Skip to content

Commit b096b00

Browse files
flowzone-app[bot]flowzone-app[bot]
authored
v5.2.3
1 parent 9adeaeb commit b096b00

File tree

3 files changed

+376
-1
lines changed

3 files changed

+376
-1
lines changed

‎.versionbot/CHANGELOG.yml

+347
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,350 @@
1+
- commits:
2+
- subject: Update layers/meta-balena to 90d838ae943ffa72108522bfcc4370105a3be40c
3+
hash: 677757980fc2453660258e6a47a6d261556ba1e3
4+
body: Update layers/meta-balena
5+
footer:
6+
Changelog-entry: Update layers/meta-balena to 90d838ae943ffa72108522bfcc4370105a3be40c
7+
changelog-entry: Update layers/meta-balena to 90d838ae943ffa72108522bfcc4370105a3be40c
8+
author: Self-hosted Renovate Bot
9+
nested:
10+
- commits:
11+
- subject: mv docs/{,uefi-}secure-boot.md
12+
hash: 18e35c55cb486d93aadc43df1f5e0db0ef840c03
13+
body: ""
14+
footer:
15+
Change-type: patch
16+
change-type: patch
17+
Signed-off-by: Joseph Kogut <joseph@balena.io>
18+
signed-off-by: Joseph Kogut <joseph@balena.io>
19+
author: Joseph Kogut
20+
nested: []
21+
- subject: "docs: secure-boot: update for PCR7 sealing"
22+
hash: e3c6131e6979390292c72e5e18c96d83165096fe
23+
body: >
24+
Update secure boot docs to reflect changes made for PCR7
25+
sealing,
26+
27+
including:
28+
29+
30+
* No first boot needed anymore to reach secure state
31+
32+
* PCR roles
33+
footer:
34+
Change-type: patch
35+
change-type: patch
36+
Signed-off-by: Joseph Kogut <joseph@balena.io>
37+
signed-off-by: Joseph Kogut <joseph@balena.io>
38+
author: Joseph Kogut
39+
nested: []
40+
- subject: "os-helpers: compute_pcr7: merge event log digests"
41+
hash: e10d67084621e5ce10f14557f2466e91ff684b41
42+
body: >
43+
The main variables measured into PCR7 to ensure secure boot
44+
45+
configuration integrity are the state and EFI vars, including
46+
PK, KEK,
47+
48+
db, dbx, etc.
49+
50+
51+
However, some systems have firmware that will measure other,
52+
unexpected
53+
54+
events, such as "DMA Protection Disabled" (related to a Windows
55+
feature
56+
57+
[0]), or "Unknown event type" with strange data.
58+
59+
60+
These events can't be predicted, and other devices may have
61+
different
62+
63+
measured events that aren't compliant with the TCG spec, so
64+
attempt to
65+
66+
check the TPM event log and extend our digest with any unknown
67+
events
68+
69+
that fit the bill.
70+
71+
72+
[0]
73+
https://learn.microsoft.com/en-us/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt
74+
footer:
75+
Change-type: patch
76+
change-type: patch
77+
Signed-off-by: Joseph Kogut <joseph@balena.io>
78+
signed-off-by: Joseph Kogut <joseph@balena.io>
79+
author: Joseph Kogut
80+
nested: []
81+
- subject: Update policy's PCR7 value in hostapp-update hook
82+
hash: f05deea2cd1003e186fa7756eecf8f113db26a7f
83+
body: >
84+
When performing a hostapp-update, we may touch file and efivars
85+
that are
86+
87+
measured into PCR7. Re-generate the predicted value and reseal
88+
the LUKS
89+
90+
passphrase using this new digest.
91+
footer:
92+
Change-type: patch
93+
change-type: patch
94+
Signed-off-by: Joseph Kogut <joseph@balena.io>
95+
signed-off-by: Joseph Kogut <joseph@balena.io>
96+
author: Joseph Kogut
97+
nested: []
98+
- subject: "os-helpers-tpm2: compute_pcr7: allow overriding efivars"
99+
hash: 3e0911a5c4317ea4b9ca03a7816ce600e5b202c5
100+
body: >
101+
When computing the digest of PCR7, it may be necessary to
102+
override the
103+
104+
input variables used, in order to predict the value on the next
105+
boot.
106+
107+
Allow these inputs to be overridden using function parameters.
108+
footer:
109+
Change-type: patch
110+
change-type: patch
111+
Signed-off-by: Joseph Kogut <joseph@balena.io>
112+
signed-off-by: Joseph Kogut <joseph@balena.io>
113+
author: Joseph Kogut
114+
nested: []
115+
- subject: Move policy update to HUP commit hook
116+
hash: 80f9bd84de394aa728ed802a2d4c02f3a87f370b
117+
body: >
118+
When migrating the TPM2 policy used to secure the LUKS
119+
passphrase to use
120+
121+
different PCRs, we temporarily want to maintain fallback
122+
capability in
123+
124+
case the newly installed hostapp doesn't pass healthchecks. This
125+
allows
126+
127+
the system to boot back into the original OS and try again.
128+
129+
130+
In order to do so, we leave the passphrase in place with the old
131+
PCR
132+
133+
authentication policy. The cryptsetup hook in the initramfs will
134+
try
135+
136+
PCRs 0,2,3,7 and if those don't work we fallback to the original
137+
PCRs.
138+
139+
140+
Once the new system successfully boots, we'll re-encrypt the
141+
passphrase
142+
143+
and use the new PCRs to create a policy to secure the key.
144+
footer:
145+
Change-type: patch
146+
change-type: patch
147+
Signed-off-by: Joseph Kogut <joseph@balena.io>
148+
signed-off-by: Joseph Kogut <joseph@balena.io>
149+
author: Joseph Kogut
150+
nested: []
151+
- subject: "rollback-health: move apply-dbx to HUP commit hook"
152+
hash: 3d78d26366b284313ea718adb8d5498ac4f27e1f
153+
body: >
154+
This operation is done after rollback-health completes and the
155+
new OS is
156+
157+
running to ensure the OS is healthy before appending to the
158+
forbidden
159+
160+
signatures list.
161+
162+
163+
Move this out of rollback-health and into a HUP commit hook,
164+
which
165+
166+
allows it to be excluded from OS images that don't use EFI or
167+
support
168+
169+
secure boot.
170+
footer:
