Incorrect SHA-1 hash calculation of ramdisk files

[Zepmann]

Incorrect SHA-1 hash calculation of ramdisk files

[neusdan]

First of all thanks for this detailed bug report. Thanks to this i could very quickly reproduce this bug. I'll look into it.

[Zepmann]

I found the culprit. The grub_TPM_measureFile function in tpm_kern.c uses GRUB's grub_file_open function (from file.c) , which pre-processes compressed files (such as initramfs files) by decompressing them into memory before returning them. Therefore, grub_TPM_measureFile (used by GRUB commands measure, initrd, etc.) does not measure the file on the disk (as would be expected), but the decompressed data in memory. This does not affect non-compressed files, since they are not modified by GRUB when they are loaded into memory.

The attached patch has one possible solution. It adds a grub_file_open_nofilter function to file.c, which is called by grub_TPM_measureFile in tpm_kern.c (instead of grub_file_open). grub_file_open_nofilter is a copy of grub_file_open with the filter code removed. Therefore, it opens a file 'raw' into the memory. The result is as expected: the correct SHA-1 hash is now calculated over compresed (and other) files.

tgrub-1.2.1-nofilefilter.patch.zip

To apply the patch (assuming that TrustedGRUB2 is already installed):
First make sure that the debug option for TPM operations is enabled in tpm.h, so the calculated SHA-1 hashes are visible during boot. Start from the TrustedGRUB2 source code directory.

Apply and install the patch:

patch -p1 < tgrub-1.2.1-nofilefilter.patch
make clean
make
make install

Install the patched TrustedGRUB2 to the MBR. Make sure that the device (/dev/sda in the example below) is correct.

grub-install --recheck --target=i386-pc --directory=/usr/lib/grub/i386-pc --no-rs-codes /dev/sda

Reboot, and you will see that SHA-1 checksums for initramfs and other compressed files are now correctly calculated.

[neusdan]

Thanks a lot for reporting and fixing this!

I would like to see more such well written issue reports on GitHub 👍

[neusdan]

found a simpler solution to fix this