =3D 0xBB (the BIOS interface for some TPM calls), my =20
motherboard will simply reboot. Indeed, by removing all INT 0x1A =20
calls from TrustedGRUB, I was able to make it work, though without =20
TPM support, obviously. Interestingly, INT 1A with some other value =20
of AH is used for the system's real time clock, and there's a couple =20
of calls to this function somewhere in the middle of TrustedGRUB's =20
stage2; they're working fine (assuming they're being called at all) =20
and not rebooting the machine. Only when AH =3D 0xBB will the machine =20=

reboot.

Right now, I'm guessing the problem is that TPM calls via INT 0x1A =20
are not implemented by my mainboard's BIOS. It might be a faulty TPM =20
chip as well, though this is unlikely since it's working fine in =20
other contexts, as noted in the original post. I'd appreciate if =20
someone had any info on that, perhaps a troubleshooting suggestion or =20=

some crucial BIOS/jumper/whatever setting that I may have forgotten, =20
and I'd particularly like to hear from other owners of Intel D915GMH =20
motherboards, whether they were able or not to run TrustedGRUB.

Thanks

D=E9cio

On Jun 28, 2006, at 12:22 AM, D=E9cio Luiz Gazzoni Filho wrote:

> Hello,
>
> I realize this is probably a stupid question, but since Trusted =20
> GRUB's documentation is lacking (as far as I could spot, it's just =20
> a quick HOWTO in the README file and something similar in the shell =20=

> script for compiling the software), I don't even know where to =20
> start troubleshooting.
>
> I'll state upfront that I'm not familiar with GRUB, only lilo. =20
> Also, I'm using Gentoo Linux. I emerged (installed) plain GRUB and =20
> modified the sample config file and I had a working bootloader. =20
> Then I unmerged (uninstalled) plain GRUB and installed Trusted GRUB =20=

> following the instructions (copying the newly compiled stage1 and =20
> stage2, plus the `default' file, to /boot/grub). I cleaned up the =20
> old stage1_5 loaders left over from the plain GRUB installation. =20
> Having kept my working config file from plain GRUB, I ran the newly =20=

> installed grub-install and everything seemed to go smoothly. =20
> However, when trying to boot the computer, I can only see a brief =20
> flash of `tGRUB' on the screen before the computer reboots itself. =20
> I tried recompiling with the -DDEBUG flag but no debugging info was =20=

> printed -- probably it's failing at an early point in the boot =20
> process, perhaps still at stage 1.
>
> My hardware is an Intel D915GMH mainboard with Infineon 1.1b TPM =20
> chip. I'm using kernel 2.6.17 and the Infineon TPM drivers in the =20
> kernel. The TPM itself is fine -- I succesfully configured it in =20
> Windows and did a little bit of fiddling with TrouSerS, tpm-tools =20
> and the apps bundled with IBM's libtpm.
>
> Any help would be appreciated.
>
> D=E9cioUsing Tomcat but need to do more? Need to support web =20
> services, security?
> Get stuff done quickly with pre-integrated technology to make your =20
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache =20
> Geronimo
> http://sel.as-us.falkag.net/sel?=20
> cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D121642________________________=
______=20
> _________________
> Trustedgrub-users mailing list
> Tru...@li...
> https://lists.sourceforge.net/lists/listinfo/trustedgrub-users

[Trustedgrub-users] Newbie question

[<de...@de...>]

Hello,

I realize this is probably a stupid question, but since Trusted =20
GRUB's documentation is lacking (as far as I could spot, it's just a =20
quick HOWTO in the README file and something similar in the shell =20
script for compiling the software), I don't even know where to start =20
troubleshooting.

I'll state upfront that I'm not familiar with GRUB, only lilo. Also, =20
I'm using Gentoo Linux. I emerged (installed) plain GRUB and modified =20=

the sample config file and I had a working bootloader. Then I =20
unmerged (uninstalled) plain GRUB and installed Trusted GRUB =20
following the instructions (copying the newly compiled stage1 and =20
stage2, plus the `default' file, to /boot/grub). I cleaned up the old =20=

stage1_5 loaders left over from the plain GRUB installation. Having =20
kept my working config file from plain GRUB, I ran the newly =20
installed grub-install and everything seemed to go smoothly. However, =20=

when trying to boot the computer, I can only see a brief flash of =20
`tGRUB' on the screen before the computer reboots itself. I tried =20
recompiling with the -DDEBUG flag but no debugging info was printed =20
-- probably it's failing at an early point in the boot process, =20
perhaps still at stage 1.

My hardware is an Intel D915GMH mainboard with Infineon 1.1b TPM =20
chip. I'm using kernel 2.6.17 and the Infineon TPM drivers in the =20
kernel. The TPM itself is fine -- I succesfully configured it in =20
Windows and did a little bit of fiddling with TrouSerS, tpm-tools and =20=

the apps bundled with IBM's libtpm.

Any help would be appreciated.

D=E9cio=