sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

Browse Source 
The Dell 820 kept "finding a cert" and bypassing enrolment despite repeated BIOS
TPM clears. tpm2_nvreadpublic revealed 0x01800001 on that hardware is a FIRMWARE
platform index (platformcreate|policydelete|writelocked, 70 bytes — not our
cert; siblings at 0x01800003/4 + 0x01810000). platformcreate survives TPM2_Clear
and policydelete needs the platform's secret policy, so it's permanent and
unusable by us — the blind check false-positived on it, and enrolment could
never write there anyway. Same class of bug as the EK-handle collision.

Move the NV cert index default 0x01800001 -> 0x01800100 (free on the 820, owner
range, overridable via rd.dot1x.nvindex): cmdline (extract-artifacts.sh),
fleet-enrol -nvindex, the dracut hooks, bench scripts, CLAUDE.md invariant #1,
and design/SSP docs. The signing-key handle (0x81000100) is unchanged.

Harden WriteNVCert: refuse a platformcreate index with a clear "pick a free
owner index via rd.dot1x.nvindex" error instead of a confusing undefine
failure. Regression simtest/TestWriteNVCertRefusesPlatformIndex; NV roundtrip +
ReadNVCert tests moved to 0x01800100. All go tests + packer validate pass.
This commit is contained in:
Audiobuzz
2026-07-03 02:51:38 +00:00
parent 33de300af8
commit 6fe623c727
16 changed files with 97 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+1 -1
View File
@@ -31,7 +31,7 @@ if [ -z "$NIC" ]; then
NIC=$_name; break
done
fi
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800100
TIMEOUT=$(getarg rd.dot1x.timeout=); [ -n "$TIMEOUT" ] || TIMEOUT=60
info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
files/dracut/95dot1x-macsec/tpm-enrol.sh
+2 -2
View File
@@ -2,7 +2,7 @@
# tpm-enrol.sh — initqueue/settled hook, runs BEFORE dot1x-macsec-up.sh.
#
# INLINE empty-NV enrolment GATE (docs/tpm-enrolment-design.md). On a secure
# build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
# build whose TPM NV 0x01800100 is empty, it brings up a pre-auth network on the
# physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
# which generates the key/CSR, talks to the broker, shows the Plymouth
# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS.
@@ -37,7 +37,7 @@ TESTMODE=0
[ "$(getarg rd.dot1x=)" = "0" ] && TESTMODE=1
# --- knobs (override on the kernel cmdline) ---------------------------------
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800100
# Persistent handle for the signing key: a NON-reserved owner handle. NOT the EK
# slot 0x81010001 (which most firmware/swtpm provisioning already occupies) nor
# the SRK 0x81000001 — see EnsureKey / CLAUDE.md invariant #1.
files/enrol/main.go
+3 -3
View File
@@ -1,13 +1,13 @@
// fleet-enrol — inline empty-NV first-boot TPM enrolment client.
//
// Invoked from the dracut hook (95dot1x-macsec/tpm-enrol.sh) ONLY when the
// secure build boots a host whose TPM NV 0x01800001 is empty. It:
// secure build boots a host whose TPM NV 0x01800100 is empty. It:
// 1. ensures an ECDSA signing key exists at a non-reserved owner handle
// (default 0x81000100 — deliberately NOT the EK slot 0x81010001),
// 2. builds a CSR with it (key never leaves the TPM),
// 3. submits CSR + device context to the enrolment broker, shows the returned
// fingerprint on the Plymouth splash, and polls until an admin approves,
// 4. writes the issued cert (DER) to NV 0x01800001.
// 4. writes the issued cert (DER) to NV 0x01800100.
//
// The hook then reboots into the normal secure path. Everything host-specific
// (key, cert, hostnqn) is created here at runtime — nothing is baked (invariant #1).
@@ -49,7 +49,7 @@ func main() {
var (
url = flag.String("url", "http://boot.fleet.lab/enrol", "enrolment broker base URL")
