Test that no OS-present events appear in PCRs 0, 1, 2, and 3

[chrisccoulson]

The efi package only copies pre-OS events from the TCG log to the profile for PCRs 0 and 2, and will generate an invalid profile if the platform firmware measures anything after this. The preinstall tests should check for this for these PCRs (and 1 and 3 when supported) in order to catch this.

[HonroH]

I believe I have a Ubuntu 26.04.1 installation affected by this issue.

Hardware

• Lenovo ThinkPad E14 Gen 7 AMD, Type 21T0
• BIOS 1.24
• Secure Boot enabled
• TPM 2.0

Ubuntu

• Ubuntu Desktop 26.04.1
• Installed using the installer hardware-backed TPM/FDE option

The ubuntu installer accepted the machine for TPM-backed FDE (but only just recently after 26.04.1), but TPM automatic unlocking has never worked. Every boot requires the recovery key.

snap-bootstrap reports for both default and default-fallback:

invalid PCR policy data: cannot complete authorization policy assertions:
the PCR policy is not authorized for the current configuration

FDE auto-repair reports:

{
  "auto-repair-result": "success",
  "status": "recovery"
}

With SNAPD_DEBUG=1, snapd successfully performs resealing:

resealing (5) succeeded
fallback resealing (5) succeeded

However, the generated Preinstall check based PCR protection profile for PCR2 ends with:

ExtendPCR(TPM_ALG_SHA256, 2, fc1f749d6a6f0fa7e84b27b1d0236911fd7225eacda5c5ff5ced21558d3cd266)
ExtendPCR(TPM_ALG_SHA256, 2, 47dc2e4e9fd7142c37ddb64bf83f1b05fa0f2a674612fc8b33d45931d36ff823)
ExtendPCR(TPM_ALG_SHA256, 2, e29c3f02f4b12b5df9a0fe2d9c90e714ae24725119502c2c65d7f23d1fee6f3a)
ExtendPCR(TPM_ALG_SHA256, 2, 2119ccc9d9876f60c0c04dd1d5bd662e6cba523700cfda590f37979e0ce91a4f)
ExtendPCR(TPM_ALG_SHA256, 2, 887a09f934acbb6f09bbbadabc20e610e1005268448d22279c975eeff79e3d38)
ExtendPCR(TPM_ALG_SHA256, 2, 7a79f7804de448f475fbcfb306ce782ba1476ab4783adfd0bbfad3b256be0f15)
ExtendPCR(TPM_ALG_SHA256, 2, df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119)

The final value above is the separator measurement, and the generated profile contains no subsequent PCR2 extension.

However, the firmware performs an additional PCR2 measurement after the separator which is not present in the PCR2 profile generated by secboot from the preinstall-check data:

EventNum: 44
PCRIndex: 2
EventType: EV_EFI_BOOT_SERVICES_DRIVER
DigestCount: 1
Digests:
- AlgorithmId: sha256
  Digest: "e704147ef2dd3c7369b07d4e6a328fcea7f751fba5a442928ee86dd04edccaa9"

The event log therefore produces this final PCR2 value:
92ec7b14cece6bac079196e4c0d62cc3de3aab72bffc959a0af18c3b6bdeec8c
This appears to mean that the PCR2 policy generated from the preinstall-check data cannot match the PCR2 produced by an actual boot.

PCR7 does not appear to have the missing db authority issue described in #558. My real event log contains:

EV_EFI_VARIABLE_AUTHORITY  db
EV_EFI_VARIABLE_AUTHORITY  SbatLevel
EV_EFI_VARIABLE_AUTHORITY  MokListRT

and those measurements are also present in snapd's generated profile.

Therefore, auto-repair/resealing succeeds, but appears to regenerate the same unusable PCR profile, so the next boot again requires the recovery key.

This also seems to indicate that the preinstall check did not reject a machine exhibiting the post-pre-OS PCR2 measurement condition described in this issue.

I can provide the complete tpm2_eventlog output and snapd debug/PCR-profile output if useful.