Skip to content

Commit b84dee8

Browse files
flowzone-app[bot]flowzone-app[bot]
authored
v5.3.15
1 parent 3a89749 commit b84dee8

File tree

3 files changed

+249
-1
lines changed

3 files changed

+249
-1
lines changed

‎.versionbot/CHANGELOG.yml

+230
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,233 @@
1+
- commits:
2+
- subject: Update layers/meta-balena to 8352e3480e96f4503361752cfe72aca9622250a3
3+
hash: 4755880de6f929fdeb9f5b28ff4e75ef60aa80d3
4+
body: Update layers/meta-balena
5+
footer:
6+
Changelog-entry: Update layers/meta-balena to 8352e3480e96f4503361752cfe72aca9622250a3
7+
changelog-entry: Update layers/meta-balena to 8352e3480e96f4503361752cfe72aca9622250a3
8+
author: Self-hosted Renovate Bot
9+
nested:
10+
- commits:
11+
- subject: "os-helpers-tpm2: fix empty efivar reads"
12+
hash: 3f9d048f964f922c9bfaeee4939197cb31c8eef6
13+
body: >
14+
When reading from efi variables in hostapp-update hooks during
15+
rollback,
16+
17+
tcgtool will improperly read zero bytes from efivar files. This
18+
results
19+
20+
in an improper calculation of the PCR 7 digest, and an
21+
unbootable
22+
23+
system.
24+
25+
26+
Read the file contents, skipping the first four bytes that are
27+
28+
attributes, and pipe the data directly to tcgtool to work around
29+
this.
30+
footer:
31+
Change-type: patch
32+
change-type: patch
33+
Signed-off-by: Joseph Kogut <[email protected]>
34+
signed-off-by: Joseph Kogut <[email protected]>
35+
author: Joseph Kogut
36+
nested: []
37+
- subject: "rollback-health: bind mount EFI partition in old_rootfs"
38+
hash: 8761c1d6536d86249757f37925ae40d905716cc3
39+
body: >
40+
Some hooks, such as 0-signed-update, will attempt to read files
41+
from the
42+
43+
EFI system partition, such as combined policy binaries.
44+
45+
46+
Bind mount the EFI partition into old_rootfs before running
47+
hooks to
48+
49+
ensure this is available.
50+
footer:
51+
Change-type: patch
52+
change-type: patch
53+
Signed-off-by: Joseph Kogut <[email protected]>
54+
signed-off-by: Joseph Kogut <[email protected]>
55+
author: Joseph Kogut
56+
nested: []
57+
- subject: "rollback-health: mount securityfs in old_rootfs"
58+
hash: e87838103af3c5ee05c60b7105353f987af47e61
59+
body: >
60+
When rollback-health runs, a failing healthcheck causes the
61+
62+
hostapp-update hooks to be run from the inactive partition, to
63+
make the
64+
65+
inactive system bootable again.
66+
67+
68+
The 0-signed-update hook, which updates the sealing policy for
69+
secure
70+
71+
boot enabled systems, reads from the securityfs mounted at
72+
73+
/sys/kernel/security in order to parse the TPM event log.
74+
75+
76+
If this filesystem isn't mounted, the hook will improperly
77+
detect that
78+
79+
the TPM event log isn't available, and unneccessarily create a
80+
combined
81+
82+
policy when a single PCR policy would suffice.
83+
84+
85+
Mount this filesystem in old_rootfs before chrooting to fix
86+
this.
87+
footer:
88+
Change-type: patch
89+
change-type: patch
90+
Signed-off-by: Joseph Kogut <[email protected]>
91+
signed-off-by: Joseph Kogut <[email protected]>
92+
author: Joseph Kogut
93+
nested: []
94+
- subject: "os-helpers-tpm2: compute_pcr7 w/ events post separator"
95+
hash: e4f8f6f9c79f994f873bc930bfa028f2161a29d9
96+
body: >
97+
In commit 1c19ebb, we append digests from the TPM event log
98+
99+
corresponding to events that are logged before EV_SEPARATOR. For
100+
101+
instance, parsing the event log on a typical system for event
102+
types, the
103+
104+
output looks like this:
105+
106+
107+
EV_EFI_VARIABLE_DRIVER_CONFIG (SecureBoot)
108+
109+
EV_EFI_VARIABLE_DRIVER_CONFIG (PK)
110+
111+
EV_EFI_VARIABLE_DRIVER_CONFIG (KEK)
112+
113+
EV_EFI_VARIABLE_DRIVER_CONFIG (db)
