2

Where can I find the list of what each PCR "represents" in the TPM for a Linux OS? The official guide I found (https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf, section 3.3.4) has the following list:

PCR Usage table

These all seem to be about the boot process, such as UEFI, BIOS, boot loader, etc. (except maybe 6), nothing that is set based on the OS. Where can I find a list of the usage of PCRs 8-15 in Linux? i.e. what PCR would I use (if any) to verify that the kernel hasn't changed, or that init scripts haven't changed, or whatnot?

Baruch
  • 121
  • 2

1 Answers1

0

The tpm log will tell you what events went into the calculation of each PCR. These events roughly match the table in your question, but with a bit more detail, and some variation in linux.

The command to view the log is fwupdtpmevlog

According to documentation, the TPM event log is not secure and can be easily modified, but the PCR registers are secure, and you can verify matches between PCR values and values listed as calculated from things in the event log.

If I recall correctly, the system I check used 1-10 and 14, where 1-7 were bios specific, and 7-10 were generated by the linux boot process, and 14 looked like it was getting new events added to it after booting. The last two or three I think included (among other things) the entire grub config file, and the following one the kernel, initrd, and kernel command line arguments, and the specific grub entry that was used. (All of these were used, but I don't remember the exact combination or which register they were in.)

user10489
  • 1,217
  • 1
  • 3
  • 13