tpmPath = flag.String("tpm", "/dev/tpmrm0", "TPM device path")
nvHex = flag.String("nvindex", "0x01800001", "TPM NV index for the client cert")
nvHex = flag.String("nvindex", "0x01800100", "TPM NV index for the client cert")
handleHex = flag.String("handle", "0x81000100", "TPM persistent handle for the signing key (non-reserved owner handle; NOT the EK slot 0x81010001)")
cn = flag.String("cn", "fleet-host", "CSR CommonName (generic; identity is the cert serial)")
iface = flag.String("iface", "", "network interface for the device-context MAC")
files/enrol/simtest/tpmsim_test.go
+31 -1
View File
@@ -10,6 +10,7 @@ import (
"crypto/sha256"
"crypto/x509"
"crypto/x509/pkix"
"strings"
"testing"
"fleet-enrol/tpmkey"
@@ -81,7 +82,7 @@ func TestEnsureKeyAndSignCSR(t *testing.T) {
func TestNVWriteAndPresence(t *testing.T) {
tpm := openSim(t)
const nv = tpm2.TPMHandle(0x01800001)
const nv = tpm2.TPMHandle(0x01800100)
if tpmkey.NVPresent(tpm, nv) {
t.Fatalf("NV should be empty on a fresh TPM")
@@ -229,3 +230,32 @@ func TestEnsureKeyRefusesToEvictProtectedKey(t *testing.T) {
t.Fatalf("protected object was evicted (should have been left intact): %v", err)
}
}
// Regression for the Dell 820 finding: our NV index collided with an OEM
// PLATFORM-created index (platformcreate|policydelete) that no owner clear can
// remove. WriteNVCert must REFUSE such an index with a clear error (the remedy
// is a different rd.dot1x.nvindex), not a confusing undefine failure.
func TestWriteNVCertRefusesPlatformIndex(t *testing.T) {
tpm := openSim(t)
const nv = tpm2.TPMHandle(0x01800100)
def := tpm2.NVDefineSpace{
AuthHandle: tpm2.TPMRHPlatform,
PublicInfo: tpm2.New2B(tpm2.TPMSNVPublic{
NVIndex: nv,
NameAlg: tpm2.TPMAlgSHA256,
Attributes: tpm2.TPMANV{
PlatformCreate: true, AuthRead: true, AuthWrite: true,
NoDA: true, NT: tpm2.TPMNTOrdinary,
},
DataSize: 8,
}),
}
if _, err := def.Execute(tpm); err != nil {
t.Fatalf("define platform NV: %v", err)
}
err := tpmkey.WriteNVCert(tpm, nv, make([]byte, 64))
if err == nil || !strings.Contains(err.Error(), "platform-created") {
t.Fatalf("WriteNVCert should refuse a platform-created index; got: %v", err)
}
}
files/enrol/tpmkey/tpmkey.go
+9 -1
View File
@@ -2,7 +2,7 @@
// / no openssl tpm2 provider). Provides: ensure a persistent ECDSA signing key
// at a non-reserved owner handle (default 0x81000100 — NOT the EK slot
// 0x81010001, see EnsureKey), a crypto.Signer backed by it (for CSR signing),
// and NV cert read-presence + write at 0x01800001. Talks to any transport.TPM,
// and NV cert read-presence + write at 0x01800100. Talks to any transport.TPM,
// so the same
// code runs against /dev/tpmrm0 (production) and the software simulator (tests).
//
@@ -224,6 +224,14 @@ func ReadNVCert(tpm transport.TPM, index tpm2.TPMHandle) ([]byte, error) {
func WriteNVCert(tpm transport.TPM, index tpm2.TPMHandle, der []byte) error {
// Undefine a stale index first (re-enrolment / resized cert).
if rp, err := (tpm2.NVReadPublic{NVIndex: index}).Execute(tpm); err == nil {
// A PLATFORM-created index at our handle is OEM firmware NV (bench-seen on
// a Dell 820: 0x01800001 was platformcreate|policydelete|writelocked). We
// cannot undefine it with owner auth, and TPM2_Clear/BIOS won't remove it —
// so fail LOUDLY with guidance rather than a confusing "nv undefine" error.
// The remedy is a different, free owner index via rd.dot1x.nvindex.
if pub, e := rp.NVPublic.Contents(); e == nil && pub.Attributes.PlatformCreate {
return fmt.Errorf("NV index %#x is a platform-created (firmware-owned) index — cannot be written by enrolment; pick a free owner index via rd.dot1x.nvindex / -nvindex", uint32(index))
}
if _, err := (tpm2.NVUndefineSpace{
AuthHandle: tpm2.TPMRHOwner,
NVIndex: tpm2.NamedHandle{Handle: index, Name: rp.NVName},