114+
115+
EV_EFI_VARIABLE_DRIVER_CONFIG (dbx)
116+
117+
EV_SEPARATOR
118+
119+
120+
This system requires no merging of event log digests.
121+
122+
123+
On systems that measure EFI binaries (mostly only QEMU w/ edk2),
124+
we also
125+
126+
get this:
127+
128+
129+
EV_EFI_VARIABLE_DRIVER_CONFIG (SecureBoot)
130+
131+
EV_EFI_VARIABLE_DRIVER_CONFIG (PK)
132+
133+
EV_EFI_VARIABLE_DRIVER_CONFIG (KEK)
134+
135+
EV_EFI_VARIABLE_DRIVER_CONFIG (db)
136+
137+
EV_EFI_VARIABLE_DRIVER_CONFIG (dbx)
138+
139+
EV_SEPARATOR
140+
141+
EV_EFI_VARIABLE_AUTHORITY (bootx64.efi)
142+
143+
EV_EFI_VARIABLE_AUTHORITY (bzImage)
144+
145+
146+
Again, this requires no merging. We compute the signature of the
147+
148+
relevant EFI binaries ourselves, as they're subject to change
149+
during
150+
151+
hostapp-update.
152+
153+
154+
However, we've also seen event logs like this:
155+
156+
157+
EV_EFI_VARIABLE_DRIVER_CONFIG (SecureBoot)
158+
159+
EV_EFI_VARIABLE_DRIVER_CONFIG (PK)
160+
161+
EV_EFI_VARIABLE_DRIVER_CONFIG (KEK)
162+
163+
EV_EFI_VARIABLE_DRIVER_CONFIG (db)
164+
165+
EV_EFI_VARIABLE_DRIVER_CONFIG (dbx)
166+
167+
EV_EFI_ACTION (DMA Protection Disabled)
168+
169+
EV_SEPARATOR
170+
171+
172+
This case is the one we've handled previously, by reading from
173+
the event
174+
175+
log and appending event digests before EV_SEPARATOR. We stopped
176+
at
177+
178+
EV_SEPARATOR because we weren't parsing event types previously,
179+
and this
180+
181+
digest is a constant that's easily recognized. However, we've
182+
since
183+
184+
encountered systems that have unexpected events *after*
185+
EV_SEPARATOR, as
186+
187+
shown below.
188+
189+
190+
EV_EFI_VARIABLE_DRIVER_CONFIG (SecureBoot)
191+
192+
EV_EFI_VARIABLE_DRIVER_CONFIG (PK)
193+
194+
EV_EFI_VARIABLE_DRIVER_CONFIG (KEK)
195+
196+
EV_EFI_VARIABLE_DRIVER_CONFIG (db)
197+
198+
EV_EFI_VARIABLE_DRIVER_CONFIG (dbx)
199+
200+
EV_SEPARATOR
201+
202+
Unknown event type (?!)
203+
204+
205+
In order to handle this, parse digests and event types into
206+
temporary
207+
208+
files and iterate through them together. We only stop appending
209+
digests
210+
211+
from the event log when the next event type is
212+
EV_EFI_VARIABLE_AUTHORITY
213+
214+
(EFI binary signature) or we hit the end of the list. This
215+
should
216+
217+
account for all possible variations.
218+
footer:
219+
Change-type: patch
220+
change-type: patch
221+
Signed-off-by: Joseph Kogut <[email protected]>
222+
signed-off-by: Joseph Kogut <[email protected]>
223+
author: Joseph Kogut
224+
nested: []
225+
version: meta-balena-5.3.15
226+
title: ""
227+
date: 2024-06-05T00:15:59.506Z
228+
version: 5.3.15
229+
title: ""
230+
date: 2024-06-05T04:36:04.969Z
1231
- commits:
2232
- subject: Update layers/meta-balena to 9e95be489587395fec796dc6969fc7d78cf81f77
3233
hash: b4458fb7118bc81a98e2a29f24ce0cc6bb058fe3

‎CHANGELOG.md

+18
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,24 @@
22

33
All notable changes to this project will be documented in this file
44

5+
# v5.3.15
6+
## (2024-06-05)
7+
8+
9+
<details>
10+
<summary> Update layers/meta-balena to 8352e3480e96f4503361752cfe72aca9622250a3 [Self-hosted Renovate Bot] </summary>
11+
12+
> ## meta-balena-5.3.15
13+
> ### (2024-06-05)
14+
>
15+
> * os-helpers-tpm2: fix empty efivar reads [Joseph Kogut]
16+
> * rollback-health: bind mount EFI partition in old_rootfs [Joseph Kogut]
17+
> * rollback-health: mount securityfs in old_rootfs [Joseph Kogut]
18+
> * os-helpers-tpm2: compute_pcr7 w/ events post separator [Joseph Kogut]
19+
>
20+
21+
</details>
22+
523
# v5.3.14
624
## (2024-06-02)
725

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.3.14
1+
5.3.15

0 commit comments

Comments
 (0)