Bug 1754906

Summary:	Disabling TPM measurements & usage
Product:	Red Hat Enterprise Linux 8	Reporter:	Marc-Andre Lureau <marcandre.lureau>
Component:	grub2	Assignee:	Bootloader engineering team <bootloader-eng-team>
Status:	CLOSED NOTABUG	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.1	CC:	javierm, lersek, pjones, sbarcomb
Target Milestone:	rc
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-08 13:49:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1734505

Description Marc-Andre Lureau 2019-09-24 10:55:00 UTC

RHEL8 grub2 does TPM measurement, and will update TPM PCR 8 & 9 registers.

In bug 1734505, the customer is trying to pass through a TPM device to QEMU Windows VM with bitlocker.

Unfortunately, bitlocker requires a set of PCR registers to be untouched/0 during boot (even though the group policy settings allows to uncheck those PCR for sealing).

The current solution so far is to use a custom grub build with TPM support removed.

Could this be an install-time or mkconfig option instead? (What are the security implications?)

What would be the support for a custom-build grub with TPM measurements removed?

Is there other solutions?

thanks

Comment 1 Peter Jones 2020-01-21 17:18:41 UTC

Fundamentally here, the issue is that in the TCG TPM implementation specs, PCRs 8-15 are "Defined for use by the Static OS", and Linux and Windows have, reasonably, chosen different things to use them for.  This makes using TPM passthrough challenging.

Regarding grub's usage specifically, we're using 8 and 9 to measure the bootloader configuration and kernel command line (8), and the kernel and initramfs being booted (9).  Because this is boot information, and we're merely creating records for something to use later, it's not like the BitLocker use case, but rather the same reason bootmgr is still extending them[0] even if you change the group policy for BitLocker. we definitely can't make changing them be an install-time or configuration option - that creates several bad scenarios:

1) anything that has hard-coded the PCR they're sealing against accidentally seals against an uninitialized PCR
2) anything that doesn't have them hard-coded now has to look up which ones to seal against, which creates a race condition where an attacker can cause the producer and consumer to believe different sets of PCRs are in use.  This potentially leads to encrypting with an attacker's key, or doing attestation with a PCR that only the attacker has ever extended anything into.

Making this configurable either at runtime or during the build opens you up to these problems if the attacker is present in the right time frame during initial provisioning or any recovery procedure, and we can't change that for just one customer who needs it; it poisons the well for everyone.  That said, IMA using PCR 10 is configurable at kernel build time, so possibly that is more flexible[1], but I don't think there's a reasonable way to get around 8 and 9 being used for cross purposes by each OS.

I really think the only answer here is to use swtpm to provide the guest TPM, and use IMA and/or LUKS to secure the swtpm data, instead of trying to do pass-through.

[0] as noted here: https://bugzilla.redhat.com/show_bug.cgi?id=1734505#c51
[1] Incidentally, I'm still not sure why PCR 12 is changing in https://bugzilla.redhat.com/show_bug.cgi?id=1734505#c41 , especially as https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings makes no mention of it.