/
githubmirror
/
shim
Обзор
Документация
Войти
/
githubmirror
/
shim
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
README.tpm
41 строка
2 KB
Thien Trung Vuong
README.tpm: Update MokList entry to MokListRT
18 мар 2025, 16:56
18 мар 2025, 16:56
28d8871
Код
Авторство
О чём код?
The following PCRs are extended by shim: PCR4: - the Authenticode hash of the binary being loaded will be extended into PCR4 before SB verification. - the hash of any binary for which Verify is called through the shim_lock protocol PCR7: - Any certificate in one of our certificate databases that matches a binary we try to load will be extended into PCR7. That includes: - DBX - the system denylist, logged as "dbx" - MokListX - the Mok denylist, logged as "MokListX" - vendor_dbx - shim's built-in vendor denylist, logged as "dbx" - DB - the system allowlist, logged as "db" - vendor_db - shim's built-in vendor allowlist, logged as "vendor_db" - MokListRT the runtime Mok allowlist, logged as "MokListRT" - vendor_cert - shim's built-in vendor allowlist, logged as "Shim" - shim_cert - shim's build-time generated allowlist, logged as "Shim" - MokSBState will be extended into PCR7 if it is set, logged as "MokSBState". - SBAT will be extended into PCR7 if it is set, logged as "SBAT" Note: In the past this document called out that vendor_db was logged as "db", when in fact the code didn't do that. Since changing the code risks breaking recorded logs, the documentation is update to reflect reality. vendor_dbx is in fact logged as "dbx". PCR8: - If you're using the grub2 TPM patchset we cary in Fedora, the kernel command line and all grub commands (including all of grub.cfg that gets run) are measured into PCR8. PCR9: - If you're using the grub2 TPM patchset we carry in Fedora, the kernel, initramfs, and any multiboot modules loaded are measured into PCR9. PCR14: - MokList, MokListX, and MokSBState will be extended into PCR14 if they are set.