Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Event processing when no access to vendor-table.json #768

Open
iadgovuser58 opened this issue May 6, 2024 · 0 comments
Open

Event processing when no access to vendor-table.json #768

iadgovuser58 opened this issue May 6, 2024 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@iadgovuser58
Copy link
Collaborator

iadgovuser58 commented May 6, 2024

When eventlog tool is run as user (such as in a command prompt without sudo, or in an IDE which is run as the user), the vendor-table.json file is not accessible, and so valid GUID lookups return "unknown GUID reference". In some cases the code needs this GUID reference to determine the next piece of code that executes. If the GUID is valid but the code thinks it is invalid, it will not process the next chunk of data properly.

Changes needed:

Part 1:

  • do not process code with an unknown SignatureType in EFI_SIGNATURE_TYPE
  • add output to indicate how many signature lists there are, and how many certs or hashes in each list

Part 2:

  • when grabbing the file vendor-table.json from /etc/hirs/aca/default-properties/vendor-table.json, if the file is not accessible, then grab the file from code: /HIRS_AttestationCA/src/main/resources/vendor-table.json
  • if the vendor-table.json is not accessible, print a msg noting this and warning that not all Secure Boot PCR 7 data will be processed
  • if the vendor-table.json from code was used, print a msg noting that the file was not found, and the code file was used

Note for testing purposes:
Typical file permissions for the path to vendor

  • /etc/ drwxr-xr-x.
  • /hirs/ drwxr-xr-x
  • /aca/ drwxr-x---
  • /default-properties/ drwxr-xr-x
  • vendor-table.json -rw-r--r--
    For testing purposes, to render the file vendor-table.json acessible to user, the permissions for /aca/ need to be changed from 750 to 751.
@iadgovuser58 iadgovuser58 added the enhancement New feature or request label May 6, 2024
@iadgovuser58 iadgovuser58 self-assigned this May 6, 2024
@iadgovuser58 iadgovuser58 changed the title Eventlog Tool root access Event processing when no access to vendor-table.json Part 1/2 May 9, 2024
@iadgovuser58 iadgovuser58 changed the title Event processing when no access to vendor-table.json Part 1/2 Event processing when no access to vendor-table.json May 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant