From b6f94dbeacfc6f0a507413096189304c58dbe66c Mon Sep 17 00:00:00 2001 From: Mathieu Trudel-Lapierre Date: Wed, 13 Sep 2017 12:09:40 -0700 Subject: New upstream version 13~git1505328970.9c1c35c5 --- README.tpm | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 README.tpm (limited to 'README.tpm') diff --git a/README.tpm b/README.tpm new file mode 100644 index 00000000..261bcd05 --- /dev/null +++ b/README.tpm @@ -0,0 +1,22 @@ +The following PCRs are extended by shim: + +PCR4: +- the Authenticode hash of the binary being loaded will be extended into + PCR4 before SB verification. + +PCR7: +- Any certificate in one of our certificate databases that matches a binary + we try to load will be extended into PCR7. That includes: + - DBX - the system blacklist, logged as "dbx" + - MokListX - the Mok blacklist, logged as "MokListX" + - vendor_dbx - shim's built-in vendor blacklist, logged as "dbx" + - DB - the system whitelist, logged as "db" + - MokList the Mok whitelist, logged as "MokList" + - vendor_cert - shim's built-in vendor whitelist, logged as "Shim" + - shim_cert - shim's build-time generated whitelist, logged as "Shim" +- MokSBState will be extended into PCR7 if it is set, logged as + "MokSBState". + +PCR14: +- MokList, MokListX, and MokSBState will be extended into PCR14 if they are + set. -- cgit v1.2.3