From ee48f8f61ebf09c8da09e02f71d3af10da14c31c Mon Sep 17 00:00:00 2001 From: Thierry Laurion Date: Mon, 7 Sep 2026 15:43:42 -0400 Subject: [PATCH 1/3] doc: fix PCR table and stale comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extends wiki iteration-1 (linuxboot/heads-wiki#246) to doc/tpm.md. - PCR 16: change from 'scratch use only' to accurate history — was scratch PCR on TPM1 (PCR 23 on TPM2) in old calcfuturepcr; now unused after rewrite to replay from cbmem -L event log - kexec-seal-key.sh:274: fix stale comment that referenced PCR 16 — the code calls qubes-measure-luks.sh which extends PCR 6, not PCR 16 Signed-off-by: Thierry Laurion --- doc/security-model.md | 8 -------- doc/tpm.md | 2 +- initrd/bin/kexec-seal-key.sh | 6 ++---- 3 files changed, 3 insertions(+), 13 deletions(-) diff --git a/doc/security-model.md b/doc/security-model.md index 5979db53c..97e9f9026 100644 --- a/doc/security-model.md +++ b/doc/security-model.md @@ -408,14 +408,6 @@ creating additional hardware binding: │ │ Includes: PCR 5, PCR 6 → More restrictive │ │ │ │ → Changing kernel modules or LUKS headers requires resealing DUK │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ -│ │ -│ ┌─────────────────────────────────────────────────────────────────────┐ │ -│ │ PCR 16 (Scratch) │ │ -│ │ │ │ -│ │ Used internally for calcfuturepcr (pre-computing future values) │ │ -│ │ Not part of any sealing policy - purely for calculation │ │ -│ └─────────────────────────────────────────────────────────────────────┘ │ -│ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` diff --git a/doc/tpm.md b/doc/tpm.md index 8cecfb55b..4f36ce3a3 100644 --- a/doc/tpm.md +++ b/doc/tpm.md @@ -164,7 +164,7 @@ unchanged; the TXT mechanism adds the DRTM capability on top of it. | 5 | Heads `insmod` wrapper | Each loaded kernel module: parameters + binary content (default `MODULE_PCR=5`) | | 6 | Heads `qubes-measure-luks.sh` | LUKS header dump for each encrypted drive | | 7 | Heads `cbfs-init.sh`, `uefi-init.sh` | Each CBFS/UEFI file: filename then content (default `CONFIG_PCR=7`) — covers `config.user`, GPG keyring, user CBFS files | -| 16 | `tpmr.sh calcfuturepcr` (scratch use only) | Resettable debug PCR used as scratch pad during pre-computation of future PCR values; not part of any sealing policy | +| 16 | unused | Historically used as scratch PCR by `calcfuturepcr` on TPM1 (TPM2 used PCR 23); now unused — [#1428](https://github.com/linuxboot/heads/pull/1428) rewrote `calcfuturepcr` to replay from `cbmem -L` event log instead of extending a physical PCR | PCRs 0-3 are read at seal time and included in sealing policies. The zero state of PCRs 0, 1, and 3 is intentional — any unexpected extension of those diff --git a/initrd/bin/kexec-seal-key.sh b/initrd/bin/kexec-seal-key.sh index 9c2674b8d..ce19c3e33 100755 --- a/initrd/bin/kexec-seal-key.sh +++ b/initrd/bin/kexec-seal-key.sh @@ -269,10 +269,8 @@ for dev in $key_devices; do STATUS_OK "$dev: LUKS TPM Disk Unlock Key added to slot $duk_keyslot" done -# Now that we have setup the new keys, measure the PCRs -# We don't care what ends up in PCR 6; we just want -# to get the /tmp/luksDump.txt file. We use PCR16 -# since it should still be zero +# Now that we have setup the new keys, measure the LUKS headers into PCR 6. +# The dump goes to /tmp/luksDump.txt for calcfuturepcr to use as input. STATUS "Measuring TPM Disk Unlock Key (DUK) for sealing policy (PCR[6])" echo "$key_devices" | xargs /bin/qubes-measure-luks.sh || DIE "Unable to measure the LUKS headers" From a4c25a63d676c5f3cfa1110de8326a02a8de8d6c Mon Sep 17 00:00:00 2001 From: Thierry Laurion Date: Mon, 7 Sep 2026 20:32:28 -0400 Subject: [PATCH 2/3] doc: remove unused PCR 16 box from security model MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extends wiki iteration-1 (linuxboot/heads-wiki#246) to doc/tpm.md. - PCR 16: removed from security-model.md diagram — unused, not relevant to the security model - kexec-seal-key.sh:274: fix stale comment that referenced PCR 16 — the code calls qubes-measure-luks.sh which extends PCR 6, not PCR 16 Signed-off-by: Thierry Laurion --- doc/security-model.md | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/security-model.md b/doc/security-model.md index 97e9f9026..d09d05472 100644 --- a/doc/security-model.md +++ b/doc/security-model.md @@ -408,6 +408,7 @@ creating additional hardware binding: │ │ Includes: PCR 5, PCR 6 → More restrictive │ │ │ │ → Changing kernel modules or LUKS headers requires resealing DUK │ │ │ └─────────────────────────────────────────────────────────────────────┘ │ +│ │ └─────────────────────────────────────────────────────────────────────────────┘ ``` From e2ea4da0c935e3b51f39a1381dc58a88a6395997 Mon Sep 17 00:00:00 2001 From: Thierry Laurion Date: Mon, 7 Sep 2026 22:19:54 -0400 Subject: [PATCH 3/3] =?UTF-8?q?doc:=20remove=20PCR=2016=20references=20?= =?UTF-8?q?=E2=80=94=20unused=20since=20#1428?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PCR 16 was historically used as scratch space by calcfuturepcr on TPM1 (PCR 23 on TPM2). PR #1428 rewrote calcfuturepcr to replay from cbmem -L event log, eliminating the need for any scratch PCR. Remove all PCR 16 references: - doc/tpm.md: remove PCR 16 row from PCR table - doc/security-model.md: remove PCR 16 (Scratch) box from diagram - kexec-seal-key.sh: fix stale comment referencing PCR16 Signed-off-by: Thierry Laurion --- doc/tpm.md | 1 - 1 file changed, 1 deletion(-) diff --git a/doc/tpm.md b/doc/tpm.md index 4f36ce3a3..8cc2ccf77 100644 --- a/doc/tpm.md +++ b/doc/tpm.md @@ -164,7 +164,6 @@ unchanged; the TXT mechanism adds the DRTM capability on top of it. | 5 | Heads `insmod` wrapper | Each loaded kernel module: parameters + binary content (default `MODULE_PCR=5`) | | 6 | Heads `qubes-measure-luks.sh` | LUKS header dump for each encrypted drive | | 7 | Heads `cbfs-init.sh`, `uefi-init.sh` | Each CBFS/UEFI file: filename then content (default `CONFIG_PCR=7`) — covers `config.user`, GPG keyring, user CBFS files | -| 16 | unused | Historically used as scratch PCR by `calcfuturepcr` on TPM1 (TPM2 used PCR 23); now unused — [#1428](https://github.com/linuxboot/heads/pull/1428) rewrote `calcfuturepcr` to replay from `cbmem -L` event log instead of extending a physical PCR | PCRs 0-3 are read at seal time and included in sealing policies. The zero state of PCRs 0, 1, and 3 is intentional — any unexpected extension of those