171+
Change-type: patch
172+
change-type: patch
173+
Signed-off-by: Joseph Kogut <joseph@balena.io>
174+
signed-off-by: Joseph Kogut <joseph@balena.io>
175+
author: Joseph Kogut
176+
nested: []
177+
- subject: "hostapp-hooks: include 0-signed-update only for efi"
178+
hash: 328222014146f0116e0208443f3e255d0e85ef15
179+
body: >
180+
This hook is only applicable for EFI machines. Include it in the
181+
build
182+
183+
only when MACHINE_FEATURES includes EFI.
184+
footer:
185+
Change-type: patch
186+
change-type: patch
187+
Signed-off-by: Joseph Kogut <joseph@balena.io>
188+
signed-off-by: Joseph Kogut <joseph@balena.io>
189+
author: Joseph Kogut
190+
nested: []
191+
- subject: "secure boot: seal luks passphrase w/ PCR7"
192+
hash: 86460d1fa00e40caa1e3edd3ebed5d2098dafe31
193+
body: ""
194+
footer:
195+
Change-type: patch
196+
change-type: patch
197+
Signed-off-by: Joseph Kogut <joseph@balena.io>
198+
signed-off-by: Joseph Kogut <joseph@balena.io>
199+
author: Joseph Kogut
200+
nested: []
201+
- subject: "os-helpers-tpm2: separate authentication from crypto"
202+
hash: 6a4e3cd2f48dc7e48acc35f04200317397d6d0b1
203+
body: >
204+
When encrypting the LUKS passphrase, we need the ability to
205+
construct a
206+
207+
policy that can logically OR together multiple policies, such as
208+
when
209+
210+
the machine may or may not measure binaries loaded through EFI
211+
boot
212+
213+
services into PCR7.
214+
215+
216+
We also need the ability to update the sealing policy to revoke
217+
218+
previously valid configurations, such as after
219+
hostapp-healthcheck
220+
221+
completes successfully. Ideally, this should be completed before
222+
223+
modifying any efi variables, to prevent the system from becoming
224+
225+
unbootable in the event of an interrupted update.
226+
227+
228+
These requirements necessitate the ability to create sealing
229+
policies
230+
231+
and authenticate against them outside of the
232+
hw_{en,de}crypt_passphrase
233+
234+
functions.
235+
236+
237+
This commit allows the caller to setup the sealing policy when
238+
239+
encrypting, and choose what kind of authentication to use when
240+
241+
decrypting.
242+
footer:
243+
Change-type: patch
244+
change-type: patch
245+
Signed-off-by: Joseph Kogut <joseph@balena.io>
246+
signed-off-by: Joseph Kogut <joseph@balena.io>
247+
author: Joseph Kogut
248+
nested: []
249+
- subject: "tcgtool: new recipe"
250+
hash: 5217a6c8e8599f18ef84d319fb41049c476be265
251+
body: >
252+
Create recipe for tcgtool, a program that replicates the
253+
structures used
254+
255+
to represent data measured and hashed to extend TPM PCRs.
256+
257+
258+
This is useful to compute a PCR hash at runtime, which is
259+
normally
260+
261+
computed by the firmware before the OS boots. This allows for
262+
adjusting
263+
264+
a TPM2 policy to unlock the disk encryption passphrase with the
265+
updated
266+
267+
state on the next boot.
268+
footer:
269+
Change-type: patch
270+
change-type: patch
271+
Signed-off-by: Joseph Kogut <joseph@balena.io>
272+
signed-off-by: Joseph Kogut <joseph@balena.io>
273+
author: Joseph Kogut
274+
nested: []
275+
- subject: "recipes-bsp: add recipe for GRUB 2.12"
276+
hash: 27808e2da6740bcd17d435aa15d644fef7b2b69c
277+
body: >
278+
This version changes how kernel images are booted, passing them
279+
to the EFI
280+
281+
boot services LoadImage method, which uses EFISTUB and retains
282+
the TPM
283+
284+
event log in memory.
285+
286+
287+
Copy this recipe from Poky rev 43f9098. This may be removed once
288+
Poky is
289+
290+
bumped to Scarthgap (5.0).
291+
292+
293+
More info: https://edk2.groups.io/g/devel/topic/93730585
294+
footer:
295+
Change-type: patch
296+
change-type: patch
297+
Signed-off-by: Joseph Kogut <joseph@balena.io>
298+
signed-off-by: Joseph Kogut <joseph@balena.io>
299+
author: Joseph Kogut
300+
nested: []
301+
- subject: "tests: skip bootloader config integrity check"
302+
hash: ad70f51fcc899dd3ec521c280c0a074302f7498f
303+
body: >
304+
GRUB 2.12 no longer outputs the escape codes the previous
305+
version did.
306+
307+
Skip this test until we can patch the bootloader to output a
308+
string we
309+
310+
can match against.
311+
footer:
312+
Change-type: patch
313+
change-type: patch
314+
Signed-off-by: Joseph Kogut <joseph@balena.io>
315+
signed-off-by: Joseph Kogut <joseph@balena.io>
316+
author: Joseph Kogut
317+
nested: []
318+
- subject: "secureboot: enroll kernel hash in db for EFISTUB"
319+
hash: 45fe30fcc01bb2f3c423c11e2ea244546da30d57
320+
body: >
321+
Generate hash for second stage bootloader and enroll in db
322+
efivar to
323+
324+
allow the firmware to verify the image for booting when using
325+
EFISTUB.
326+
327+
328+
This is necessary to update to GRUB 2.12, which passes the EFI
329+
image to
330+
331+
the EFI boot services LoadImage method, which then validates the
332+
image
333+
334+
when secure boot is enabled.
335+
footer:
336+
Change-type: patch
337+
change-type: patch
338+
Signed-off-by: Joseph Kogut <joseph@balena.io>
339+
signed-off-by: Joseph Kogut <joseph@balena.io>
340+
author: Joseph Kogut
341+
nested: []
342+
version: meta-balena-5.2.3
343+
title: ""
344+
date: 2024-03-22T08:48:01.071Z
345+
version: 5.2.3
346+
title: ""
347+
date: 2024-03-22T10:26:00.680Z
1348
- commits:
2349
- subject: Update contracts to 2de35264348458938cf5c85c28660a58a1e8066a
3350
hash: 94d0ed9119f4f37fa106caff3986f66fde4f63ea

‎CHANGELOG.md

+28
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,34 @@
22

33
All notable changes to this project will be documented in this file
44

5+
# v5.2.3
6+
## (2024-03-22)
7+
8+
9+
<details>
10+
<summary> Update layers/meta-balena to 90d838ae943ffa72108522bfcc4370105a3be40c [Self-hosted Renovate Bot] </summary>
11+
12+
> ## meta-balena-5.2.3
13+
> ### (2024-03-22)
14+
>
15+
> * mv docs/{,uefi-}secure-boot.md [Joseph Kogut]
16+
> * docs: secure-boot: update for PCR7 sealing [Joseph Kogut]
17+
> * os-helpers: compute_pcr7: merge event log digests [Joseph Kogut]
18+
> * Update policy's PCR7 value in hostapp-update hook [Joseph Kogut]
19+
> * os-helpers-tpm2: compute_pcr7: allow overriding efivars [Joseph Kogut]
20+
> * Move policy update to HUP commit hook [Joseph Kogut]
21+
> * rollback-health: move apply-dbx to HUP commit hook [Joseph Kogut]
22+
> * hostapp-hooks: include 0-signed-update only for efi [Joseph Kogut]
23+
> * secure boot: seal luks passphrase w/ PCR7 [Joseph Kogut]
24+
> * os-helpers-tpm2: separate authentication from crypto [Joseph Kogut]
25+
> * tcgtool: new recipe [Joseph Kogut]
26+
> * recipes-bsp: add recipe for GRUB 2.12 [Joseph Kogut]
27+
> * tests: skip bootloader config integrity check [Joseph Kogut]
28+
> * secureboot: enroll kernel hash in db for EFISTUB [Joseph Kogut]
29+
>
30+
31+
</details>
32+
533
# v5.2.2+rev1
634
## (2024-03-21)
735

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.2.2+rev1
1+
5.2.3

0 commit comments

Comments
 (0)